Cyber Red Team Lead Operator

Clark Creative Solutions•Port Hueneme, CA

3d•Onsite

About The Position

Clark Creative Solutions is seeking an experienced Cyber Red Team Lead Operator to support NAVFAC cybersecurity operations. The role conducts and leads authorized penetration testing, cyber threat emulation, vulnerability exploitation, and adversarial security assessments to identify weaknesses and strengthen the cybersecurity posture of Facility-Related Control Systems (FRCS), Industrial Control Systems (ICS), networks, applications, and supporting infrastructure. The position requires hands-on ethical hacking, penetration testing, vulnerability exploitation, attack methodology, and cyber threat emulation experience. The operator leads Red Team engagement planning, tasking, risk analysis, and quality assurance; develops offensive security tools and testing methodologies; researches emerging threats and adversarial Tactics, Techniques, and Procedures (TTPs); and works with SOC Analysts, Incident Responders, Blue Team personnel, cybersecurity analysts, and project managers. The role includes analyzing and reporting findings, recommending mitigation strategies, and validating security improvements through follow-up testing. The position is onsite in Port Hueneme, California, with travel based on mission requirements. An active Secret clearance is required, and the candidate must be eligible for and willing to undergo an upgrade to Top Secret clearance.

Requirements

At least 5 years of experience in security operations or industrial control automation/management, including demonstrated leadership in customer-facing roles.
Experience with penetration testing, ethical hacking, vulnerability exploitation, or cyber threat emulation.
Strong understanding of cyberattack classifications, attack stages, and system/application vulnerabilities.
Knowledge of DoD policies and procedures.
Knowledge of networking and protocols including TCP/IP, ICMP, HTTP/S, DNS, SSH, SMTP, and SMB.
Experience with security and infrastructure technologies such as Palo Alto, Elastic SIEM, Cribl, Splunk, VMware, and Security Center.
Proficiency with Linux and Windows operating systems.
Experience with programming or scripting languages and security-tool development.
Familiarity with the MITRE ATT&CK framework.
Strong technical writing, analytical, troubleshooting, and communication skills.
Active Secret clearance.
Must be eligible for a Top Secret clearance and willing to undergo the upgrade process.
Must be able to work onsite in Port Hueneme, California.
Must be willing to travel based on mission-support requirements.

Nice To Haves

Experience developing custom exploits or exploitation tools.
Knowledge of Operational Technology (OT) and Industrial Control Systems (ICS).
Experience with Python, Bash, or PowerShell.
Experience with BACnet, Modbus, SCADA systems, and PCAP.
Experience using threat intelligence and emerging attack vectors to support continuous security monitoring.
Relevant certifications may include Certified Ethical Hacker (CEH), OffSec Certified Professional (OSCP), GIAC Penetration Tester (GPEN), GIAC Red Team Professional (GRTP), Certified Information Systems Security Professional (CISSP), GIAC Certified Incident Handler (GCIH), GIAC Exploit Researcher and Advanced Penetration Tester (GXPN), GIAC Enterprise Vulnerability Assessor (GEVA), GIAC Information Security Fundamentals (GISF), or equivalent cybersecurity or IT certifications.

Responsibilities

Conduct internal, external, and remote penetration testing.
Perform authorized vulnerability testing and exploitation of applications, network devices, operating systems, protocols, and infrastructure.
Design and execute simulated adversarial attacks to test cybersecurity defenses.
Lead Red Team engagement planning, tasking, risk analysis, and quality assurance.
Research emerging threats, vulnerabilities, attack vectors, and adversarial Tactics, Techniques, and Procedures (TTPs).
Develop offensive security tools and penetration-testing methodologies.
Review code for security vulnerabilities and assist with malware analysis and reverse engineering.
Analyze security logs for anomalies and potential cybersecurity threats.
Collaborate with SOC Analysts, Incident Responders, Blue Team personnel, cybersecurity analysts, and project managers.
Validate security improvements through follow-up testing.
Develop vulnerability, assessment, and remediation reports for technical and nontechnical stakeholders.
Communicate findings and recommended mitigation strategies to technical teams and executive leadership.