Senior Cybersecurity Red Team Engineer

We have an urgent requirement for Senior Cybersecurity Red Team Engineer for our client based in, Muscat, Oman

Conduct penetration testing and red team exercises to simulate real-world cyberattacks, identify vulnerabilities across applications, networks, systems, and infrastructure, and evaluate the effectiveness of security controls.--Must

Perform vulnerability assessments, risk analysis, and security testing, providing detailed reports and actionable recommendations to strengthen cybersecurity posture and ensure compliance with industry standards.--Must

Utilize tools such as Burp Suite, Metasploit, Nessus, Nmap, Wireshark, and Kali Linux, along with scripting languages (Python, Bash, PowerShell) to automate testing, exploit development, and attack simulations.--Must

Collaborate with security teams to remediate vulnerabilities, conduct phishing and social engineering assessments, support incident response activities, and drive continuous improvement of security processes and defenses.--Must

Purpose of the Role:

Purpose of the Job

• Assess and evaluate the organization's security posture by simulating real-world cyberattacks.


• Identify vulnerabilities in systems, networks, applications, and infrastructure to uncover weaknesses.


• Simulate adversary tactics and techniques to mimic sophisticated cyberattacks and test defenses.


• Provide actionable insights and recommendations to improve security measures and reduce risks.


• Support security hardening efforts by discovering potential gaps in security controls before malicious actors can exploit them.


• Enhance incident response capabilities through realistic attack simulations.


• Ensure compliance with industry standards and regulations by identifying potential areas of concern.


• Improve organizational defense by offering continuous feedback to strengthen security protocols and practices.

Experience/Qualifications Needed

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field (preferred).


• Proven experience in penetration testing, red teaming, or ethical hacking, typically 2-5 years.


• Hands-on experience with penetration testing tools and methodologies (e.g., Burp Suite, Metasploit, Nessus, Nmap, Wireshark, etc.).


• Deep understanding of common attack vectors, exploits, and how to simulate real-world attacks.


• Knowledge of network protocols (TCP/IP, HTTP, DNS, etc.), web application security, and system vulnerabilities.


• Experience in scripting or programming languages (e.g., Python, Bash, PowerShell, or similar) for automation and exploit development.


• Familiarity with common operating systems (Linux, Windows, macOS) and their security mechanisms.


• Hands-on experience with cloud platforms (AWS, Azure, Google Cloud) and container security (Docker, Kubernetes) is a plus.


• Experience in vulnerability assessment and risk analysis tools to identify weaknesses and propose mitigation strategies.


• Knowledge of security frameworks (e.g., OWASP, NIST, MITRE ATT&CK) and industry best practices.


• Experience with social engineering techniques (phishing, pretexting) for real-world red team exercises.


• Familiarity with incident response and forensics practices in the context of simulated attacks.

Certifications:

•  


• Certified Ethical Hacker (CEH)


• Offensive Security Certified Professional (OSCP)


• Certified Red Team Professional (CRTP)


• GIAC Penetration Tester (GPEN)


• Principal Accountabilities (The outputs of the job)


• Conduct Penetration Testing on web applications, networks, systems, and infrastructure.


• Simulate Real-World Cyberattacks through red team exercises.


• Identify and Exploit Vulnerabilities in the organization’s IT systems.


• Create Detailed Reports documenting findings and remediation recommendations.


• Collaborate with Internal Security Teams to address vulnerabilities.


• Assess Risks and Prioritize Vulnerabilities based on their potential impact.


• Test the Effectiveness of Security Controls and defenses.


• Perform Post-Test Validation to ensure vulnerabilities are remediated.


• Conduct Phishing Attacks to simulate real-world social engineering attempts and assess employee awareness.


• Manage and Operate Attack Simulation Technology to execute automated or manual phishing campaigns, vulnerability assessments, and red team exercises.


• Stay Up-to-Date with the Latest Security Threats and attack techniques.


• Ensure Ethical Standards and Legal Compliance in all testing activities.


• Support Compliance Assessments and security certification efforts.


• Develop Custom Attack Scenarios and Security Testing Tools for tailored assessments.


• Provide Feedback for Continuous Improvement of security processes and defenses.

Key Competencies Required (The inputs of the job – knowledge, skills, behaviors, attitudes, etc.)Technical Skills:

• Proficient in penetration testing tools such as Burp Suite, Metasploit, Nessus, Nmap, Wireshark, and Kali Linux.


• Strong understanding of vulnerability assessment techniques for web applications, network infrastructures, and system configurations.


• In-depth knowledge of network security protocols including TCP/IP, HTTP, DNS, SMTP, FTP, etc.


• Expertise in identifying and exploiting common web application vulnerabilities like SQL injection, XSS, and CSRF.


• Proficiency with Linux, Windows, and macOS operating systems, including security hardening and exploiting misconfigurations.


• Knowledge of scripting languages (Python, Bash, PowerShell) for automation, exploit development, and attack tool creation.


• Experience with social engineering techniques, including phishing attacks and pretexting.


• Ability to exploit vulnerabilities in web applications, network devices, and cloud infrastructures.


• Proficient in using attack simulation technologies to automate and manage phishing campaigns and red team exercises.


• Familiarity with incident response processes and tools used to track and mitigate security breaches during testing