Consultant, Red Teaming

Ensign is hiring !

Red Team Engagements

• Plan and conduct authorised Red Team engagements, adversarial simulations, and objective-based security assessments.

• Translate relevant threats and customer risks into realistic attack scenarios.

• Perform reconnaissance, initial-access testing, social engineering, privilege escalation, lateral movement, persistence, and data-access simulations where authorised.

• Assess security controls across networks, endpoints, applications, cloud platforms, identity systems, and operational processes.

• Identify and demonstrate attack paths that could expose critical systems or business assets.

• Develop or adapt tools, scripts, payloads, and supporting infrastructure to achieve engagement objectives.

• Maintain operational security and minimise the risk of unintended disruption throughout each engagement.

Purple Team Engagements

• Collaborate with Blue Teams, Security Operations Centres, incident response teams, and other defensive stakeholders.

• Design and execute controlled attack scenarios to validate preventive, detective, and responsive security controls.

• Map simulated adversary behaviours to recognised frameworks such as MITRE ATT&CK.

• Evaluate security alerts, telemetry, logging coverage, investigation workflows, and response procedures.

• Help defensive teams develop and refine detection rules, use cases, playbooks, and response processes.

• Facilitate knowledge-sharing sessions to explain attacker techniques and strengthen defensive capabilities.

• Conduct validation and retesting to confirm that identified security gaps have been addressed.

• Document improvements and remaining areas of security exposure.

Engagement Planning and Governance

• Define engagement objectives, scope, assumptions, success criteria, and rules of engagement with relevant stakeholders.

• Ensure all activities are conducted within approved legal, ethical, safety, and customer-defined boundaries.

• Follow applicable change-control, data-handling, access-control, and escalation procedures.

• Maintain accurate records of actions, evidence, findings, and attack paths.

• Communicate critical findings, operational concerns, and potential business risks promptly.

• Coordinate with project managers, internal teams, and customer stakeholders throughout the engagement lifecycle.

Reporting and Stakeholder Communication

• Produce clear technical reports, executive summaries, attack narratives, and prioritised remediation recommendations.

• Explain technical findings in terms of their operational and business impact.

• Present engagement outcomes to technical teams, senior management, and executive stakeholders.

• Deliver engagement debriefs and remediation workshops where required.

• Support remediation planning, validation, and retesting.

Capability Development

• Contribute to the improvement of Red Team and Purple Team methodologies, tools, procedures, and knowledge bases.

• Research emerging threats, vulnerabilities, attack techniques, defensive approaches, and security technologies.

• Share technical knowledge, lessons learned, and good practices with team members.

• Support the development of reusable attack scenarios and detection-validation content.

Customer Engagement and Adaptability

• Deliver assignments of varying scope, complexity, and duration based on customer and business needs.

• Work at customer premises when required.

• Adapt to different industries, technologies, operating environments, and levels of security maturity.

• Remain flexible in supporting planned and ad-hoc project requirements.

• Communicate effectively with internal teams and customer stakeholders throughout each assignment.

• Offensive Security Certified Professional (OSCP) is required.

• Advanced or specialist certifications, such as OSEP, OSED, OSWE, CRTO, CRTE, CREST CRT/CCT, GPEN, GXPN, would be advantageous.

• Demonstrated experience in Red Teaming, Purple Teaming, adversarial simulation, penetration testing, or a related offensive security role.

• Strong knowledge of adversary tactics, techniques, and procedures, including the MITRE ATT&CK framework.

• Hands-on experience with network, Active Directory, Windows, Linux, web application, cloud, and identity-based attack techniques.

• Experience collaborating with defensive security teams to validate and improve security controls.

• Understanding of defensive technologies and processes, including SIEM, endpoint detection and response, network monitoring, security logging, threat hunting, and incident response.

• Proficiency with relevant commercial or open-source offensive security tools and frameworks.

• Ability to develop or modify tools and scripts using languages such as Python, PowerShell, Bash, C#, or another relevant programming language.

• Ability to analyse complex attack paths and translate technical findings into clear business risks and actionable recommendations.

• Strong report-writing, presentation, communication, and stakeholder-management skills.

• Sound professional judgement and a strong commitment to ethics, confidentiality, operational security, and authorised testing boundaries.

• Ability to work independently and collaboratively within multidisciplinary teams.

• Willingness and ability to undertake customer-facing assignments of varying duration, including working at customer premises when required.

• Flexibility to support ad-hoc assignments and changing project requirements.

• Eligibility to obtain any security clearance or customer-specific access approval required for assigned engagements.

• A degree or diploma in cybersecurity, computer science, information technology, or a related discipline is preferred; equivalent practical experience will also be considered.