Position Summary

The main function of the Red Team is to rigorously evaluate by imitating adversarial threat actors and test the security of an infrastructure by deploying technologies, both software and hardware. This involves exploiting vulnerabilities on Facility Related Control Systems (FRCS) and Industrial Control Systems (ICS) or the network topology with the ultimate objective of identifying weaknesses and boosting the cybersecurity posture. Efforts will encompass conducting offensive security operations to simulate adversarial tactics and procedures to test preventive, detective, and response controls across various network domains and enterprises.

Upkeeps sustainable facilities, delivers utilities and services, and offers expeditionary combat force capabilities. The establishment of a Red Team (RT) includes the necessity to conduct penetration testing and analytics to strengthen and fortify the cybersecurity posture of facility-related controls.

• Performing tests of vulnerability and/or authorized exploitation of applications, network devices, and physical infrastructure.
• Conduct internal, external, and remote based penetration testing.
• Design and conduct simulated adversarial engineering attacks with intent to stress the limitations of the cyber security posture.
• Write technical and executive reports. Communicate findings to both technical staff and executive leadership.
• Research and experiment with different types of adversarial attacks.
• Mimic adversarial attack vectors or develop new methodologies for penetration testing.
• Review code for security vulnerabilities.
• Assist with reverse engineering of malware, spam, or other malicious software and TTPs.
• Validate security improvements with additional testing and collaborate with defensive (Blue Team) counterparts.
• Assist with the analysis of log data for anomalies and cybersecurity threats.
• Development of team planning, selection, tasking, risk analysis/management and overall quality assurance of engagement report(s)
• Responsible for ensuring that all activity undertaken meets the scope set by the client, and or, negotiates changes to that scope based on issues identified during an engagement
• Exploiting vulnerabilities and misconfigurations within operating systems, protocols, and networks
• Developing and recommending detailed cyber threat mitigation strategies for customer systems and networks.
• Engineering offensive tool development for use in stand-alone and network-connected systems
• Collaborate with cybersecurity analysts and project managers to prepare operational plans and ensure meticulous execution of security assessments
• Provide detailed vulnerability and assessment reports to technical and non-technical stakeholders, and remediation strategies
• Maintain up-to-date knowledge of cybersecurity trends and threat intelligence to enhance assessment methodologies
• Able to generate threat intelligence indicators during Threat Emulation operations and identify gaps in security posture
• Maintains a comprehensive understanding of the cyber threat landscape, situational awareness of emerging threats, zero days, vulnerabilities and other threats against client systems, networks, and assets including identifying and analyzing cyber threats actors and/or activities

• Must have an active Secret Clearance to be considered
• Bachelor's Degree in IT/Cybersecurity related field
• At least five (5) years of experience in security operations or industrial control automation/management and demonstrating leadership in customer-facing roles
• Proficient familiarity with current and emerging hacking or infiltration tools and methodologies.
• Proficient in analyzing or mimicking cyber-attacks, with a deep understanding of attack classifications, stages, system/application vulnerabilities, and compliance with Department of Defense (DoD) policies and procedures
• Knowledge of network topologies, protocols (e.g., TCP/IP, ICMP, HTTP/S, DNS, SSH, SMTP, SMB), and experience with tools like Palo Alto, Elastic SIEM, Cribl, Splunk, VMware, Security Center
• Proven ability to develop and follow penetration testing procedures and document findings comprehensively.
• Proficient with Linux and Windows Operating systems
• Proficient in common code languages and programing of scripts, tools, or applications
• Capable of advisory attack reconstruction based on known threat tactics, integrating Threat Intelligence, and familiar with MITRE ATT&CK framework, with the ability to collaborate effectively with multiple operations centers
• Must be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future.

• Active Top Secret or TS/SCI is preferred
• Experience developing custom exploits and exploitation tools in support of authorized penetration tests or cyber threat emulation exercises.
• Knowledge of Operational Technology (OT) or Industrial Control Systems (ICS) are a plus
• Strong analytical and troubleshooting skills
• Experience with scripting languages like Python, Bash, or PowerShell
• Understands how to utilize knowledge of latest threats and attack vectors to develop correlation rules for continuous monitoring on various security appliances
• Experience in other tools and communication languages as applicable such as Bacnet, MODBus, SCADA systems, and PCAP
• Able to review logs to determine if relevant data is present to accelerate against data models to work with existing use cases
• Certified Ethical Hacker (CEH), OffSec Certified Professional (OSCP), GIAC Penetration Tester (GPEN), GIAC Red Team Professional (GRTP), or relevant IT technology certifications:
  • Examples of other considered certifications include:
    • Certified Computer Security Incident Handler (CERT)
    • GIAC Certified Incident Handler (GCIH)
    • GIAC Information Security Fundamentals (GISF)
    • Certified Information System Security Professional (CISSP)
    • GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)
    • GIAC Enterprise Vulnerability Assessor Certification (GEVA)
    • Additional certifications at an equivalent may also be considered.