- Leading a small team of Red Team Operators in the planning, execution, and reporting of Red Team engagements around the globe. This includes, but is not limited to:
- Performing intelligence gathering against target networks, people, processes, and technologies.
- Finding creative ways to obtain a foothold in a target network.
- Delivering malware and establishing command and control (C2).
- Moving stealthily within target networks, satisfying the campaign objectives, while staying undetected by the blue teams.
- Establishing persistence and strategically tuning long-haul beacons to maintain long-term footholds where necessary.
- Ensuring adherence to the Rules of Engagement during every step of the Red Team engagements.
- Maintaining operational oversite of all actions conducted during Red Team engagements. Ensuring that every action is planned, executed, and logged properly at all times by every operator.
- Maintaining in-depth documentation and auditing of actions taken during Red Team operations, at all times, for the purposes of deconfliction and non-repudiation.
- Identifying and acting on opportunities to train and mentor other members of the Red Team.
- Assisting in the management of the Red Team Attack Network and the implementation of new tools and techniques to improve the team’s tradecraft.
- Sharing your research within the Deloitte Global Red Team community, and with the broader security organization, by writing blogs, speaking at conferences, or publishing code.
- Developing operational processes, field manuals, and attack methodologies to continuously improve the quality of engagements and knowledge sharing amongst the team.
- Ensure deliverables meet the quality and timeliness expected of a world-class Red Team.




- Working closely with a wide variety of Deloitte’s industry leading information security teams to identify and reduce risk around the globe.

Required:

- 3+ years of Red Team experience.
- A deep understanding of threat actor tactics, techniques, and procedures (TTPs)
- Experience with, and a deep understanding of, digital forensics and incident response capabilities and procedures
- Experience with leading Red Team Operations against companies and their associated people, processes, and technologies
- The ability to create, update, and maintain documentation ranging from Red Team TTPs to governing documentation as needed
- Experience with enumerating and attacking Windows Active Directory and Azure EntraID environments
- Experience leading the designing, building, maintaining, and utilization of covert C2 infrastructure in various cloud platforms and environments. Automation experience is a plus
- Experience with contemporary malware development and obfuscation techniques
- A deep understanding of enterprise security architecture and the associated security controls
- A deep understanding of monitoring, detections, and indicators of compromise/attack, and the implications they have on covert Red Team Operations
- Hands on experience working with industry leading Red Team tools like Cobalt Strike, Nighthawk C2, Bloodhound, Evilginx2, etc..

Preferred:

- Relevant certifications such as OSCP, OSCE, OSEP, OSED, OSEE, CRTP, CRTE, etc
- Public examples of blogs, conference talks, and open-source tooling demonstrating your expertise
- Experience operating against security products such as Microsoft Defender for Endpoint/Identity and CrowdStrike Falcon
- Experience with Social Engineering (physical, phishing)
- Experience with Outflank OST
- Experience automating infrastructure deployment with Ansible and Terraform
- Experience leading red teaming efforts
- Experience with fully remote positions

📌 Senior Red Team Operator (Canada)
🏢 Deloitte
📍 Canada