Senior Red Team Operator – Adversary Emulation & AI

Citizens Bank; Raleigh (NC); Hybrid; USD 120,000 - 210,000; Full time

Job summary

Citizens Bank is seeking a Principal Operator, Red Team to perform advanced adversary emulation across on-prem, cloud, SaaS and hybrid environments. This hands-on role tests controls and translates findings into measurable improvements in detection, response, and risk posture.

You will work with Blue Team, Detection Engineering, Threat Intelligence, and Incident Response in a purple-team approach with a hybrid schedule (4 days onsite, 1 day remote) across designated hub locations.

Qualifications

• Hands-on Red Team and adversary emulation experience across complex environments.
• Ability to design and execute attack paths across on-prem, cloud, SaaS and hybrid
• Strong collaboration with Blue Team and Detection Engineering to translate activity into improved defenses
• Excellent documentation and testing discipline for engagements
• Familiarity with AI security testing and misuse scenarios

Responsibilities

• Execute Red Team and Purple Team engagements including adversary emulation and breach scenarios
• Design and execute campaign-based attacks across enterprise environments
• Perform exploitation across on-prem, cloud, SaaS and hybrid infrastructures
• Simulate attacker tradecraft including living off the land, privilege escalation, lateral movement
• Test AI-enabled systems and workflows for misuse by attackers
• Conduct prompt manipulation and AI model misuse assessments
• Collaborate with Detection Engineering to validate detections and close gaps
• Translate offensive findings into remediation insights with stakeholders
• Ensure engagement findings are tracked through resolution and risk reduction
• Develop targeted scripts or payloads to emulate adversary behaviors
• Document findings and contribute to engagement reports and debriefs
• Operate within rules of engagement and safety protocols
• Stay current on evolving adversary tactics and tooling

Skills

Red Team operations

Adversary emulation

Cloud and AI security

Threat simulation

Operational discipline

Education

Bachelor's Degree in Security / CS / IT or related field

OSCP, OSEP, CRTO, CRTP or similar

AI security testing exposure

Tools

Caldera

Metasploit

Atomic Red Team

Job description

Citizens Bank is seeking a Principal Operator, Red Team to perform advanced adversary emulation across on-prem, cloud, SaaS and hybrid environments. This hands-on role tests controls and translates findings into measurable improvements in detection, response, and risk posture.

You will work with Blue Team, Detection Engineering, Threat Intelligence, and Incident Response in a purple-team approach with a hybrid schedule (4 days onsite, 1 day remote) across designated hub locations.