Principal Red Team Payload Architect

Kroll; United States; Hybrid; USD 150,000 - 200,000; Full time

Job summary

Kroll is expanding its Red Team capabilities with a Principal Consultant / L4 Red Team Payload Engineering Specialist. You will design, develop, and operationalize custom payloads and C2 tooling to support authorized engagements across client environments.

You will work with operators and engagement leads to tailor tooling, ensure adherence to rules of engagement, and deliver actionable findings that improve detection and response.

Qualifications

• 5+ years in offensive cybersecurity and red team engagements.
• Experience developing or extending offensive security tooling.
• Strong experience with Windows and Linux OS internals.
• Hands-on with C2 frameworks such as Mythic, Cobalt Strike, Sliver.
• Familiar with CI/CD, DevOps, and infrastructure automation tools.
• Practical understanding of evasion techniques and detection-aware tradecraft.
• Excellent communication and ability to explain complex concepts clearly.
• Ability to manage risk during live engagements within rules of engagement.

Responsibilities

• Lead design, development, customization, and maintenance of command-and-control payloads, droppers, loaders, and supporting tools for use in client engagements.
• Implement and package detection-aware tradecraft (injection, obfuscation, AMSI/ETW bypass, direct syscalls, reflective loading) for safe use.
• Build and operate red team infrastructure and C2 tooling (Mythic, Cobalt Strike, Sliver) with emphasis on OPS-Sec and resilience.
• Develop and maintain internal tooling pipelines, including automated payload generation, testing, and deployment via CI/CD and IaC.
• Support engagement planning with technical input on threat-informed scenarios and objectives.
• Execute hands-on offensive activity as needed, including AD exploitation, credential access, privilege escalation, and lateral movement.
• Apply understanding of EDR, SIEM, identity protection, and network monitoring to tooling and tradecraft.
• Support purple team engagements by developing or adapting TTPs and validating detections.
• Conduct R&D to improve tooling, tradecraft, methodology, and reporting.
• Produce clear, evidence-based reports showing attack paths, business impact, and remediation steps.
• Present technical findings to security teams and senior stakeholders.
• Mentor junior consultants and contribute to peer review and QA.
• Collaborate with wider Cyber Risk teams like incident response, threat intel, cloud security.

Skills

Red Team

Purple Team

Adversary emulation

Assumed-breach

Custom tooling

Windows internals

Linux internals

CI/CD

Networking protocols

Tools

Mythic

Cobalt Strike

Sliver

Git

Jenkins

Terraform

Ansible

Job description

Kroll is expanding its Red Team capabilities with a Principal Consultant / L4 Red Team Payload Engineering Specialist. You will design, develop, and operationalize custom payloads and C2 tooling to support authorized engagements across client environments.

You will work with operators and engagement leads to tailor tooling, ensure adherence to rules of engagement, and deliver actionable findings that improve detection and response.