adversary emulation engineer

cFocus Software Incorporated

<div><b>Position Title</b><br>
Threat Emulation &amp; Readiness Lead / Red Team Lead<br>
<b>Position Overview</b><br>
The Threat Emulation &amp; Readiness Lead will oversee adversary emulation, red team operations, cyber readiness exercises, and threat-informed defense initiatives supporting a federal enterprise cybersecurity program.<br>
The Lead will direct realistic adversary simulation activities aligned to nation-state tradecraft and MITRE ATT&amp;CK methodologies to assess and improve organizational detection, response, resilience, and operational readiness.<br>
<b>Key Responsibilities</b><ul><li>
Lead red team operations and adversary emulation exercises.
</li><li>Design and execute:
<ul><li>threat emulation campaigns,
</li><li>purple team exercises,
</li><li>tabletop exercises,
</li><li>crisis simulations,
</li><li>and readiness drills.
</li></ul></li><li>Emulate advanced threat actor TTPs targeting enterprise, cloud, identity, and hybrid environments.
</li><li>Develop attack chains aligned to:
<ul><li>MITRE ATT&amp;CK,
</li><li>intelligence reporting,
</li><li>and real-world threat actor behaviors.
</li></ul></li><li>Coordinate closely with SOC, CTI, Threat Hunt, and Detection Engineering teams.
</li><li>Assess detection and response effectiveness across defensive technologies and operational workflows.
</li><li>Develop after-action reports, findings, remediation recommendations, and improvement roadmaps.
</li><li>Lead operational readiness assessments and continuous improvement initiatives.
</li><li>Brief executives and operational leadership on adversary risk and organizational readiness.
</li></ul><b>Required Qualifications</b><ul><li>
10+ years of offensive security or advanced cybersecurity operations experience.
</li><li>5+ years leading red team or adversary emulation operations.
</li><li>Experience conducting operations against:
<ul><li>enterprise Active Directory environments,
</li><li>cloud infrastructure,
</li><li>hybrid identity systems,
</li><li>and modern endpoint defenses.
</li></ul></li><li>Deep understanding of:
<ul><li>adversary tradecraft,
</li><li>post-exploitation,
</li><li>detection evasion,
</li><li>persistence,
</li><li>and lateral movement techniques.
</li></ul></li><li>Experience conducting purple team engagements and readiness exercises.
</li><li>Strong executive communication and briefing capabilities.
</li></ul><b>Preferred Certifications</b><ul><li>
OSCP
</li><li>OSEP
</li><li>CRTO
</li><li>GXPN
</li><li>GPEN
</li><li>CISSP
</li><li>MITRE ATT&amp;CK certifications</li></ul><p>
</p><p>byKblLEwvK</p></div>

AOUSC - Threat Emulation & Readiness Lead / Red Team Lead

Cyber Force

<div>Cairo, Egypt Hybrid Full-time</div>
<br><div><h2 class="jobSectionHeader"><b>About Cyber Force</b></h2>
<p>
Cyber Force is a cybersecurity consultancy delivering advisory, managed services, and operations to international clients. Our senior-led teams combine governance, engineering, and 24&times;7 response to turn cyber risk into measurable resilience.</p>
<h2 class="jobSectionHeader"><b>
Role Overview</b></h2>
<p>
We are looking for a Mid-Level Penetration Tester to join our established Offensive Security &amp; Assurance practice. You will independently conduct web/API, network, mobile, and cloud penetration tests, participate in red team and adversary emulation engagements, and contribute to purple team exercises &mdash; delivering against international client engagements. You will work alongside an existing team of offensive security engineers and leverage AI-augmented tooling and LLM-based workflows.</p>
<h2 class="jobSectionHeader"><b>
Key Responsibilities</b></h2>
<ul><li>Independently plan and execute web application and API penetration tests (OWASP Top 10, ASVS)</li>
<li>Conduct network pen tests: external/internal, Active Directory and Entra ID attack-path analysis, privilege escalation, lateral movement</li>
<li>Perform mobile application security assessments (OWASP MASVS)</li>
<li>Execute cloud pen tests across AWS, Azure, and GCP</li>
<li>Participate in red team and adversary emulation engagements mapped to MITRE ATT&amp;CK</li>
<li>Contribute to purple team exercises with blue team / SOC</li>
<li>Conduct social engineering campaigns: phishing, pretexting, physical</li>
<li>Develop custom exploitation tools, scripts, and payloads</li>
<li>Produce pen test reports: executive summaries, technical findings, CVSS, remediation</li>
<li>Present findings to CISOs and technical teams</li>
<li>Leverage AI tools (Claude, ChatGPT) and agentic workflows for recon, exploit research, reporting</li>
<li>Mentor junior offensive security trainees</li>
</ul><h2 class="jobSectionHeader"><b>Requirements</b></h2>
<ul><li>Bachelor&rsquo;s in CS, Cybersecurity, IT, or related (or equivalent practical experience)</li>
<li>2&ndash;4 years of hands-on penetration testing (web, network, + mobile/cloud/AD)</li>
<li>OSCP (Offensive Security Certified Professional) &mdash; required</li>
<li>Fluent English (written and spoken)</li>
<li>Core tools: Burp Suite Pro, Nmap, Metasploit, BloodHound, Cobalt Strike or C2, Kali Linux</li>
<li>Active Directory and Entra ID attack techniques</li>
<li>Web application security: OWASP Top 10, injection classes, SSRF, deserialization</li>
<li>Cloud security testing in AWS, Azure, or GCP</li>
<li>MITRE ATT&amp;CK mapping ability</li>
<li>Custom scripting: Python, Bash, or PowerShell</li>
<li>Demonstrated experience using LLM-based tools for offensive security tasks &mdash; this is a must</li>
<li>OSEP, OSWE, CRTO, GPEN, GXPN, or CPTS &mdash; a plus</li>
<li>VICI VCOP (Viridian Certified Offensive Operations Professional) &mdash; a plus</li>
<li>Bug bounty hall-of-fame or published CVEs &mdash; a plus</li>
<li>French language &mdash; a plus</li></ul></div>
<br><div><h4 class="jobSectionHeader"><b>Role details</b></h4>
<div>Location Cairo, Egypt
</div><div>Type Full-time
</div><div>Mode Hybrid</div></div>

