Senior Adaptive Threat Simulation Red Teamer

Bank of America • Denver, CO

11d • Onsite

About The Position

At Bank of America, this experienced professional performs research, analysis, and testing of computer and network vulnerabilities through vulnerability assessments, penetration testing, red team operations, and social engineering across a wide variety of platforms and systems. The role documents test findings, including their risk and business impact, and assists Lines of Business with questions about vulnerabilities and remediation.

The successful candidate communicates effectively with technical and non-technical audiences, explaining the significance of security issues. The role works with Global Information Security, technical stakeholders, risk partners, Lines of Business, and executive leadership to identify, communicate, and remediate risk. It also requires working knowledge of AI and LLM technologies, their security risks, and emerging AI-enabled attack techniques.

The position leads AI security testing engagements and plans and executes covert, objective-based red team operations that emulate advanced threat actors while avoiding detection. The candidate evaluates AI-enabled systems from an adversarial perspective, identifies attack paths and control weaknesses, and uses offensive security tools, techniques, and programming or scripting skills. The role typically requires 7–10 years of IT experience, including 5 years focused on offensive security testing.

The role is based at one of the listed Bank of America locations in Denver, Washington, D.C., Chicago, Boston, or Jersey City. The schedule is first shift, 40 hours per week. Bank of America describes its culture as in-office, with role-specific flexibility based on responsibilities and business needs.

Requirements

• Typically 7–10 years of IT experience, with 5 years focused on offensive security testing.
• Understanding of AI/LLM security concepts and attack techniques, including prompt injection, insecure tool or plugin usage, sensitive information disclosure, excessive agency, model/system manipulation, and abuse of AI-enabled applications.
• Understanding of how generative AI may be used by threat actors and red teams to augment reconnaissance, social engineering, vulnerability research, code development, and other phases of offensive operations.
• Experience and high proficiency with common red teaming and penetration testing tools, such as Metasploit, Burp Suite, and Cobalt Strike.
• Experience developing implants and techniques to evade common security controls and detection technologies.
• Solid understanding of voice and data networks, major operating systems, Active Directory, associated peripherals, and MITRE ATT&CK tactics, techniques, and procedures.
• Knowledge of tactics, techniques, and procedures associated with malicious insider activity, organized crime/fraud groups, and state- and non-state-sponsored threat actors.
• Ability to critically examine an organization and its systems from a threat actor's perspective and articulate risk clearly and precisely.
• Ability to work independently and effectively as part of a team with people from varied technical and professional backgrounds.
• Ability to code effectively in a scripting or programming language such as Python, C#, PowerShell, or C.
• Excellent communication skills and ability to explain security risks to non-technical audiences.

Nice To Haves

• Previous experience working in the financial industry.
• Experience performing security assessments of free and open-source software (FOSS), including identifying vulnerabilities and supply chain risk.
• Certifications such as OSCP, GPEN, or OSCE.

Responsibilities

• Lead AI security testing engagements, including defining scope, test approach, and safe testing guardrails for emerging AI technologies.
• Plan and execute covert, objective-based red team operations that emulate advanced threat actors while avoiding detection.
• Research, analyze, and test computer and network vulnerabilities through assessments, penetration testing, red team operations, and social engineering.
• Clearly document test findings, including risk and business impact, in reports.
• Assist Lines of Business with questions about vulnerabilities and remediation efforts.
• Evaluate AI-enabled systems from an adversarial perspective to identify attack paths, control weaknesses, and opportunities for abuse.
• Work with Global Information Security, technical stakeholders, risk partners, Lines of Business, and executive leadership to ensure risks are identified, communicated, and remediated.
• Explain the significance of vulnerabilities and security issues to non-technical audiences.

Benefits

• Access to paid time off.
• Resources and support for employees.
• Eligible to participate in the annual discretionary plan and receive an award based on individual and business performance and company success.
• Benefits eligible.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed