Cybersecurity Red Team & Security Engineering Manager

TX-HHSC-DSHS-DFPS•Austin, TX

5d•$8,488 - $14,356•Onsite

About The Position

This position is open to U.S. Citizens and permanent residents. This onsite role requires the selected candidate to work from an HHS office in Austin, Texas. The Cybersecurity Analyst IV performs advanced managerial and cybersecurity leadership work with emphasis on security engineering, adversary emulation, penetration testing, breach attack simulation, security architecture validation, cybersecurity automation, and defensive capability enhancement. The role supports agency cybersecurity objectives by leading Red Team operations and enterprise security engineering functions that strengthen the organization's ability to prevent, detect, respond to, and recover from cybersecurity threats. The Red Team & Security Engineering Manager is responsible for leading the agency's offensive security and cybersecurity engineering programs. This position provides strategic leadership and advanced technical expertise in adversary emulation, penetration testing, attack simulation, detection engineering, security automation, cloud security engineering, threat-informed defense, and security control effectiveness validation. The Manager develops and maintains programs designed to evaluate the effectiveness of security controls, identify gaps in cybersecurity defenses, and enhance operational detection and response capabilities. This position serves as a critical leader in advancing the agency's cybersecurity maturity through the development of innovative security engineering solutions, continuous security testing, and collaborative security improvement initiatives. This position performs highly advanced cybersecurity management and information security work. The Manager works under minimal supervision with extensive latitude for the use of initiative and independent judgment, reporting to the Deputy CISO. The Manager oversees security engineering and offensive security operations, establishes strategic priorities, develops program objectives, manages assigned personnel, and provides senior-level consultation regarding cybersecurity technologies, risks, and defensive capabilities. The Manager partners closely with Cybersecurity Operations, Governance Risk & Compliance, Infrastructure Services, Cloud Operations, Application Development, Enterprise Architecture, Incident Response, and executive leadership to mature the overall security posture of the organization.

Requirements

Knowledge of offensive security methodologies, penetration testing techniques, adversary emulation practices, and Red Team operations.
Knowledge of enterprise security architecture, cloud security, application security, identity security, and network security technologies.
Knowledge of security engineering principles, cybersecurity monitoring architectures, automation frameworks, and detection engineering methodologies.
Knowledge of threat intelligence, threat hunting methodologies, MITRE ATT&CK framework, and modern adversary tactics and techniques.
Knowledge of risk management concepts, security frameworks, and cybersecurity best practices.
Knowledge of personnel management principles, project management methodologies, and organizational leadership practices.
Skill in leading highly technical cybersecurity engineering and offensive security teams.
Skill in adversary emulation, penetration testing, security validation, and security assessments.
Skill in cybersecurity strategy development and program management.
Skill in analyzing complex cybersecurity risks and developing remediation strategies.
Skill in communicating technical concepts to executive leadership and non-technical stakeholders.
Skill in planning, organizing, and directing large-scale cybersecurity initiatives.
Ability to lead strategic cybersecurity programs and technical teams.
Ability to translate complex technical findings into business-focused recommendations.
Ability to establish priorities and allocate resources across multiple cybersecurity initiatives.
Ability to build effective partnerships with technical, business, and executive stakeholders.
Ability to drive continuous improvement across offensive security, security engineering, and security operations programs.
Ability to manage multiple high-priority projects, investigations, and strategic initiatives simultaneously.
Graduation from an accredited four-year college or university with major coursework in information technology security, computer information systems, computer science, management information systems, or a related field is strongly preferred. Education and experience may be substituted for one another on a year for year basis.
A minimum of 7+ years of experience in information technology, cybersecurity, information security, offensive security, security engineering, security operations, security architecture, or related disciplines.
A minimum of 5+ years of experience with enterprise security technologies including SIEM, EDR/XDR, cloud security, identity security, email security, network security, vulnerability management, and security automation platforms.

Nice To Haves

A minimum of 3+ years of experience leading cybersecurity red teams preferred.
Experience conducting or directly overseeing penetration testing, adversary emulation, breach attack simulation, threat modeling, Red Team operations, Purple Team exercises, or cybersecurity assessments is preferred.
Certified Information Systems Security Professional (CISSP)
Certified Cloud Security Professional (CCSP)
Certified Information Systems Manager (CISM)
GIAC Certified Security Operations Manager (GSOM)
GIAC Penetration Tester (GPEN)
GIAC Red Team Professional (GRTP)
GIAC Defensible Security Architecture (GDSA)
Offensive Security Certified Professional (OSCP)
Offensive Security Experienced Penetration Tester (OSEP)
Certified Ethical Hacker (CEH)
Practical Network Penetration Tester (PNPT)

Responsibilities

Directs and oversees enterprise cybersecurity engineering activities supporting agency security operations, monitoring, automation, and defensive technology platforms.
Establishes engineering strategies for improving threat detection, cloud security, endpoint protection, identity protection, security monitoring, and operational resilience.
Provides technical and strategic leadership for cybersecurity engineering initiatives, tool modernization efforts, and enterprise security architecture improvements.
Develops roadmaps and operational plans that align cybersecurity engineering efforts with agency objectives and risk management priorities.
Evaluates emerging technologies and security capabilities to improve enterprise cyber defense effectiveness.
Oversees maintenance and upgrades of the SecOps technology stack.
Leads enterprise Red Team activities, penetration testing exercises, security assessments, breach attack simulations, exfiltration testing, and adversary emulation engagements.
Directs testing activities designed to evaluate the effectiveness of administrative, technical, and operational security controls.
Oversees assessments of cloud environments, applications, network infrastructure, identity platforms, and emerging technologies.
Coordinates Purple Team activities between offensive security personnel and cybersecurity operations teams to improve detection and response capabilities.
Develops recommendations and remediation strategies based on identified vulnerabilities, control weaknesses, and security gaps.
Provides senior-level consultation regarding security architecture, cloud security, application security, infrastructure protection, and cybersecurity modernization initiatives.
Participates in enterprise design reviews, major project reviews, and strategic technology initiatives.
Advises leadership regarding security capability gaps, emerging threats, technology risk, and cybersecurity investments.
Supports development of security standards, engineering requirements, and technical security baselines.
Oversees development and improvement of detection use cases, threat analytics, monitoring strategies, and cybersecurity automation capabilities.
Ensures threat-informed defensive strategies are aligned with current adversary tactics, techniques, and procedures (TTPs).
Supports improvements to Security Operations Center visibility, telemetry coverage, and investigative capabilities.
Promotes the use of threat intelligence and MITRE ATT&CK methodologies to improve detection effectiveness and coverage.
Supervises cybersecurity engineers, Red Team personnel, and other assigned cybersecurity staff.
Establishes performance expectations, develops work assignments, and supports employee development and training initiatives.
Assists with recruiting, interviewing, onboarding, mentoring, and workforce development activities.
Promotes collaboration across cybersecurity teams and technical disciplines.
Develops operational metrics, performance measurements (KPIs), strategic initiatives, and program reporting.
Supports cybersecurity governance activities by ensuring engineering and testing programs align with agency objectives and regulatory requirements.
Assists with budgeting, procurement activities, project planning, and resource allocation.
Performs additional duties as assigned.