Mid-Level Penetration Tester

Saronic Technologies

<div><div><h2 class="jobSectionHeader"><b>Location</b></h2>
<p>Austin, TX</p>
</div><div><h2 class="jobSectionHeader"><b>Employment Type</b></h2>
<p>Full time</p>
</div><div><h2 class="jobSectionHeader"><b>Location Type</b></h2>
<p>On-site</p>
</div><div><h2 class="jobSectionHeader"><b>Department</b></h2>
<p>Software</p></div></div>
<br><div><div><p>Saronic Technologies is a leader in revolutionizing autonomy at sea, dedicated to developing state-of-the-art solutions that enhance maritime operations through autonomous and intelligent platforms.</p>
<p></p><p>Security at Saronic is a force multiplier. We're seeking a Security Engineer at the senior-level or above on our Security Operations team with strong detection engineering experience. You'll design and develop high-fidelity detection content, build and operate the data pipelines that power our security operations, develop automation playbooks that accelerate response, and work across a uniquely diverse telemetry landscape spanning cloud infrastructure, embedded vessel platforms, corporate systems, and operational technology.</p><br>
<div></div><p>This role is heavily weighted toward detection engineering. You should think in terms of adversary behavior and telemetry coverage, not just alert triage. You'll own detections end-to-end: from identifying gaps in coverage, through designing and testing detection logic, to tuning and validating in production.</p>
<p></p><h1 class="jobSectionHeader"><b>Key Responsibilities:</b></h1>
<ul><li><p>Design, build, test, and tune high-fidelity detection rules and analytic queries across endpoint, cloud, network, identity, and DLP telemetry sources</p>
</li><li><p>Develop and maintain detection content using detection-as-code practices including version-controlled logic, automated testing, and CI/CD deployment</p>
</li><li><p>Map detection coverage to MITRE ATT&amp;CK, identify gaps, and prioritize new detection development based on threat intelligence and business risk</p>
</li><li><p>Engineer correlation rules, behavioral analytics, and anomaly-based detections that minimize false positives while surfacing real adversary tradecraft</p>
</li><li><p>Own the detection lifecycle from initial development through production tuning, performance monitoring, and retirement</p>
</li><li><p>Build and operate pipelines to ingest, normalize, enrich, and manage security telemetry at scale across diverse data sources, using Terraform and infrastructure-as-code practices to deploy and maintain logging and detection infrastructure</p>
</li><li><p>Design and maintain log collection, parsing, and enrichment configurations that ensure the right telemetry is available at the right fidelity for detection and investigation</p>
</li><li><p>Evaluate and onboard new telemetry sources as Saronic's infrastructure and threat landscape evolve</p>
</li><li><p>Monitor pipeline health, data quality, and ingestion reliability to ensure detections operate on complete and accurate data</p>
</li><li><p>Develop and manage automated response playbooks in SOAR platforms to accelerate containment and reduce analyst toil</p>
</li><li><p>Build automation that enriches alerts with contextual data, reducing investigation time and improving analyst decision-making</p>
</li><li><p>Support incident response efforts and translate lessons learned into improved detections and playbooks</p>
</li><li><p>Partner with SOC analysts, Cloud Security, Product Security, and IT teams to close visibility and detection gaps across environments</p>
</li><li><p>Collaborate with threat intelligence to ensure detection engineering is informed by current adversary TTPs relevant to defense, maritime, and autonomous systems</p>
</li></ul><p></p><h1 class="jobSectionHeader"><b>Required Qualifications:</b></h1>
<ul><li><p>3+ years of hands-on experience in detection engineering, security operations, security automation, or a closely related security engineering role</p>
