Senior Red Team Operator

About the role

Lead a small team of Red Team Operators in planning, execution, and reporting of Red Team engagements globally. Work with Deloitte Technology to develop and protect the organization.

Responsibilities

• Perform intelligence gathering against target networks, people, processes, and technologies.
• Find creative ways to obtain a foothold in a target network.
• Deliver malware and establish command and control (C2).
• Move stealthily within target networks, satisfying campaign objectives while staying undetected by blue teams.
• Establish persistence and strategically tune long-haul beacons to maintain long-term footholds where necessary.
• Ensure adherence to the Rules of Engagement during every step of Red Team engagements.
• Maintain operational oversight of all actions conducted during Red Team engagements.
• Ensure every action is planned, executed, and logged properly at all times by every operator.
• Maintain in-depth documentation and auditing of actions taken during Red Team operations for deconfliction and non-repudiation.
• Identify and act on opportunities to train and mentor other members of the Red Team.
• Assist in the management of the Red Team Attack Network and implementation of new tools and techniques to improve tradecraft.
• Share research within the Deloitte Global Red Team community and broader security organization via blogs, conference talks, or publishing code.
• Develop operational processes, field manuals, and attack methodologies to continuously improve engagement quality and knowledge sharing.
• Ensure deliverables meet quality and timeliness expected of a world-class Red Team.
• Work closely with Deloitte's industry-leading information security teams to identify and reduce risk globally.

Requirements

• 3+ years of Red Team experience.
• Deep understanding of threat actor tactics, techniques, and procedures (TTPs).
• Experience with, and deep understanding of, digital forensics and incident response capabilities and procedures.
• Experience leading Red Team Operations against companies and their associated people, processes, and technologies.
• Ability to create, update, and maintain documentation ranging from Red Team TTPs to governing documentation as needed.
• Experience enumerating and attacking Windows Active Directory and Azure EntraID environments.
• Experience leading the designing, building, maintaining, and utilization of covert C2 infrastructure in various cloud platforms and environments.
• Experience with modern malware development and obfuscation techniques.
• Deep understanding of enterprise security architecture and associated security controls.
• Deep understanding of monitoring, detections, and indicators of compromise/attack, and implications they have on covert Red Team Operations.
• Hands‑on experience with industry‑leading Red Team tools such as Cobalt Strike, Nighthawk C2, Bloodhound, Evilginx2, etc.

Qualifications

• Relevant certifications such as OSCP, OSCE, OSEP, OSED, OSEE, CRTP, CRTE, etc. (preferred)
• Public examples of blogs, conference talks, and open‑source tooling demonstrating expertise.
• Experience operating against security products such as Microsoft Defender for Endpoint/Identity and CrowdStrike Falcon.
• Experience with Social Engineering (physical, phishing).
• Experience with Outflank OST.
• Experience automating infrastructure deployment with Ansible and Terraform.
• Experience leading red teaming efforts.
• Experience with fully remote positions.
• Limited immigration sponsorship may be available.

Benefits

At Deloitte, we value our people and offer employees a broad range of benefits. Our Total Rewards program reflects our continued commitment to lead from the front in everything we do—that's why we take pride in offering a comprehensive variety of programs and resources to support your health and well‑being.