Adversary Emulation Senior Director

Job Description As an Adversary Emulation Senior Director, you help lead members of the offensive security team to enhance the firm's cybersecurity or resiliency posture by using industry-standard assessment methodologies and techniques to proactively identify risks and vulnerabilities in people, processes, and technology. Design and deploy risk‑driven tests and simulations and inform analysis to clearly outline root‑causes. In this role, evaluate preventative controls, incident response processes, and detection capabilities, and advise cross‑functional teams on security strategy and risk management. Responsibilities Manage and coordinate the Adversary Emulation Security Team: Manage members of the Offensive Security Team, third‑party engagements, and coordination between teams to conduct various team activities, including penetration testing, red team operations, purple team exercises, and vulnerability assessments. Conduct penetration testing: Coordinate testing, and conduct comprehensive penetration tests on various systems, applications, networks, and physical security controls to identify vulnerabilities and security gaps. Red team operations: Engage in simulated adversarial attacks to evaluate the effectiveness of existing security measures, response strategies, and incident handling processes. Purple team exercises: Conduct purple team exercises to perform adversary emulation against security controls and work with teams and/or measure responses directly to determine security control effectiveness and where enhancements may need to be applied. Vulnerability assessment: Analyze and assess vulnerabilities discovered during tests, including but not limited to network infrastructure, web applications, databases, and end‑user devices. Report findings: Manage communicate findings, including detailed reports of vulnerabilities, risk assessments, and recommended remediation strategies to both technical and non‑technical stakeholders. Collaboration: Work closely with the IT and security teams to understand current security architecture and assist in developing strategies to mitigate identified risks. Compliance: Ensure that penetration testing activities adhere to relevant compliance standards and regulations, including those specific to the casino industry such as PCI‑DSS and other gaming regulations. Continuous improvement: Stay current with the latest security trends, techniques, and vulnerabilities, and apply this knowledge to continuously improve the security posture of the casino. Training and awareness: Provide guidance and training to internal teams on best practices for security and how to address identified vulnerabilities. Qualifications 10+ years of experience in cybersecurity or resiliency with focuses on securing multiple proficiencies including application security, cloud security, data exfiltration, emerging technology, hardware, mainframe security, network security, physical security and other security controls. 5+ years of experience in offensive security testing, including performing targeted, covert security tests with vulnerability identification, exploitation, and post‑exploitation activities. 3+ years of leading a highly motivated offensive security testing team. Strong understanding of networking fundamentals (all OSI layers, protocols); Windows, Linux, Unix, Mac operating systems as well as software vulnerability and exploitation techniques; commercial or open‑source offensive security tools for reconnaissance, scanning, exploitation and post‑exploitation (e.g., Cobalt Strike, Metasploit, Nmap, Nessus, Burp Suite). Familiarity with system administration skills such as configuration, maintenance, and interpretation of log output from networking devices, operating systems, and infrastructure services, as well as with cloud architecture, operations, and security vulnerabilities. Experience in multiple businesses or verticals, with organizational and cultural understanding of call centers, payments processes, and client service/sales organizations. Expertise in collaborating with high‑performing teams and individuals throughout the firm to accomplish common goals. Knowledge of US financial services sector cybersecurity or resiliency organization practices, operations risk management processes, principles, regulations, threats, risks, and incident response methodologies. Ability to identify systemic security or resiliency issues as they relate to threats, vulnerabilities, or risks, with a focus on recommendations for enhancements or remediation, and proficiency in multiple security assessment methodologies (e.g., OWASP Top Ten, NIST Cybersecurity Framework), offensive testing tools, or resiliency testing equivalents. #J-18808-Ljbffr Caesars Entertainment