Senior Offensive Security Engineer (Red Team)

KeyBank is seeking a Senior Offensive Security Engineer to lead its Cyber Defense Red Team. The role guides adversary emulation, red team, penetration testing, exposure validation, purple team exercises, and offensive security program maturity across enterprise, cloud, and AI-enabled environments.

Responsibilities:

• Provide day-to-day technical and operational team leadership for the Red Team, reporting to the CAEM manager, including work prioritization, engagement assignments, execution oversight, issue escalation, and coordination of team deliverables
• Coach and mentor team members, facilitate knowledge sharing, identify capability gaps, and support development of technical depth and leadership readiness across the team
• Provide third-party vendor support, dependencies, and stakeholder communications to keep engagements on track and ensure risks, blockers, and decisions are elevated promptly
• Provide hands-on technical guidance during complex engagements and reinforce safe, responsible, and repeatable adversarial tradecraft
• Partner with Detection Engineering, Security Operations, Threat Intelligence, and Incident Response teams to conduct purple team exercises that validate control effectiveness, detection coverage, and response capabilities against real-world adversary behaviors
• Lead the development and execution of a maturity roadmap for adversarial simulation, red team, and penetration testing capabilities, including repeatable methodologies, standards, tooling, automation, and quality assurance practices
• Establish and maintain a risk-based testing strategy and engagement pipeline aligned with enterprise threats, critical assets, regulatory expectations, and stakeholder priorities
• Define and report program metrics that demonstrate coverage, execution quality, remediation outcomes, control validation, and progress against the offensive security maturity roadmap
• Use program metrics and engagement outcomes to identify trends, communicate risk, and prioritize improvements to testing coverage and team capabilities
• Drive continuous improvement of adversarial emulation methodologies, tooling, documentation, and operating practices
• Present offensive security program metrics, engagement outcomes, risk themes, and strategic recommendations to cybersecurity leadership, governance forums, and executive stakeholders
• Align adversarial testing activities with exposure management priorities by validating remediation efforts, identifying exploitable attack paths, and measuring reductions in organizational exposure
• Lead and execute adversary emulation engagements using intelligence-driven threat scenarios aligned with frameworks such as MITRE ATT&CK
• Design and conduct full-scope red team operations, including initial access, lateral movement, privilege escalation, and data exfiltration simulation
• Conduct physical, external/internal, wireless network, web application, and mobile application security assessments
• Lead security assessments across cloud platforms (Google Cloud, Microsoft Azure, AWS), identity infrastructure, privileged access management solutions, hybrid enterprise environments, and embedded systems
• Develop and operationalize Red Team tooling, automation, and adversary emulation capabilities that replicate real-world threat actor behaviors and enable repeatable assessment of application, cloud, infrastructure, and network security controls
• Employ these tools and techniques within the environment with minimal supervision while mentoring team members in their safe and responsible use
• Lead adversarial testing of AI-enabled applications, machine learning systems, generative AI technologies, large language models, and autonomous agents to identify exploitable weaknesses, misuse scenarios, and gaps in preventive, detective, and responsive security controls
• Review engagement plans, rules of engagement, testing evidence, findings, and reports to promote consistent quality, accuracy, safety, and actionable outcomes
• Lead cross-functional teams during project testing phases and architectural design reviews to ensure appropriate security controls are in place to mitigate threats
• Coordinate and monitor third-party penetration testing engagements, ensuring alignment with requirements, effective communication, and timely, accurate reporting
• Provide detailed post-mortem reports and executive briefings with prioritized recommendations
• Present engagement outcomes, risk themes, maturity assessments, and strategic recommendations to senior leadership, governance committees, and cybersecurity stakeholders
• Partner with the Cyber Threat Intelligence team to ensure Red Team capabilities and tactics accurately reflect the current threat landscape and that real-world tactics, techniques, and procedures (TTPs) are translated into emulation plans
• Evaluate the effectiveness of detection and response capabilities across SOC, EDR/XDR, SIEM, and other security layers
• Build collaborative relationships with blue teams to conduct purple team exercises and improve detection engineering
• Lead efforts to track remediation of findings to completion through coordination with application and technology system owners
• Validate the effectiveness of remediation actions through retesting, attack path analysis, and other exposure validation activities
• Support Continuous Threat Exposure Management (CTEM) initiatives by validating prioritized exposure reductions and measuring security improvements resulting from remediation activities
• Development of custom offensive security tools and automation capabilities to support adversary emulation and security testing
• Incorporation of artificial intelligence, automation, and emerging technologies to improve offensive security testing efficiency, scalability, and effectiveness
• Research and development of novel offensive techniques and tradecraft
• Incorporation of threat actor intelligence into emulation scenarios
• Delivery of internal presentations and knowledge-sharing sessions

Requirements:

• Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent professional experience
• 12+ years of experience in Red Team or Penetration Testing roles
• Demonstrated experience leading complex offensive security engagements and coordinating the work of technical teams
• Experience building or maturing a Red Team, adversarial simulation, or penetration testing program, including methodologies, quality standards, metrics, and multi-year capability planning
• Proficiency with Red Team tools and Command-and-Control (C2) frameworks
• Advanced networking knowledge and experience with attack simulation
• Deep understanding of the MITRE ATT&CK framework and adversary TTPs
• Deep understanding of one or more penetration testing methodologies, such as PTES, ISECOM, ISSAF, or OSSTMM
• Demonstrated knowledge of AI security risks and adversarial testing techniques, including experience evaluating generative AI applications, model and agent integrations, data exposure, prompt-based attacks, excessive agency, and other emerging AI threat scenarios
• Strong scripting and programming skills in PowerShell, Python, JavaScript, Bash, Golang, or similar languages
• Deep understanding of Windows, Linux, Kali Linux, and macOS operating systems
• Direct experience with one or more cloud platforms:
• Microsoft Azure
• AWS
• Google Cloud Platform (GCP)
• Strong research and reporting skills
• Ability to translate technical findings into actionable recommendations for technical and executive audiences
• Strong team leadership, coaching, prioritization, stakeholder management, and executive communication skills
• Experience presenting offensive security findings, program metrics, and strategic recommendations to executive leadership, governance committees, audit stakeholders, and technical teams
• Experience defining strategy, establishing standards, measuring performance, and driving continuous improvement of offensive security capabilities
• Ability and willingness to travel for on-site assessments
• Experience leading purple team engagements
• Experience validating security controls through adversarial simulation
• Experience supporting Continuous Threat Exposure Management (CTEM) or attack path analysis programs
• Experience assessing generative AI and agentic AI platforms
• Offensive Security Certified Professional (OSCP)
• Offensive Security Certified Expert (OSCE)
• Offensive Security Experienced Penetration Tester (OSEP)
• Certified Red Team Professional (CRTP)
• Certified Red Team Operator (CRTO)
• Certified Red Team Operator II (CRTO II)
• GIAC Penetration Tester (GPEN)
• GIAC Web Application Penetration Tester (GWAPT)
• GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)
• CREST Registered Penetration Tester / CBEST Qualifications
• Certified Azure Red Team Professional (CARTP)
• Certified Azure Red Team Expert (CARTE)