Sr Analyst - Red Team Operator

Lowes•Charlotte, NC

About The Position

The Offensive Security Team is seeking a highly skilled Red Team Operator to plan and execute authorized, threat-informed offensive security operations across Lowe’s enterprise, cloud, identity, endpoint, and retail technology environments. The role focuses on realistic adversary emulation, initial access, command-and-control (C2) infrastructure, operational security, endpoint telemetry, evasion research, Active Directory, cloud identity, and offensive tooling. The operator will conduct authorized red team and purple team exercises, investigate attack paths, develop and assess offensive tools, and partner with defensive security teams to improve detection and response. The role also communicates findings through technical reports, executive summaries, attack narratives, detection-gap analysis, and prioritized remediation recommendations. It includes mentoring team members and contributing to repeatable methodologies, lab environments, tooling standards, and operational processes.

Requirements

Bachelor’s degree in computer science, computer information systems, engineering, business administration, cybersecurity, or a related field, or equivalent years of experience in lieu of the education requirement, if applicable.
At least 4 years of experience in information security.

Nice To Haves

7+ years of hands-on offensive security experience, including 5+ years leading or executing full-scope red team and adversary emulation operations in complex enterprise environments, from initial access through post-exploitation and objective completion.
Experience planning and executing authorized operations involving phishing, external or application exploitation, identity abuse, cloud or SaaS footholds, and third-party scenarios.
Strong command of C2 infrastructure, redirectors, engagement deconfliction, attribution control, payload safety, detection exposure, burn procedures, teardown, and rules of engagement.
Ability to develop, modify, and review offensive tooling, payloads, implants, or agents using Python, PowerShell, C/C++, C#, Go, or Rust.
Hands-on knowledge of EDR/AV behavior, endpoint telemetry, SIEM visibility, evasion research, malware analysis, or reverse engineering.
Deep understanding of Windows and Active Directory attack paths, including Kerberos, ADCS, delegation, trusts, privileged access, and lateral movement.
Understanding of cloud and SaaS attack paths involving Entra ID/Azure, Google Cloud/Workspace, OAuth, IAM, service accounts, and cloud security controls.
Experience building adversary emulation plans based on real-world threats, mapping activity to MITRE ATT&CK, and translating offensive findings into actionable detection gaps, control weaknesses, attack-path narratives, and remediation recommendations.
Familiarity with EDR, SIEM/SOAR, CSPM/CNAPP, vulnerability management, attack surface management, and identity security technologies.
Ability to operate effectively in large, complex enterprise environments and clearly communicate technical findings, business risk, and recommended actions to security teams, engineering partners, and leadership.
Experience in retail, e-commerce, supply chain, payments, or fraud environments.
Relevant offensive or cloud security certifications.

Responsibilities

Plan, scope, and execute authorized red team and adversary emulation operations across enterprise, cloud, identity, endpoint, application, and retail technology environments.
Conduct authorized initial-access scenarios, including external attack surface testing, phishing simulations, identity abuse, public-facing application exploitation, and SaaS or cloud footholds.
Design, deploy, operate, and safely decommission C2 infrastructure for approved operations.
Maintain operational security across tooling, infrastructure, logging exposure, operator behavior, payload safety, engagement deconfliction, and post-operation cleanup.
Develop, modify, test, and review offensive tooling, payloads, automation, and tradecraft in controlled, authorized environments.
Conduct endpoint telemetry and evasion research to assess how security controls detect, block, or miss adversary behavior.
Identify and validate attack paths involving Active Directory, ADCS, Kerberos, privileged access, trust relationships, Microsoft Entra ID, cloud IAM, SaaS platforms, and endpoint controls.
Partner with Detection Engineering, SOC, Threat Hunting, and Incident Response teams to improve visibility, alerting, response playbooks, and control effectiveness.
Translate red team findings into technical reports, executive summaries, attack narratives, detection gaps, and prioritized remediation recommendations.
Map adversary behaviors, findings, and emulation plans to frameworks such as MITRE ATT&CK.
Support purple team exercises that validate detection logic, response workflows, and defensive control improvements.
Stay current on adversary tradecraft, offensive security research, cloud and identity attack paths, endpoint security capabilities, and emerging defensive technologies.
Mentor offensive security team members and contribute to repeatable methodologies, lab environments, tooling standards, and operational processes.