Principal Consultant, Red Team Operator

Kroll•United States,

14h•$150,000 - $200,000

About The Position

Kroll is seeking a Principal Consultant / L4 Red Team Payload Engineering Specialist to develop and operationalize custom command-and-control tooling, payloads, and supporting infrastructure for red team, purple team, assumed-breach, and adversary emulation engagements. The role works with operators and engagement leads to understand client environments and objectives, then builds and adapts detection-aware payloads, loaders, and infrastructure for use within agreed rules of engagement. The position also helps clients understand the business impact of offensive techniques and provides actionable recommendations to improve prevention, detection, and response. It contributes technical input to engagement planning, supports hands-on offensive activity as needed, produces evidence-based reports, and presents findings to technical teams and senior stakeholders. The consultant mentors junior colleagues and collaborates with Kroll teams including incident response, threat intelligence, cloud security, and detection engineering. Remote or hybrid arrangements may be considered depending on location and team needs. The salary range is $150,000–$200,000 USD.

Requirements

At least 5 years of experience in offensive cybersecurity, supporting or delivering red team, purple team, adversary emulation, or assumed-breach engagements.
Demonstrated experience developing, modifying, or extending offensive security tooling, scripts, or payloads, including custom loaders, implants, or droppers.
Strong experience with Windows and Linux operating system internals.
Hands-on experience customizing, modifying, and operating C2 frameworks such as Mythic, Cobalt Strike, Sliver, or similar tooling in authorized client engagements.
Working knowledge of C, C#, Python, PowerShell, and/or JavaScript, with deep proficiency in at least one language relevant to payload or loader development.
Experience with CI/CD, DevOps, and infrastructure automation tools such as Git, Jenkins, Terraform, Ansible, or similar.
Practical understanding of evasion techniques, endpoint security controls, operational security, and detection-aware tradecraft.
Strong understanding of networking and web protocols, including TCP/IP, DNS, HTTP, HTTPS, and authentication flows.
Excellent written and verbal communication skills, including the ability to explain complex technical issues to technical and non-technical audiences.
Ability to manage risk during live client engagements and operate within agreed rules of engagement.

Nice To Haves

Red Team certifications such as CRTO, CRTL, or equivalent experience.
Malware engineering training such as Maldev Academy, SEKTOR7 malware development, or similar.
Hands-on testing and evasion work against modern EDR solutions such as CrowdStrike, Microsoft Defender, SentinelOne, or similar, and application control solutions.
Experience delivering threat intelligence-driven red team engagements.
Working knowledge of cloud platforms such as AWS, Azure, or GCP.
Experience with exploit development, reverse engineering, malware analysis, or assembly-level debugging.
Experience using modern AI tooling to support offensive development or engagements.
Threat intelligence, detection engineering, or incident response experience.
Experience writing blogs, presenting at industry events, publishing research, or contributing to offensive security tooling.
Experience leading small teams or technical workstreams during complex offensive security engagements.

Responsibilities

Lead the design, development, customization, and maintenance of command-and-control payloads, droppers, loaders, and supporting tools for authorized client engagements.
Implement and package detection-aware tradecraft, including process injection variants, sleep obfuscation, AMSI/ETW bypass techniques, direct syscalls, and reflective loading.
Build, adapt, and operate red team infrastructure and C2 tooling, such as Mythic, Cobalt Strike, Sliver, or similar frameworks, with a focus on operational security and resilience.
Develop and maintain internal tooling pipelines for automated payload generation, testing, and deployment using CI/CD and infrastructure-as-code practices.
Contribute technical input to engagement planning, including threat-informed scenarios, attack objectives, operational security considerations, and success criteria.
Execute or support hands-on offensive activity as needed, including Active Directory exploitation, credential access, privilege escalation, and lateral movement.
Apply knowledge of EDR, SIEM, identity protection, conditional access, email security, and network monitoring to tooling and tradecraft.
Support purple team engagements by developing or adapting TTPs, working with client security teams, validating detection logic, and improving response capability.
Conduct research and development to improve Kroll’s red team tooling, tradecraft, methodology, and reporting.
Produce evidence-based reporting explaining attack paths, business impact, detection and response observations, and prioritized remediation actions.
Present technical findings to security teams and communicate business risk to senior stakeholders.
Mentor junior consultants, support technical delivery, and contribute to peer review and quality assurance.
Collaborate with Kroll’s wider Cyber Risk teams, including incident response, threat intelligence, cloud security, and detection engineering.