Red Team Operator - AVP

About the role

Embark on a transformative journey as a Red Team Operator – AVP at Barclays. In this highly hands‑on role you will leverage industry‑leading tools, explore emerging techniques, and execute operations across cyber, physical, human, process, and technology domains. You will participate in full‑scope adversary emulation exercises—including cyber operations, physical security assessments, and social engineering engagements—to test the resilience of defenses under realistic conditions, identify vulnerabilities and control gaps, and work closely with stakeholders to strengthen the security posture. The role offers dedicated time for research, tool evaluation, and collaboration with a team of skilled operators.

Purpose

Identify potential vulnerabilities within the bank’s IT systems using penetration testing tools and techniques to ensure the security of computer systems, applications, servers, and networks.

Responsibilities

• Develop and execute assessments, audits, and threat models to identify vulnerabilities within the bank’s systems, applications, and servers, and communicate key findings and recommendations to stakeholders.
• Collaborate with stakeholders and IT teams to identify emerging cyber‑attack techniques, tools, and technologies, supporting the development of penetration‑testing methodologies.
• Develop and maintain comprehensive documents and reports for senior stakeholders on penetration‑test findings, including remediation guidance.
• Work with business units to understand security requirements and controls in processes and applications, enhancing overall security posture and assurance.
• Identify emerging vulnerabilities, exploit code, and cyber‑attacks to create testing methodologies and assurance activities.
• Advise and influence decision‑making, contribute to policy development, and ensure operational effectiveness.
• Lead or contribute to complex assignments, set objectives, coach team members, and drive performance outcomes.
• Provide guidance on risk mitigation, governance, and control strengthening.
• Perform complex analysis of data from multiple internal and external sources to solve problems creatively and communicate complex information to stakeholders.

Requirements

• Experience executing full‑scope Red Team engagements aligned to adversarial objectives across cyber, physical, social engineering, and process attack surfaces.
• Designing and delivering end‑to‑end phishing and social engineering campaigns, including building and managing supporting infrastructure (domains, redirectors, email services, landing pages), realistic pretexts, and payloads.
• Deploying, operating, and optimizing Command and Control frameworks such as Cobalt Strike, Nighthawk, or similar platforms to support adversary emulation activities.
• Assessing the effectiveness of security controls by simulating advanced attacker behaviors and identifying improvement opportunities.
• Collaborating with security teams and stakeholders to translate findings into actionable recommendations and measurable security improvements.
• Developing and enhancing custom tooling, offensive tradecraft, and defense‑evasion techniques to emulate sophisticated threat actors.
• Researching, prototyping, and executing innovative attack methodologies that advance adversary emulation capabilities.
• Possession of industry‑recognized certifications (e.g., OSCP, OSEP, CRTO, CRTP, CREST, CCSAS, CCRTS) is a plus.
• Strong programming and scripting skills to build, customize, and automate tools for Red Team engagements.
• Analytical thinking, creativity, and problem‑solving skills to navigate technical challenges and deliver impactful security testing outcomes.
• Demonstrated ability to work effectively across teams and influence stakeholders.

Benefits

• Medical, dental, and vision coverage.
• 401(k) retirement plan.
• Life insurance.
• Paid leave for qualifying circumstances.
• Eligibility for an incentive award.

Pay

Base salary range: $115,000 – $155,000.

Schedule

Work from Home (WFH) opportunity.