Red Team Operator — Offensive Security & Resilience

Starling; Cardiff; On-site; GBP 70,000 - 110,000; Full time

Benefits offered by this job

33 days holiday

Birthday leave

Pension scheme

Private medical insurance

Wellbeing & discounts

Cycle to work

Job summary

Starling Bank is seeking an experienced Offensive Security professional to join our security team in the UK. You will lead red team operations, threat emulation, and resilience testing across cloud and on-premise environments, collaborating with defenders to strengthen the platform.

You will research threats, adapt TTPs, and help mature incident response and recovery playbooks. Strong JavaScript/Go/Python scripting and cloud knowledge are advantageous for this role.

Qualifications

• 2+ years in Offensive Security or similar cyber resilience roles.
• Experience emulating threats and using MITRE ATT&CK.
• Familiarity with cloud infra, Windows/Linux, and security tooling.
• Industry certs or equivalent practical security experience.

Responsibilities

• Lead end-to-end red and purple team ops and cyber resilience exercises.
• Emulate real threat actors and test defences across cloud and endpoints.
• Research emerging threats and adapt TTPs for assessments.
• Remediate vulnerabilities and improve playbooks with defensive teams.
• Keep up-to-date with offensive security and resilience trends.

Skills

Red Teaming

Penetration Testing

MITRE ATT&CK

Cloud Security (AWS/GCP)

Networking fundamentals

Windows/Linux

Scripting (Python/Go/PowerShell)

CI/CD / IaC

Threat Modelling

C2 frameworks (Mythic, Cobalt Strike)

Education

CRTO/OSEP/OSCP or equivalent

Tools

Cobalt Strike

Mythic

PowerShell

Python

Go

AWS

GCP

Job description

Starling Bank is seeking an experienced Offensive Security professional to join our security team in the UK. You will lead red team operations, threat emulation, and resilience testing across cloud and on-premise environments, collaborating with defenders to strengthen the platform.

You will research threats, adapt TTPs, and help mature incident response and recovery playbooks. Strong JavaScript/Go/Python scripting and cloud knowledge are advantageous for this role.