Description
The Senior Principal Red Team Operator will lead a defined area of the Red Team capability and the team or programme that delivers it. This is a senior individual contributor offensive security role carrying technical authority for red team operations.
The Red Team emulates real adversaries against GSK. Operators run full-lifecycle engagements using real-world attacker tradecraft, then measure what GSK's defenders actually detect and how they respond.
Key responsibilities:
- Lead a defined area of the capability, including its people, delivery and outcomes.
- Manage delivery against the capability roadmap and escalate blockers early.
- Develop team capability through coaching, review and structured feedback.
- Represent the area in CSO governance and cross-functional forums.
- Execute red team engagements across a variety of networks using real-world adversarial tactics, techniques and procedures, from conception through to report delivery.
- Emulate real attackers to simulate security incidents, then observe and measure how GSK's monitoring and incident response perform.
- Develop after-action reports stating what was achieved, what was detected, what was missed and what should change.
- Build and maintain red team infrastructure, including command and control, redirectors and payload delivery, with operational security discipline.
- Develop custom tooling and exploits where off-the-shelf capability is insufficient or too well signatured.
- Run purple team exercises with the Cyber Defense team to convert findings into detection coverage.
Basic Qualifications:
- Degree in a relevant discipline, or related experience.
- Demonstrated experience in offensive security and red team operations.
- Working knowledge of adversary tradecraft and command and control frameworks.
- Practical experience with full-lifecycle engagement delivery.
- Significant experience in cyber security within the relevant domain.
- Proven experience leading a team or a substantial programme of work.
- Experience managing delivery to plan, quality and timelines.
- Excellent relationship management, influencing and communication skills.
Preferred Qualifications:
- OSCP, OSEP, OSED, CRTO, GPEN or GXPN.
- Exploit development capability.
- Active Directory and cloud attack path expertise.
- Experience with detection evasion within an authorised engagement.
- Experience in a regulated industry, including OT and clinical system awareness.
- Relevant certification such as OSCP, OSEP, CRTO, GPEN, GXPN.
- Experience in pharmaceutical, life sciences or another highly regulated industry.