Leads complex red team and adversary simulation engagements from planning through objective completion, including evasion, lateral movement, custom tooling, reporting, and executive briefings. Develops methodologies, mentors consultants, supports technical pre-sales, and maintains operational safety. Requires expertise across Active Directory, Office 365, cloud platforms, macOS, attack lifecycle techniques, security controls, and regulatory testing frameworks.
As an Executive Principal Consultant within the Red Teaming practice, you’ll take a leading role in delivering high-end adversary simulation engagements for clients with mature security postures and critical risk profiles. You'll operate across the entire attack lifecycle—from initial access and evasion of EDR, through lateral movement and objective completion—while ensuring the safety, confidentiality, and operational integrity of every engagement.
You’ll also contribute to our capability development, tooling, and methodologies, while mentoring the next generation of Red Teamers and representing NCC Group in client-facing engagements, including with C-level stakeholders.
Key Responsibilities
Engagement Delivery
- Design, plan, and execute advanced adversary simulation and Red Team engagements aligned with industry standards and regulatory frameworks (e.g., CBEST, TIBER, CORIE, AASE, iCAST, FEER).
- Maintain a strong focus on operational security and risk mitigation throughout delivery.
- Communicate risks and safety concerns to clients clearly and proactively before and during operations.
- Use both off-the-shelf and custom-built tools to achieve objectives and evade detection.
- Create and maintain custom scripts or tools to automate Red Team activities or exploit environment-specific weaknesses.
Reporting and Communication
- Produce high-quality, narrative-driven reports that convey technical detail, context, and actionable insight to both technical and non-technical audiences.
- Deliver detailed debriefs and presentations to security teams and C-level stakeholders.
- Translate complex attack chains into engaging, informative documentation.
- Collaboration and Stakeholder Management
- Work autonomously on smaller engagements and collaboratively on large-scale, multi-phase assessments.
- Build strong, lasting relationships with clients and internal teams.
- Support sales and scoping activity where required, contributing to technical pre-sales conversations.
Capability Development
- Share knowledge and develop internal Red Team capabilities through collaboration, tooling contributions, and process improvements.
- Keep abreast of emerging TTPs, threat actors, and detection technologies, evaluating and integrating relevant techniques.
Mentorship and Thought Leadership
- Act as a mentor and knowledge resource for junior consultants and cross-functional teams.
- Promote a culture of learning, safety, and excellence within the Red Team practice.
Skills, Knowledge and Expertise
Essential:
- Demonstrable experience delivering high-complexity Red Team engagements end-to-end.
- Deep understanding of the adversary lifecycle and common tactics, techniques, and procedures (TTPs).
- Familiarity with evasion techniques and bypassing controls such as EDR/EPP, email/web gateways, proxies, etc.
- Experience in stakeholder engagement, with the ability to brief both security professionals and executive stakeholders.
- Excellent written English and ability to create structured, compelling reporting documents.
Proficiency across multiple relevant technical domains:
- Microsoft Active Directory
- Office 365 security mechanisms
- Cloud security (AWS, Azure, GCP)
- MacOS and mixed environments
Desirable:
- Experience working under regulatory testing frameworks such as:
- CBEST, TIBER-EU, CORIE, AASE, iCAST, or FEER
- Experience in the design or development of Red Team tooling or automation.
- Familiarity with UK and international cybersecurity frameworks, regulations, and best practices.
Preferred Qualifications:
- CREST CCT-INF (Infrastructure)
- CREST CCSAS (Simulated Attack Specialist)
- CREST CCSAM (Simulated Attack Manager)
Benefits
We have a high-performance culture which is balanced evenly with world-class well-being initiatives and benefits:
- Flexible Working: Balance your work and personal life with our flexible working options.
- Generous Holiday Allowance: Enjoy 25 days of holiday, plus bank holidays, with the option to buy up to 5 additional days of annual leave.
- Medicash & Critical Illness Scheme
- Financial & Investment Benefits: Enjoy peace of mind with our Pension, Life Assurance, and Share Save Scheme.
- Community & Volunteering Programmes: Make a difference in your community with our volunteering opportunities.
- Green Car Scheme: Drive green and save money with our eco-friendly car scheme.
- Cycle Scheme: Stay fit and healthy with our cycle-to-work scheme.
- Special Time Off: Take time off for those big moments in life, like getting married/entering into a civil partnership, becoming a grandparent, and welcoming home a new pet.
- Family Planning: Benefit from our generous maternity and paternity leave, as well as time off and support for those undergoing fertility treatments.
About
We assess, develop and manage cyber threats across our increasingly connected society. We advise global technology, manufacturers, financial institutions, critical national infrastructure providers, retailers and governments on the best way to keep businesses, software and personal data safe.With our knowledge, experience and global footprint, we are best placed to help businesses identify, assess, mitigate & respond to the risks they face.We are passionate about making the Internet safer and revolutionising the way in which organisations think about cyber security.Headquartered in Manchester, UK, with over 35 offices across the world, NCC Group employs more than 2,000 people and is a trusted advisor to 15,000 clients worldwide.
Similar Jobs
Information Technology • Professional Services • Software • Cybersecurity
Leads complex red team and adversary simulation engagements from initial access through objective completion. Designs operations, evades security controls, develops tooling, produces executive-ready reports, manages client stakeholders, supports presales, advances internal methodologies, monitors emerging threats, and mentors junior consultants.
Top Skills:
AWSAzureEdrEmail GatewaysEppGCPmacOSMicrosoft Active DirectoryOffice 365ProxiesWeb Gateways
Information Technology • Professional Services • Software • Cybersecurity
Lead complex red team and adversary simulation engagements from initial access through objective completion. Design attack plans, evade security controls, develop tooling, manage operational risk, and produce executive-level reports and briefings. Build client relationships, support technical pre-sales, develop internal capabilities, track emerging threats, and mentor junior consultants. The role requires expertise across Active Directory, Office 365, cloud security, macOS, and mixed environments.
Top Skills:
AWSEdr/EppEmail GatewaysGoogle Cloud PlatformmacOSMicrosoft Active DirectoryAzureMicrosoft Office 365ProxiesRed Team ToolingScripting And AutomationWeb Gateways
Artificial Intelligence • Cloud • HR Tech • Information Technology • Productivity • Software • Automation
Build and deploy production-grade, LLM-enabled applications for strategic customers. Own backend services, data orchestration, frontend integrations, APIs, vector databases, LLM pipelines, and reusable AI tooling. Work directly with customers in agile field deployments, integrate legacy systems, improve developer experience, and influence platform strategy. Deliver secure, scalable solutions while creating libraries, SDKs, prompts, scaffolds, and documentation that accelerate future enterprise AI implementations.
Top Skills:
AngularAWSAzureCi/CdContainersDistributed SystemsGCPGraphQLInfrastructure As CodeJavaLangchainLlmsMonitoringNode.jsPrompt ChainingPythonReactRestSemantic KernelVector DatabasesVector Search
What you need to know about the London Tech Scene
London isn't just a hub for established businesses; it's also a nursery for innovation. Boasting one of the most recognized fintech ecosystems in Europe, attracting billions in investments each year, London's success has made it a go-to destination for startups looking to make their mark. Top U.K. companies like Hoptin, Moneybox and Marshmallow have already made the city their base — yet fintech is just the beginning. From healthtech to renewable energy to cybersecurity and beyond, the city's startups are breaking new ground across a range of industries.
