Senior Consultant, Human Threats

Coalfire; Chicago (IL); On-site; USD 146,000 - 180,000; Full time

Benefits offered by this job

Flexible work model

Parental leave

Training reimbursement

Mental health support

Insurance options

Job summary

Coalfire, headquartered in Chicago, IL, seeks a Senior Consultant, Human Threats to join our DivisionHex Human Threats team. You will assess security posture and human-centered detection and response capabilities with emphasis on authorized physical security assessments, social engineering, and risk evaluations across client facilities.

You will plan engagements, develop scenarios, and deliver clear reports with practical remediation.

Qualifications

• 5-8 years client-facing consulting experience with 3-5 years experience in social engineering, red team, insider risk, physical security
• Demonstrated expertise of social engineering principles and techniques, phishing, vishing, smishing, and other communication-based attack methods
• Knowledge of threat actor tactics, physical security concepts, badge/access control weaknesses, and user-targeted attack paths
• Willingness and ability to travel to client sites up to 75%

Responsibilities

• Conduct human threat engagements, including social engineering, phishing, vishing, authorized physical security assessments, and human risk evaluations
• Plan, scope, and execute physical security assessments across facilities, offices, campuses, and other client locations
• Evaluate physical security controls, including perimeter protections, entry points, locks, badges, visitor management, and secure areas
• Develop assessment plans, scenarios, pretexts, and test plans for combined physical and social engineering engagements
• Coordinate onsite logistics and client communications while adhering to scope and authorization
• Document observations with notes, timestamps, photos, interviews, and secure handling of client data
• Analyze results, assign risk-based findings, and provide actionable remediation recommendations
• Prepare and review Human Threat reports to meet quality standards
• Deliver client briefings and debriefs highlighting gaps, impact, and actions
• Mentor junior consultants and contribute to methodology development
• Represent Coalfire at events and with clients as a subject matter expert

Skills

Social engineering

Phishing

Vishing

Smishing

Pretext development

Adversary emulation

Human risk assessments

Report writing

Client presentations

Job description

Senior Consultant, Human Threats

About Coalfire

Coalfire is on a mission to make the world a safer place by solving our clients hardest cybersecurity challenges. We work at the cutting edge of technology to advise, assess, automate, and ultimately help companies navigate the ever-changing cybersecurity landscape. We are headquartered in Chicago, Illinois with offices across the U.S. and U.K., and we support clients around the world.

But thats not who we are thats just what we do.

We are thought leaders, consultants, and cybersecurity experts, but above all else, we are a team of passionate problem-solvers who are hungry to learn, grow, and make a difference.

Position Summary:

The Human Threats Senior Consultant will serve as a senior technical consultant on the DivisionHex Human Threats team, assessing the security posture and human-centered detection and response capabilities of client organizations. The role will place a strong emphasis on authorized physical security assessments, including facility access controls, perimeter and entry-point security, visitor and badge-management processes, secure-area protections, employee behaviors, and other physical safeguards. The Senior Consultant will also perform and support social engineering activities, including phishing, vishing, pretext development, human risk assessment, and awareness and behavior measurement, to evaluate how physical and digital attack paths can exploit people, processes, and technology.

The ideal candidate will bring expert-level knowledge of physical security assessment methodologies and adversary tradecraft, along with deep experience in one or more social engineering disciplines. They will work with the Managing Principal of Human Threats, Project Managers, Directors, and client Points of Contact to plan and execute engagements, meet project requirements, and provide subject matter expertise across social engineering domains. As a trusted client advisor, the Senior Consultant will use objective testing, onsite assessment activities, social engineering exercises, and clear reporting to help clients identify weaknesses, prioritize remediation, and improve resilience against physical and other human-centric threats.

