Red & Purple Team Operator

SIXGEN’s mission is to deliver agile, mission-ready cybersecurity solutions that empower government and critical infrastructure organizations to stay ahead of advanced cyber threats. We combine innovation, deep expertise, and cutting-edge capabilities to uncover vulnerabilities, protect vital systems, and ensure operational superiority in an ever-evolving digital landscape.

POSITION OVERVIEW

• Position: Senior Red & Purple Team Operator

• Experience: 7+ years

• Job Type: Full-time

• Location: Remote

• Clearance: Ability to be Cleared

WHAT YOU'LL DO

We are seeking a highly experienced and self-sufficient Senior Red & Purple Team Operator to independently plan, execute, and document advanced offensive cybersecurity assessments against enterprise systems, networks, applications, cloud environments, and security controls. This role conducts penetration testing, adversary emulation, Red Team operations, and Purple Team exercises designed to evaluate and improve the organization’s ability to prevent, detect, respond to, and recover from sophisticated cyberattacks.

The ideal candidate is an experienced offensive security professional capable of executing an engagement from initial planning through final reporting with minimal supervision. This includes establishing secure cloud-based attack infrastructure, developing attack plans and scenarios, conducting reconnaissance and exploitation, executing advanced persistent threat (APT)-style operations, collecting and preserving evidence, cleaning up operational infrastructure, and producing comprehensive technical and executive-level reports.

The ideal candidate will also be comfortable working directly with other cybersecurity teams during penetration testing and Purple Team engagements to validate detection capabilities, identify visibility gaps, and translate offensive findings into measurable improvements to enterprise defenses.

KEY RESPONSIBILITIES

Red Team Operations

• Independently plan and execute end-to-end Red Team engagements simulating sophisticated real-world adversaries and advanced persistent threats (APTs).

• Develop realistic attack scenarios based on organizational risk, threat intelligence, and adversary tactics, techniques, and procedures (TTPs).

• Conduct reconnaissance, initial access, exploitation, privilege escalation, credential access, persistence, defense evasion, lateral movement, command and control, and other authorized adversary activities.

• Evaluate the organization’s ability to prevent, detect, investigate, respond to, and recover from advanced cyberattacks.

• Identify weaknesses across people, processes, technologies, security controls, and operational procedures.

• Maintain operational security throughout Red Team engagements and ensure testing remains within established Rules of Engagement (ROE).

Purple Team Operations

• Plan and conduct collaborative Purple Team exercises with SOC, Threat Hunting, Incident Response, Detection Engineering, and other security personnel.

• Execute specific adversary TTPs to evaluate existing detection and response capabilities.

• Validate alerts, telemetry, detection logic, and investigative procedures.

• Identify visibility, telemetry, detection, and response gaps and provide actionable recommendations for improvement.

• Assist defensive teams in translating offensive techniques into new or improved detections and threat-hunting opportunities.

• Conduct iterative testing to validate that newly implemented detections and mitigations operate as intended.

• Assess organizational response capabilities and recommend targeted training or operational improvements.

Penetration Testing

• Assist in conducting comprehensive penetration testing of enterprise networks, systems, applications, cloud environments, and security infrastructure.

• Simulate realistic attack paths to determine whether identified vulnerabilities can be exploited and chained to achieve meaningful objectives.

• Perform manual testing and validation rather than relying exclusively on automated vulnerability scanning.

• Evaluate technical vulnerabilities in the context of actual exploitability and organizational impact.

• Develop clear, actionable remediation recommendations for identified vulnerabilities and attack paths.

• Utilize appropriate AI-enabled penetration testing technologies to supplement manual testing and improve assessment efficiency.

Offensive Security Infrastructure

• Independently design, deploy, configure, secure, and maintain offensive security infrastructure required to conduct authorized operations.

• Build cloud-based Red Team infrastructure in environments such as AWS.

• Configure and maintain redirectors, command-and-control infrastructure, payload delivery infrastructure, testing systems, and supporting operational services as required.

• Implement appropriate operational security controls to protect assessment infrastructure and authorized activities.

• Tear down and sanitize temporary infrastructure following completion of engagements.

• Troubleshoot attack infrastructure and tooling independently during active operations.

Adversary Emulation & Detection Validation

• Translate threat intelligence into realistic adversary emulation plans.

• Emulate known threat actors and advanced adversary behaviors using the MITRE ATT&CK framework.

• Develop custom attack scenarios based on relevant TTPs rather than relying solely on predefined penetration testing procedures.

• Evaluate security controls against realistic attack chains and determine opportunities for bypass or evasion.

• Collaborate with Threat Intelligence and Threat Hunting personnel to improve adversary-focused defensive capabilities.

Evidence Collection & Reporting

• Maintain detailed records of testing activities, timestamps, commands, screenshots, artifacts, affected systems, and supporting evidence throughout each engagement.

