Senior Red Team & Offensive Security Consultant

About the role

Senior hands‑on offensive security professional responsible for delivering complex, objective‑driven Red Team and Adversary Simulation engagements for local and global clients. The role combines deep technical execution with independent ownership of projects across enterprise, macOS, Windows, web, AI/LLM, cloud and hybrid environments.

Key responsibilities

• Take ownership of Red Team, adversary emulation, Purple Team and threat‑led engagements from planning through execution, reporting and client debrief.
• Emulate realistic threat actors and execute multi‑stage attack chains covering reconnaissance, initial access, persistence, privilege escalation, lateral movement, command‑and‑control, defense evasion and business‑impact objectives.
• Perform offensive assessments across macOS, Windows, endpoints, identity systems, networks, web applications, APIs, AI‑enabled applications, cloud platforms and hybrid infrastructure.
• Identify and exploit vulnerabilities in web applications and APIs, and chain them with infrastructure, endpoint, identity and cloud attack paths.
• Assess AI and LLM‑enabled applications for prompt injection, insecure tool usage, excessive permissions, data exposure and other emerging attack surfaces.
• Develop, customize and maintain offensive tooling, scripts, payloads and command‑and‑control infrastructure while applying safety and operational‑security controls.

Required profile

• 5+ years of hands‑on offensive security experience with proven ownership of complex Red Team or advanced penetration testing engagements.
• Strong expertise in macOS and Windows operating systems, endpoint security controls and persistence mechanisms.
• Deep knowledge of web and API security, including authentication, authorization, session management and exploitation techniques.
• Understanding of AI/LLM security concepts such as prompt injection, agentic AI risks and integration weaknesses.
• Solid grasp of enterprise identity, Active Directory and Microsoft Entra ID attack vectors.

Required skills

• macOS security
• Windows security
• Web application and API security
• AI/LLM security (prompt injection, tool‑calling, data exposure)
• Active Directory / Microsoft Entra ID
• Cloud and hybrid infrastructure security
• Offensive tooling, C2 frameworks, scripting and payload development
• MITRE ATT&CK knowledge and adversary TTP mapping