Skip to content
sec/atlas
all careers

careers

Red Team Operator

Simulate a real adversary to find out whether the defense would notice.

A red team operator runs goal-driven, authorized simulations of realistic adversaries, testing people, process and detection as much as technology. The best red teams work toward a stronger blue team: they share techniques, measure what was detected and help close the gaps.

see this path on the journey map

A day in the job

  • Plan an exercise from threat intelligence about adversaries relevant to the organization.
  • Emulate techniques in a controlled, authorized way with safety stops and deconfliction.
  • Record each technique, its time and the telemetry it should create.
  • Run the debrief with defenders and turn the gaps into detections and fixes.
0 of 7 studiedNext topic: Authorization, scope and ethics

  1. Stage 1· Foundations

    Learn the rules, the ethics and the structure of an engagement.

    Study here

    Learn elsewhere

    • Networking and operating system fundamentals
    • Programming and scripting for tooling

    Build this

    Write rules of engagement and a deconfliction process for a fictional exercise.

  2. Stage 2· Practitioner

    Understand reconnaissance, the human surface and adversary behavior.

    Study here

    Learn elsewhere

    • MITRE ATT&CK in depth
    • Active Directory and cloud identity basics

    Build this

    Choose a public threat actor report and turn it into an ordered technique plan with expected telemetry.

  3. Stage 3· Advanced

    Run emulation exercises and improve detection together with the defenders.

    Study here

    Learn elsewhere

    • Safe adversary emulation tooling and lab infrastructure
    • Evasion concepts from the defender's perspective

    Build this

    Run a purple-team session in a lab, log which techniques were detected and write the detections for the gaps.

What to show

  • A purple-team report with the technique log, detection results and the improvements made.
  • An emulation plan for a public threat actor, with ATT&CK mappings and expected telemetry.

Certifications (examples)

  • CRTO (Zero-Point Security)
  • OSEP (OffSec)
  • GPEN (GIAC)

Examples, not endorsements or requirements. Check the issuer for current details.

Related roles