</li><li><p>Demonstrated experience designing, testing, and tuning detection rules and analytic queries across production security telemetry (endpoint, cloud, network, identity, or DLP)</p>
</li><li><p>Hands-on experience with SIEM platforms and proficiency with query languages such as SPL, KQL, or equivalent</p>
</li><li><p>Experience building and operating security data pipelines, including log ingestion, normalization, enrichment, and data quality management</p>
</li><li><p>Understanding of data engineering concepts including ETL pipelines, data modeling, schema design, and indexing as applied to security telemetry</p>
</li><li><p>Hands-on coding experience in Python, PowerShell, Go, or Rust for security automation, detection tooling, or pipeline development, and familiarity with Terraform for managing detection and logging infrastructure as code</p>
</li><li><p>Understanding of MITRE ATT&amp;CK framework and its application to detection coverage and gap analysis</p>
</li><li><p>Ability to obtain and maintain a security clearance</p>
</li></ul><p></p><h1 class="jobSectionHeader"><b>Preferred Qualifications:</b></h1>
<ul><li><p>Experience in defense, aerospace, robotics, autonomy, or other high-assurance environments</p>
</li><li><p>Experience with EDR platforms including custom detection rule creation and telemetry analysis</p>
</li><li><p>Experience with cloud-native detection in AWS and Microsoft 365/Azure</p>
</li><li><p>Experience using Terraform to deploy and manage security monitoring infrastructure, log pipeline components, or cloud-native security service configurations</p>
</li><li><p>Hands-on experience with incident response, threat hunting, or adversary emulation</p>
</li><li><p>Exposure to embedded Linux, operational technology, or ICS telemetry and detection</p>
</li><li><p>Familiarity with NIST SP 800-171, NIST SP 800-53, or CMMC and their logging and monitoring requirements</p>
</li><li><p>Relevant certifications such as GCIH, GCIA, GCDA, GSOM, OSDA, or OSCP</p>
</li></ul><p></p><h1 class="jobSectionHeader"><b>Benefits:</b></h1>
<ul><li><p><b>Medical Insurance: </b>Comprehensive health insurance plans covering a range of services</p>
</li><li><p>Saronic pays 100% of the premium for employees and 80% for dependents</p>
</li><li><p><b>Dental and Vision Insurance: </b>Coverage for routine dental check-ups, orthodontics, and vision care</p>
</li><li><p>Saronic pays 100% of the premium under the basic plan for employees and 80% for dependents</p>
</li><li><p><b>Time Off: </b>Generous PTO and Holidays</p>
</li><li><p><b>Parental Leave: </b>Paid maternity and paternity leave to support new parents</p>
</li><li><p><b>Competitive Salary: </b>Industry-standard salaries with opportunities for performance-based bonuses</p>
</li><li><p><b>Retirement Plan:</b> 401(k) plan</p>
</li><li><p><b>Stock Options:</b> Equity options to give employees a stake in the company&rsquo;s success</p>
</li><li><p><b>Life and Disability Insurance:</b> Basic life insurance and short- and long-term disability coverage</p>
</li><li><p><b>Pet Insurance:</b> Discounted pet insurance options including 24/7 Telehealth helpline</p>
</li><li><p><b>Additional Perks:</b> Free lunch benefit and unlimited free drinks and snacks in the office</p><br>
</li></ul><div></div><p><i>This role requires access to export-controlled information or items that require &ldquo;U.S. Person&rdquo; status. As defined by U.S. law, individuals who are any one of the following are considered to be a &ldquo;U.S. Person&rdquo;: (1) U.S. citizens, (2) legal permanent residents (a.k.a. green card holders), and (3) certain protected classes of asylees and refugees, as defined in </i><i>8 U.S.C. 1324b(a)(3)</i><i>.</i></p>
<p>Saronic does not discriminate on the basis of race, sex, color, religion, age, national origin, marital status, disability, veteran status, genetic information, sexual orientation, gender identity or any other reason prohibited by law in provision of employment opportunities and benefits.</p></div></div><p></p>

