Offensive Security Senior Analyst

S&P Global•Englewood, NC

About The Position

The Offensive Security Senior Analyst will join S&P Global’s Offensive Security team, which conducts red and collaborative purple team operations to strengthen the organization’s ability to detect, disrupt, and withstand cyber threats. The team emphasizes inclusiveness, teamwork, knowledge sharing, continuous learning, and integrity, following the principle that “Offense sharpens defense.” The role involves simulating advanced persistent threats and real-world attack scenarios against S&P Global infrastructure and applications. The analyst will work with defensive security teams to improve detection, prevention, incident response, and cyber resilience; develop breach and attack simulations; create custom tools and methodologies; and partner with development and infrastructure teams to provide actionable remediation guidance. The position requires at least five years of relevant hands-on experience and is eligible for additional S&P Global benefits.

Requirements

Excellent communication skills, including the ability to explain technical concepts to non-technical individuals.
At least 5 years of hands-on experience in offensive security, purple teaming, or red team operations.
Proficiency with commercial and open-source red teaming frameworks and tools.
Strong knowledge of network protocols; Windows, Linux, and Mac operating systems; Entra/AD; cloud platforms such as AWS, Azure, or GCP and associated services; databases; middleware; email; and web applications.
Experience using scripting and programming languages such as Python, PowerShell, Bash, or JavaScript for automation and tool development.
Experience leveraging artificial intelligence through all phases of the attack chain.
Familiarity with Cyber Threat Intelligence and threat actors, and the ability to emulate their Tactics, Techniques and Procedures (TTPs); solid knowledge of the MITRE ATT&CK framework.
Relevant security certifications such as GIAC RTP, RTO, OSCP, GPEN, or equivalent industry-recognized credentials.
Demonstrated ability to manage responsibilities independently while contributing positively to cross-functional team objectives.

Nice To Haves

Experience with SIEM technologies, Identity & Access Management systems, and defensive security platforms such as EDR, Next-Gen Firewalls, IDS/IPS, WAF, proxies, and CDR, including associated bypass and evasion techniques.
Knowledge of DevSecOps practices and experience integrating security testing into CI/CD pipelines.

Responsibilities

Conduct red team engagements simulating advanced persistent threats and real-world attacks against S&P Global infrastructure and applications.
Execute purple team exercises with defensive security teams to improve detection and prevention capabilities, incident response procedures, and cyber resilience.
Design and conduct breach and attack simulations to identify security gaps, improve detection capabilities, and validate security controls.
Develop custom attack tools and methodologies to test security resilience and address emerging threats.
Partner with development and infrastructure teams to provide actionable remediation guidance and security recommendations.