Red Team Operator: Offensive Security & Threat Emulation

Starling Bank; Southampton; On-site; GBP 75,000 - 110,000; Full time

Benefits offered by this job

Private Medical Insurance

Group Life Insurance

Cycle to Work

Pension / Salary Sacrifice

Job summary

Starling Bank is recruiting an experienced security professional to join its offensive security team in the UK. You will design and execute red team operations, threat modelling, and resilience exercises across cloud and on‑prem environments.

You will emulate real threats, test defenses with MITRE ATT&CK, and collaborate with defensive teams to remediate findings. Strong scripting, cloud knowledge (AWS/GCP), and IaC/CI/CD familiarity are highly valued.

Qualifications

• 2+ years in Offensive Security or cyber resilience
• Experience emulating real-world cyber threats and understanding cyber kill chains and MITRE TTPs
• Familiarity with CI/CD, IaC and cloud tech (AWS/GCP)
• Strong fundamentals in Windows and Linux
• Ability to operate under defined rules of engagement and bridge technical exploits with business recovery

Responsibilities

• Participating in end-to-end red and purple team operations and delivering resilience exercises
• Emulating real threat actors and testing defences across cloud and endpoint estates
• Identifying emerging threats and adapting Threat Actor TTPs for assessments
• Remediating vulnerabilities with defensive teams and refining playbooks
• Staying up-to-date with offensive security trends and operational resilience

Skills

Red Teaming

Pentesting

Threat Modelling

MITRE ATT&CK

Cloud (AWS/GCP)

Windows

Linux

Scripting (Python/Go)

C2 Frameworks

CI/CD / IaC

Certifications (CRTO/OSCP)

Education

CRTO, OSEP, OSMR, OSCP

Tools

Mythic

Cobalt Strike

Job description

Starling Bank is recruiting an experienced security professional to join its offensive security team in the UK. You will design and execute red team operations, threat modelling, and resilience exercises across cloud and on‑prem environments.

You will emulate real threats, test defenses with MITRE ATT&CK, and collaborate with defensive teams to remediate findings. Strong scripting, cloud knowledge (AWS/GCP), and IaC/CI/CD familiarity are highly valued.