Offensive Security Analyst, Senior Specialist

The Vanguard Group•Dallas, TX

6d•Hybrid

About The Position

We are seeking a talented Offensive Security Analyst to join our team of ethical hackers. In this mid-level role, you will be an integral part of our red teaming and penetration testing efforts, using your technical expertise to find and exploit vulnerabilities across web applications, networks, cloud platforms, and critical systems. By thinking like an attacker, you will help us identify weaknesses before real adversaries do, and work with cross-functional partners to fix them. This is a hands-on role focused on traditional offensive security methods – you’ll use well-known and custom tools to emulate sophisticated threat actors, improve our security posture, and reduce risk.

Requirements

5+ years of hands-on penetration testing and/or red teaming experience.
Proven track record of identifying and exploiting vulnerabilities across web applications (deep knowledge of OWASP Top 10), networks, and cloud services.
Familiarity with shell scripting and programming (Python, PowerShell, Bash) for exploit development and automation.
Strong understanding of network protocols, operating systems, identity management, and security architecture.
Demonstrated ability to think like an attacker to anticipate and craft creative exploitation scenarios.
Familiarity with frameworks and methodologies like MITRE ATT&CK, PTES (Penetration Testing Execution Standard), and relevant compliance standards (NIST, ISO), ensuring tests are realistic and comprehensive.
Strong written and verbal communication skills to produce high-quality reports and articulate risk to stakeholders.
Experience collaborating with defensive teams (security operations, appsec, IT engineering) to help them understand issues and prioritize fixes.
A team-oriented approach: open to knowledge sharing, learning from others, and contributing positively to the team’s success.

Nice To Haves

Offensive security certifications such as OSCP, OSWE, OSWA, GPEN, GWAPT, or similar, demonstrating validated skills in penetration testing.
Experience performing threat modeling and incorporating attacker perspective into security design reviews.
Familiarity with cloud platforms (AWS, Azure, GCP) and their specific security considerations.
Knowledge of secure software development practices and experience working with DevSecOps or CI/CD pipeline security.
Red team operations exposure or small-scale adversary simulations (beyond standard pentesting), showing the ability to plan multi-phase attacks and operate stealthily.
Active participation in the security community (e.g., CTFs, bug bounties, open-source contributions) demonstrating passion for offensive security.

Responsibilities

Participate in full-scope red team engagements, contributing across the kill-chain (reconnaissance, exploitation, lateral movement, data exfiltration, etc.).
Occasionally lead targeted adversary simulations at moderate scope (e.g., a spear-phishing campaign or an endpoint compromise scenario, using phishing or malware implants).
Emulate real threat actor TTPs aligned with frameworks like MITRE ATT&CK to test our detection and response capabilities.
Work closely with defensive teams – such as developers, system engineers, and security operations – to ensure discovered issues are understood and remediated effectively.
Provide actionable technical guidance to fix vulnerabilities (e.g., code remediation suggestions for development teams).
Support purple team exercises by sharing attacker perspective knowledge and helping defensive teams validate alerts and improve detection rules.
Document each engagement thoroughly, producing clear and detailed penetration test reports that explain findings, their severity, and recommended mitigations.
Communicate technical details to both technical and non-technical audiences; for instance, explaining a complex exploit in layman’s terms to business stakeholders or summarizing red team outcomes in executive readouts.
Continuously research emerging vulnerabilities, new exploit techniques, and security trends in the offensive domain.
Keep offensive toolkit sharp – use and refine tools like Burp Suite, OWASP ZAP, Metasploit, Kali Linux, etc., and create custom scripts (in Python, PowerShell, Bash, etc.) to automate routine tasks or develop new exploits.
Share knowledge with peers, help mentor junior analysts, and contribute to the team’s playbooks and knowledge base.