Business Process Red Team Operator

What you'll do

• Perform and manage hands-on offensive security activities using social engineering techniques against critical assets.
• Conduct business process assessments including tabletop exercises and live testing of payment, fraud, and supplier management controls.
• Design and execute risk-driven simulations such as penetration tests, cyber exercises, and resiliency tests.
• Evaluate the effectiveness of preventative controls and identify opportunities to automate control evaluations.
• Develop comprehensive assessment reports that include detailed findings, risk assessments, and remediation recommendations for senior stakeholders.
• Utilize threat intelligence and security research to improve the firm's assessment strategy and risk management.
• Perform covert security tests involving vulnerability identification, exploitation, and post-exploitation activities.

What we're looking for

• 5+ years of experience in cybersecurity or resiliency with skills to plan, design, and coordinate offensive security testing and simulations.
• Knowledge of US financial services sector cybersecurity practices, risk management processes, and incident response methodologies.
• Proficiency in multiple security assessment methodologies (e.g., OWASP Top Ten, NIST) and various offensive testing tools.
• Ability to perform covert security tests including vulnerability identification, exploitation, and post-exploitation activities.
• Strong understanding of networking fundamentals, operating systems, and software vulnerability/exploitation techniques using tools like Cobalt Strike or Metasploit.
• Experience in multiple business verticals such as call centers, payment processes, and client service organizations.
• Social engineering background (or intelligence, law enforcement, or similar experience) (preferred).
• Relevant certifications such as OSCP, OSEP, CREST, SANS, CFE, or CAMS (preferred).