• Maintain appropriate evidence integrity and handling practices.

• Document attack paths and map offensive activities to relevant MITRE ATT&CK techniques.

• Independently produce comprehensive assessment reports describing:

  • Scope and methodology

  • Attack narrative and timeline

  • Tactics, techniques, and procedures used

  • Vulnerabilities and security weaknesses identified

  • Evidence supporting findings

  • Risk and potential business impact

  • Detection and response observations

  • Prioritized remediation recommendations

• Produce executive-level summaries that clearly communicate risk and assessment outcomes to non-technical leadership.

• Conduct technical and executive out-briefings following completion of engagements.

QUALIFICATIONS

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline, or equivalent professional experience.

• 7+ years of offensive cybersecurity experience involving penetration testing, Red Team operations, adversary emulation, or comparable security assessment activities.

• Demonstrated ability to independently plan and execute Red Team and penetration testing engagements from initial scoping through final reporting.

• Hands-on experience conducting advanced network, Active Directory, identity, endpoint, application, and cloud attacks.

• Strong understanding of the MITRE ATT&CK framework and adversary tactics, techniques, and procedures.

• Experience developing and operating offensive security infrastructure in AWS, Azure, or comparable cloud environments.

• Experience with command-and-control frameworks and offensive security tooling.

• Strong understanding of Windows, Linux, Active Directory, networking, authentication protocols, and enterprise security architecture.

• Experience performing manual exploitation, privilege escalation, lateral movement, credential attacks, persistence, and defense evasion.

• Demonstrated experience collecting and documenting technical evidence during offensive security engagements.

• Strong technical writing skills with demonstrated experience producing professional penetration testing or Red Team reports.

• Ability to work independently with minimal technical oversight while maintaining strict adherence to authorized scope and Rules of Engagement.

PREFERRED QUALIFICATIONS

• Offensive Security Certified Professional (OSCP)

• Offensive Security Experienced Penetration Tester (OSEP)

• Offensive Security Web Expert (OSWE)

• GIAC Penetration Tester (GPEN)

• GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)

• Certified Red Team Operator (CRTO/CRTO II) or comparable Red Team certification

• Experience conducting Red Team or adversary emulation exercises within federal government environments.

• Experience working directly with SOC, Threat Hunting, Incident Response, and Detection Engineering teams.

• Experience developing custom offensive security tooling, scripts, payloads, or automation.

• Experience with cloud-native offensive security testing across AWS and/or Azure environments.

• Experience leveraging AI-enabled tools to augment reconnaissance, penetration testing, analysis, and reporting activities.

Knowledge, Skills, and Abilities

• Advanced knowledge of offensive security, penetration testing, Red Team operations, and adversary emulation.

• Ability to operate independently across the complete lifecycle of an offensive security engagement.

• Strong understanding of attacker tradecraft, operational security, and modern adversary behaviors.

• Ability to establish and manage secure offensive infrastructure without dependency on another engineering team.

• Strong knowledge of enterprise identity environments, Active Directory, cloud platforms, network architecture, and modern security controls.

• Ability to think creatively and identify attack paths that automated security tools may not discover.

• Ability to pivot and adapt testing methodologies when encountering defensive controls or unexpected technical conditions.

• Strong evidence collection, documentation, and technical reporting capabilities.

• Ability to communicate offensive security findings to both deeply technical personnel and executive stakeholders.

• Ability to collaborate effectively with Blue Team personnel and translate offensive findings into improved detection, response, and mitigation capabilities.

• Strong professional judgment and ability to operate safely within defined authorization, scope, and Rules of Engagement.

COMPENSATION & BENEFITS

At SIXGEN, we are committed to fair and equitable compensation practices. Compensation for this role will be based on experience, qualifications, technical expertise, and overall alignment with the position.

Additionally, SIXGEN offers top-tier benefits for full-time employees, including:

• Employer-paid health insurance premiums (medical, dental, vision) for you and your family

• Employer-paid short/long term disability insurance and basic life/AD&D insurance

• 401K with a 4% employer contribution

• Professional development reimbursement options available (training, certification, education, etc.)

• Flexible and remote work policies for most positions

• Flexible PTO and holiday schedule

For more information, please reach out to our Director of Human Resources, Amy Maxwell at [email protected].

OUR COMMITMENT

SIXGEN is an Equal Opportunity Employer. We ensure that all applicants are considered for employment without regard to race, color, religion, sexual orientation, gender identity, national origin, disability, age, marital status, ancestry, projected veteran status, or any other protected group or class.

We are committed to fostering an inclusive culture that values diversity in our people, reflecting the communities we serve and our customer base. We strive to attract and retain a diverse talent pool and create an environment where everyone is empowered to be their authentic selves at work.