Security Engineer I

Overview

The purpose of the Cyber Security Engineer I in the Red Team is to support the planning, execution and reporting of red team engagements that simulate real-world attacks against the Group's networks, applications, cloud environments, endpoints and people. The role participates in reconnaissance, vulnerability identification, exploitation support and adversary emulation activities under the guidance of senior red team members and takes ownership of the human risk management workstream.

Requirements

• A Qualification in Computer Science, Cybersecurity, Information Technology, Information Systems or a related field - (essential).
• 1-2 years of experience in cybersecurity, with exposure to penetration testing, red teaming, vulnerability assessment or offensive security tooling - (essential).
• Knowledge of common attack techniques across networks, web applications, cloud platforms and endpoints, including exposure to social engineering tactics and the psychology of manipulation - (essential).
• Demonstrable understanding and exposure to information security standards, cybersecurity architecture, risk management practices and security models - (essential).
• A recognised industry certifications relevant to offensive security, such as CompTIA Security+, CompTIA PenTest+, or a practical junior penetration testing certification (e.g. PJPT, eJPT) - (beneficial).
• Demonstrable online portfolio evidencing hands-on practical ability, such as an active GitHub profile, CTF participation, or completed rooms and rankings on TryHackMe, HackTheBox or similar platforms - (beneficial).
• Practical exposure to offensive security tooling for web applications, network and host exploitation frameworks - (desired).
• Exposure to phishing simulation and security awareness platforms, and breach and attack simulation (BAS) - (desired).
• Understanding of the cyber kill chain and MITRE ATT&CK across both technical and human-focused techniques - (desired).
• Knowledge of automation, scripting and basic programming to support red team tooling and reporting - (desired).

Responsibilities

• Support the planning, scoping and execution of red team engagements across network, application, cloud, endpoint and physical environments.
• Conduct reconnaissance and open-source intelligence (OSINT) gathering to map an organisation's attack surface.
• Assist with the identification, validation and exploitation of vulnerabilities across networks, applications, cloud platforms and endpoints.
• Support post-exploitation activities such as privilege escalation, lateral movement and persistence testing.
• Contribute to adversary emulation exercises aligned to recognised frameworks such as MITRE ATT&CK.
• Plan, build and run phishing, vishing and other social engineering simulations.
• Assist with the measurement, tracking and reporting of human cyber risk indicators.
• Support the development and delivery of security awareness content and culture-building initiatives.
• Document findings from red team and social engineering exercises.
• Collaborate with blue team and security operations stakeholders on purple-team style exercises.
• Support the development and maintenance of red team playbooks, attack scenarios and rules of engagement.
• Stay abreast of emerging attack tactics, techniques and procedures.
• Maintain strict confidentiality, discretion and professionalism.

How to apply

Apply on source site