Offensive Security Senior Analyst

S&P Global•Raleigh, NC

2d•$120,000 - $155,000

About The Position

The Offensive Security Senior Analyst joins S&P Global’s Offensive Security team, which conducts red and collaborative purple team operations under the tagline “Offense sharpens defense.” The team works to improve the organization’s ability to detect, disrupt, and withstand cyber threats, with an emphasis on teamwork, knowledge sharing, continuous learning, integrity, and building a resilient security posture. The role conducts red team engagements and breach-and-attack simulations against S&P Global infrastructure and applications, and collaborates with defensive security teams through purple team exercises. It develops custom attack tools and methodologies, validates security controls, improves detection and response capabilities, and provides actionable remediation recommendations to development and infrastructure teams.

Requirements

Excellent communication skills, including the ability to translate technical concepts for non-technical individuals.
At least 5 years of hands-on experience in offensive security, purple teaming, or red team operations.
Proficiency with commercial and open-source red teaming frameworks and tools.
Strong knowledge of network protocols; Windows, Linux, and Mac operating systems; Entra/AD; cloud platforms such as AWS, Azure, or GCP and their services; databases; middleware; email; and web applications.
Experience using scripting and programming languages such as Python, PowerShell, Bash, or JavaScript for automation and tool development.
Experience leveraging artificial intelligence through all phases of the attack chain.
Familiarity with cyber threat intelligence, threat actors, and emulating their tactics, techniques, and procedures, along with solid knowledge of the MITRE ATT&CK framework.
Relevant security certifications such as GIAC RTP, RTO, OSCP, GPEN, or equivalent industry-recognized credentials.
Demonstrated ability to manage responsibilities independently while contributing positively to cross-functional team objectives.

Nice To Haves

Experience with SIEM technologies, Identity & Access Management systems, and defensive security platforms such as EDR, Next-Gen Firewalls, IDS/IPS, WAF, proxies, and CDR, including associated bypass and evasion techniques.
Knowledge of DevSecOps practices and experience integrating security testing into CI/CD pipelines.

Responsibilities

Conduct red team engagements that simulate advanced persistent threats and real-world attacks against S&P Global infrastructure and applications.
Execute purple team exercises with defensive security teams to improve detection and prevention capabilities, incident response procedures, and cyber resilience.
Design and conduct breach and attack simulations to identify security gaps, improve detection capabilities, and validate existing security controls.
Develop custom attack tools and methodologies to test security resilience and address emerging threats.
Partner with development and infrastructure teams to provide actionable remediation guidance and security recommendations.