Security Engineer, Detection Engineering

MITRE

<div>Why choose between doing meaningful work and having a fulfilling life? At MITRE, you can have both. That's because MITRE people are committed to tackling our nation's toughest challenges&mdash;and we're committed to the long-term well-being of our employees. MITRE is different from most technology companies. We are a not-for-profit corporation chartered to work for the public interest, with no commercial conflicts to influence what we do. The R&amp;D centers we operate for the government create lasting impact in fields as diverse as cybersecurity, healthcare, aviation, defense, and enterprise transformation. We're making a difference every day&mdash;working for a safer, healthier, and more secure nation and world. Our workplace reflects our values. We offer competitive benefits, exceptional professional development opportunities for career growth, and a culture of innovation that embraces adaptability, collaboration, technical excellence, and people in partnership. If this sounds like the choice you want to make, then choose MITRE - and make a difference with us.<p></p><p>
The Critical Infrastructure Protection Department (L561) sits within MITRE&rsquo;s Cyber-Physical Systems Division. L561 delivers innovative solutions by bringing a multidisciplinary approach to sponsor challenges that are critical to national security and public sector missions. Our work involves researching, developing, and applying advanced technologies in protecting national critical infrastructure from non-kinetic threats and ensuring operational resiliency. Focus areas include:</p><ul><li>
Infrastructure Susceptibility Analysis</li><li>
Safety Engineering</li><li>
Critical Infrastructure (CI) Threat Detection and Analytics</li><li>
CI Adversary Emulation</li><li>
Operational Technology (OT) Device Security</li><li>
Cross-Sector Interdependency analysis</li><li>
Civilian Critical Infrastructure Sector Specific Expertise</li></ul><p></p><p><b>
Roles &amp; Responsibilities:</b></p><ul><li>
Apply cyber threat intelligence expertise to assist sponsors or private owner/operators in securing critical infrastructure and performing cyber operations.</li><li>
Guide government sponsors or private owner/operators in building and advancing their cyber threat intelligence capabilities and programs.</li><li>
Track and analyze adversary tactics, techniques, and procedures (TTPs) relevant to industrial control systems (ICS), Operational Technology (OT), and space system OT, impacting critical infrastructure and national security missions.</li><li>
Support cyber threat modeling, risk assessments, and mission impact analyses for critical infrastructure and space systems based on unclassified and classified sources.</li><li>
Fuse multiple intelligence sources to develop products and recommendations for sponsors to support mission assurance and risk-informed decision-making.</li><li>
Monitor and analyze emerging threats, vulnerabilities, and supply chain risks affecting ICS/OT and Space OT technologies.</li><li>
Serve as a subject matter expert (SME) in cyber threat intelligence with a focus on ICS/OT-relevant threats, working closely with OT engineers and domain experts.</li><li>
Brief sponsors and senior leaders on threat trends, risks, and mitigation strategies to enhance mission assurance.</li><li>
Produce and deliver artifacts and strategic briefings that synthesize classified and unclassified reporting into clear, decision-focused insights for senior leaders.</li><li>
Partner with sponsors to identify key intelligence gaps, prioritize collection, and provide feedback to collectors to improve coverage of priority threats.</li><li>
Contribute to thought leadership (e.g., white papers, best practice guides, methodologies) on threat-informed defense, cyber risk assessment, and CTI tradecraft for critical infrastructure.</li></ul><p></p><p><b>
Basic Qualifications:</b></p><ul><li>
Typically requires a minimum of 8 years of related experience with a bachelor&rsquo;s degree; or 6 years and a master&rsquo;s degree; or a PhD with 3 years&rsquo; experience; or equivalent combination of related education and work experience.</li><li>
Degree in Electrical Engineering, Mechanical Engineering, Civil Engineering, Engineering Technology, Computer Science, Cybersecurity, or related technical field; equivalent utility, military, or industrial experience may be considered.</li><li>
Operational experience with electric power utilities.</li><li>
Experience with industrial control systems (ICS), Operational Technology (OT), SCADA, or other control systems used in critical infrastructure or space missions (through professional work, lab projects, or research).</li><li>
Ability to lead discussions, collaborate across different teams and organizations, and brief technical and non-technical stakeholders.</li><li>
Minimum 50% hybrid on-site work required at MITRE or government locations.</li><li>
Must have a TS clearance to be considered.</li><li>
Per the U.S. Government&rsquo;s eligibility requirements, you must be a U.S Citizen to be considered for a security clearance.</li></ul><p></p><p><b>
Preferred Qualifications:
</b></p><ul><li>Deep subject-matter expertise in SCADA network cyber security.</li><li>
Extensive experience securing, assessing, or operating SCADA, ICS, OT, or other control systems in electric utilities or other critical infrastructure environments.</li><li>
Expert knowledge of ICS/OT architectures, industrial protocols, and embedded/control system components (e.g., PLCs, DCS, SCADA, Modbus, DNP3, OPC).</li><li>
Familiarity with cyber threat intelligence, all-source intelligence, and adversary TTPs relevant to OT/ICS/embedded systems. Experience using frameworks such as ATT&amp;CK to inform detection, defense, or risk analysis.</li><li>
Experience translating threat intelligence, vulnerability information, or adversary behavior into security controls, threat-informed defense, risk assessments, or mission assurance activities.</li><li>
Experience supporting government, utility, or other critical infrastructure cyber defense, analysis, or operational security efforts.</li><li>
Demonstrated track record leading analytic or technical efforts, communicating findings effectively to technical and non-technical stakeholders, delivering high-impact products, and building trusted relationships with demanding customers, leaders, or government sponsors.</li><li>
Excellent interpersonal skills, judgment, discretion, and tact.</li><li>
An advanced degree in Electrical Engineering, Mechanical Engineering, Civil Engineering, Engineering Technology, Computer Science, Cybersecurity, or related technical field is a plus.</li><li>
Active SCI Clearance.</li></ul><p></p><p><b>
This requisition requires the candidate to have a minimum of the following clearance(s):</b></p>
Top Secret<p></p><p><b>
This requisition requires the hired candidate to have or obtain, within one year from the date of hire, the following clearance(s):</b></p>
Top Secret/SCI<p></p><p><b>
Salary compensation range and midpoint:</b></p>
$158,800 - $198,500 - $238,200 Annual<p></p><p><b>
Work Location Type:</b></p>
Hybrid<p></p><p>
It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.<br>
<br>
<b>Commitment to Non-Discrimination</b></p><p>
All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local or international law.</p><p></p><p>
MITRE intends to maintain a website that is fully accessible to all individuals. If you are unable to search or apply for jobs and would like to request a reasonable accommodation for any part of MITRE&rsquo;s employment process, please email recruitinghelp@mitre.org for general support and collegerecruiting@mitre.org for intern positions. This service is for individuals requiring reasonable accommodation requests. Please note that vendor solicitations will not receive a reply.</p><p></p><p>
Benefits information may be found here.</p><p></p>
Copyright &copy; 1997-2026, The MITRE Corporation. All rights reserved. MITRE is a registered trademark of The MITRE Corporation. Material on this site may be copied and distributed with permission only.</div>

