Lead, Offensive Security

Become a part of our caring community

We're hiring the technical leader of our red team, a hands-on Lead who runs our hardest adversary-emulation campaigns, sets how the team operates, owns the rules of engagement, and moves us into AI-augmented red teaming. You will own the craft: the tradecraft, the standards, the objective-based operations, and the safe, authorized conduct of offensive work.

Red teaming here is not vulnerability coverage and not automated control validation, it's objective-based adversary emulation: we measure whether the enterprise can detect, resist, and respond to a realistic adversary pursuing a mission objective, across network, social engineering, physical, and assumed-breach domains, mapped to MITRE ATT&CK and validated with our defenders through purple teaming.

This is a remote role on a specialized offensive-security team, red teaming shoulder-to-shoulder with Penetration Testing, Breach & Attack Simulation, and Bug Bounty. Fridays are for research and development. You'll have Hack The Box Pro Labs and role-based paths, discretionary certification funding, and a conference/training budget.

What you'll own

• The red-team tradecraft and standards. You set the methods, playbooks, and quality bar the team operates to. These are adversary emulation, C2 tradecraft, initial access, privilege escalation, lateral movement, defense evasion, and assumed-breach methodology — and keep them current as adversaries and defenses evolve.

• The hardest campaigns. You scope, lead, and land the most complex objective-based operations end-to-end, and you're the technical escalation point when an operation hits a wall.

• Rules of engagement and safe conduct. You own the authorization, scoping, deconfliction, and rules-of-engagement governance that keep offensive operations legal, in-scope, and safe.

• AI-augmented red teaming, on two fronts. You drive how the team operates and matures agentic AI offensive tooling to sharpen planning, tradecraft research, evidence synthesis, reporting, and you lead adversarial testing of the enterprise's own production AI systems as targets.

• Defensive impact and functional influence. You turn campaigns into executive-consumable risk narratives, advise leadership on the direction of the red-team function, and partner with detection engineering and the SOC to close the loop on what we found.

What you'll do

• Set and govern the team's adversary-emulation methodology, C2 tradecraft standards, and evidence-quality bar; standardize how objective-based operations are scoped, executed, and reported.

• Lead the most complex red-team campaigns, external/internal network, social engineering, assumed-breach, and full-scope objective operations, with full autonomy, and mentor Senior red teamers on tradecraft without being their manager.

• Own rules of engagement: define authorization, scope, deconfliction, and safe-conduct standards for every operation, in partnership with the Associate Director and stakeholders.

• Operate and mature agentic AI red-team tooling: apply it to improve campaign planning, adversary research, and reporting quality; evaluate AI-assisted output for accuracy and operational fit; and feed practitioner requirements back to the Offensive AI Engineering team who build the platform.

• Test AI systems as targets: lead adversarial assessments of production AI-enabled systems, prompt injection (direct/indirect), agent/tool abuse, RAG/training-data poisoning, sensitive-data exposure, and guardrail/control bypass, including abusing an internal AI agent as a step toward a mission objective within a broader adversary-emulation campaign, mapped to the OWASP Top 10 for LLM Applications, MITRE ATLAS, and the NIST AI Risk Management Framework.

• Run purple-team engagements: measure detection and response (dwell time, alert fidelity, ATT&CK coverage) and drive detection-engineering improvements from what the campaign surfaced.

• Advise leadership on the direction of the red-team function; identify gaps in coverage and defensive controls; propose new adversary-emulation approaches for emerging threats.

Your first 6–12 months

• By 90 days: you've learned about our most complex prior campaigns and…