Red Team / Offensive Security Analyst

Job Description

Job Description

Job Title: Red Team / Offensive Security Analyst
Location: Hybrid – New York, NY
Tax Term (W2, C2C): Open
Duration: Long-Term

Description:

We are seeking a skilled Red Team / Offensive Security Analyst to simulate real-world cyberattacks against systems, networks, and applications to identify and assess security vulnerabilities before they can be exploited by malicious actors. The ideal candidate will have hands-on experience in penetration testing, vulnerability assessments, exploitation techniques, security tooling, and remediation recommendations.

Role and Responsibilities:

• Security Testing & Assessments

  • Conduct penetration testing on web applications, networks, infrastructure, Windows/Linux desktops and servers, APIs, cloud environments, and mobile applications.

  • Perform vulnerability assessments using automated tools and manual testing techniques.

  • Simulate real-world cyberattacks to evaluate security controls and system resilience.

• Exploitation & Analysis

  • Identify and safely exploit security weaknesses in systems and applications within authorized testing environments.

  • Analyze security flaws, misconfigurations, and insecure code.

  • Test authentication mechanisms, access controls, and network defenses.

  • Identify exploitable credentials, attack paths, and potential privilege escalation opportunities.

• Reporting & Documentation

  • Document findings, testing methodologies, and supporting evidence.

  • Prepare detailed technical reports and executive summaries.

  • Communicate security risks, business impact, and remediation recommendations to stakeholders.

• Remediation & Security Improvement

  • Recommend solutions to address identified vulnerabilities and security gaps.

  • Collaborate with development, infrastructure, and security teams to implement corrective measures.

  • Validate remediation efforts through retesting and follow-up assessments.

• Tooling & Automation

  • Utilize security tools such as Metasploit, Nmap, Burp Suite, Kali Linux, vulnerability scanners, and Pentera Console and Surface.

  • Develop Python and Bash scripts to automate security testing processes.

  • Design custom exploits and testing methodologies for authorized security assessments.

• Continuous Learning & Threat Research

  • Stay current with emerging cyber threats, exploitation techniques, and security vulnerabilities.

  • Research OWASP guidance, Common Vulnerabilities and Exposures (CVEs), and emerging attack vectors.

  • Continuously improve penetration testing methodologies and offensive security capabilities.

• Collaboration & Advisory

  • Collaborate with security teams, developers, IT operations, and infrastructure teams.

  • Advise development teams on secure coding practices and security best practices.

  • Support compliance initiatives, security audits, and risk assessments.

Qualifications:

Hands-on experience in penetration testing, ethical hacking, and offensive security assessments.

Strong understanding of network protocols, operating systems, application security, and common attack techniques.

Experience identifying, validating, documenting, and helping remediate security vulnerabilities.

Strong analytical, troubleshooting, documentation, and communication skills.

Ability to collaborate effectively with technical teams and business stakeholders.

Background verification must be cleared before the start date.

Required Skills:

Red Team operations and offensive security.

Penetration testing and vulnerability assessments.

Web application, network, infrastructure, API, cloud, and mobile security testing.

Windows and Linux security assessment.

Exploitation techniques, attack path analysis, and privilege escalation.

Hands-on experience with Metasploit, Nmap, Burp Suite, Kali Linux, vulnerability scanners, and Pentera.

Python and Bash scripting for security automation.

Vulnerability analysis, technical reporting, and remediation validation.

Knowledge of OWASP, CVEs, emerging threats, and security best practices.