Senior Red Team Consultant

bishopfox; Stati Uniti; Remoto; USD 140.000 - 210.000; Tempo pieno

Vantaggi offerti da questo lavoro

Health insurance

Paid time off

Remote work stipend

Training budget

Retirement matching

Parental leave

Descrizione del lavoro

bishopfox is seeking a senior offensive security consultant to lead engaging red and purple team assessments across networks, apps, cloud, and physical environments. You will research advanced attacker techniques, develop tooling, and translate findings into actionable guidance for clients.

In addition to hands-on testing, the role includes mentoring junior staff, guiding practice development, and advising clients on risk and security improvements.

Competenze

• 5+ years of offensive security experience including red team or purple team work across varied industries.
• Strong knowledge of common operating systems and Active Directory exploitation and lateral movement.
• Familiarity with major cloud platforms, Kubernetes, and Docker.
• Hands-on experience with command-and-control frameworks, custom tooling, payload development, reverse engineering, and endpoint detection evasion.
• Proficiency in multiple programming or scripting languages and solid network and web protocol knowledge.
• Experience with reconnaissance and social engineering, plus the ability to assess AI system risks involving tool misuse, trust boundaries, authorization, and sensitive data.

Mansioni

• Plan red and purple team engagements by profiling targets, defining objectives, and mapping attack paths.
• Conduct authorized operations across network, web, physical, and social engineering scenarios.
• Assess exposure in cloud environments, containers, identity systems, and AI applications.
• Develop or adapt tools and payloads, research evasion approaches, and perform reverse engineering as needed.
• Communicate findings, response implications, and prioritized recommendations to client stakeholders.
• Lead small engagement teams, mentor peers, and contribute to consulting methods and practice development.

Conoscenze

Offensive security

Red team

Purple team

Leadership

Communication

Scripting

Reverse engineering

Cloud platforms

Strumenti

Kubernetes

Docker

C2 frameworks

Descrizione del lavoro

Role overview

Lead offensive security engagements that test how organizations withstand realistic adversary activity. The work spans research and planning through operations across networks, applications, physical environments, and social engineering, with findings translated into clear, actionable guidance. At senior level, the role also includes advising clients, leading small teams, mentoring colleagues, and strengthening consulting practices.

Responsibilities

• Plan red and purple team engagements by profiling targets, defining objectives, and mapping attack paths.
• Conduct authorized operations across network, web, physical, and social engineering scenarios.
• Assess exposure in cloud environments, containers, identity systems, and AI applications.
• Develop or adapt tools and payloads, research evasion approaches, and perform reverse engineering as needed.
• Communicate findings, response implications, and prioritized recommendations to client stakeholders.
• Lead small engagement teams, mentor peers, and contribute to consulting methods and practice development.

Requirements

• At least five years of offensive security experience, including red team or purple team work across varied industries.
• Strong knowledge of common operating systems and expertise in Active Directory exploitation and lateral movement.
• Familiarity with major cloud platforms, productivity suites, Kubernetes, and Docker.
• Hands‑on experience with command‑and‑control frameworks, custom tooling, payload development, reverse engineering, and endpoint detection evasion.
• Proficiency in multiple programming or scripting languages and solid network and web protocol knowledge.
• Experience with reconnaissance and social engineering, plus the ability to assess AI system risks involving tool misuse, trust boundaries, authorization, and sensitive data.
• Strong written and verbal communication skills.

Nice to have

• Exploit development, assembly, threat modeling, threat intelligence, incident response, DevOps, or CI/CD experience.
• Physical penetration testing experience.
• Relevant security certifications; credentials are helpful but not required.

Benefits and work setup

The role is remote for candidates based in the United States or Mexico.

• paid time off and holidays
• work-from-home support
• phone and internet allowances
• a training budget
• health insurance
• paid parental leave
• retirement matching for US employees