Red Team Operator, Operational Technology (OT)
Armadin · Remote · Remote
Posted by Armadin on their careers site · View the original posting
Draft this job a résumé tailored to it, and the application filled in
draft's reading
Open 31 days
Visa sponsorship: Says no sponsorship · This posting says it won't sponsor
Not legal advice — confirm with the employer, your DSO or an immigration attorney.
The posting, as Armadin wrote it
About Us
At Armadin, we're a group of engineers, researchers, and security researchers on a mission to redefine what proactive security can do in the AI era. Cyberattacks are becoming autonomous and relentless and we believe defending against threats before they materialize is one of the most powerful ways to protect the institutions the world depends on.
We're building autonomous proactive security from the ground up, reinforcing the tradecraft of elite security practioners into purpose-built security models and agents that discover risk and remediate it before organizations are breached.
Led by Kevin Mandia, founder of Mandiant ($5.4B exit to Google), our team brings together researchers and engineers from Google, xAI, Meta, Stanford, Georgia Tech, Waterloo, Berkeley, and MIT to reinvent security for an adversary that never sleeps.
ROLE OVERVIEW
As an Operational Technology (OT) Red Team Operator, you will conduct adversary-focused offensive operations in highly sensitive Operational Technology (OT), Critical Infrastructure, and converged enterprise environments where the margin for error is zero. Modern OT environments do not exist in isolation; they are deeply interconnected with corporate networks, Active Directory, cloud systems, and specialized web/thick-client software management layers. These engagements are designed to simulate complex, multi-stage real-world attacks spanning the entire attack surface—from enterprise network perimeters down to cyber-physical and industrial control systems.
This role requires far more than executing automated scanners—you will analyze environments holistically, discover complex attack paths across network boundaries and applications, and operate with discipline, creativity, and intent. You will emulate motivated threat actors by chaining application vulnerabilities, Active Directory misconfigurations, network trust relationships, and protocol weaknesses to achieve operational objectives while minimizing detection and ensuring process safety.
Beyond direct engagement work, you will partner closely with internal engineers and researchers to help define, build, and test adversarial evaluations that model real attacker behavior across OT, network, and application domains. You will translate engagement outcomes—such as complex kill chains, privilege escalation techniques, and custom operational tradecraft—into structured inputs that support the training and validation of AI systems intended to learn how to plan, execute, and reason about offensive operations at scale. This role plays a direct part in shaping how cross-domain offensive expertise is captured, operationalized, and automated.
WHAT YOU'LL DO
- Execute Cyber-Physical & Converged Penetration Tests: Plan and execute semi-automated and manual red team operations across sensitive OT environments (e.g., ICS, SCADA, DCS, BMS, IIoT, Embedded Systems) where testing requires human expertise and judgement to maintain safety, process
[…]
business logic flaws, authentication/authorization bypass, injection attacks, API security).
- Systems & Automation: Strong operating system fundamentals (Linux, Windows) and proficiency in scripting/programming in at least one language (Python, Go, PowerShell, Bash, or C/C++) to modify or extend offensive tooling.
- Risk Contextualization: Ability to quantify exploitability and impact in a way that balances cyber risk with operational safety and uptime requirements.
- Communication: Exceptional technical writing and verbal skills to communicate with both plant engineers and C-level executives.
- Work Authorization: Must be eligible to work in the United States without sponsorship.
EVEN BETTER WITH
- OT/ICS Certifications: GICSP (Global Industrial Cyber Security Professional), GRID (GIAC Response and Industrial Defense), GCIP (GIAC Critical Infrastructure Protection), or equivalent.
- Specialized Experience: On one or more of the following: Mobile application testing, source code reviews, reverse engineering, embedded device testing, encryption/decryption, packet analysis, and covert communication channels
- Network & Offensive Security Certifications: OSCP, OSEP, CRTO/CRTE (Certified Red Team Operator/Expert), CPTS, or PNPT.
- AppSec Certifications: GWAPT, eWPTXv2, OSWE, CWES, or TCM Practical Web/Mobile Pentest.
- Tooling & AI Focus: Experience developing custom C2 modules/extensions, or interest/experience in how LLMs and agentic AI workflows apply to offensive security operations.
- Background: Prior experience within specialized government offensive units, top-tier offensive security consultancies, or Fortune 500 red teams with operational technology scope.
Location
Remote within the United States
Benefits & Perks | FTE
🏥 Full Health, Dental, & Vision Coverage
📈 Meaningful Equity Ownership
🥙 In-Office Meals
✂️ Haircuts at the Office
🎉 Company Sponsored Conferences & Events