Social Engineering Red Team Operator - Process Assessments

J.P. Morgan; New York (NY); On-site; USD 190,000 - 270,000; Full time

Job summary

JPMorgan Chase & Co. in New York seeks an experienced Business Process Red Team Operator to lead social engineering and assessments of critical business processes such as payments, fraud, and supplier management.

The role combines hands-on offensive security testing with risk-based analysis, delivering detailed findings and remediation recommendations to executives while advancing resilient controls and threat emulation capabilities.

Qualifications

• 5+ years in cybersecurity or resiliency, with demonstrated offensive testing experience.
• Knowledge of OWASP Top Ten and NIST CSF.
• Ability to perform targeted, covert security tests with vulnerability identification, exploitation, and post‑exploitation.
• Strong networking fundamentals and OS knowledge across Windows/Linux/Unix.
• Experience with social engineering campaigns (phishing, vishing).

Responsibilities

• Perform offensive security testing using social engineering against critical JPMC assets.
• Conduct business process assessments including tabletop/workshop sessions and live testing of controls.
• Design and execute testing and simulations (penetration tests, cyber exercises) and refine assessment frameworks.
• Evaluate controls for effectiveness and opportunities to automate testing.
• Prepare detailed findings, risk assessments, and remediation recommendations for senior stakeholders.
• Stay informed on threats, industry practices, and regulatory requirements to guide risk management.

Skills

Offensive security

Social engineering

Threat modeling

Vulnerability assessment

Red Team operations

Tools

Cobalt Strike

Metasploit

Nmap

Nessus

Burp Suite

Job description

JPMorgan Chase & Co. in New York seeks an experienced Business Process Red Team Operator to lead social engineering and assessments of critical business processes such as payments, fraud, and supplier management.

The role combines hands-on offensive security testing with risk-based analysis, delivering detailed findings and remediation recommendations to executives while advancing resilient controls and threat emulation capabilities.