Red Team Operator (AVP) – Contract to Perm

Bonhill Partners; Greater London; Hybrid; GBP 70,000 - 90,000; Full time

Job summary

Bonhill Partners is supporting a global investment bank in hiring a Red Team Operator (AVP level) for a contract-to-permanent position. This role will focus on offensive security operations including adversary simulation in a mature cyber security environment.

The successful candidate will lead red team operations and work closely with SOC and blue teams. The role offers strong visibility and the chance to influence security strategy, with a hybrid work model transitioning to three days onsite post-conversion.

Qualifications

• Strong background in red teaming and adversary simulation.
• Deep understanding of threat actor tactics, techniques, and procedures (TTPs).
• Experience conducting purple team engagements with SOC / detection teams.

Responsibilities

• Lead and execute red team operations across enterprise environments.
• Conduct adversary simulation exercises aligned to real‑world threat actor behaviours.
• Mentor junior team members and contribute to overall red team capability growth.

Skills

Red teaming and adversary simulation

Threat actor tactics, techniques, and procedures

Conducting purple team engagements

Translating technical findings into business insights

Operating within complex enterprise environments

Tools

Scripting or offensive tooling development

Job description

Red Team Operator (AVP) – Contract to Perm

London

Global Investment Bank (Confidential Search)

4 days onsite during contract to 3 days hybrid post-conversion

We’re supporting a leading global investment bank in hiring a Red Team Operator (AVP level) into a growing offensive security function.

This is a contract-to-permanent opportunity offering the chance to work within a mature cyber security environment focused on adversary simulation, purple teaming, and enterprise-scale offensive security operations.

The role combines hands‑on red team delivery with strategic influence across security operations, detection engineering, and stakeholder engagement.

The Role

As the operator you’ll be responsible for planning and executing realistic adversary simulation exercises across complex enterprise environments, helping the organisation assess and strengthen its ability to detect and respond to modern threats.

This is a highly visible role sitting at the intersection of offensive security, SOC collaboration, and cyber strategy.

Key Responsibilities

• Lead and execute red team operations across enterprise environments
• Conduct adversary simulation exercises aligned to real‑world threat actor behaviours
• Partner closely with SOC and blue teams on purple team engagements
• Identify detection gaps and provide actionable remediation guidance
• Support development of offensive security strategy and testing methodologies
• Communicate technical findings clearly to both technical and non‑technical stakeholders
• Mentor junior team members and contribute to overall red team capability growth

Core experience

• Strong background in red teaming and adversary simulation
• Deep understanding of threat actor tactics, techniques, and procedures (TTPs)
• Experience conducting purple team engagements with SOC / detection teams
• Ability to translate technical findings into business‑relevant insights
• Experience operating within complex enterprise environments

Nice to have

• Financial services or regulated industry experience
• Exposure to threat intelligence‑led operations
• Scripting or offensive tooling development experience

The Environment

You’ll be joining a high‑performing cyber security function within a global investment bank, working alongside SOC, detection engineering, and security leadership teams to improve enterprise‑wide cyber resilience.

The role offers strong visibility, real ownership, and the opportunity to influence how offensive security is delivered across the organisation.

Package & Structure

• Initial 6‑month contract with guaranteed conversion to permanent
• Hybrid model (3 days onsite) post‑conversion