Lead Red Team Operator: Adversary Emulation & Threat Hardening

Citizens Bank; Johnston (RI); Hybrid; USD 120,000 - 210,000; Full time

Benefits offered by this job

Medical, dental & vision coverage

Retirement benefits

Paid time off

Education reimbursement

Wellness programs

Flexible work arrangements

Job summary

Citizens Bank is seeking a Principal Operator, Red Team to lead offensive security engagements across on-prem, cloud, SaaS, and hybrid environments. You will emulate real-world attackers, identify attack paths, and work with Blue and Detection teams to improve detections, responses, and overall risk posture.

The role reports to the Red Team Manager and requires hands-on, lifecycle-driven testing with strong documentation and collaboration across Purple Team activities.

Qualifications

• Bachelor's degree in Security, CS, IT, or related field, or equivalent experience.
• OSCP, OSEP, CRTO, CRTP, or similar advanced offensive security credentials.
• Exposure to AI security testing or AI red teaming preferred.

Responsibilities

• Lead Red Team and Purple Team engagements as primary operator, including adversary emulation and intelligence driven attack paths.
• Design and execute campaign-based attack operations simulating real world attacker behavior across enterprise environments.
• Perform hands-on exploitation across on prem, cloud, SaaS, and hybrid infrastructures.
• Collaborate with Blue Team to translate offensive activity into improved detection and response capabilities.
• Document findings clearly, including attack paths and detection gaps, contributing to engagement reports.
• Operate within rules of engagement, safety protocols, and ethical guidelines.
• Stay current on evolving adversary tactics, offensive tooling, and AI security research.

Job description

Citizens Bank is seeking a Principal Operator, Red Team to lead offensive security engagements across on-prem, cloud, SaaS, and hybrid environments. You will emulate real-world attackers, identify attack paths, and work with Blue and Detection teams to improve detections, responses, and overall risk posture.

The role reports to the Red Team Manager and requires hands-on, lifecycle-driven testing with strong documentation and collaboration across Purple Team activities.