AOUSC - Threat Emulation & Readiness Lead / Red Team Lead

cFocus Software Incorporated; Washington (District of Columbia); On-site; USD 180,000 - 240,000; Full time

Job summary

cFocus Software Incorporated is seeking a Threat Emulation & Readiness Lead to oversee adversary emulation, red team operations, and cyber readiness exercises supporting a federal enterprise cybersecurity program. The Lead will direct realistic adversary simulations aligned to MITRE ATT&CK to assess detection, response, resilience, and readiness.

The role involves coordinating with SOC, CTI, Threat Hunt, and Detection Engineering teams, and delivering after-action reports with remediation

Qualifications

• 10+ years of offensive security or advanced cybersecurity operations experience.
• 5+ years leading red team or adversary emulation operations.
• Experience conducting operations against enterprise Active Directory environments, cloud infrastructure, hybrid identity systems, and modern endpoint defenses.
• Deep understanding of adversary tradecraft, post-exploitation, detection evasion, persistence, and lateral movement techniques.
• Experience conducting purple team engagements and readiness exercises.
• Strong executive communication and briefing capabilities.

Responsibilities

• Lead red team operations and adversary emulation exercises.
• Emulate advanced threat actor TTPs targeting enterprise, cloud, identity, and hybrid environments.
• Develop attack chains aligned to MITRE ATT&CK and real-world threat actor behaviors.
• Coordinate with SOC, CTI, Threat Hunt, and Detection Engineering teams.
• Assess detection and response effectiveness across defensive technologies and workflows.
• Develop after-action reports, findings, remediation, and improvement roadmaps.
• Lead operational readiness assessments and continuous improvement initiatives.
• Brief executives and operational leadership on adversary risk and readiness.

Skills

Offensive security

Red team leadership

Adversary emulation

Threat emulation

Executive briefing

Tools

Active Directory

Cloud infrastructure

Endpoint defenses

Job description

Position Title

Threat Emulation & Readiness Lead / Red Team Lead

Position Overview

The Threat Emulation & Readiness Lead will oversee adversary emulation, red team operations, cyber readiness exercises, and threat-informed defense initiatives supporting a federal enterprise cybersecurity program.

The Lead will direct realistic adversary simulation activities aligned to nation-state tradecraft and MITRE ATT&CK methodologies to assess and improve organizational detection, response, resilience, and operational readiness.

Key Responsibilities

• Lead red team operations and adversary emulation exercises.
  • threat emulation campaigns
  • purple team exercises
  • tabletop exercises
  • crisis simulations
  • and readiness drills.
• Emulate advanced threat actor TTPs targeting enterprise, cloud, identity, and hybrid environments.
• Develop attack chains aligned to:
  • MITRE ATT&CK
  • intelligence reporting
  • and real-world threat actor behaviors.
• Coordinate closely with SOC, CTI, Threat Hunt, and Detection Engineering teams.
• Assess detection and response effectiveness across defensive technologies and operational workflows.
• Develop after-action reports, findings, remediation recommendations, and improvement roadmaps.
• Lead operational readiness assessments and continuous improvement initiatives.
• Brief executives and operational leadership on adversary risk and organizational readiness.

Required Qualifications

• 10+ years of offensive security or advanced cybersecurity operations experience.
• 5+ years leading red team or adversary emulation operations.
• Experience conducting operations against:
  • enterprise Active Directory environments
  • cloud infrastructure
  • hybrid identity systems
  • and modern endpoint defenses.
• Deep understanding of:
  • adversary tradecraft
  • post-exploitation
  • detection evasion
  • persistence
  • and lateral movement techniques.
• Experience conducting purple team engagements and readiness exercises.
• Strong executive communication and briefing capabilities.

Preferred Certifications

• OSCP
• OSEP
• CRTO
• GXPN
• GPEN
• CISSP
• MITRE ATT&CK certifications