Offensive Security Senior Analyst

S&P Global•Raleigh, NC

About The Position

S&P Global’s Offensive Security team conducts red and collaborative purple team operations to strengthen the organization’s ability to detect, disrupt, and withstand cyber threats. The team values inclusiveness, teamwork, knowledge sharing, continuous learning, and integrity, operating under the tagline “Offense sharpens defense.” The role conducts realistic adversary simulations and partners with defensive, development, and infrastructure teams to improve security controls and cyber resiliency.

Requirements

Excellent communication skills, including the ability to translate technical concepts for non-technical individuals.
At least 5 years of hands-on experience in offensive security, purple teaming, or red team operations.
Proficiency with commercial and open-source red teaming frameworks and tools.
Strong knowledge of network protocols; Windows, Linux, and Mac operating systems; Entra/AD; cloud platforms such as AWS, Azure, or GCP and associated services; databases; middleware; email; and web applications.
Experience with scripting and programming languages such as Python, PowerShell, Bash, or JavaScript for automation and tool development.
Experience leveraging artificial intelligence throughout all phases of the attack chain.
Familiarity with Cyber Threat Intelligence, threat actors, emulating their tactics, techniques, and procedures (TTPs), and the MITRE ATT&CK framework.
Relevant security certifications such as GIAC RTP, RTO, OSCP, GPEN, or equivalent industry-recognized credentials.
Ability to manage responsibilities independently while contributing positively to cross-functional team objectives.

Nice To Haves

Experience with SIEM technologies, Identity & Access Management systems, and defensive security platforms such as EDR, next-generation firewalls, IDS/IPS, WAF, proxies, and CDR, including associated bypass and evasion techniques.
Knowledge of DevSecOps practices and experience integrating security testing into CI/CD pipelines.

Responsibilities

Conduct red team engagements that simulate advanced persistent threats and real-world attacks against S&P Global’s infrastructure and applications.
Execute purple team exercises with defensive security teams to improve detection and prevention capabilities, incident response procedures, and cyber resiliency.
Design and conduct breach and attack simulations to identify security gaps, improve detection capabilities, and validate security controls.
Develop custom attack tools and methodologies to test security resilience and address emerging threats.
Partner with development and infrastructure teams to provide actionable remediation guidance and security recommendations.