Senior Red Team Specialist

Allied OneSource; Chicago (IL); On-site; USD 143,000 - 156,000; Full time

Job summary

Allied OneSource is seeking a Senior Red Team Specialist in Chicago to lead adversary-emulation engagements across endpoint, identity, cloud, SaaS, network, and application environments. You will work with Detection Engineering and Incident Response to improve detections, reduce gaps, and speed response.

The role requires 5+ years in red teaming or offensive security, strong tradecraft knowledge, and hands-on experience across hybrid infrastructures.

Qualifications

• 5+ years of red teaming, penetration testing, or offensive security experience with demonstrated impact in modern enterprise environments.
• Strong understanding of attacker tradecraft and TTPs, plus hands-on experience operating across endpoint, identity, cloud, and hybrid infrastructure.
• Working knowledge of defensive tooling and operations (e.g., EDR, SIEM, identity protection, cloud security controls) and experience collaborating in purple team exercises.
• Ability to plan and execute independently within defined scope, paired with high ethical standards, strong documentation/reporting skills, and clear communication.

Responsibilities

• Execute advanced red team and adversary emulation engagements aligned to real-world attacker tactics, objectives, and multi-stage attack chains (including assumed breach scenarios).
• Perform hands-on offensive operations end-to-end (initial access through persistence, privilege escalation, lateral movement, and C2) across hybrid enterprise environments while adhering to rules of engagement.
• Build, maintain, and safely use custom tooling and techniques (scripts, payloads, automation, tradecraft improvements) to simulate realistic adversary behavior and evade controls in a controlled manner.
• Translate offensive findings into defensive improvements by partnering with detection/hunting/IR teams to validate coverage, identify gaps, and deliver clear reporting with actionable recommendations.

Skills

Red team operations

Penetration testing

Threat emulation

Documentation

Python

PowerShell

Tools

EDR

SIEM

PowerShell

Python

Job description

If you thrive on breaking things responsibly to make defenses stronger, this is a rare, deeply hands‑on red team role inside a mature Security Operations organization. As a Senior Red Team Specialist, you’ll run adversary-emulation engagements that mirror real threat actors—testing controls across endpoint, identity, cloud, SaaS, network, and application environments. You’ll work side‑by‑side with Detection Engineering, Threat Hunting, Incident Response, and Purple Team partners to ensure every engagement produces measurable outcomes: tighter detection coverage, faster response, and fewer blind spots.

Responsibilities

• Execute advanced red team and adversary emulation engagements aligned to real‑world attacker tactics, objectives, and multi‑stage attack chains (including assumed breach scenarios).
• Perform hands‑on offensive operations end‑to‑end (initial access through persistence, privilege escalation, lateral movement, and C2) across hybrid enterprise environments while adhering to rules of engagement.
• Build, maintain, and safely use custom tooling and techniques (scripts, payloads, automation, tradecraft improvements) to simulate realistic adversary behavior and evade controls in a controlled manner.
• Translate offensive findings into defensive improvements by partnering with detection/hunting/IR teams to validate coverage, identify gaps, and deliver clear reporting with actionable recommendations.

Requirements

• 5+ years of red teaming, penetration testing, or offensive security experience with demonstrated impact in modern enterprise environments.
• Strong understanding of attacker tradecraft and TTPs, plus hands‑on experience operating across endpoint, identity, cloud, and hybrid infrastructure.
• Working knowledge of defensive tooling and operations (e.g., EDR, SIEM, identity protection, cloud security controls) and experience collaborating in purple team exercises.
• Ability to plan and execute independently within defined scope, paired with high ethical standards, strong documentation/reporting skills, and clear communication.

Preferred / Nice To Have

• Threat‑intelligence‑informed adversary emulation (not only vulnerability‑driven testing)
• Proven track record converting red team findings into improved detections or response playbooks
• Scripting/automation (Python, PowerShell, Bash) and familiarity with MITRE ATT&CK
• Experience in regulated or large enterprise environments; mentoring or internal training contributions

Salary: $143,000-156,000/yr