Must-have Skills:

· Hands-on offence: adversary emulation, C2, exploitation, attack-path analysis across cloud / infra / endpoint

· Detection and logging fluency (the purple half)

· BAS and ATT&CK;

· Python and automation; tight rules-of-engagement discipline

Valuable-to-Have skills:

· AI coding / agentic tools (GPT-5.5 Trusted Access for Cyber, Codex, Claude Code, Copilot or similar) to find and prove exploitable vulns at repo scale

· GitLab Ultimate; standing up AI-assisted code-analysis infrastructure

· Detection engineering

· Application / code security experience (SAST, DAST, SCA)

Responsibilities:

· Runs red and purple team engagements against critical apps, infrastructure and controls

· Builds and maintains fit-for-purpose red team infrastructure





· Validates controls, detection and logging; finds gaps and proves they are closed

· Owns and matures Breach & Attack Simulation

· Uses AI to scale attack-path analysis and prioritise the gaps that matter

· Closes the loop: proposes remediation, new detections, log sources and controls; drives findings into the engineering backlog

· Acts as the validation arm of threat-informed defence (ATT&CK-mapped;)

Validates whether customer’s control, detection and logging actually catch real attacks, and identifies and supports closing the gaps.

📌 Offensive Security (Brisbane)
🏢 BULLIT MANAGEMENT SERVICES
📍 Brisbane