Offensive Security Analyst

Vanguard•Malvern, PA

1d•Hybrid

About The Position

Vanguard is seeking an offensive security professional to perform advanced security testing and adversary simulation activities across a broad range of technologies and business functions. The role helps validate security controls against realistic attack scenarios and advance the maturity of offensive security capabilities, producing outcomes that strengthen Vanguard's security posture. The analyst leads penetration tests, adversary emulation exercises, and red team activities; assesses applications, APIs, cloud environments, identity platforms, infrastructure, and emerging technologies; and researches threat techniques and vulnerabilities. The role also develops offensive security tools and automation, analyzes and reports findings, presents recommendations to stakeholders, tracks remediation, collaborates with engineering and security teams, and supports capability development and continuous improvement. Vanguard uses a hybrid working model for the majority of its crew members, combining flexibility with in-person learning, collaboration, and connection. Vanguard is not offering visa sponsorship for this position.

Requirements

3–5+ years of offensive security, penetration testing, red teaming, or related cybersecurity experience.
Demonstrated experience conducting security assessments across web applications, infrastructure, cloud, and identity environments.
Strong understanding of attacker methodologies, attack chains, and offensive tradecraft.
Experience with offensive security tools such as Burp Suite, Cobalt Strike, Metasploit, Nmap, BloodHound, Impacket, or equivalent platforms.
Working knowledge of MITRE ATT&CK and threat-informed security testing.
Proficiency in Python, PowerShell, Bash, or similar scripting languages.
Strong written and verbal communication skills.

Nice To Haves

Experience conducting adversary emulation or red team operations within a large enterprise.
Experience assessing AWS, Azure, or hybrid cloud environments.
Experience participating in Purple Team engagements and detection validation exercises.
Knowledge of AI security, adversarial AI testing, or emerging technology risk assessments.
Offensive security certifications such as OSCP, CRTO, PNPT, OSEP, GXPN, or equivalent.

Responsibilities

Lead and execute penetration tests, adversary emulation exercises, and red team activities.
Assess web applications, APIs, cloud environments, identity platforms, infrastructure, and emerging technologies.
Simulate realistic attacker behaviors to identify vulnerabilities, control weaknesses, and attack paths.
Validate security controls through exploitation and proof-of-concept testing.
Support threat-led operations aligned to organizational risk priorities.
Develop and execute attack scenarios based on current threat intelligence and adversary tradecraft.
Use frameworks such as MITRE ATT&CK to design realistic attack simulations.
Research emerging attack techniques, vulnerabilities, and exploitation methods.
Contribute to offensive security methodologies and testing procedures.
Analyze findings and evaluate business and technical risk.
Produce technical reports and executive-ready summaries; present findings, recommendations, and remediation strategies to stakeholders.
Track remediation efforts and validate corrective actions.
Develop and maintain offensive security tooling, scripts, and testing frameworks.
Automate repetitive testing activities and reporting processes.
Contribute to the evolution of OSFT operational capabilities and infrastructure.
Support innovation initiatives that use automation and AI to improve testing effectiveness.
Partner with engineering, application security, cyber defense, fraud, and technology teams throughout engagements.
Participate in purple team activities and collaborative security validation efforts.
Support knowledge-sharing across offensive and defensive security functions.
Provide technical guidance to less experienced analysts.
Contribute to capability development initiatives across OSFT and assist with testing standards, playbooks, and best practices.
Support strategic initiatives to improve offensive security coverage, scale, and maturity.
Maintain awareness of evolving threat landscapes and industry practices.