AI-Focused Red Team/Blue Team Operator

ECS Federal•Washington, DC

About The Position

Everforth ECS is seeking a Top Secret-cleared Red Team/Blue Team Operator in Washington, DC, with expertise in offensive and defensive cyber operations and knowledge of AI-enabled systems, threats, and security controls. The role supports advanced security assessments, adversary emulation, detection engineering, and threat hunting, using AI to reduce time to detection and help identify zero-day vulnerabilities. The operator will assess AI models and pipelines against the OWASP LLM Top 10 and AI-specific threat models; conduct adversarial ML and LLM red teaming; and help defend AI systems through guardrails, content filtering, evaluation harnesses, and monitoring. The role also uses AI for offensive and defensive security operations, including agent-driven reconnaissance, code analysis, alert triage, automated enrichment, and LLM-assisted hunting. Additional work includes building agentic workflows for triage, detection tuning, and report generation, and securely using AI coding assistants while reviewing AI-generated code.

Requirements

Active Top Secret clearance; SCI eligibility preferred.
Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field, or equivalent practical experience.
At least 5 years of cybersecurity experience, with meaningful hands-on experience in both red team and blue team operations.
Demonstrated experience in offensive security testing, adversary emulation, or penetration testing.
Experience in defensive operations, vulnerability analysis, and threat hunting.
Experience with prompt engineering for AI-driven security tools and familiarity with defensive mitigations for prompt injection and jailbreaking.
Experience with Windows, Linux, Active Directory, cloud environments, and enterprise networks.
Experience with security tooling such as vulnerability assessment tools and attack simulation frameworks.
Working knowledge of MITRE ATT&CK, intrusion kill chain concepts, and adversary behaviors.
Experience leveraging AI-enabled tools, assessing or securing AI/ML systems, large language model integrations, or AI-enabled applications.
Experience performing vulnerability assessments using one or more of NESSUS, Nmap, Tenable, Kali, Burp, Metasploit, or Core Impact.
Strong understanding of security principles related to identity, access management, segmentation, logging, incident response, and secure architecture.
Ability to communicate highly technical issues clearly to technical and non-technical stakeholders.
U.S. citizenship required due to clearance requirements.

Nice To Haves

SCI eligibility.
AI security coursework, such as AI security fundamentals or LLM red teaming labs.

Responsibilities

Support advanced security assessments, adversary emulation, detection engineering, and threat hunting.
Leverage AI to reduce time to detect threats and identify zero-day vulnerabilities.
Conduct adversarial ML testing, including prompt injection, model evasion, data poisoning, and model extraction.
Red-team LLMs for jailbreaks, indirect injection, RAG poisoning, and tool-use abuse.
Assess models and pipelines against the OWASP LLM Top 10 and AI-specific threat models.
Defend AI systems using guardrails, content filtering, evaluation harnesses, and monitoring.
Use AI for offensive operations, including agent-driven reconnaissance, code analysis, payload generation, and reconnaissance at scale.
Use AI for defensive operations, including anomaly detection, alert triage, automated enrichment, and LLM-assisted hunting.
Build agentic workflows for triage, detection tuning, and report generation.
Use AI coding assistants securely and review AI-generated code.
Perform vulnerability assessments using relevant security tools and frameworks.
Communicate technical issues clearly to technical and non-technical stakeholders.