Offensive Cybersecurity Team Manager

Tantalum Labs LLC; United States; Hybrid; USD 180,000 - 240,000; Full time

Job summary

Tantalum Labs LLC is seeking an experienced offensive security leader to guide and grow the penetration testing practice. This player-coach role splits time between hands-on engagements and building processes, methodologies, and a high-performing team in a startup-like environment.

You will run complex assessments across web apps, networks, cloud, APIs, and AD, set reporting standards, hire and develop testers, and communicate findings to security leaders and clients.

Qualifications

• 6+ years of hands‑on penetration testing, offensive security, or red team experience
• 2+ years of direct leadership experience managing or supervising a team of technical practitioners
• Demonstrated experience building and improving team processes such as methodology, quality assurance, reporting standards, engagement workflow, and tooling standardization
• Proven track record of reviewing and improving other testers’ work, including report review, finding validation, and technical coaching

Responsibilities

• Lead the penetration testing team's day-to-day delivery, including engagement assignment, scheduling, capacity planning, and quality control across active assessments
• Personally conduct penetration testing engagements from scoping and reconnaissance through exploitation, reporting, and client readout, with roughly half of the role remaining hands-on technical work
• Own and evolve the team's testing methodology so that coverage stays consistent and repeatable across web applications, APIs, network infrastructure, cloud environments, wireless deployments, and Active Directory domains
• Serve as the final technical reviewer on deliverables, validating findings, severity ratings, evidence quality, and remediation guidance before reports reach the client
• Establish and maintain internal standards for engagement documentation, evidence handling, rules of engagement, safe testing practices, and client communication
• Take point on the most technically complex and highest-sensitivity engagements, and act as the escalation path when a tester gets stuck
• Identify attack paths, privilege escalation opportunities, credential exposure, and lateral movement risks, and coach the team on doing the same
• Direct the development of internal tooling, automation, and testing frameworks, and make build or buy decisions on the team's tooling stack
• Present findings to technical teams, security leaders, and executive stakeholders, and lead client readouts on major engagements
• Participate in client-facing meetings to walk through security assessment results, discuss remediation priorities, and provide practical guidance on strengthening overall cybersecurity posture
• Recruit, onboard, and develop penetration testers as the team grows, including interviewing, skills assessment, and structured mentorship
• Set individual development plans, certification paths, and research time for the team, and give clear feedback on both technical work and professional growth
• Drive internal research, methodology development, and knowledge sharing across the team
• Contribute to scoping conversations and level-of-effort estimates so that engagements are sized to fit committed timelines

Job description

Team: Cybersecurity Professional Services Location: Remote - USA Type: Full-time Hours: Monday-Friday 8AM-5PM (Central Time)

Job Description

We are seeking an experienced offensive security practitioner to lead and grow our penetration testing team. This is a player-coach role. About half your time is spent hands-on in engagements, and the other half is spent leading the people, methodology, and delivery processes behind them. You will personally run complex assessments across web applications, internal and external networks, cloud environments, APIs, and Active Directory domains, while setting the technical standard for how engagements are scoped, executed, documented, and delivered.

This is the first dedicated leadership role on the team, so there is as much to build as there is to manage. You will define the testing methodology, stand up quality controls, establish the reporting standard, and hire and develop the testers who work within it. The ideal candidate has led a small technical team before, works well in a startup environment, and has a clear view of what separates a high-quality penetration test from a scan with a report attached.

Responsibilities Include:

• Lead the penetration testing team's day-to-day delivery, including engagement assignment, scheduling, capacity planning, and quality control across active assessments
• Personally conduct penetration testing engagements from scoping and reconnaissance through exploitation, reporting, and client readout, with roughly half of the role remaining hands-on technical work
• Own and evolve the team's testing methodology so that coverage stays consistent and repeatable across web applications, APIs, network infrastructure, cloud environments, wireless deployments, and Active Directory domains
• Serve as the final technical reviewer on deliverables, validating findings, severity ratings, evidence quality, and remediation guidance before reports reach the client
• Establish and maintain internal standards for engagement documentation, evidence handling, rules of engagement, safe testing practices, and client communication
• Take point on the most technically complex and highest-sensitivity engagements, and act as the escalation path when a tester gets stuck
• Identify attack paths, privilege escalation opportunities, credential exposure, and lateral movement risks, and coach the team on doing the same
• Direct the development of internal tooling, automation, and testing frameworks, and make build or buy decisions on the team's tooling stack
• Present findings to technical teams, security leaders, and executive stakeholders, and lead client readouts on major engagements
• Participate in client-facing meetings to walk through security assessment results, discuss remediation priorities, and provide practical guidance on strengthening overall cybersecurity posture
• Recruit, onboard, and develop penetration testers as the team grows, including interviewing, skills assessment, and structured mentorship
• Set individual development plans, certification paths, and research time for the team, and give clear feedback on both technical work and professional growth
• Drive internal research, methodology development, and knowledge sharing across the team
• Contribute to scoping conversations and level-of-effort estimates so that engagements are sized to fit committed timelines

Requirements

Required Technical Tooling Proficiency:
Candidates should demonstrate strong proficiency across the core categories, working familiarity with at least three specialized categories, and deep expertise in at least one. As the senior technical authority on the team, you should be able to review a tester’s work in any core category and recognize when a technique was applied correctly, incompletely, or unsafely.

Core Categories:These represent the foundational skill areas expected for this role.

