Senior Adaptive Threat Simulation Red Teamer

Bank of America • Jersey City, NJ

12d • $160,000 - $205,000 • Onsite

About The Position

At Bank of America, this role performs research, analysis, and testing of computer and network vulnerabilities through vulnerability assessments, penetration testing, red team operations, and social engineering across a wide range of platforms and systems. The role documents test findings, including their risks and business impacts, and assists Lines of Business with questions about vulnerabilities and remediation.

The successful candidate works with Global Information Security, technical stakeholders, risk partners, and executive leadership to identify, communicate, and remediate risk. They must be able to explain the business significance of vulnerabilities to non-technical audiences. The position also requires working knowledge of AI and large language model technologies, their security risks, and emerging AI-enabled attack techniques, including how threat actors may use AI in reconnaissance, social engineering, vulnerability research, payload development, and other offensive activities.

The role leads AI security testing engagements and plans and executes covert, objective-based red team operations that emulate advanced threat actors while avoiding detection. It evaluates AI-enabled systems from an adversarial perspective, identifies attack paths and control weaknesses, and communicates risk clearly. The posting states that the role typically requires 7–10 years of IT experience, including 5 years focused on offensive security testing. It is a first-shift role with a 40-hour work week and is based at one of the listed U.S. offices.

Requirements

• Typically 7–10 years of IT experience, with 5 years focused on offensive security testing.
• Experience leading AI security testing engagements and defining scope, test approach, and safe testing guardrails for emerging AI technologies.
• Experience planning and executing covert, objective-based red team operations that emulate advanced threat actors while avoiding detection.
• Understanding of AI/LLM security concepts and attack techniques, including prompt injection, insecure tool or plugin usage, sensitive information disclosure, excessive agency, model/system manipulation, and abuse of AI-enabled applications.
• Understanding of how generative AI may be used by threat actors and red teams to augment reconnaissance, social engineering, vulnerability research, code development, and other offensive-operation phases.
• Ability to evaluate AI-enabled systems from an adversarial perspective and identify potential attack paths, control weaknesses, and opportunities for abuse.
• Experience and high proficiency with common red teaming and penetration testing tools such as Metasploit, Burp Suite, and Cobalt Strike.
• Experience developing implants and techniques to evade common security controls and detection technologies.
• Solid understanding of voice and data networks, major operating systems, Active Directory, associated peripherals, and MITRE ATT&CK tactics, techniques, and procedures.
• Knowledge of tactics, techniques, and procedures associated with malicious insider activity, organized crime/fraud groups, and state- and non-state-sponsored threat actors.
• Ability to examine an organization and its systems from a threat actor’s perspective and articulate risk clearly and precisely.
• Ability to work independently and effectively as part of a team with people from varied technical and professional backgrounds.
• Ability to code effectively in a scripting or programming language such as Python, C#, PowerShell, or C.
• Excellent communication skills and ability to explain the business significance of vulnerabilities or security issues to non-technical audiences.

Nice To Haves

• Previous experience working in the financial industry.
• Experience performing security assessments of free and open-source software (FOSS), including identifying vulnerabilities and supply chain risk.
• Certifications such as OSCP, GPEN, or OSCE.

Responsibilities

• Research, analyze, and test computer and network vulnerabilities through assessments, penetration testing, red team operations, and social engineering.
• Document the risk and business impact of testing findings in reports.
• Assist Lines of Business with vulnerability and remediation questions.
• Work with Global Information Security, technical stakeholders, risk partners, and executive leadership to ensure risk is identified, communicated, and remediated.
• Lead AI security testing engagements, including defining scope, test approach, and safe testing guardrails.
• Plan and execute covert, objective-based red team operations that emulate advanced threat actors while avoiding detection.
• Evaluate AI-enabled systems adversarially to identify attack paths, control weaknesses, and opportunities for abuse.
• Articulate security risk clearly and precisely to technical and non-technical audiences.

Benefits

• Industry-leading benefits.
• Paid time off.
• Resources and support for employees.
• Eligible to participate in the annual discretionary incentive plan, with awards based on individual performance and behaviors, line-of-business and/or group performance, and the overall success of the Company.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed