Principal Consultant, Red Team Operator
Kroll · United States · $150,000–$200,000 (stated in the posting)
In a world of disruption and increasingly complex business challenges, our professionals bring truth into focus with the Kroll Lens. Our sharp analytical skills, paired with the latest technology, allow us to give our clients clarity—not just answers—in all areas of business. We embrace diverse backgrounds and global perspectives, and we cultivate diversity by respecting, including, and valuing one another. As part of One team, One Kroll, you’ll contribute to a supportive and collaborative work environment that empowers you to excel.
Our Offensive Security professionals are on a mission to make the world a safer place, one company at a time. We help our clients discover, understand, and remediate security risks across their networks, systems, applications, cloud environments, and identity platforms. Our clients trust us to use advanced offensive security tools, creativity, imagination, and expert knowledge to identify realistic attack paths and improve cyber resilience.
We are looking to grow our Red Team capability with a Principal Consultant / L4 Red Team Payload Engineering Specialist. This role is focused on the design, development, and operationalization of custom command-and-control tooling, payloads, and supporting infrastructure that enable high-quality red team, purple team, assumed-breach, and adversary emulation engagements. Our collaborative ties to our forensic and incident response team, detection engineering team, threat intelligence team, and wider Cyber Risk practice enable us to deliver high-impact offensive security engagements for clients across a range of sectors.
What you’ll do
As a Principal Consultant, Red Team Payload Engineering Specialist, you will be the primary driver of custom tooling and payload development that supports complex red team operations. You will work closely with operators and engagement leads to understand client environments and objectives, then design, build, and adapt detection-aware payloads, loaders, and infrastructure that allow the team to operate effectively within agreed rules of engagement.
You will also help clients understand the business impact of the techniques and tooling used, and provide clear, actionable recommendations to improve prevention, detection, and response.
In summary, you will:
- Lead the design, development, customization, and maintenance of command-and-control payloads, droppers, loaders, and supporting tools for use in authorized client engagements
- Implement and package detection-aware tradecraft (including process injection variants, sleep obfuscation, AMSI/ETW bypass techniques, direct syscalls, reflective loading, and related methods) so operators can use it reliably and safely
- Build, adapt, and operate red team infrastructure and C2 tooling (including frameworks such as Mythic, Cobalt Strike, Sliver, or similar) during engagements, with a focus on operational security and resilience
- Develop and maintain internal tooling pipelines, including automated payload generation, testing, and deployment processes using CI/CD and infrastructure-as-code practices
- Support engagement planning by contributing technical input on threat-informed scenarios, attack objectives, operational security considerations, and success criteria
- Execute or support hands-on offensive activity when needed, including Active Directory exploitation, credential access, privilege escalation, and lateral movement, while prioritizing tooling that enables the broader team
- Apply a deep understanding of how EDR, SIEM, identity protection, conditional access, email security, and network monitoring affect operations, and incorporate that knowledge into tooling and tradecraft
- Support purple team engagements by developing or adapting TTPs, working with client security teams, validating detection logic, and helping improve response capability
- Conduct ongoing research and development to improve Kroll’s red team tooling, tradecraft, methodology, and reporting
- Produce clear, evidence-based reporting that explains attack paths, business impact, detection and response observations, and prioritized remediation actions
- Present technical findings to security teams and communicate business risk to senior stakeholders
- Mentor junior consultants, support technical delivery, and contribute to peer review and quality assurance
- Work collaboratively with Kroll’s wider Cyber Risk teams, including incident response, threat intelligence, cloud security, and detection engineering
What you’ll need to succeed
- 5+ years in offensive cybersecurity, with experience supporting or delivering red team, purple team, adversary emulation, or assumed-breach engagements
- Demonstrated experience developing, modifying, or extending offensive security tooling, scripts, or payloads (including custom loaders, implants, or droppers)
- Strong experience with Windows and Linux operating system internals
- Hands-on experience customizing, modifying, and operating command-and-control frameworks such as Mythic, Cobalt Strike, Sliver, or similar tooling in authorized client engagements
- Working knowledge of C, C#, Python, PowerShell, and/or JavaScript, with deep proficiency in at least one language relevant to payload or loader development
- Experience working with CI/CD, DevOps, and infrastructure automation tools (e.g., Git, Jenkins, Terraform, Ansible, or similar)
- Practical understanding of evasion techniques, endpoint security controls, operational security, and detection-aware tradecraft
- Strong understanding of networking and web protocols, including TCP/IP, DNS, HTTP, HTTPS, and authentication flows
- Excellent written and verbal communication skills, with the ability to explain complex technical issues clearly to technical and non-technical audiences
- The ability to manage risk during live client engagements and operate within agreed rules of engagement
Nice to have
- Red Team certifications such as CRTO, CRTL, or equivalent experience
- Malware engineering courses such as Maldev Academy, SEKTOR7 malware development, or similar training
- Hands-on testing and evasion work against modern EDR (e.g., CrowdStrike, Microsoft Defender, SentinelOne, or similar) and application control solutions
- Experience delivering threat intelligence-driven red team engagements
- Working knowledge of cloud platforms such as AWS, Azure, or GCP
- Experience with exploit development, reverse engineering, malware analysis, or assembly-level debugging
- Experience employing modern AI tooling to support offensive development or engagements
- Threat intelligence, detection engineering, or incident response experience
- Experience writing blogs, presenting at industry events, publishing research, or contributing to offensive security tooling
- Experience leading small teams or technical workstreams during complex offensive security engagements
This role offers the opportunity to focus on advanced payload and tooling development while supporting high-impact client engagements. Remote or hybrid arrangements may be considered depending on location and team needs.
In order to be considered for a position, you must formally apply via careers.kroll.com.
Kroll is committed to creating an inclusive work environment. We are proud to be an equal opportunity employer and will consider all qualified applicants regardless of gender, gender identity, race, religion, colour, nationality, ethnic origin, sexual orientation, marital status, veteran status, age, or disability.
Salary range for this role is $150,000 - $200,000 USD
#LI-KH1