Red Team Operator, Operational Technology (OT)

Execute semi-automated and manual red team and penetration testing on sensitive OT environments (e.g., ICS, SCADA, DCS, BMS, IIoT, Embedded Systems) where autonomous testing requires expert human oversight to maintain safety and uptime.

Identify and exploit weaknesses across diverse attack surfaces:

Understanding of OT services and protocols

Understanding and able to execute common Active Directory attacks that would allow lateral movement and privilege escalation

Ability to target controls systems and embedded devices for attack activities and abuse opportunities

Moderate understanding of container technologies and attack techniques to abuse these technologies

Certificate services and PKI infrastructure abuse

Knowledge of trust relationship attacks forest trusts

Conduct privilege escalation, lateral movement, and post-exploitation activities

Ability to customize public offensive tooling or develop custom internal tooling

Maintain operational security throughout engagements:

Deploy and operate command-and-control infrastructure (Cobalt Strike, Sliver, Mythic, custom frameworks)

Implement evasion techniques against EDR, SIEM, and network monitoring

Practice proper OPSEC including infrastructure isolation and attribution management

Demonstrate operational discipline, including scope control, cleanup, and evidence handling

Develop proof-of-concept exploits and tooling as needed to achieve objectives

Produce clear, actionable reports that communicate risk and business impact

Present findings to technical teams and executive stakeholders

Contribute to internal research, tooling, playbooks, and knowledge sharing

Define the reasoning paths, safety guardrails, and protocol-specific logic our AI uses to navigate industrial networks.

Act as the ultimate safety valve, defining the "No-Go" parameters for autonomous agents in volatile manufacturing or utility environments.

Work with client engineers and our internal AI teams to translate validated OT kill chains into autonomous defensive postures.

Ability to clearly communicate with OT stakeholders in a manner that builds relationships and trust.

Demonstrated experience in offensive security with a focus on OT/ICS/SCADA/Embedded Systems. You should know your way around automation and control systems as well as a Linux terminal.

You understand that while AI provides scale, human expertise is required to navigate the nuance of a sensitive power grid or production line.

Deep technical knowledge of industrial protocols (Modbus, DNP3, Ethernet/IP, Profinet) and the ability to perform manual packet manipulation.

Deep understanding of networking and operating system fundamentals

Strong knowledge of common enterprise protocols and services (e.g., SMB, LDAP, Kerberos, DNS, HTTP)

Scripting or programming experience in at least one language (e.g., Python, Go, PowerShell, Bash, C/C++)

Ability to quantify "exploitable risk" vs. "theoretical vulnerability" in a way that resonates with both plant managers and CISOs.

Ability to analyze attack paths and chain multiple weaknesses into meaningful outcomes

Strong technical writing and communication skills

Eligibility to work in the United States without sponsorship.

Experience modifying or developing offensive tooling

Familiarity with detection evasion concepts and operational tradecraft

Experience working with mature defensive teams and security operations centers

Experience or interest in how LLMs and agentic workflows can be applied to offensive security.

Relevant certifications (e.g., GICSP, GRID, GCIP, or OSCP/OSEP) or equivalent demonstrated capability

Experience at world class consulting firms, fortune 100 Red Teams, or within specialized government offensive units