Principal Consultant, Red Team Operator

Kroll, LLC.; United States; Hybrid; USD 150,000 - 200,000; Full time

Job summary

Kroll is expanding its Red Team capabilities with a Principal Consultant / L4 Red Team Payload Engineering Specialist. You will design, develop, and operationalize custom payloads and C2 tooling to support authorized engagements across client environments.

You will work with operators and engagement leads to tailor tooling, ensure adherence to rules of engagement, and deliver actionable findings that improve detection and response.

Qualifications

• 5+ years in offensive cybersecurity and red team engagements.
• Experience developing or extending offensive security tooling.
• Strong experience with Windows and Linux OS internals.
• Hands-on with C2 frameworks such as Mythic, Cobalt Strike, Sliver.
• Familiar with CI/CD, DevOps, and infrastructure automation tools.
• Practical understanding of evasion techniques and detection-aware tradecraft.
• Excellent communication and ability to explain complex concepts clearly.
• Ability to manage risk during live engagements within rules of engagement.

Responsibilities

• Lead design, development, customization, and maintenance of command-and-control payloads, droppers, loaders, and supporting tools for use in client engagements.
• Implement and package detection-aware tradecraft (injection, obfuscation, AMSI/ETW bypass, direct syscalls, reflective loading) for safe use.
• Build and operate red team infrastructure and C2 tooling (Mythic, Cobalt Strike, Sliver) with emphasis on OPS-Sec and resilience.
• Develop and maintain internal tooling pipelines, including automated payload generation, testing, and deployment via CI/CD and IaC.
• Support engagement planning with technical input on threat-informed scenarios and objectives.
• Execute hands-on offensive activity as needed, including AD exploitation, credential access, privilege escalation, and lateral movement.
• Apply understanding of EDR, SIEM, identity protection, and network monitoring to tooling and tradecraft.
• Support purple team engagements by developing or adapting TTPs and validating detections.
• Conduct R&D to improve tooling, tradecraft, methodology, and reporting.
• Produce clear, evidence-based reports showing attack paths, business impact, and remediation steps.
• Present technical findings to security teams and senior stakeholders.
• Mentor junior consultants and contribute to peer review and QA.
• Collaborate with wider Cyber Risk teams like incident response, threat intel, cloud security.

Skills

Red Team

Purple Team

Adversary emulation

Assumed-breach

Custom tooling

Windows internals

Linux internals

CI/CD

Networking protocols

Tools

Mythic

Cobalt Strike

Sliver

Git

Jenkins

Terraform

Ansible

Job description

In a world of disruption and increasingly complex business challenges, our professionals bring truth into focus with the Kroll Lens. Our sharp analytical skills, paired with the latest technology, allow us to give our clients clarity—not just answers—in all areas of business. We embrace diverse backgrounds and global perspectives, and we cultivate diversity by respecting, including, and valuing one another. As part of One team, One Kroll, you’ll contribute to a supportive and collaborative work environment that empowers you to excel.

Our Offensive Security professionals are on a mission to make the world a safer place, one company at a time. We help our clients discover, understand, and remediate security risks across their networks, systems, applications, cloud environments, and identity platforms. Our clients trust us to use advanced offensive security tools, creativity, imagination, and expert knowledge to identify realistic attack paths and improve cyber resilience.

We are looking to grow our Red Team capability with a Principal Consultant / L4 Red Team Payload Engineering Specialist. This role is focused on the design, development, and operationalization of custom command-and-control tooling, payloads, and supporting infrastructure that enable high-quality red team, purple team, assumed-breach, and adversary emulation engagements. Our collaborative ties to our forensic and incident response team, detection engineering team, threat intelligence team, and wider Cyber Risk practice enable us to deliver high-impact offensive security engagements for clients across a range of sectors.

What you’ll do

As a Principal Consultant, Red Team Payload Engineering Specialist, you will be the primary driver of custom tooling and payload development that supports complex red team operations. You will work closely with operators and engagement leads to understand client environments and objectives, then design, build, and adapt detection-aware payloads, loaders, and infrastructure that allow the team to operate effectively within agreed rules of engagement.