• OSINT & Passive Reconnaissance: Tools such as Shodan, theHarvester, Recon-ng, SpiderFoot, and Maltego
• Reconnaissance & Information Gathering: Tools such as Nmap, Masscan, Amass, Subfinder, and Rustscan
• Web Application Security Testing: Tools such as Burp Suite, OWASP ZAP, Nuclei, ffuf, and SQLMap
• Directory & Content Discovery: Tools such as Gobuster, Feroxbuster, Dirsearch, Dirb, and Wfuzz
• Exploitation & C2 Frameworks: Tools such as Metasploit, Msfvenom, Cobalt Strike, Sliver, and Havoc
• Active Directory & Network Protocol Exploitation: Tools such as BloodHound, Impacket, NetExec/CrackMapExec, Responder, and Rubeus
• Post-Exploitation & Privilege Escalation: Tools such as LinPEAS, WinPEAS, Mimikatz, Seatbelt, and SharpCollection
• Network Traffic Analysis & Packet Capture: Tools such as Wireshark, tcpdump, tshark, NetworkMiner, and Ettercap
• Password Cracking & Credential Attacks: Tools such as Hashcat, John the Ripper, Hydra, CeWL, and Hash-identifier
• Wireless Security Testing: Tools such as Aircrack-ng (Airmon-ng, Airodump-ng, Aireplay-ng), Kismet, Wifite, and Bettercap

Specialized Categories:These represent areas of deeper focus that strengthen a candidate’s profile. Working familiarity with at least three is expected, along with demonstrable depth in at least one. Additional specialized expertise will increase the potential salary base.

• Social Engineering Testing: Tools such as GoPhish, Evilginx, EvilNoVNC, and other AiTM tools
• API & GraphQL Security Testing: Tools such as Arjun, Postman, GraphQL introspection tooling, JWT analysis utilities, and custom fuzzing scripts
• Pivoting & Tunneling: Tools such as Chisel, Ligolo-ng, ProxyChains, sshuttle, and SSH tunneling techniques
• Code Analysis & Secrets Exposure Discovery: Tools such as DependencyCheck, TruffleHog, Gitleaks, git-secrets, SecretFinder, and CloudEnum
• Cloud Security Assessment: Tools such as Prowler, ScoutSuite, Pacu, Checkov, and CloudMapper
• Container & Kubernetes Security: Tools such as Trivy, kube-hunter, kube-bench, Falco, and Docker Bench
• Binary Analysis & Reverse Engineering: Tools such as Ghidra, Radare2, GDB, Pwntools, and Binwalk
• Mobile Application Security Analysis: Tools such as MobSF, Frida, and others for identifying and exploiting iOS and Android vulnerabilities

Required Qualifications:

• 6+ years of hands‑on penetration testing, offensive security, or red team experience
• 2+ years of direct leadership experience managing or supervising a team of technical practitioners, with accountability for their output and development
• Demonstrated experience building and improving team processes such as methodology, quality assurance, reporting standards, engagement workflow, and tooling standardization
• Proven track record of reviewing and improving other testers’ work, including report review, finding validation, and technical coaching
• 3+ years of Python experience, with demonstrated ability to build custom security tooling, automation scripts, and exploit proof‑of‑concepts
• Strong proficiency across the core tooling categories listed above
• Working familiarity with at least three specialized tooling categories listed above, and demonstrable depth in at least one
• Deep working knowledge of the Penetration Testing Execution Standard (PTES), including experience adapting it into a working team methodology
• Strong familiarity with the MITRE ATT&CK framework for mapping adversary tactics, techniques, and procedures
• Strong familiarity with the OWASP Web Security Testing Guide (WSTG) for structured web application assessments
• Solid understanding of the OSI model and how network protocols operate and interact across layers
• Solid understanding of TCP/IP, DNS, HTTP/S, SMB, LDAP, Kerberos, and common enterprise attack paths
• Ability to write and edit clear, professional reports, and to explain risk to both technical and non‑technical audiences
• Strong written and verbal communication skills, including comfort presenting to executive and non‑technical stakeholders
• Comfortable working in a startup or high‑growth environment where priorities shift and processes are still being built
• Comfortable working independently and leading a distributed team in a remote, high‑trust environment

Preferred Qualifications:

• Prior experience at a startup, boutique consultancy, or early‑stage security services team, particularly as an early technical hire or first team lead
• Experience standing up a penetration testing practice or service line from the ground up
• Industry certifications such as OSCP, OSWE, OSEP, GPEN, GWAPT, GXPN, CRTO, eWPT, or eCPPT
• Experience hiring and assessing offensive security talent, including designing practical technical interviews
• Understanding of AI red teaming concepts, including prompt injection, model evasion, adversarial input testing, LLM abuse scenarios, and AI/ML pipeline security assessment
• Familiarity with the Model Context Protocol (MCP) and how cybersecurity tools integrate with MCP servers for orchestrated, agent‑driven security workflows
• Background in CTF competitions, bug bounty programs, vulnerability research, or published security research
• Experience assessing AWS, Azure, or GCP environments at an architectural level
• Experience with DevSecOps pipelines, infrastructure‑as‑code review, or security automation
• Conference talks, tool releases, training development, or published technical research
• 100% Employer‑Sponsored Platinum Health, Vision & Dental Insurance for Individuals and Families
• Generous 401(k) with 5% Automatic Employer Contribution - You get 5% whether you contribute or not.