Offensive Security Analyst

Vanguard; Malvern (Chester County); Hybrid; USD 180,000 - 230,000; Full time

Job summary

Vanguard is seeking an experienced Offensive Security Analyst to plan and execute advanced security assessments across applications, infrastructure, cloud, and emerging tech. You will emulate real‑world attackers, lead red team activities, and partner with engineering, cyber defense, fraud, and technology teams to reduce organizational risk.

The role requires independent execution of engagements, development of tooling and automation, and mentorship of junior analysts, with a focus on improving

Qualifications

• 3–5+ years of offensive security, penetration testing, red teaming, or related cybersecurity experience.
• Experience evaluating security across web applications, infrastructure, cloud, and identity environments.
• Strong understanding of attacker methodologies, attack chains, and offensive tradecraft.
• Proficiency in Python, PowerShell, Bash, or similar scripting languages.
• Strong written and verbal communication skills.

Responsibilities

• Lead and execute penetration tests, adversary emulation exercises, and red team activities.
• Assess web applications, APIs, cloud environments, identity platforms, infrastructure, and emerging technologies.
• Simulate attacker behaviors to identify vulnerabilities, control weaknesses, and attack paths.
• Validate security controls through exploitation and PoC testing.
• Provide high-quality findings, reports, and remediation guidance.

Skills

Penetration testing

Adversary emulation

MITRE ATT&CK

Python scripting

PowerShell

Communication skills

Red team operations

Tools

Burp Suite

Cobalt Strike

Metasploit

Nmap

BloodHound

Impacket

Job description

The Offensive Security Analyst is an experienced individual contributor responsible for planning and executing offensive security assessments that identify high-risk vulnerabilities, validate security controls, and improve Vanguard's cyber resilience. This role conducts adversary emulation, red team operations, threat-led security assessments, and security research activities across applications, infrastructure, cloud environments, and emerging technologies. As a key member of the Offensive Security & Fraud Testing (OSFT) team, the analyst partners with application security, engineering, cyber defense, fraud, and technology teams to emulate real-world attackers and provide actionable recommendations that reduce organizational risk. The role is expected to independently execute engagements while contributing to operational improvements, tooling enhancements, and mentorship of junior team members.

We are seeking a highly skilled offensive security professional to perform advanced security testing and adversary simulation activities. You will execute assessments across a broad range of technologies and business functions, helping validate the effectiveness of security controls against realistic attack scenarios.

The ideal candidate combines strong technical offensive security expertise with excellent communication skills and a passion for continuous learning. You will help advance the maturity of offensive security capabilities while producing meaningful outcomes that strengthen Vanguard's security posture.

Key Responsibilities

Offensive Security Operations

• Lead and execute penetration tests, adversary emulation exercises, and red team activities.
• Assess web applications, APIs, cloud environments, identity platforms, infrastructure, and emerging technologies.
• Simulate realistic attacker behaviors to identify vulnerabilities, control weaknesses, and attack paths.
• Validate security controls through exploitation and proof-of-concept testing.
• Support threat-led operations aligned to organizational risk priorities.

Adversary Emulation & Research

• Develop and execute attack scenarios based on current threat intelligence and adversary tradecraft.
• Leverage frameworks such as MITRE ATT&CK to design realistic attack simulations.
• Research emerging attack techniques, vulnerabilities, and exploitation methods.
• Contribute to the development of offensive security methodologies and testing procedures.

Security Assessment & Reporting

• Analyze findings and evaluate business and technical risk.
• Produce high-quality technical reports and executive-ready summaries.
• Present findings, recommendations, and remediation strategies to stakeholders.
• Track remediation efforts and provide validation of corrective actions.

Tooling & Automation

• Develop and maintain offensive security tooling, scripts, and testing frameworks.
• Automate repetitive testing activities and reporting processes.
• Contribute to the evolution of OSFT operational capabilities and infrastructure.
• Support innovation initiatives that leverage automation and AI to improve testing effectiveness.

Collaboration & Stakeholder Management

• Partner with engineering, application security, cyber defense, fraud, and technology teams throughout engagements.
• Participate in purple team activities and collaborative security validation efforts.
• Support knowledge-sharing initiatives across offensive and defensive security functions.
• Provide technical guidance to less experienced analysts.

Continuous Improvement

• Contribute to capability development initiatives across OSFT.
• Assist with developing testing standards, playbooks, and best practices.
• Support strategic initiatives that improve offensive security coverage, scale, and maturity.
• Maintain awareness of evolving threat landscapes and industry practices.

Required Qualifications

• 3–5+ years of offensive security, penetration testing, red teaming, or related cybersecurity experience.
• Demonstrated experience conducting security assessments across web applications, infrastructure, cloud, and identity environments.
• Strong understanding of attacker methodologies, attack chains, and offensive tradecraft.
• Experience using offensive security tools such as Burp Suite, Cobalt Strike, Metasploit, Nmap, BloodHound, Impacket, or equivalent platforms.
• Working knowledge of MITRE ATT&CK and threat-informed security testing.
• Proficiency in Python, PowerShell, Bash, or similar scripting languages.
• Strong written and verbal communication skills.

Preferred Qualifications

• Experience conducting adversary emulation or red team operations within a large enterprise.
• Experience assessing AWS, Azure, or hybrid cloud environments.
• Experience participating in Purple Team engagements and detection validation exercises.
• Knowledge of AI security, adversarial AI testing, or emerging technology risk assessments.
• Offensive security certifications such as OSCP, CRTO, PNPT, OSEP, GXPN, or equivalent.

Special Factors

Sponsorship

Vanguard is not offering visa sponsorship for this position.

About Vanguard

At Vanguard, we don't just have a mission—we're on a mission.

To work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients' lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.

How We Work

Vanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.