Intermediate Red Team Operator in Washington, District of Columbia at Intelligent Waves, LLC
Explore Related Opportunities
Job Description
Intermediate Red Team Operator
US-DC-Washington
Job ID: 2026-4397
Type: Regular Full-Time
# of Openings: 1
Category: Cybersecurity
Thurgood Marshall Federal Judiciary Building
Overview
Intelligent Waves is seeking a Mid-Level Red Team Operator to support a U.S. Courts contract. This hybrid position (80% remote) requires reporting once weekly to an office near Union Station in Washington, D.C.; commuting expenses for parking, MARC, VRE, or Metro are fully reimbursed.
The operator will execute red team exercises on production IT systems, facilities, and personnel; conduct spear-phishing campaigns and exploit external assets to gain internal access; perform post-exploitation activities to meet objectives; and carry out on-site penetration assessments at federal courthouses and other Court locations. The role involves using custom code and commercial exploitation frameworks, operating within established ROE/SOPs, and applying proven red team tradecraft throughout exercises.
Location: National Capital Region (NCR) - Hybrid (80% remote)
Travel: Up to 10%, reimbursed per IW policy, GSA Per Diem, and DoD JTR
Clearance Requirement: United States Citizen with ability to obtain and hold a Public Trust clearance
Office Requirement: Report to office near Union Station, Washington D.C. (one day per work week)
Intelligent Waves delivers mission-focused multi-domain operational expertise and innovation to the Government through high-impact technology solutions in cybersecurity, data science, enterprise network & systems engineering, software development, and cognitive human performance.
ANYTIME. ANYWHERE. ANY DOMAIN.
Since 2006, we have proudly served federal agencies including the Department of Defense. Our ability to operate globally in a wide range of environments, coupled with our deep understanding of customer needs and requirements, enables us to provide cost-effective solutions to support the most complex missions.
Adherence to all customer site protocols is mandatory for employees.
Responsibilities
- Conduct red team exercises against production IT systems, facilities, and personnel belonging to the AO and the Courts.
- Develop and conduct spear phishing campaigns to gain internal network access.
- Conduct exploitation of external facing assets to gain internal network access.
- Conduct post-exploitation actions towards exercise objectives.
- Conduct on-site physical penetration assessments at various federal courthouses and other Court locations to obtain access to internal networks.
- Use custom code and/or commercial-off-the-shelf (COTS) exploitation frameworks to bypass and penetrate network and system defenses.
- Comply with the unique rules of engagement (ROE) provided for each exercise, along with the standard operating procedures (SOP) for Red Team operations.
- Employ red team tradecraft while conducting exercises.
Qualifications
- Minimum 4 years of direct, hands-on technical red team and/or government computer network exploitation/offensive operations experience.
- Minimum 4 years of hands-on experience with red team tools (Cobalt Strike, Kali, etc.) in a production environment.
- Minimum 4 years of experience with network technologies and protocols (OSI model, routing, troubleshooting).
- Minimum 4 years of experience using and investigating living off the land TTPs.
- Ability to secure, configure, deploy, and troubleshoot Windows, Linux, and MacOS systems.
- Minimum 4 years of experience scripting in Bash, C#, Ruby, Perl, Python, PHP, etc.
- Minimum 4 years of social engineering and physical penetration testing.
- Minimum 4 years of experience writing cybersecurity assessment reports.
Additional Preferred Qualifications:
- Experience with Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), including integrating results into developer workflows is preferred
- Knowledge of OWASP Top 10 & SANS Top 25 vulnerabilities, with ability to exploit/remediate is preferred
- Experience with application security testing for web, mobile, and API endpoints is preferred
- CRTO certification (or ability to obtain within 3 months of onboarding) is required.
- OSCP and/or GPEN certifications are preferred, but not required.