Red Team Operator, Operational Technology

This is a fully remote position, open to applicants in United States.

📋 Description

• Perform both semi-automated and manual red team and penetration testing on critical OT environments (e.g., ICS, SCADA, DCS, BMS, IIoT, Embedded Systems) where autonomous testing necessitates expert human oversight to ensure safety and operational continuity.

• Detect and exploit vulnerabilities across various attack surfaces:

• Comprehend OT services and protocols.

• Capable of executing common Active Directory attacks that facilitate lateral movement and privilege escalation.

• Target control systems and embedded devices for attack activities and exploitation opportunities.

• Moderate understanding of container technologies and their associated attack techniques.

• Abuse of certificate services and PKI infrastructure.

• Knowledge of trust relationship attacks and forest trusts.

• Conduct privilege escalation, lateral movement, and post-exploitation activities.

• Customize public offensive tools or create proprietary internal tools.

• Uphold operational security throughout engagements:

• Deploy and manage command-and-control infrastructure (Cobalt Strike, Sliver, Mythic, custom frameworks).

• Implement evasion strategies against EDR, SIEM, and network monitoring systems.

• Exhibit proper OPSEC including infrastructure isolation and attribution management.

• Demonstrate operational discipline, encompassing scope management, cleanup, and evidence handling.

• Develop proof-of-concept exploits and tools as necessary to meet objectives.

• Generate clear, actionable reports that convey risk and business implications.

• Present findings to technical teams and executive stakeholders.

• Contribute to internal research, tooling, playbooks, and knowledge sharing initiatives.

• Define the reasoning paths, safety protocols, and protocol-specific logics utilized by our AI to navigate industrial networks.

• Act as the ultimate safety valve, establishing the "No-Go" parameters for autonomous agents in dynamic manufacturing or utility environments.

• Collaborate with client engineers and our internal AI teams to translate validated OT kill chains into autonomous defensive strategies.

⛳️ Requirements

• Ability to communicate effectively with OT stakeholders in a way that fosters relationships and trust.

• Proven experience in offensive security with a focus on OT/ICS/SCADA/Embedded Systems. Familiarity with automation and control systems as well as proficiency in using a Linux terminal is essential.

• Understanding that while AI offers scalability, human expertise is crucial for navigating the intricacies of a sensitive power grid or production line.

• Extensive technical knowledge of industrial protocols (Modbus, DNP3, Ethernet/IP, Profinet) and the ability to perform manual packet manipulation.

• Strong grasp of networking and operating system fundamentals.

• Comprehensive knowledge of common enterprise protocols and services (e.g., SMB, LDAP, Kerberos, DNS, HTTP).

• Experience in scripting or programming in at least one language (e.g., Python, Go, PowerShell, Bash, C/C++).

• Ability to assess "exploitable risk" versus "theoretical vulnerability" in a manner that resonates with both plant managers and CISOs.

• Capacity to analyze attack paths and combine multiple vulnerabilities into significant outcomes.

• Excellent technical writing and communication abilities.

• Eligibility to work in the United States without sponsorship.

🏝️ Benefits

• Comprehensive Health, Dental, & Vision Coverage.

• Meaningful Equity Ownership.

• In-Office Meals.

• On-site Haircuts.

• Company Sponsored Conferences & Events.

• 401(k), HSA, and FSA Plans.

• Flexible PTO.