Description
We are seeking a Principal Red Team Operator to lead workstreams within our Red Team and act as a subject matter expert for the capability. This is a senior hands-on offensive security role.
The Red Team emulates real adversaries against GSK, running full-lifecycle engagements using real-world attacker tradecraft, and measures what GSK's defenders actually detect and how they respond.
Key responsibilities:
- Lead assigned workstreams from definition through delivery
- Act as subject matter expert for the capability and advise stakeholders across GSK
- Mentor colleagues and review their technical or analytical work
- Execute red team engagements across a variety of networks using real-world adversarial tactics, techniques and procedures
- Emulate real attackers to simulate security incidents, then observe and measure how GSK's monitoring and incident response perform
- Develop after-action reports stating what was achieved, what was detected, what was missed and what should change
- Build and maintain red team infrastructure, including command and control, redirectors and payload delivery, with operational security discipline
- Develop custom tooling and exploits where off-the-shelf capability is insufficient or too well signatured
- Run purple team exercises with the Cyber Defense team to convert findings into detection coverage
- Map engagement activity to MITRE ATT&CK so coverage gaps are expressed in a common language
Basic Qualifications:
- Degree in a relevant discipline, or related experience
- Demonstrated experience in offensive security and red team operations
- Working knowledge of adversary tradecraft and command and control frameworks
- Practical experience with full-lifecycle engagement delivery
- Strong practical experience in the relevant cyber security domain
- Proven experience leading workstreams and delivering high-quality outcomes
- Ability to act as a subject matter expert and advise stakeholders confidently
- Strong written and verbal communication skills
Preferred Qualifications:
- OSCP, OSEP, OSED, CRTO, GPEN or GXPN
- Exploit development capability
- Active Directory and cloud attack path expertise
- Experience with detection evasion within an authorised engagement
- Experience in a regulated industry, including OT and clinical system awareness
- Relevant certification such as OSCP, OSEP, CRTO, GPEN, GXPN
- Experience in pharmaceutical, life sciences or another highly regulated industry