Senior Red Team Operator / SME

About This Opportunity

We are representing a confidential federal contracting organization seeking a Senior Red Team Operator / SME to lead adversary-emulation engagements supporting critical government cybersecurity initiatives. This is a full-time position based in the United States with up to 25% continental travel.

Our client works within programs designed to safeguard federal IT networks through continuous monitoring, diagnostics, and mitigation. As a senior operator, you will own end-to-end red team campaigns—translating threat intelligence into realistic, safe engagements that measure and improve defensive capabilities across federal cyber assets.

Responsibilities

• Lead red team engagements from scenario design and rules-of-engagement planning through infrastructure build, execution, deconfliction, reporting, and customer out-briefing
• Develop multi-vector campaigns aligned to MITRE ATT&CK and modern APT profiles, integrating identity-layer exploitation, cloud lateral movement, and infrastructure pivoting
• Design and oversee adversary infrastructure, redirectors, command-and-control channels, payload-delivery methods, operator access, logging, and teardown procedures
• Construct secure cloud-based attack infrastructure and teardown workflows consistent with modern adversary tradecraft
• Execute advanced identity, endpoint, network, web, cloud, phishing, defense-evasion, persistence, and exfiltration-simulation techniques when authorized
• Mentor junior operators, review tradecraft and scripts, enforce OPSEC and safety controls, and make real-time technical decisions during operations
• Review payload and tooling for evasion capabilities (EDR/AV bypass and living-off-the-land techniques) within authorized scope
• Coordinate with stakeholders to validate detection and response, develop purple-team scenarios, and translate observations into measurable defensive improvements
• Own technical quality for operator logs, attack narratives, evidence, mitigation recommendations, assessment reports, and customer out-briefs
• Escalate material risks, scope changes, operational impacts, and cross-engagement issues appropriately

What We're Looking For

Required:

• U.S. citizenship and ability to obtain a Public Trust fitness determination (High Risk)
• Five or more years of hands-on red team, adversary-emulation, or advanced penetration-testing experience, including at least two years leading engagements or small operator teams
• Demonstrated campaign-planning experience across reconnaissance, initial access, credential access, privilege escalation, lateral movement, persistence, command and control, defense evasion, and simulated exfiltration
• Advanced experience with C2 frameworks, adversary infrastructure, Active Directory/Entra ID, Windows and Linux tradecraft, cloud attack paths, and operator scripting/tool development
• Strong understanding of operational security, deconfliction, legal and ethical boundaries, evidence handling, and safe execution in production environments
• Ability to write and technically review assessment reports and deliver clear out-briefs to technical and executive audiences
• Proficiency with advanced tooling (Sliver, Mythic, Havoc) and secure cloud attack architecture
• One or more advanced hands-on certifications such as OSEP/OSCE, OSCP, GXPN, GPEN, CRTO/CRTL, CRTP, OSED, or equivalent
• Ability to work in customer-provided remote environments, use customer-approved tools, and comply with rules of engagement, data-handling requirements, evidence controls, deconfliction procedures, and stop-work criteria

Desired:

• Eight or more years of offensive-security experience, including multi-tenant enterprise or federal engagements
• Payload or tool development in C#, C/C++, Go, Rust, Python, or PowerShell; familiarity with modern EDR/AV bypass and living-off-the-land techniques
• Advanced AWS/Azure identity and cloud tradecraft, container/Kubernetes security, or hybrid-enterprise campaign experience
• Experience facilitating purple-team exercises, detection engineering, or SOC/incident-response validation
• Critical-infrastructure, ICS/OT, federal high-value-asset, or restricted/air-gapped-environment experience

How We Work With You

When you apply through Get A Job.ai, our talent team will review your profile and schedule an initial screening call. We will discuss your red team background, campaign leadership experience, certifications, and clearance eligibility. If there is a strong match, we will submit your candidacy to our client for consideration. Please do not contact the client directly—all communication and interview coordination will be managed by Get A Job.ai to ensure a smooth, confidential process.

Pay

Pay via Get A Job.ai will be competitive and commensurate with your experience, certifications, and location. Specific compensation details will be discussed during the screening process.

Equal Employment Opportunity: Get A Job.ai is committed to creating a diverse and inclusive environment. We provide equal employment opportunities to all qualified applicants without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristic protected by law.