What You'll Do

• Conduct human threat engagements, including social engineering, phishing, vishing, authorized physical security assessments, and human risk evaluations.
• Plan, scope, and execute physical security assessments across facilities, offices, campuses, and other client locations in accordance with approved rules of engagement.
• Evaluate physical security controls, including perimeter protections, entry points, locks, badges, visitor management, reception procedures, secure areas, employee access practices, and related processes.
• Perform onsite testing and walkthroughs to identify opportunities for unauthorized access, security control bypass, tailgating or piggybacking, weak access governance, and other physical security exposures.
• Develop assessment scenarios, pretexts, and test plans that safely evaluate how physical and social engineering techniques may be combined to gain access to people, facilities, information, or technology.
• Coordinate onsite logistics, client communications, safety considerations, evidence collection, and testing activities while maintaining strict adherence to scope and client authorization.
• Document observations and evidence through accurate notes, timestamps, photographs, interviews, and other appropriate assessment records, while protecting sensitive client information.
• Analyze physical assessment results, assign risk-based findings, and provide practical recommendations that improve facility security, access management, detection, response, and resilience.
• Prepare, review, and approve Human Threat reports to meet quality requirements.
• Deliver timely client briefings and debriefs that clearly communicate physical security gaps, social engineering results, business impact, and prioritized remediation actions.
• Manage priorities and tasks to achieve delivery utilization targets and ensure client deliverables and services are delivered on time.
• Advise clients on testing and assessment activities in a timely and professional manner and establish positive collaborative relationships with clients and stakeholders.
• Maintain current industry certifications and knowledge of emerging physical security, social engineering, and human threat tactics, technologies, and trends.
• Identify up-sell and cross-sell opportunities and elevate them to sales.
• Collaborate with project managers, quality management, sales, and other delivery team members to drive customer satisfaction and meet project deliverables.
• Mentor junior consultants in physical assessment techniques, social engineering tradecraft, client communications, reporting, and engagement execution.
• Contribute to the development and refinement of Human Threat methodologies, tooling, playbooks, and service offerings, with an emphasis on repeatable physical assessment practices.
• Contribute to thought leadership through research, blogs, whitepapers, webinars, and conference presentations on physical security, human threat, and related security topics.
• Support the development of the Human Threat practice through original research, service innovation, and externally facing industry content.
• Represent Coalfire at industry events, client briefings, and conferences as a subject matter expert.
• Contribute to other offensive security engagements, as needed, based on business demand, skillset alignment, and delivery priorities when not assigned to Human Threat assessments.
• Perform other responsibilities as needed in support of client delivery, practice development, and team success.

What You'll Bring

• 5 - 8 years client-facing consulting experience with 3 - 5 years experience in social engineering, red team, insider risk, physical security
• Demonstrated expertise of:
  • Social engineering principles and techniques
  • Phishing, vishing, smishing, and other communication-based attack methods
  • Pretext development and adversary emulation against human targets
  • Human risk assessments and behavior-based security evaluations
  • Report writing and client presentation delivery
• Demonstrated knowledge of:
  • Current threat actor tactics, techniques, and procedures involving human targets
  • Physical security concepts and badge/access control weaknesses
  • Email security controls, identity-based attacks, and user-targeted attack paths
  • Security awareness, culture, and behavior change principles
• Ability to travel up to 75%
• Strong writing skills, personal accountability, and the ability to complete work to established standards without direct supervision.
• Demonstrated experience planning and conducting authorized physical security assessments, facility walkthroughs, access control reviews, and onsite testing.
• Working knowledge of physical security principles and controls, including perimeter security, entry points, locks, badges, visitor management, reception procedures, secure areas, and employee access practices.
• Ability to develop assessment plans, scenarios, pretexts, rules of engagement, and safety procedures for physical and social engineering activities.
• Strong situational awareness, sound judgment, discretion, and professionalism when conducting onsite assessments and interacting with employees, visitors, and client stakeholders.
• Ability to identify, document, risk-rate, and communicate physical and human-centered security vulnerabilities with clear, practical remediation recommendations.
• Demonstrated ability to communicate complex security concepts through written content, client presentations, executive briefings, and public speaking.
• Excellent communication, collaboration, and presentation skills.
• Strong time management skills and the ability to manage multiple priorities, engagements, deadlines, and onsite requirements.
• Ability to protect sensitive client information and maintain accurate assessment evidence and engagement records.
• Working knowledge of social engineering tactics, phishing, vishing, pretext development, human risk, and related human threat disciplines.
• Willingness and ability to travel to client sites and participate in onsite assessments as required.

Bonus Points

• ASIS Certified Protection Professional certification or a comparable physical security credential.
• Knowledge of physical red team tactics and techniques.
• Executive protection or executive-targeted social engineering scenarios.
• Behavioral science, psychology, or influence-based training.
• Threat intelligence related to social engineering campaigns and threat actor tradecraft.
• Insider risk program development.
• Training content development and workshop facilitation.
• Hardware, badge, or access-control related social engineering experience.
• Published research, blogs, whitepapers, or conference presentations related to social engineering, human threat, or offensive security.

$146,000 - $180,000 a year

The salary range listed is a reasonable estimate of the compensation range for this role based on national salary averages. The actual salary offer to the successful candidate will be based on job-related education, geographic location, training, licensure and certifications and other factors. You may also be eligible to participate in annual incentive, commission, and/or recognition programs.

Why Youll Want to Join Us

At Coalfire, youll find the support you need to thrive personally and professionally. In many cases, we provide a flexible work model that empowers you to choose when and where youll work most effectively whether youre at home or an office.

Regardless of location, youll experience a company that prioritizes connection and wellbeing and be part of a team where people care about each other and our communities. Youll have opportunities to join employee resource groups, participate in in-person and virtual events, and more. And youll enjoy competitive perks and benefits to support you and your family, like paid parental leave, flexible time off, certification and training reimbursement, digital mental health and wellbeing support membership, and comprehensive insurance options.

At Coalfire, equal opportunity and pay equity is integral to the way we do business. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran. Coalfire is committed to providing access, equal opportunity, and reasonable accommodation for individuals with disabilities in employment, its services, programs, and activities. To request reasonable accommodation to participate in the job application or interview process, contact our Human Resources team at [e-mail].