Senior Red Team Operator

Deloitte France; Indianapolis (IN); Remote; USD 140,000 - 230,000; Full time

Job summary

Deloitte Global is seeking a seasoned Red Team Operator to lead a small team in global engagements. You will plan, execute, and report red team activities, perform intelligence gathering, and develop covert C2 infrastructure while ensuring engagement governance.

Ideal candidates bring 3+ years of Red Team experience, deep TTP knowledge, and experience with Windows AD/Azure EntraID, malware techniques, and cloud tooling. Remote work options are available.

Qualifications

• 3+ years of Red Team experience.
• Deep understanding of threat actor TTPs.
• Experience with forensics and incident response capabilities.
• Experience leading Red Team operations against companies and their people, processes, and technologies.
• Ability to create, update, and maintain Red Team documentation.
• Experience enumerating and attacking Windows AD and Azure EntraID environments.
• Experience building covert C2 infrastructure in cloud platforms. Automation a plus.
• Experience with modern malware development and obfuscation techniques.
• Deep understanding of enterprise security architecture and security controls.
• Understanding monitoring and IOC implications for covert Red Team operations.
• Hands-on experience with Red Team tools: Cobalt Strike, Nighthawk C2, BloodHound, Evilginx2.

Responsibilities

• Lead a team of Red Team Operators in planning, execution, and reporting of engagements.
• Perform intelligence gathering on targets worldwide.
• Develop covert C2 and malware techniques.
• Maintain logs, governance, and deconfliction artifacts.
• Mentor team members and share research within the Deloitte Global Red Team.
• Advance attack methodologies and field manuals for ongoing engagements.
• Collaborate with security teams to reduce global risk.

Skills

Red Team operations

Threat TTPs

Forensics & IR

Documentation

AD/Azure EntraID

C2 infrastructure

Malware techniques

Security architecture

IOC & monitoring

Red Team tools (Cobalt Strike)

Education

OSCP

OSCE

OSEP

OSED

OSEE

CRTP

CRTE

Tools

Cobalt Strike

Nighthawk C2

BloodHound

Evilginx2

Ansible

Terraform

Job description

Deloitte Global is the engine of the Deloitte network. Our professionals reach across disciplines and borders to develop and lead global initiatives. We deliver strategic programs and services that unite our organization.

Work you'll do

• Leading a small team of Red Team Operators in the planning, execution, and reporting of Red Team engagements around the globe. This includes, but is not limited to:

• Performing intelligence gathering against target networks, people, processes, and technologies.

• Finding creative ways to obtain a foothold in a target network.

• Delivering malware and establishing command and control (C2).

• Moving stealthily within target networks, satisfying the campaign objectives, while staying undetected by the blue teams.

• Establishing persistence and strategically tuning long-haul beacons to maintain long-term footholds where necessary.

• Ensuring adherence to the Rules of Engagement during every step of the Red Team engagements.

• Maintaining operational oversite of all actions conducted during Red Team engagements. Ensuring that every action is planned, executed, and logged properly at all times by every operator.

• Maintaining in-depth documentation and auditing of actions taken during Red Team operations, at all times, for the purposes of deconfliction and non-repudiation.

• Identifying and acting on opportunities to train and mentor other members of the Red Team.

• Assisting in the management of the Red Team Attack Network and the implementation of new tools and techniquesto improve the team's tradecraft.

• Sharing your research within the Deloitte Global Red Team community, and with the broader security organization, by writing blogs, speaking at conferences, or publishing code.

• Developing operational processes, field manuals, and attack methodologies to continuously improve the quality of engagements and knowledge sharing amongst the team.

• Ensure deliverables meet the quality and timeliness expected of a world-class Red Team.

• Working closely with a wide variety of Deloitte's industry leading information security teams to identify and reduce risk around the globe.

The team

Deloitte Technology works at the forefront of technology development and processes to support and protect Deloitte around the world. In this truly global environment, we operate not in what is but rather what can be to help Deloitte deliver and connect with its clients, its communities, and one another in ways not previously conceived.

Qualifications

Required:

• 3+ yearsofRed Teamexperience.

• A deep understanding of threat actor tactics, techniques, and procedures (TTPs).

• Experience with, and a deep understanding of, digital forensics and incident response capabilities and procedures.

• Experience with leading Red Team Operations against companies and their associated people, processes, and technologies.

• The ability to create, update, and maintain documentation ranging from Red Team TTPs to governing documentation as needed.

• Experience with enumerating and attacking Windows Active Directory and Azure EntraID environments.

• Experience leading the designing, building, maintaining, and utilization of covert C2 infrastructure in various cloud platforms and environments. Automation experience is a plus!

• Experience with modern malware development and obfuscation techniques.

• A deep understanding of enterprise security architecture and the associated security controls.

• A deep understanding of monitoring, detections, and indicators of compromise/attack, and the implications they have on covert Red Team Operations.

• Hands on experience working with industry leading Red Team tools like Cobalt Strike, Nighthawk C2, Bloodhound, Evilginx2, etc...

  Preferred:

• Relevant certifications such as OSCP, OSCE, OSEP, OSED, OSEE, CRTP, CRTE, etc.

• Public examples of blogs, conference talks, and open-source tooling demonstrating your expertise.

• Experience operating against security products such as Microsoft Defender for Endpoint/Identity and CrowdStrike Falcon.

• Experience with Social Engineering (physical, phishing).

• Experience with Outflank OST.

• Experience automating infrastructure deployment with Ansible and Terraform.

• Experience leading red teaming efforts.

• Experience with fully remote positions.

Limited immigration sponsorship may be available.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability or protected veteran status, or any other legally protected basis, in accordance with applicable law.