Red Team Operator Colombia

Role Summary
The Red Team Operator plans and executes authorized adversary simulations to test how well the organization can prevent, detect, investigate, and respond to real-world cyberattacks. This is a mid-career offensive security role (roughly 3–5 years of experience) suited for someone who has run red team operations, penetration tests, or adversary emulation engagements and is comfortable owning both the attack execution and the infrastructure behind it.The operator acts as a simulated adversary, probing endpoint, identity, network, cloud, and application defense, while also building and maintaining the evasive infrastructure (C2, redirectors, phishing systems) that supports each engagement. The role increasingly incorporates AI-enabled offensive security workflows, using and building pipelines that accelerate recon, tooling, attack-path analysis, and reporting.
Responsibilities
Execute authorized red team operations emulating real adversary TTPs (MITRE ATT&CK) across the full attack chain: recon, initial access, privilege escalation, lateral movement, persistence, C2, defense evasion.Deploy and maintain red team infrastructure (C2, redirectors, domains/DNS/TLS, VPNs/proxies, cloud resources) with attention to OPSEC and secure teardown.Develop and adapt payloads, implants, and tooling to bypass EDR/AV/network/email/identity controls.Build and use AI-enabled offensive security pipelines; assess AI apps/agents for exploitable weaknesses.Analyze telemetry to determine detection gaps; partner with threat hunting, detection engineering, and IR teams (purple teaming).Document findings and report to technical and leadership audiences; mentor junior operators.
Qualifications3–5 years in red teaming, pentesting, or adversary emulation; CS/cybersecurity degree or equivalent experience.Strong knowledge of Windows, Linux, Active Directory, networking, and authentication systems.Cloud (AWS/Azure/GCP) and identity/SSO/MFA experience preferred.Hands-on C2 framework and infrastructure-as-code experience.Scripting/programming in Python, PowerShell, Bash, Go, C#, C/C++, or JavaScript.EDR/SIEM experience and telemetry analysis.AI-assisted security workflow familiarity a plus.Certifications valued (OSCP, CRTO, OSEP, OSWE, GPEN, etc.) but are substitutable with equivalent hands-on experience