Principal, Adversary Services

What You'll Do

• Provide expertise in adversary services, working in detection and response evasion, creation of novel tactics and exploits, emulation of threat actor TTPs, and the evolution of sophisticated command and control (C2) infrastructure.
• Develop and execute on sophisticated offensive cybersecurity tradecraft to gain initial access, establish persistence, escalate privileges, move laterally, and evade detection and response controls.
• Execute on adversary simulation, adversary emulation, and purple team exercises.
• Lead prolonged, holistic, engagements of our clients’ systems and applications, identifying and prioritizing security risks, detection gaps, and recommending appropriate remediation measures, with reporting aligned to MITRE ATT&CK and other relevant frameworks.
• Develop and maintain custom exploit code, scripts, and tools to automate and streamline adversary services activities.
• Stay current with emerging security threats and trends, and proactively identify areas of improvement to enhance our security posture.
• Act as a trusted advisor to our clients on security matters, providing insights and recommendations to inform strategic decision-making.

What You'll Bring

• 6+ years of experience in penetration testing, adversary services/red teaming, and purple teaming, with a minimum of 3+ years leading covert Red Team engagements.
• Significant experience creating and delivering specialized testing and training for internal stakeholders and customers on the latest threat actor TTPs and capabilities, including advanced persistent threats (APTs), ransomware, and insider threats.
• Experience presenting thought leadership, including talks at security conferences, blogs, or in other forums.
• Deep technical expertise in adversary services-related tradecraft, including development and management of command and control infrastructure, custom development of leading C2 toolsets (e.g. Cobalt Strike, Sliver, Mythic), and stewardship of evasion techniques to maximize effectiveness.
• Extensive experience conducting adversary services engagements across a variety of platforms and environments, including on-premise, cloud, and hybrid environments.
• Relevant certifications such as CRTO, CRTO II, AT:RTO, OSEP, or related.
• Excellent communication and collaboration skills, with the ability to effectively convey complex technical concepts to both technical and non-technical audiences.
• Experience in all components of the attack chain, including OSINT, social engineering (phishing, vishing, smishing), payloads, C2 infrastructure, lateral movement, privilege escalation, and impact objectives.
• Technical knowledge of programming and scripting languages (e.g. Python, Ruby, Go) to develop and modify custom evasion tooling and infrastructure.
• Ability to thrive in a fast-paced, dynamic environment, and adapt quickly to changing priorities and requirements.
• Ability to foster a positive work environment and attitude, with a “team first” mentality.