Red Team Operator, Operational Technology (OT)

As an Operational Technology (OT) Red Team Operator, you will conduct adversary-focused offensive operations in highly sensitive Operational Technology (OT), Critical Infrastructure, and converged enterprise environments where the margin for error is zero. Modern OT environments do not exist in isolation; they are deeply interconnected with corporate networks, Active Directory, cloud systems, and specialized web/thick-client software management layers.

These engagements are designed to simulate complex, multi-stage real-world attacks spanning the entire attack surface—from enterprise network perimeters down to cyber-physical and industrial control systems.

This role requires far more than executing automated scanners—you will analyze environments holistically, discover complex attack paths across network boundaries and applications, and operate with discipline, creativity, and intent. You will emulate motivated threat actors by chaining application vulnerabilities, Active Directory misconfigurations, network trust relationships, and protocol weaknesses to achieve operational objectives while minimizing detection and ensuring process safety.

Beyond direct engagement work, you will partner closely with internal engineers and researchers to help define, build, and test adversarial evaluations that model real attacker behavior across OT, network, and application domains. You will translate engagement outcomes—such as complex kill chains, privilege escalation techniques, and custom operational tradecraft—into structured inputs that support the training and validation of AI systems intended to learn how to plan, execute, and reason about offensive operations at scale.

This role plays a direct part in shaping how cross-domain offensive expertise is captured, operationalized, and automated.

• Execute Cyber-Physical & Converged Penetration Tests: Plan and execute semi-automated and manual red team operations across sensitive OT environments (e.g., ICS, SCADA, DCS, BMS, IIoT, Embedded Systems) where testing requires human expertise and judgement to maintain safety, process integrity, and uptime.
• Exploit Multi-Domain Attack Surfaces: Identify and exploit weaknesses across converged IT, network, application, and OT layers including:
• OT services and industrial protocols (e.g., Modbus, DNP3, EtherNet/IP, Profinet).
• Active Directory attacks (Kerberoasting, pass-the-hash, BloodHound enumeration, domain trust abuse) to pivot laterally from corporate networks into OT control zones.
• OT software applications, engineering workstations, embedded web applications, and management APIs (OWASP Top 10, logic flaws, insecure authentication).
• Container technologies, virtualization, and edge computing layers supporting modern industrial architectures.