Operational Technology (OT) Systems Security, Lead

<div><h1 class="jobSectionHeader"><b>Digital Forensics Engineer Job Description</b></h1><b>
Position Title: </b>Digital Forensics Engineer<br>
<b>Program: </b>SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader"><b>
Position Summary</b></h2>
The Digital Forensics Engineer supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program by providing advanced digital forensics, incident response, cyber investigation, evidence preservation, malware analysis, and e-discovery support services.<br>
The Digital Forensics Engineer conducts complex forensic examinations involving workstations, servers, cloud platforms, mobile devices, email systems, network traffic, and enterprise applications in support of cybersecurity investigations, incident response activities, insider threat investigations, legal support actions, and enterprise cyber defense operations. The role supports 24x7x365 Security Operations Center (SOC) functions and coordinates closely with federal stakeholders, incident responders, threat hunters, legal teams, privacy personnel, and law enforcement partners.<h2 class="jobSectionHeader"><b>
Essential Duties and Responsibilities</b></h2><ul><li>
Perform advanced digital forensic analysis and investigations in support of SBA ECS cybersecurity operations requirements.</li><li>
Support Task Areas 3.5.3 and 3.5.3.6 by conducting forensic examinations related to cybersecurity incidents, insider threats, malware infections, unauthorized access, and data exfiltration.</li><li>
Collect, preserve, analyze, and document digital evidence in accordance with federal forensic standards and chain-of-custody procedures.</li><li>
Perform host-based, network-based, cloud-based, and mobile device forensic investigations across enterprise environments.</li><li>
Conduct forensic acquisition and analysis of Windows, Linux, macOS, cloud, virtualized, and hybrid systems.</li><li>
Analyze endpoint telemetry, security logs, network packet captures (PCAP), SIEM data, and forensic artifacts to identify indicators of compromise (IOCs) and adversary activity.</li><li>
Support incident response activities by reconstructing attack timelines, determining root cause, identifying attack vectors, and assessing operational impact.</li><li>
Perform malware analysis and reverse engineering support activities to identify malicious behaviors, persistence mechanisms, and command-and-control communications.</li><li>
Support e-discovery operations including collection, indexing, preservation, processing, and review of electronically stored information (ESI).</li><li>
Conduct forensic examinations supporting legal, Inspector General (IG), Human Resources (HR), insider threat, privacy, and law enforcement investigations.</li><li>
Utilize forensic and cyber defense tools including EnCase, FTK, Velociraptor, Wireshark, Volatility, Splunk, Microsoft Defender, Sentinel, and endpoint detection and response (EDR) platforms.</li><li>
Perform memory analysis, disk analysis, registry analysis, browser artifact analysis, and log correlation activities.</li><li>
Develop forensic reports, technical findings, evidentiary documentation, executive briefings, and remediation recommendations.</li><li>
Maintain detailed forensic documentation, evidence handling procedures, and chain-of-custody records.</li><li>
Support cybersecurity monitoring, detection, containment, eradication, and recovery activities within the SOC environment.</li><li>
Coordinate with SOC analysts, incident responders, threat hunters, engineers, and federal stakeholders during cyber investigations and breach response activities.</li><li>
Support continuous improvement of forensic methodologies, investigative procedures, and cybersecurity operational capabilities.</li><li>
Assist with the development and maintenance of digital forensic playbooks, standard operating procedures (SOPs), and incident handling guidance aligned with NIST SP 800-61 and NIST SP 800-86.</li><li>
Research emerging cyber threats, adversary tactics, techniques, and procedures (TTPs), and evolving forensic technologies.</li><li>
Support federal cybersecurity compliance requirements, reporting activities, and operational readiness initiatives.</li></ul><h2 class="jobSectionHeader"><b>
Minimum Qualifications</b></h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Digital Forensics, Information Assurance, Information Technology, or related discipline. Relevant experience may substitute for degree requirements.</li><li>
Minimum of 8 years of experience supporting digital forensics, cyber investigations, incident response, cybersecurity operations, or Security Operations Center (SOC) environments.</li><li>
Hands-on experience conducting enterprise-level forensic investigations and evidence analysis.</li><li>
Experience with forensic acquisition and analysis tools including EnCase, FTK, X-Ways, Velociraptor, Volatility, or equivalent technologies.</li><li>
Experience analyzing Windows, Linux, cloud, mobile, and network forensic artifacts.</li><li>
Knowledge of incident response methodologies, MITRE ATT&amp;CK framework, cyber kill chain concepts, and adversary TTP analysis.</li><li>
Experience supporting legal hold, e-discovery, insider threat, and regulatory investigation activities.</li><li>
Experience with SIEM, EDR, IDS/IPS, packet analysis, and security monitoring technologies.</li><li>
Strong understanding of NIST cybersecurity standards including NIST SP 800-61 and NIST SP 800-86.</li><li>
Ability to prepare technical forensic reports and present investigative findings to technical and executive stakeholders.</li><li>
Strong analytical, investigative, communication, and technical documentation skills.</li></ul><h2 class="jobSectionHeader"><b>
Preferred Certifications</b></h2><ul><li>
GIAC Certified Forensic Analyst (GCFA)</li><li>
GIAC Network Forensic Analyst (GNFA)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
EnCase Certified Examiner (EnCE)</li><li>
Certified Computer Examiner (CCE)</li><li>
Certified Ethical Hacker (CEH)</li><li>
CompTIA CySA+</li><li>
CompTIA Security+</li><li>
Certified Information Systems Security Professional (CISSP)</li></ul><p>
</p><p>6HY6JyRiD8</p></div>

