Senior Red Team Operator

ing; Amsterdam; On-site; EUR 120,000 - 160,000; Full time

Job summary

ING in Amsterdam is seeking a Senior Red Team Operator to drive adversarial simulations that stress people, processes, and technology across global systems. You will lead advanced red team engagements and design long-term campaigns testing on-premise, cloud (Azure, AWS, GCP), and hybrid environments.

Within the Tribe Cyber Threat Management, you will build bespoke tooling, run end-to-end campaigns, collaborate with SOC, and deliver actionable insights to executives.

Qualifications

• 5+ years in a dedicated red team role.
• Strong development skills in a low-level language for custom tools.
• Proficient in scripting languages such as Python or PowerShell.
• Deep experience attacking complex enterprise environments incl. AD and cloud.
• OPSEC mindset with ability to conduct covert, objective-driven ops.
• Fluent in English, written and spoken.
• Advanced offensive security certifications are a plus.

Responsibilities

• Lead advanced red team engagements.
• Design and run long-term, intelligence-led red team campaigns.
• Test global enterprise across on-prem, cloud, and hybrid environments.
• Execute the full attack lifecycle from initial access to data exfiltration.
• Develop and maintain red team infrastructure and C2 tooling.
• Collaborate with SOC and defensive teams in purple team exercises.
• Create custom tooling to bypass modern defenses.
• Research emerging TTPs and translate findings for executives.

Skills

Red team experience

Low-level programming

Scripting

Cloud environments

Active Directory security

OPSEC mindset

English fluency

Job description

A role in Global CISO that's as much about breaking things as it is about building resilience.

Are you passionate about cybersecurity and driven by an adversarial mindset? Do you want to test a global financial institution against sophisticated, real-world threats?

As a Senior Red Team Operator at ING, you will be part of a hands-on team focused on strengthening the bank's security posture. We emulate the mindset of an attacker to test our people, processes, and technology on a global scale. Your mission will be to simulate the tactics, techniques, and procedures (TTPs) of advanced threat actors, providing critical assurance to the business and its leadership.

This is not a standard penetration testing role. We are looking for a specialist in red teaming who can plan and execute long-term, intelligence-led campaigns while maintaining exceptional operational security (OPSEC).

The team

You will join the Amsterdam-based red team, a highly specialized, multicultural group of experts with a proven track record in cybersecurity. As part of the Tribe Cyber Threat Management (CTM), we have a hands-on approach and focus on the constant evolution of our skills through research and on-the-job experience. We are a crucial part of the Global CISO organisation, and our work directly influences ING's global security strategy. We help each other to be successful and live by the Orange Behaviours.

Roles and responsibilities

You play a key role in protecting ING through:

• Leading advanced red team engagements.
• Design and conduct complex, long-run red team campaigns that mirror the sophistication of top-tier, intelligence-led exercises. You will test our global enterprise, including on-premise, cloud (Azure, Google Cloud), and hybrid environments.
• Executing the full attack lifecycle.
• Run objective-driven, end-to-end red team campaigns, from initial access to data exfiltration, while employing stealth to ev
• Developing and maintaining red team infrastructure.
• Build, operate, and customize the team's command-and-control (C2) infrastructure. You will be expected to go beyond using standard tools like Cobalt Strike or Sliver, developing bespoke capabilities to ensure operational success.
• Driving defensive improvements through purple teaming.
• Partner directly with our SOC and defensive teams in collaborative purple team exercises to tune detection rules, improve playbooks, and enhance ING's defensive capabilities.
• Developing custom tooling to bypass advanced defences.
• Research emerging TTPs and create your own tools, implants, and loaders in languages like C++, C#, or Go to bypass modern security controls like EDR and application allow-listing.
• Delivering actionable insights to the business.
• Author comprehensive, narrative-style reports that translate complex technical findings into clear, actionable recommendations for executive stakeholders.

In addition, the following technical skills will help you to be successful in this role:

• 5+ years of hands-on experience in a dedicated red team role.
• You bring strong development skills in at least one low-level language (e.g., C++, C#, Go, Rust) for custom tool development, and proficiency in a scripting language (e.g., Python, PowerShell).
• Deep experience attacking complex enterprise environments, including Active Directory and major cloud providers (Azure, AWS, GCP).
• A strong Operational Security (OPSEC) mindset with a proven ability to conduct covert, objective-driven operations.
• Advanced offensive security certifications (e.g. OSEP, OSCE, GXPN, CRTO) are a plus, but your hands-on experience is what matters most.
• You are fluent in English, both verbally and in writing.

Rewards and benefits

We want to make sure that it's possible for you to strike the right balance between your career and your private life.