> Markdown version of [/jobs/ext/2190880-principal-offensive-security-operator](https://www.wearedevelopers.com/jobs/ext/2190880-principal-offensive-security-operator). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Principal Offensive Security Operator

- **Company:** Ministry of Justice
- **Location:** London, UK
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Cyber Security, Azure Active Directory, Red Team (Cyber Security), Software Vulnerability Management, Cyber Threat Analysis, Infrastructure as Code (IaC)
- **Published:** August 23, 2026
- **Apply:** https://www.apply4u.co.uk/jobs/principal-offensive-security-operator/44945439

## About the Role

mitigation and risk-based cyber security decision-making.Mentor junior Red Team personnel and contribute to the development of offensive security capability.Share offensive security knowledge with security and wider business teams. Essential Experience & SkillsYou will need to demonstrate:Proven experience planning and delivering complex, multi-phase offensive security operations.Strong experience in scenario-driven adversary simulation and red-team engagements.Practical threat intelligence analysis and assessment experience.Strong exploitation capabilities across a broad technology landscape, including:Microsoft Entra ID and Active DirectoryMicrosoft 365macOSKubernetesCI/CD environmentsAWS and AzureWeb applicationsEnterprise infrastructureExtensive post-exploitation, persistence and lateral movement experience.The ability to analyse complex attack paths and identify routes to high-value targets.Experience conducting offensive engagements using strong operational security practices and
realistic threat-actor tradecraft.Deep knowledge of enterprise operating systems, infrastructure and security technologies.Understanding of complex modern and legacy enterprise architectures at scale.Experience developing and deploying tools to support Red Team operations.Experience with attack infrastructure, C2 frameworks and Infrastructure as Code (IaC).Excellent communication skills, including the ability to present complex technical findings and business risks to senior stakeholders.Experience contributing to vulnerability management, threat mitigation and risk-based security decisions.Participation in GCASE, GBEST, CBEST and/or TIBER engagements. Desirable ExperienceThe following would be advantageous:Threat research and/or vulnerability research experience.Security research publications or conference presentations.Previous experience in protective monitoring, incident response, security engineering or security architecture.Red-team or offensive-security certifications such as CCSAS
or CRTL. What We're Looking ForThis opportunity is suited to a senior offensive security professional who combines deep technical exploitation capability with strategic thinking, creativity and operational discipline.You should be confident emulating capable threat actors across complex enterprise, cloud and digital environments, developing novel attack paths and adapting your approach as an engagement evolves.Just as importantly, you'll need the judgement to conduct sophisticated offensive activity safely, operate within defined engagement parameters and communicate the resulting risks clearly to both technical and senior business stakeholders.If you're an experienced offensive security operator looking for a challenging opportunity to deliver high-impact adversary simulation within a complex government environment, we'd like to hear from you.

## Description

operational security and minimising disruption to business operations. Key ResponsibilitiesPlan and execute threat intelligence-led, full-spectrum red-team and adversary simulation engagements.Design and conduct complex, multi-phase operations, including exploitation, post-exploitation, persistence and lateral movement.Identify and demonstrate attack paths to high-value systems, users and data.Assess the effectiveness of security controls and wider defensive capabilities.Apply realistic threat-actor tradecraft and operational security principles to minimise detection and operational impact.Develop and maintain attack infrastructure, command-and-control capabilities and supporting automation.Develop tools, techniques and methodologies to enhance offensive security operations.Conduct tactical attack-path analysis across complex technology estates.Translate technical findings and attack scenarios into clear business risk and strategic recommendations.Support vulnerability management, threat


## Related Videos

- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Backstage in Practice: Offloading Developer Operational Work Through Platform Self-Service](https://www.wearedevelopers.com/videos/1922-backstage-in-practice-offloading-developer-operational-work-through-platform-self-service)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Reporting Active Exploits in 24 Hours: Are You Ready for the CRA?](https://www.wearedevelopers.com/videos/100248-reporting-active-exploits-in-24-hours-are-you-ready-for-the-cra)
- [Forecasting Cyber Attacks with Glassdoor Reviews - Lianne Potter](https://www.wearedevelopers.com/videos/2143-forecasting-cyber-attacks-with-glassdoor-reviews-lianne-potter)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)