Principal Offensive Security Operator

Principal Offensive Security Operator

(Remote)

CCL Global are currently working with a leading public sector organisation who are seeking an experienced Principal Offensive Security Operator for a 12-month contract opportunity. The successful applicant will join the organisation’s offensive security function, conducting realistic and controlled cyber-attack simulations to identify vulnerabilities, test security defences and assess the organisation’s ability to withstand sophisticated threats.

Location: UK Remote, with occasional travel to London approximately once every couple of months depending on business requirements.

Type of Contract: 12-month contract

Day Rate: Inside IR35 (umbrella)

Key duties will include:

• Planning and executing complex Red Team and adversary simulation operations.
• Conducting realistic cyber-attack simulations against enterprise technology environments.
• Identifying and exploiting vulnerabilities across infrastructure, web applications and cloud platforms.
• Performing post-exploitation, persistence and lateral movement to assess attack paths towards high-value targets.
• Working across technologies including Active Directory, Microsoft Entra, M365, Azure, AWS, Kubernetes and CI/CD environments .
• Developing and deploying tools, attack infrastructure and Command & Control (C2) frameworks to support offensive security operations.
• Using threat intelligence to plan realistic attack scenarios based on relevant threat actors and techniques.
• Applying evasion techniques to assess whether security controls and monitoring capabilities can detect sophisticated attacks.
• Producing clear, risk-focused reports and presenting technical findings to senior stakeholders.
• Developing tools and methodologies to improve and automate offensive security capabilities.
• Mentoring junior Red Team members and supporting wider cybersecurity knowledge sharing.

Requirements:

• Proven experience in Red Teaming, Offensive Security or Adversary Simulation .
• Strong hands-on experience conducting complex, multi-stage offensive security operations.
• Experience with Active Directory, Microsoft Entra, M365, Azure and/or AWS .
• Strong understanding of post-exploitation, persistence and lateral movement.
• Experience with C2 frameworks and offensive security tooling .
• Experience conducting infrastructure and web application exploitation.
• Knowledge of modern cloud and enterprise environments, including Kubernetes and CI/CD.
• Strong threat intelligence and adversary simulation experience.
• Ability to communicate complex vulnerabilities and business risks clearly to senior stakeholders.
• Experience participating in GCASE, GBEST, CBEST or TIBER engagements would be highly beneficial.
• Active SC clearance is mandatory.
• Red Team certifications such as CCSAS or CRTL would be beneficial.