SBA - Digital Forensics Engineer

INSPYR Solutions

<div>
 <br/>
 <strong>
  Title:
 </strong>
 &nbsp;Information Security - Offensive Security Analyst
 <br/>
 <strong>
  Location:
 </strong>
 Deerfield Beach, FL (Hybrid 3/2)
 <br/>
 <strong>
  Duration:
 </strong>
 Direct Hire&nbsp;
 <br/>
 <strong>
  Compensation:
 </strong>
 $100,000 - $110,000
 <br/>
 <strong>
  Work Requirements:
 </strong>
 US Citizen, GC Holders or Authorized to Work in the U.S.
 <br/>
 <br/>
 <strong>
  Information Security - Offensive Security Analyst
 </strong>
 <p>
  <strong>
   Description
  </strong>
 </p>
 <p>
  The ideal candidate is someone with a strong software development or engineering background who is intentionally transitioning into the offensive security space. This role is well-suited for an individual who enjoys building systems, tooling, and automation, and wants to apply those skills to help design, scale, and modernize offensive security capabilities.
 </p>
 <p>
  Success in this role comes from thinking like both an engineer and an attacker &amp;mdash; identifying gaps not just in controls, but in how security capabilities themselves are constructed, integrated, and scaled.
 </p>
 <p>
  This role is responsible for building and scaling offensive security capabilities&nbsp;through adversary-focused testing, attack simulation, and custom tooling and automation. The analyst will help shift the program from a primarily tool- and vendor-driven model toward a build-first approach, leveraging software engineering, automation, and AI-assisted techniques to increase coverage, depth, and repeatability of offensive security activities.
 </p>
 <p>
  <strong>
   Responsibilities include but are not limited to
  </strong>
 </p>
 <ul>
  <li>
   Conduct offensive security activities including penetration testing, attack simulations, threat-based assessments, and control validation across on-prem, cloud, identity, and SaaS environments.
  </li>
  <li>
   Execute and assist in the development of red team and purple team exercises, collaborating with detection and response teams to validate defensive coverage.
  </li>
  <li>
   Perform vulnerability and exploitation analysis, including chaining weaknesses to demonstrate real-world attack paths and business risk.
  </li>
  <li>
   Identify, validate, and responsibly disclose security weaknesses to stakeholders, providing clear remediation guidance and risk context.
  </li>
  <li>
   Design, develop, and maintain custom offensive security tooling (Python, PowerShell, Bash, or similar), including frameworks, reusable modules, and automation that scale testing beyond point-in-time assessments.
  </li>
  <li>
   Evaluate when to build versus buy offensive security capabilities, with a bias toward internal tooling where it improves flexibility, visibility, or speed of iteration.
  </li>
  <li>
   Incorporate AI-assisted techniques (e.g., automation, chaining analysis, signal prioritization) to increase testing efficiency and analyst leverage
  </li>
  <li>
   Contribute documentation such as test reports, playbooks, findings templates, and executive-level summaries.
  </li>
  <li>
   Contribute to the long-term architecture of the offensive security program, including shared libraries, testing pipelines, data models, and reporting outputs optimized for reuse and scale.
  </li>
  <li>
   Mentor junior analysts and contribute to team knowledge sharing.
  </li>
  <li>
   Partner with application and platform engineering teams not only to test systems, but to co-design secure patterns, reference implementations, and reusable testing components.
  </li>
  <li>
   Build developer-consumable assets (templates, scripts, sample exploits, safe test harnesses) that enable teams to self-validate security assumptions earlier in the SDLC.
  </li>
  <li>
   Provide developer-friendly remediation guidance, proof-of-concepts, and secure coding recommendations that are actionable and aligned to real-world development workflows.
  </li>
  <li>
   Support the integration and tuning of security testing tools within CI/CD pipelines, balancing detection depth with developer experience and signal quality.
  </li>
  <li>
