Principal Offensive Security Operator in City of London

Contract: 12 months

Location: Remote, with occasional travel to London (approximately once every couple of months, subject to business need)

IR35: In scope

Clearance: Active SC clearance required at application

Rate: £740 per day via Umbrella

Client: Ministry of Justice (MoJ)

About the Role

We are seeking an experienced Principal Offensive Security Operator to join a high-performing security function supporting the Ministry of Justice. This is a senior offensive security role focused on conducting safe, realistic and intelligence-led cyber-attack simulations against complex technology estates. You will operate from an adversary perspective, using advanced offensive security techniques to identify weaknesses, validate defensive capabilities and provide actionable insight to support strategic security decision-making. You will be comfortable operating across traditional enterprise environments, cloud platforms and modern digital services, developing complex attack paths while maintaining strong operational security and minimising disruption to business operations.

Key Responsibilities

• Plan and execute threat intelligence-led, full-spectrum red-team and adversary simulation engagements.
• Design and conduct complex, multi-phase operations, including exploitation, post-exploitation, persistence and lateral movement.
• Identify and demonstrate attack paths to high-value systems, users and data.
• Assess the effectiveness of security controls and wider defensive capabilities.
• Apply realistic threat-actor tradecraft and operational security principles to minimise detection and operational impact.
• Develop and maintain attack infrastructure, command-and-control capabilities and supporting automation.
• Develop tools, techniques and methodologies to enhance offensive security operations.
• Conduct tactical attack-path analysis across complex technology estates.
• Translate technical findings and attack scenarios into clear business risk and strategic recommendations.
• Support vulnerability management, threat mitigation and risk-based cyber security decision-making.
• Mentor junior Red Team personnel and contribute to the development of offensive security capability.
• Share offensive security knowledge with security and wider business teams.

Essential Experience & Skills

• Proven experience planning and delivering complex, multi-phase offensive security operations.
• Strong experience in scenario-driven adversary simulation and red-team engagements.
• Practical threat intelligence analysis and assessment experience.
• Strong exploitation capabilities across a broad technology landscape, including:
• Microsoft Entra ID and Active Directory
• Microsoft 365
• macOS
• Kubernetes
• CI/CD environments
• AWS and Azure
• Web applications
• Enterprise infrastructure
• Extensive post-exploitation, persistence and lateral movement experience.
• The ability to analyse complex attack paths and identify routes to high-value targets.
• Experience conducting offensive engagements using strong operational security practices and realistic threat-actor tradecraft.
• Deep knowledge of enterprise operating systems, infrastructure and security technologies.
• Understanding of complex modern and legacy enterprise architectures at scale.
• Experience developing and deploying tools to support Red Team operations.
• Experience with attack infrastructure, C2 frameworks and Infrastructure as Code (IaC).
• Excellent communication skills, including the ability to present complex technical findings and business risks to senior stakeholders.
• Experience contributing to vulnerability management, threat mitigation and risk-based security decisions.
• Participation in GCASE, GBEST, CBEST and/or TIBER engagements.

Desirable Experience

• Threat research and/or vulnerability research experience.
• Security research publications or conference presentations.
• Previous experience in protective monitoring, incident response, security engineering or security architecture.
• Red-team or offensive-security certifications such as CCSAS or CRTL.

What We're Looking For

This opportunity is suited to a senior offensive security professional who combines deep technical exploitation capability with strategic thinking, creativity and operational discipline. You should be confident emulating capable threat actors across complex enterprise, cloud and digital environments, developing novel attack paths and adapting your approach as an engagement evolves. Just as importantly, you'll need the judgement to conduct sophisticated offensive activity safely, operate within defined engagement parameters and communicate the resulting risks clearly to both technical and senior business stakeholders. If you're an experienced offensive security operator looking for a challenging opportunity to deliver high-impact adversary simulation within a complex government environment, we'd like to hear from you.