Principal Consultant, Red Team Operator (Red Team Payload Engineering)

Location: United States; remote or hybrid arrangements may be considered depending on location and team needs.

Salary: $150,000–$200,000 USD per year.

Company

hirify.global provides cybersecurity, cyber risk, forensic, incident response, threat intelligence, and related professional services.

What you will do

• Lead the design, development, customization, and maintenance of C2 payloads, droppers, loaders, implants, and supporting tools for authorized client engagements.
• Implement detection-aware tradecraft, including process injection, sleep obfuscation, AMSI/ETW bypasses, direct syscalls, and reflective loading.
• Build and operate resilient red team infrastructure and C2 tooling such as Mythic, Cobalt Strike, Sliver, or similar frameworks.
• Develop internal tooling pipelines for automated payload generation, testing, and deployment using CI/CD and infrastructure-as-code practices.
• Support threat-informed engagement planning and hands-on offensive activity, including Active Directory exploitation, credential access, privilege escalation, and lateral movement.
• Develop purple team TTPs, validate detection logic, produce evidence-based reports, present findings to technical and senior stakeholders, mentor junior consultants, and collaborate with incident response, threat intelligence, cloud security, and detection engineering teams.

Requirements

• 5+ years of offensive cybersecurity experience, including red team, purple team, adversary emulation, or assumed-breach engagements.
• Experience developing, modifying, or extending offensive security tooling, scripts, payloads, custom loaders, implants, or droppers.
• Strong experience with Windows and Linux operating system internals.
• Hands-on experience customizing and operating Mythic, Cobalt Strike, Sliver, or similar C2 frameworks in authorized client engagements.
• Working knowledge of C, C#, Python, PowerShell, and/or JavaScript, with deep proficiency in at least one language relevant to payload or loader development.
• Experience with CI/CD, DevOps, and infrastructure automation tools such as Git, Jenkins, Terraform, Ansible, or similar.
• Practical understanding of evasion techniques, endpoint security controls, operational security, and detection-aware tradecraft.
• Strong understanding of networking and web protocols, including TCP/IP, DNS, HTTP, HTTPS, and authentication flows.
• Excellent written and verbal communication skills, ability to explain complex issues to technical and non-technical audiences, and ability to manage risk within agreed rules of engagement.

Nice to have

• CRTO, CRTL, or equivalent red team experience; malware engineering training such as Maldev Academy or SEKTOR7.
• Experience testing against modern EDR and application control solutions, including CrowdStrike, Microsoft Defender, or SentinelOne.
• Threat intelligence-driven red team experience and knowledge of AWS, Azure, or GCP.
• Experience with exploit development, reverse engineering, malware analysis, assembly-level debugging, or modern AI tooling for offensive development.
• Threat intelligence, detection engineering, incident response, research, industry presentations, offensive security tooling contributions, or leadership of small technical teams.

Culture & Benefits

• Collaborative work across hirify.global's Cyber Risk, forensic, incident response, threat intelligence, cloud security, and detection engineering teams.
• Remote or hybrid work may be available depending on location and team needs.
• Inclusive work environment and equal opportunity employment.

Hiring process

• Formal application via careers.hirify.global.com is required for consideration.