NCC Group

Global cyber security and resilience provider

Red Team Consultants – Principal & Executive Principal

Offensive Security & TestingUpdated on Nov 13

Full-timeMadrid, SpainNo salary listedHybrid

About the Job

Requirements

Demonstrable experience delivering high-complexity Red Team engagements end-to-end.
Deep understanding of the adversary lifecycle and common tactics, techniques, and procedures (TTPs).
Familiarity with evasion techniques and bypassing controls such as endpoint detection and response (EDR), endpoint protection platforms (EPP), email and web gateways, and proxies.
Experience in stakeholder engagement, with the ability to brief security professionals and executive stakeholders.
Excellent written English and the ability to create structured, compelling reporting documents.
Proficiency across Microsoft Active Directory, Office 365 security mechanisms, cloud security across AWS, Azure, and GCP, and macOS and mixed environments.

Responsibilities

Design, plan, and execute advanced adversary simulation and Red Team engagements aligned with industry standards and regulatory frameworks such as CBEST, TIBER, CORIE, AASE, iCAST, and FEER.
Maintain operational security and mitigate risk throughout engagement delivery.
Communicate risks and safety concerns clearly and proactively to clients before and during operations.
Use off-the-shelf and custom-built tools to achieve objectives and evade detection.
Create and maintain custom scripts or tools to automate Red Team activities or exploit environment-specific weaknesses.
Produce narrative-driven reports conveying technical detail, context, and actionable insight to technical and non-technical audiences.
Deliver detailed debriefs and presentations to security teams and C-level stakeholders.
Translate complex attack chains into engaging, informative documentation.
Work autonomously on smaller engagements and collaboratively on large-scale, multi-phase assessments.
Build strong, lasting relationships with clients and internal teams.
Support sales and scoping activity where required, contributing to technical pre-sales conversations.
Share knowledge and develop internal Red Team capabilities through collaboration, tooling contributions, and process improvements.
Keep abreast of emerging TTPs, threat actors, and detection technologies, evaluating and integrating relevant techniques.
Mentor junior consultants and cross-functional teams as a knowledge resource.
Promote a culture of learning, safety, and excellence within the Red Team practice.

Desired Qualifications

Experience working under regulatory testing frameworks such as CBEST, TIBER-EU, CORIE, AASE, iCAST, or FEER.
Experience in the design or development of Red Team tooling or automation.
Familiarity with UK and international cybersecurity frameworks, regulations, and best practices.
CREST CCSAS or CCRTS (Simulated Attack Specialist) qualification.
CREST CCSAM or CCRTM (Simulated Attack Manager) qualification.

As an Executive Principal Consultant within the Red Teaming practice, you’ll take a leading role in delivering high-end adversary simulation engagements for clients with mature security postures and critical risk profiles. You'll operate across the entire attack lifecycle—from initial access and evasion of EDR, through lateral movement and objective completion—while ensuring the safety, confidentiality, and operational integrity of every engagement.

You’ll also contribute to our capability development, tooling, and methodologies, while mentoring the next generation of Red Teamers and representing NCC Group in client-facing engagements, including with C-level stakeholders.

Engagement Delivery

Design, plan, and execute advanced adversary simulation and Red Team engagements aligned with industry standards and regulatory frameworks (e.g., CBEST, TIBER, CORIE, AASE, iCAST, FEER).
Maintain a strong focus on operational security and risk mitigation throughout delivery.
Communicate risks and safety concerns to clients clearly and proactively before and during operations.
Use both off-the-shelf and custom-built tools to achieve objectives and evade detection.
Create and maintain custom scripts or tools to automate Red Team activities or exploit environment-specific weaknesses.

Reporting and Communication

Produce high-quality, narrative-driven reports that convey technical detail, context, and actionable insight to both technical and non-technical audiences.
Deliver detailed debriefs and presentations to security teams and C-level stakeholders.
Translate complex attack chains into engaging, informative documentation.
Collaboration and Stakeholder Management
Work autonomously on smaller engagements and collaboratively on large-scale, multi-phase assessments.
Build strong, lasting relationships with clients and internal teams.
Support sales and scoping activity where required, contributing to technical pre-sales conversations.

Capability Development

Share knowledge and develop internal Red Team capabilities through collaboration, tooling contributions, and process improvements.
Keep abreast of emerging TTPs, threat actors, and detection technologies, evaluating and integrating relevant techniques.

Mentorship and Thought Leadership

Act as a mentor and knowledge resource for junior consultants and cross-functional teams.
Promote a culture of learning, safety, and excellence within the Red Team practice.

Essential:

Demonstrable experience delivering high-complexity Red Team engagements end-to-end.
Deep understanding of the adversary lifecycle and common tactics, techniques, and procedures (TTPs).
Familiarity with evasion techniques and bypassing controls such as EDR/EPP, email/web gateways, proxies, etc.
Experience in stakeholder engagement, with the ability to brief both security professionals and executive stakeholders.
Excellent written English and ability to create structured, compelling reporting documents.

Proficiency across multiple relevant technical domains:

Microsoft Active Directory
Office 365 security mechanisms
Cloud security (AWS, Azure, GCP)
MacOS and mixed environments

Desirable:

Experience working under regulatory testing frameworks such as:
CBEST, TIBER-EU, CORIE, AASE, iCAST, or FEER
Experience in the design or development of Red Team tooling or automation.
Familiarity with UK and international cybersecurity frameworks, regulations, and best practices.

Preferred Qualifications:

CREST CCSAS / CCRTS (Simulated Attack Specialist)
CREST CCSAM / CCRTM (Simulated Attack Manager)

About the Company

NCC Group

Global cyber security and resilience provider

NCC Group provides cyber security and resilience services to organizations and governments around the world. It helps protect digital systems by offering a range of capabilities such as security testing, risk assessment, and resilience planning, backed by a global team of experts and supported by technology-enabled tools. The company’s approach combines human expertise with technical solutions to identify vulnerabilities, assess risk, and implement concrete steps to improve security and continuity. What sets NCC Group apart is its large, worldwide team and its emphasis on practical, end-to-end cyber resilience—working with clients from assessment through to implementation and ongoing assurance. The goal is to create a more secure digital future by helping customers manage cyber risk, reduce threats, and maintain business continuity at scale.

Company size: 1,001-5,000
Company stage: IPO
Headquarters: Manchester, United Kingdom
Founded: 1999

Recently Posted Jobs

Explore more opportunities at NCC Group

See more jobs