   Collaborate with Security Engineering and Application teams to improve self-service security capabilities, documentation, and testing patterns that developers can reuse.
  </li>
  <li>
   Participate in post-testing debriefs with developers to educate, coach, and improve security outcomes&amp;mdash;not just report findings.
  </li>
 </ul>
 <p>
  <strong>
   Desired Skills
  </strong>
 </p>
 <ul>
  <li>
   Hands-on experience with penetration testing, red team, purple team, or adversary emulation activities.
  </li>
  <li>
   Strong understanding of Windows, Active Directory, Azure/Entra ID, networking, cloud platforms, and SaaS architectures.
  </li>
  <li>
   Experience with common offensive security tools and frameworks (e.g., C2 frameworks, vulnerability scanners, exploit frameworks).
  </li>
  <li>
   Knowledge of MITRE ATT&amp;CK, kill chains, and attacker tradecraft.
  </li>
  <li>
   Experience validating security controls such as EDR, SIEM, identity protections, email security, and cloud security controls.
  </li>
  <li>
   Strong scripting and automation skills; ability to customize or build tools to support testing objectives.
  </li>
  <li>
   Ability to translate technical findings into clear risk-based narratives for technical and non-technical audiences.
  </li>
  <li>
   Strong analytical, problem-solving, and critical-thinking skills.
  </li>
  <li>
   Ability to work independently while collaborating effectively in cross-functional teams.
  </li>
  <li>
   High attention to detail with a strong sense of ethics and responsible disclosure.
  </li>
  <li>
   Experience working directly with software engineers to remediate vulnerabilities and improve secure development practices.
  </li>
  <li>
   Understanding of modern SDLC and CI/CD pipelines, including how security testing fits into developer workflows.
  </li>
  <li>
   Familiarity with secure coding practices and common vulnerability classes in modern applications (web, APIs, cloud-native services).
  </li>
  <li>
   Ability to communicate security findings in a way that developers can quickly understand, prioritize, and fix.
  </li>
  <li>
   Mindset oriented toward enablement over enforcement, with a focus on reducing friction while improving security outcomes.
  </li>
  <li>
   Background in software engineering, platform engineering, or SRE, with a desire to specialize in security.
  </li>
  <li>
   Experience designing or maintaining production-quality code, not just scripts.
  </li>
  <li>
   Comfort working with APIs, data pipelines, CI/CD systems, and cloud-native services as part of security capability development.
  </li>
  <li>
   Curiosity and practical interest in applying AI/ML-assisted techniques to security testing, automation, and analysis.
  </li>
 </ul>
 <p>
  <strong>
   About INSPYR Solutions
   <br/>
  </strong>
  &nbsp;
  <br/>
  Technology is our focus and quality is our commitment. As a national expert in delivering flexible technology and talent solutions, we strategically align industry and technical expertise with our clients' business objectives and cultural needs. Our solutions are tailored to each client and include a wide variety of professional services, project, and talent solutions. By always striving for excellence and focusing on the human aspect of our business, we work seamlessly with our talent and clients to match the right solutions to the right opportunities. Learn more about us at inspyrsolutions.com.
  <br/>
  &nbsp;
  <br/>
  INSPYR Solutions provides Equal Employment Opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability, or genetics. In addition to federal law requirements, INSPYR Solutions complies with applicable state and local laws governing nondiscrimination in employment in every location in which the company has facilities.
  <br/>
  &nbsp;
  <br/>
  #IND-TELECOM
  <br/>
 </p>
 <p>
  Information collected and processed through your application with INSPYR Solutions (including any job applications you choose to submit) is subject to INSPYR Solutions&rsquo; Privacy Policy and INSPYR Solutions&rsquo; AI and Automated Employment Decision Tool Policy: https://www.inspyrsolutions.com/policies/. By submitting an application, you are consenting to being contacted by INSPYR Solutions through phone, email, or text.
 </p>
 <span>
 </span>
</div>