You will also help clients understand the business impact of the techniques and tooling used, and provide clear, actionable recommendations to improve prevention, detection, and response.

In summary, you will:

• Lead the design, development, customization, and maintenance of command-and-control payloads, droppers, loaders, and supporting tools for use in authorized client engagements
• Implement and package detection-aware tradecraft (including process injection variants, sleep obfuscation, AMSI/ETW bypass techniques, direct syscalls, reflective loading, and related methods) so operators can use it reliably and safely
• Build, adapt, and operate red team infrastructure and C2 tooling (including frameworks such as Mythic, Cobalt Strike, Sliver, or similar) during engagements, with a focus on operational security and resilience
• Develop and maintain internal tooling pipelines, including automated payload generation, testing, and deployment processes using CI/CD and infrastructure-as-code practices
• Support engagement planning by contributing technical input on threat-informed scenarios, attack objectives, operational security considerations, and success criteria
• Execute or support hands-on offensive activity when needed, including Active Directory exploitation, credential access, privilege escalation, and lateral movement, while prioritizing tooling that enables the broader team
• Apply a deep understanding of how EDR, SIEM, identity protection, conditional access, email security, and network monitoring affect operations, and incorporate that knowledge into tooling and tradecraft
• Support purple team engagements by developing or adapting TTPs, working with client security teams, validating detection logic, and helping improve response capability
• Conduct ongoing research and development to improve Kroll’s red team tooling, tradecraft, methodology, and reporting
• Produce clear, evidence-based reporting that explains attack paths, business impact, detection and response observations, and prioritized remediation actions
• Present technical findings to security teams and communicate business risk to senior stakeholders
• Mentor junior consultants, support technical delivery, and contribute to peer review and quality assurance
• Work collaboratively with Kroll’s wider Cyber Risk teams, including incident response, threat intelligence, cloud security, and detection engineering

What you’ll need to succeed

• 5+ years in offensive cybersecurity, with experience supporting or delivering red team, purple team, adversary emulation, or assumed-breach engagements
• Demonstrated experience developing, modifying, or extending offensive security tooling, scripts, or payloads (including custom loaders, implants, or droppers)
• Strong experience with Windows and Linux operating system internals
• Hands-on experience customizing, modifying, and operating command-and-control frameworks such as Mythic, Cobalt Strike, Sliver, or similar tooling in authorized client engagements
• Experience working with CI/CD, DevOps, and infrastructure automation tools (e.g., Git, Jenkins, Terraform, Ansible, or similar)
• Practical understanding of evasion techniques, endpoint security controls, operational security, and detection-aware tradecraft
• Strong understanding of networking and web protocols, including TCP/IP, DNS, HTTP, HTTPS, and authentication flows
• Excellent written and verbal communication skills, with the ability to explain complex technical issues clearly to technical and non-technical audiences
• The ability to manage risk during live client engagements and operate within agreed rules of engagement

Nice to have

• Red Team certifications such as CRTO, CRTL, or equivalent experience
• Malware engineering courses such as Maldev Academy, SEKTOR7 malware development, or similar training
• Hands-on testing and evasion work against modern EDR (e.g., CrowdStrike, Microsoft Defender, SentinelOne, or similar) and application control solutions
• Experience delivering threat intelligence-driven red team engagements
• Working knowledge of cloud platforms such as AWS, Azure, or GCP
• Experience with exploit development, reverse engineering, malware analysis, or assembly-level debugging
• Experience employing modern AI tooling to support offensive development or engagements
• Experience writing blogs, presenting at industry events, publishing research, or contributing to offensive security tooling
• Experience leading small teams or technical workstreams during complex offensive security engagements

This role offers the opportunity to focus on advanced payload and tooling development while supporting high-impact client engagements. Remote or hybrid arrangements may be considered depending on location and team needs.

Kroll is committed to creating an inclusive work environment. We are proud to be an equal opportunity employer and will consider all qualified applicants regardless of gender, gender identity, race, religion, colour, nationality, ethnic origin, sexual orientation, marital status, veteran status, age, or disability.

Salary range for this role is $150,000 - $200,000 USD