Threat Emulation Specialist (Red Team)

Equifax, Inc.; Alpharetta (GA); Hybrid; USD 95,000 - 140,000; Full time

Job summary

Equifax, Inc. in Alpharetta, GA is seeking a Red Team Operator to emulate real-world threats and train defenders by using TTPs across engagements. You will join a Global Security team and work with Cyber Operations to strengthen defenses.

You will execute multi-engagement campaigns, build secure C2 infrastructure, and develop detections with purple teams. The role emphasizes tool development, EDR evasion, cloud attack paths, and AI-assisted testing.

Qualifications

• 2+ years of cybersecurity experience with hands-on offensive work (pentesting, red teaming, offensive research).
• 1+ years of coding in at least one language (C, C#, Go, Python, or PowerShell).
• Working knowledge of Windows and Linux internals, AD, and networking fundamentals.
• Working knowledge of MITRE ATT&CK framework.
• Experience using AI/LLM tools in security workflows.

Responsibilities

• Execute threat actor emulation engagements using real-world TTPs and assist in engagement planning.
• Support multiple concurrent engagements while following rules of engagement and OPSEC standards.
• Collaborate on building and maintaining secure Red Team C2 infrastructure.
• Document findings in clear technical reports and coordinate with purple team detections.
• Contribute to tool development, including C2 extensions and evasive techniques.
• Apply AI tools to speed up threat emulation, CVE analysis, and malware analysis.
• Handle sensitive data and systems responsibly in a global financial data company.

Skills

Offensive security

Python

PowerShell

Threat emulation

Windows & Linux internals

MITRE ATT&CK

AI tools usage

Tools

Cobalt Strike

Sliver

Mythic

GCP

AWS

Job description

Equifax, Inc. in Alpharetta, GA is seeking a Red Team Operator to emulate real-world threats and train defenders by using TTPs across engagements. You will join a Global Security team and work with Cyber Operations to strengthen defenses.

You will execute multi-engagement campaigns, build secure C2 infrastructure, and develop detections with purple teams. The role emphasizes tool development, EDR evasion, cloud attack paths, and AI-assisted testing.