Information Security – Offensive Security Analyst

Peraton

<div><div><h5 class="jobSectionHeader"><b>ABOUT PERATON</b></h5><p>
Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world&rsquo;s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees solve the most daunting challenges that our customers face. Visit peraton.com to learn how we&rsquo;re keeping people around the world safe and secure.</p></div><div><h5 class="jobSectionHeader"><b>
ABOUT THE ROLE</b></h5><div><div>
We are seeking a highly skilled and innovative Threat Hunter to join our team in the greater DMV area, supporting the Army National Guard.</div><div></div><div><br>
Responsibilities</div><ul><li>
Lead proactive threat‑hunting operations: develop hypotheses, analytic campaigns, and hunting workflows to detect sophisticated adversary behaviors across networks, endpoints, cloud, and OT/DCI systems.</li><li>
Build behavioral detection logic, long‑term analytic patterns, and anomaly models mapped to MITRE ATT&amp;CK TTPs.</li><li>
Leverage threat intelligence, incident trends, CDAP findings, and vulnerability data to prioritize high‑risk hunt objectives and scope.</li><li>
Conduct deep forensic and telemetry analysis to uncover lateral movement, persistence mechanisms, credential misuse, and stealthy C2 activity.</li><li>
Develop hunt playbooks, repeatable methodologies, and validation procedures to elevate enterprise hunting maturity.</li><li>
Integrate hunting outputs into SOC, CIRT, RCC‑ARNG, NETCOM, and ARCYBER operations by delivering actionable detections, validated indicators, and threat behavior insights.</li><li>
Collaborate with detection engineering to convert hunt findings into high‑fidelity detections, tune SIEM/EDR rules, and expand telemetry coverage.</li><li>
Produce detailed technical reports, intelligence briefs, and executive summaries to inform remediation, detection priorities, and strategic risk decisions.</li><li>
Drive continuous improvement: identify telemetry gaps, enhance data‑enrichment pipelines, automate analytic processes, and evaluate emergent hunting tools and techniques.</li></ul><div>
#ENOCS</div></div></div><div></div><div><h5 class="jobSectionHeader"><b><br>
QUALIFICATIONS</b></h5><div><div>
Qualifications</div><ul><li>
Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD</li><li><div>
Clearance: Active TS/SCI clearance.</div></li><li><div>
Candidate must meet ONE of the following:</div><ul><li>
Master&rsquo;s degree or Ph.D. in Computer Science, Cybersecurity, Data Science, Information Systems, Information Technology, Software Engineering, or a related field; OR</li><li>
Relevant DoD/military training (examples: 4‑11‑C32‑255S (CP); 4C‑255N (CP); 4C‑255A (CP); M0923W1; A‑531‑4417; Cyber Defense Analyst (Advanced) Playlist); OR</li><li>
Relevant professional certification or equivalent experience (examples: CBROPS; CFR; CySA+; GCFA; GCIA; GICSP).</li></ul></li><li><div>
Required experience and skills:</div><ul><li>
Cyber threat analysis, hunting, or advanced detection experience with at least 3 years leading hunt operations or detection programs in enterprise or DoD contexts.</li><li>
Deep expertise in telemetry analytics, log forensics, memory/disk analysis, and threat‑hunting toolchains (SIEM, EDR, network forensics).</li><li>
Proven ability to author hunt hypotheses, design validation tests, and operationalize findings into detection engineering and incident response workflows.</li><li>
Strong familiarity with MITRE ATT&amp;CK, threat‑intelligence integration, adversary emulation, and validation methodologies.</li><li>
Excellent technical writing and briefing skills for producing reproducible hunt artifacts, IOC packages, and executive‑level intelligence products.</li></ul></li><li><div>
Desired:</div><ul><li>
Prior DoD/ARNG threat‑hunting or CDAP experience and experience coordinating with ARCYBER/NETCOM/RCC‑ARNG.</li><li>
Experience with automation of hunting workflows, advanced analytics (ML/behavioral models), and large‑scale telemetry platforms.</li></ul></li></ul><div>
#ENOCS</div></div></div><div><h5 class="jobSectionHeader"><b>
DETAILS</b></h5><div><p>
<b>Target Salary Range:</b> $104,000 - $166,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual&rsquo;s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
</p></div><div><p>
<b>Benefits Statement:</b> Peraton offers eligible employees a variety of benefits including medical, dental, vision, life, health savings account, short/long term disability, EAP, parental leave, 401(k), paid time off (PTO) for vacation, and company paid holidays. A full listing of available benefits can be viewed at https://www.careers.peraton.com/benefits.
</p></div><div><p>
<b>Application Statements:</b> The application period for the job is estimated to be 30 days from the job posting date. However, this timeline may be shortened or extended depending on business needs and the availability of qualified candidates. By applying to this job, you are expressing interest in the role and the Company. During the review of your application, you may be required to participate in an on-camera interview, as well as participate in a process to verify your identity.
</p></div><p><b>
EEO:</b> Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.</p></div></div><div></div>

THREAT HUNTER

Search 3902+ Adversary emulation engineer jobs near you this May. New roles added regularly across leading industries. Apply today.