Manager, Threat (Red Team)
About The Position
The Manager, Threat Simulation & Red Team is a hands-on individual contributor responsible for adversary simulation, breach and attack simulation (BAS), and deception technologies. The role validates the Company’s detection and response capabilities by emulating real-world adversary behavior, running continuous attack simulations, and deploying deception technologies to identify defensive gaps. It focuses on testing the SOC, detection engineering, and incident response capabilities rather than traditional penetration testing or application security. Reporting to the Senior Manager, Cyber Threat, the role designs and executes threat simulation exercises mapped to real adversary tradecraft, operates BAS platforms, deploys and manages honeypots and honeytokens, and delivers evidence-based assessments of defensive gaps. It partners with Cybersecurity Operations, Detection Engineering, and Threat Intelligence to turn findings into measurable improvements in threat detection and response. The role is located in Atlanta, Georgia, and requires up to 10% travel, primarily domestic, with occasional travel for conferences, training, and vendor engagements. There are no direct reports.
Requirements
- At least 5 years of progressive cybersecurity experience, with significant focus on adversary simulation, red teaming, purple teaming, or detection validation.
- Hands-on experience with breach and attack simulation platforms such as Mandiant Security Validation, AttackIQ, SafeBreach, or similar tools.
- Strong working knowledge of adversary tradecraft and the MITRE ATT&CK framework, including the ability to design realistic simulations based on current threat intelligence.
- Experience with deception technologies, including honeypots, honeytokens, and decoy infrastructure design and deployment.
- Demonstrated ability to conduct purple team exercises and collaborate with SOC and detection engineering teams to improve detection coverage.
- Proficiency with common offensive security tools and techniques used in adversary simulation, such as Cobalt Strike, Metasploit, and custom C2 frameworks.
- Strong understanding of SIEM, EDR, network monitoring, and detection engineering concepts sufficient to evaluate detection gaps and recommend improvements.
- Excellent written and verbal communication skills, including the ability to produce clear, evidence-based reports for technical and executive audiences.
- Scripting and automation skills in Python, PowerShell, or equivalent for developing custom simulation tools and automating testing workflows.
- Bachelor's degree in Cybersecurity, Computer Science, Engineering, Information Systems, or a related technical field.
- Must be currently authorized to work in the United States on a full-time basis and must not require company sponsorship to continue working legally in the United States.
Nice To Haves
- Relevant certifications such as OSCP, GPEN, GCIH, GXPN, CRTO, or CRTL are preferred.
- A master's degree or relevant professional certification such as OSCP, GPEN, GCIH, or equivalent is highly desirable.
Responsibilities
- Design and execute adversary simulation exercises to test detection, alerting, and response capabilities against realistic attack scenarios.
- Develop threat simulation scenarios mapped to MITRE ATT&CK techniques and informed by current threat intelligence about relevant adversaries.
- Conduct purple team exercises with SOC and detection engineering teams to identify detection gaps and validate improvements.
- Simulate full attack chains, including initial access, lateral movement, privilege escalation, persistence, and data exfiltration.
- Operate and optimize breach and attack simulation platforms to provide continuous, automated security-control validation.
- Define and maintain a library of attack simulations aligned to the Company's threat profile and detection priorities.
- Analyze BAS results to identify detection gaps, control failures, and configuration drift, and work with detection engineering to remediate findings.
- Produce regular reporting on control effectiveness, detection coverage, and trends over time.
- Design, deploy, and manage deception technologies, including honeypots, honeytokens, and decoy assets, across the Company's environment.
- Integrate deception alerts into SOC workflows to support timely triage and investigation.
- Evolve the deception program in response to changes in the environment, adversary behavior, and detection priorities.
- Maintain a structured view of detection coverage mapped to MITRE ATT&CK, identify gaps, and prioritize improvements.
- Partner with Detection Engineering and Cybersecurity Operations to translate simulation findings into detection rules, playbooks, and response procedures.
- Track remediation of detection gaps and validate improvements through follow-up testing.
- Produce evidence-based reports on simulation results, detection coverage, and defensive-gap trends for Cyber Threat leadership and the CISO.
- Improve simulation methodologies, tools, and processes based on evolving adversary tradecraft and lessons learned.
- Stay current with developments in adversary simulation, BAS, deception technology, and detection engineering.
Benefits
- A full range of medical, financial, and/or other benefits is offered, dependent on the position.
- Annual incentive reference value of 15% of base pay, at target.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Manager
