Director Engineering Application Security Red Teaming

Electronic Arts creates next-level entertainment experiences that inspire players and fans around the world. Here, everyone is part of the story. Part of a community that connects across the globe. A place where creativity thrives, new perspectives are invited, and ideas matter. A team where everyone makes play happen.

Central Technology is the force multiplier, accelerating creative opportunity and progress at EA. We’re a world-class community of technologists, innovators, strategists, and orchestrators transforming interactive entertainment. Together, we power the platforms, AI-driven tools, live services, and infrastructure that ensure global scale, secure player experiences, and unlock bold new possibilities.

EA Security protects our players, employees, products, and platforms. We set security standards, support game and enterprise teams, assess risk across partners and systems, and ensure compliance with global requirements. Our work strengthens system integrity, supports fair play, and enables teams to build and operate securely at scale.

The Red Team Director is a highly technical leadership role for the team that plays a critical part in finding the biggest threats to EA’s security, making EA a secure place to work for our 20,000+ people across 38+ global sites. In addition to “classic” Red Team activities and pen testing, this role will help build out an application security program that scales enterprise-wide with a focus on automation and best-practices. We’re a Red Team that can find the worst of the worst, knows what’s most likely to be attractive to attackers, and we roll up our slaves to make things better. 

This role reports into the Vice President of the Enterprise Security Team and you will have direct access to leaders across the security team, IT, production and the studios. You will play a key role in setting EA’s Enterprise security strategy, and you’ll be an ally to all our partners.  And this includes collaborative work across the gaming industry in a common effort to let gaming companies focus on building amazing games, while keeping the bad actors at bay.

The Head of the Red Team will work with many teams across EA, but will partner extensively with our vulnerability management leaders, incident response, threat hunters, and security operations team.  

Primary Responsibilities

• Respond to emerging threats such as APT and other forms of targeted attacks, organised crime, etc.

• Plan and conduct attacks on internally or externally hosted applications and infrastructure on a global scale with an emphasis on critical functions targeted by adversaries.

• Design and develop scripts, frameworks, tools and the methods required for facilitating and executing application security assessments

• Active participation in attack analysis duties as part of security incident response. This allows this team to remain abreast of the latest adversary TTPs.

• Assemble and coordinate with the IR Ops and other teams at EA to resolve security incidents as quickly and efficiently as possible.

• Communicate status of missions and Red Team activities to EA Security leadership and studio leadership.

• Ensure effective knowledge management of findings and review results of any attack campaign in order to determine severity of findings and identify potential remediation or mitigation strategies.

• Staying current on attack techniques and understands published and emerging real-life attack scenarios.

• Mentor and train more junior staff in attack techniques, tool/exploit development, intelligence analysis and adversarial tactics.

• Communicate effectively with representatives of the Lines of Business, technology specialists, and vendors.

Skills, Knowledge, and Abilities

• Be an amazing leader and attractor of high-caliber technical talent

• A proven ability to build relationships across the business and drive change through these relationships

• Strong interpersonal skills and ability to tailor engagements for different types of businesses, leaders.

• Build and deliver successful security programs from the ground up

• Plan quarterly roadmaps, make hard trade-offs and communicate them well, manage work, build up and out reporting and business rhythm

• Building and deploying flexible automation frameworks 

• 7-10+ years experience in at least 3 of the following (and knowledge of remainder):

  • Technical understanding of tools similar to Cobalt Strike, BURP, Bloodhound

  • Web Penetration Testing (injection, XSS, validation, session mgmt, web services etc.

  • Database (Oracle, MSSQL, and MySQL: hosting, configuration, etc.);

  • Network (protocols, traffic analysis, wireless, etc.);

  • Operating System (UNIX, Solaris, Linux, Mac, Windows: configuration, file system, etc.);

  • Development (coding, scripting, SQL, computer architecture, exploit writing, code analysis);

  • Application Analysis (fuzzing, reverse engineering, disassembling (IDA, OllyDbg);

  • Crypto (password cracking, encryption, algorithm analysis).