Senior Red Team Operator, Applications

Armadin; Oregon; Hybrid; USD 180,000 - 290,000; Full time

Job summary

Armadin is seeking a Senior Red Team Operator to advance autonomous defense capabilities. You will run end-to-end attack simulations, craft exploit evidence, and map how far a foothold can reach across identity, cloud, and data.

You will train AI agents, build tools, and report findings to engineers, executives, and counsel. This role demands hands-on red teaming experience and the ability to translate complex tradecraft into scalable, machine‑speed operations.

Qualifications

• Extensive red team experience across multi-surface attack surfaces.
• Ability to design and execute autonomous offensive simulations.

Responsibilities

• Run full kill chains, not checklists. Attack web, mobile, API, and client apps, hunting logic flaws and chaining weaknesses.
• Prove exploitability by turning findings into working exploits with clear evidence; separate risk from noise.
• Map blast radius from foothold to identity, cloud, and data exposure.
• Read code like an attacker; review multi-language sources for control-flow flaws and injections using AI-assisted analysis.
• Take applications apart using static/dynamic analysis, reverse engineering, runtime instrumentation, and API testing.
• Train the swarm: translate tradecraft into techniques and data for AI agents to operate at machine speed.
• Break the machine by pressure-testing attack paths and keeping human-in-the-loop for safety.
• Build scripts and tools to extend offensive capabilities and leverage AI as a force multiplier.
• Tell the attack story with reports and debriefs addressing attack narrative, risk, and fixes.
• Stay ahead of threats by researching new vulnerability classes and exploitation techniques and feeding into the platform.
• Own your work by balancing concurrent operations and research with startup-level autonomy.

Skills

Kill chain analysis

Threat modeling

Red team operations

Security engineering

Job description

About UsAt Armadin, we're a group of engineers, researchers, and security researchers on a mission to redefine what proactive security can do in the AI era. Cyberattacks are becoming autonomous and relentless and we believe defending against threats before they materialize is one of the most powerful ways to protect the institutions the world depends on.We're building autonomous proactive security from the ground up, reinforcing the tradecraft of elite security practioners into purpose-built security models and agents that discover risk and remediate it before organizations are breached.Led by Kevin Mandia, founder of Mandiant ($5.4B exit to Google), our team brings together researchers and engineers from Google, xAI, Meta, Stanford, Georgia Tech, Waterloo, Berkeley, and MIT to reinvent security for an adversary that never sleeps.

Role Overview

Every operator knows the ending. You found the path, chained it to access the crown jewel, and wrote it up. Then the engagement closed, the environment changed the next week, and nobody walked that kill chain again until next year's test. Armadin is built to end that cycle.We're building an agentic attacker swarm. These are specialized AI agents running custom models that discover, exploit, and chain vulnerabilities across external, internal, identity, cloud, and application attack surfaces. They run continuously, at machine speed, against live production environments. Until recently, nobody could put a nation-state-caliber adversary inside every network around the clock. That's the hyperattack, and it's what we do. In one recent engagement, the swarm generated more than 17 million offensive actions in three days and validated 38 attack paths. That's the scale your tradecraft will run at.As a Senior Red Team Operator, your tradecraft is the training signal. You'll run hands-on operations, and then you'll encode how you think into the reasoning our agents use at scale: how you pick a foothold, abuse an application's logic, pivot through identity, separate what's actually exploitable from scanner noise, and map the blast radius once you're in. You'll pressure-test full kill chains end to end, find where the swarm is naive, and teach it to move like an expert, using AI throughout your own workflow to go faster and deeper.

• What does a kill chain look like when it can branch a thousand ways in parallel?
• How do you prove exploitability instead of just flagging it?
• What does a continuous hyperattack find that a two-week engagement never could?

You'll work alongside operators who have spent decades on the front lines of red teaming and the AI engineers turning that experience into autonomous offense. It's a small, scrappy group with high ownership, and the work you ship reaches enterprises through industry leading partners. If you've ever finished an op thinking \"imagine running this everywhere, all the time,\" this is where you get to do it.

What You'll Do

• Run full kill chains, not checklists. Attack web, mobile, API, and thick/thin client applications the way a real adversary would, hunting logic flaws and chaining weaknesses into paths scanners never see.
• Prove what's exploitable. Turn candidate findings into working exploitation with clear evidence, and separate real risk from noise.
• Map the blast radius. Follow every foothold to its end, from application compromise to identity, cloud, and data, and show what an attacker could actually reach.
• Read code like an attacker. Review source across languages and frameworks for control-flow flaws, injection paths, and insecure design, using AI-assisted analysis to cover more ground faster.
• Take applications apart. Use static and dynamic analysis, binary reversing, runtime instrumentation, and API testing to get under the hood of how things really work.
• Train the swarm. Translate your tradecraft into the techniques, decision logic, and evaluation data that make our AI agents operate like expert operators at machine speed.
• Break the machine. Pressure-test the swarm's attack paths, spot where it's naive or wrong, and make the human-in-the-loop calls that keep autonomous operations safe and accurate.
• Build what's missing. Write scripts, tools, and plugins that extend Armadin's offensive capabilities, and treat AI as a daily force multiplier in your own workflow.
• Tell the attack story. Deliver reports and debriefs that walk engineers, executives, and counsel through the attack narrative, the business risk, and the fix.
• Stay ahead of the threat. Research emerging vulnerability classes, exploitation techniques, and AI-driven attacker tradecraft, and feed what you learn straight into the platform.
• Own your work. Balance concurrent operations and internal research with startup-level autonomy, shifting priorities as fast as the threat does.

What You'll Bring

• Deep