AI-Focused Red Team/Blue Team Operator

ecsfederal; Washington (District of Columbia); On-site; USD 160,000 - 205,000; Full time

Job summary

Everforth ECS in Washington, DC is seeking an AI-focused Red Team/Blue Team Operator with TS clearance to advance security assessments, adversary emulation, and AI threat modeling.

The role combines offensive and defensive work, leveraging AI-enabled tools to detect zero-day vulnerabilities, build defense guardrails, and hunt threats across Windows, Linux, AD, and cloud environments. Requires 5+ years in cybersecurity and strong communication with stakeholders.

Qualifications

• Active Top Secret clearance; SCI eligibility preferred.
• 5+ years in cybersecurity with hands-on red/blue team experience.
• Experience with offensive/defensive operations and AI-enabled tools.

Responsibilities

• Conduct red team and blue team operations and adversary emulation.
• Assess AI/ML systems for vulnerabilities and threat models.
• Support threat hunting, detection engineering, and security posture improvements.

Skills

Offensive security

Defensive operations

Adversary emulation

Prompt engineering

AI security tools

Threat hunting

MITRE ATT&CK

Communication

Education

Bachelor's degree in Cybersecurity / Computer Science / Information Systems / Engineering

Tools

Nessus

Nmap

Tenable

Kali

Burp

Metasploit

Core Impact

Job description

Everforth ECS is seeking an AI-Focused Red Team/Blue Team Operator to join our team in Washington, DC.

ECS is seeking Top Secret cleared Red/Blue Team Operator with deep expertise in both offensive and defensive cyber operations and a strong understanding of AI-enabled systems, threats, and security controls. This role will support advanced security assessments, adversary emulation, detection engineering, and threat hunting while leveraging AI to reduce time to detect or identify zero-day vulnerabilities

AI/ML Security

• Adversarial ML: prompt injection, model evasion, data poisoning, model extraction
• LLM red teaming: jailbreaks, indirect injection, RAG poisoning, tool-use abuse
• Model and pipeline assessment for OWASP LLM Top 10 and AI-specific threat models
• Defending AI systems: guardrails, content filtering, evaluation harnesses, monitoring
• Use of AI for offense: agent-driven recon, code analysis, payload generation, recon at scale
• Use of AI for defense: anomaly detection, alert triage, automated enrichment, LLM-assisted hunting

AI Engineering & Automation

• Building agentic workflows for triage, detection tuning, and report generation
• Fine-tuning and evaluation of security-tuned language models

Core Technical Foundations

• Secure use of AI coding assistants and code-review for AI-generated output

Certifications / Training (suggested)

• AI security coursework (e.g., AI security fundamentals, LLM red teaming labs)

Salary Range: $160,000 - $205,000

General Description of Benefits

• Active Top Secret clearance required; SCI eligibility preferred.
• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or related field, or equivalent practical experience.
• 5+ years of experience in cybersecurity with meaningful hands-on experience in both red team and blue team operations.
• Demonstrated experience with:
  • Offensive security testing, adversary emulation, or penetration testing
  • Defensive operations, vulnerability analysis and threat hunting
  • Prompt engineering to optimize AI-driven security tools, and familiarity with prompt injection/jailbreaking defensive mitigation strategies.
  • Windows, Linux, Active Directory, cloud environments, and enterprise networks
  • Security tooling such as vulnerability assessment tools, and attack simulation frameworks
• Working knowledge of MITRE ATT&CK, intrusion kill chain concepts, and adversary behaviors.
• Experience leveraging AI enabled tools, assessing or securing AI/ML systems, large language model integrations, or AI-enabled applications.
• Experience performing vulnerability assessments using one or more of the following:
  • NESSUS
  • Nmap
  • Tenable
  • Kali
  • Burp, Metasploit, Core Impact
• Strong understanding of security principles related to identity, access management, segmentation, logging, incident response, and secure architecture.
• Ability to communicate highly technical issues clearly to both technical and non-technical stakeholders.
• U.S. citizenship required due to clearance requirements.