Senior Principal - Red Team Operator

The Senior Principal Red Team Operator will lead a defined area of the Red Team capability and the team or programme that delivers it. This is a senior individual contributor offensive security role carrying technical authority for red team operations.

About the team:

The Red Team emulates real adversaries against GSK. Operators run full-lifecycle engagements using real-world attacker tradecraft, then measure what GSK's defenders actually detect and how they respond.

Key responsibilities:

• Lead a defined area of the capability, including its people, delivery and outcomes.
• Manage delivery against the capability roadmap and escalate blockers early.
• Develop team capability through coaching, review and structured feedback.
• Represent the area in CSO governance and cross-functional forums.
• Execute red team engagements across a variety of networks using real-world adversarial tactics, techniques and procedures, from conception through to report delivery.
• Emulate real attackers to simulate security incidents, then observe and measure how GSK's monitoring and incident response perform.
• Develop after-action reports stating what was achieved, what was detected, what was missed and what should change.
• Build and maintain red team infrastructure, including command and control, redirectors and payload delivery, with operational security discipline.
• Develop custom tooling and exploits where off-the-shelf capability is insufficient or too well signatured.
• Run purple team exercises with the Cyber Defense team to convert findings into detection coverage.

Basic Qualifications:

• Degree in a relevant discipline, or related experience.
• Demonstrated experience in offensive security and red team operations.
• Working knowledge of adversary tradecraft and command and control frameworks.
• Practical experience with full-lifecycle engagement delivery.
• Significant experience in cyber security within the relevant domain.
• Proven experience leading a team or a substantial programme of work.
• Experience managing delivery to plan, quality and timelines.
• Excellent relationship management, influencing and communication skills.

Preferred Qualifications:

• OSCP, OSEP, OSED, CRTO, GPEN or GXPN.
• Exploit development capability.
• Active Directory and cloud attack path expertise.
• Experience with detection evasion within an authorised engagement.
• Experience in a regulated industry, including OT and clinical system awareness.
• Relevant certification such as OSCP, OSEP, CRTO, GPEN, GXPN.
• Experience in pharmaceutical, life sciences or another highly regulated industry.
• Typical tools and technologies: command and control frameworks, custom offensive tooling, Active Directory and cloud attack tooling, MITRE ATT&CK.