Principal Red Team Operator

The posting, as Armadin wrote it

About Us

At Armadin, we're a group of engineers, researchers, and security researchers on a mission to redefine what proactive security can do in the AI era. Cyberattacks are becoming autonomous and relentless and we believe defending against threats before they materialize is one of the most powerful ways to protect the institutions the world depends on.

We're building autonomous proactive security from the ground up, reinforcing the tradecraft of elite security practioners into purpose-built security models and agents that discover risk and remediate it before organizations are breached.

Led by Kevin Mandia, founder of Mandiant ($5.4B exit to Google), our team brings together researchers and engineers from Google, xAI, Meta, Stanford, Georgia Tech, Waterloo, Berkeley, and MIT to reinvent security for an adversary that never sleeps.

Role Overview

Every operator knows the ending. You found the path, chained it to access the crown jewel, and wrote it up. Then the engagement closed, the environment changed the next week, and nobody walked that kill chain again until next year's test. Armadin is built to end that cycle.

We're building an agentic attacker swarm. These are specialized AI agents running custom models that discover, exploit, and chain vulnerabilities across external, internal, identity, cloud, and application attack surfaces. They run continuously, at machine speed, against live production environments. Until recently, nobody could put a nation-state-caliber adversary inside every network around the clock. That's the hyperattack, and it's what we do. In one recent engagement, the swarm generated more than 17 million offensive actions in three days and validated 38 attack paths. That's the scale your tradecraft will run at.

As a Principal Red Team Operator, your tradecraft is the training signal. You'll run hands-on operations, and then you'll encode how you think into the reasoning our agents use at scale: how you pick a foothold, abuse an application's logic, pivot through identity, separate what's actually exploitable from scanner noise, and map the blast radius once you're in. You'll pressure-test full kill chains end to end, find where the swarm is naive, and teach it to move like an expert, using AI throughout your own workflow to go faster and deeper.

The problems here are new ones

• What does a kill chain look like when it can branch a thousand ways in parallel?
• How do you prove exploitability instead of just flagging it?
• What does a continuous hyperattack find that a two-week engagement never could?

You'll work alongside operators who have spent decades on the front lines of red teaming and the AI engineers turning that experience into autonomous offense. It's a small, scrappy group with high ownership, and the work you ship reaches enterprises through industry leading partners. If you've ever finished an op thinking "imagine running this everywhere, all the time," this is where you get to do it.
[…]
ida, Ghidra, IDA Pro, etc.)

• Advanced scripting and tool development in Python, Bash, PowerShell, or compiled languages; ability to extend C2 frameworks, develop custom exploits, and create application-specific tooling
• Deep understanding of network protocols, packet-level analysis, cryptography, system architecture (Windows, Unix/Linux, cloud platforms), and application design patterns
• Proficiency in multiple operating systems and platforms (Windows, Linux, macOS), container technologies, and cloud environments (AWS, Azure, GCP)

Requirements

• Willingness to work onsite in our Palo Alto, CA office to collaborate with product engineering teams, support complex engagements, and participate in strategic initiatives
• Exceptional written and verbal communication skills — capable of translating complex technical concepts for executive leadership, product teams, and diverse client audiences
• Strategic thinking and the ability to align technical initiatives with business objectives; experience influencing product roadmaps or organizational strategy
• Experience providing technical mentorship and guidance

Even Better With

• Prior experience working alongside AI/ML models, automated offensive security frameworks, or building AI-augmented attack tools
• Published research, conference speaking, or significant open-source contributions in offensive security
• Experience in startup or high-growth environments; demonstrated ability to wear multiple hats and drive initiatives with minimal bureaucracy
• Advanced certifications: OSCP, OSCE, CRTE, CRTO, or equivalent elite-level credentials
• Track record of building offensive security tools or frameworks adopted by the community

Location

Onsite in Palo Alto, CA

Benefits & Perks | FTE

🏥 Full Health, Dental, & Vision Coverage

📈 Meaningful Equity Ownership

🥙 In-Office Meals

✂️ Haircuts at the Office
🎉 Company Sponsored Conferences & Events

💸 401(k), HSA, and FSA Plans

🌴 Flexible PTO