About Sekuro

We're a founder-led global consulting company in the cybersecurity market, operating across Australia, Asia, and the UK. Our reputation is built on breaking away from traditional consulting models, embracing a direct and fresh approach that puts clients at the centre of everything we do. Our mission is simple: to be our clients' most trusted security partner by delivering impactful outcomes that build resilience, enable innovation, and improve competitiveness.

Our vision is to be the world's most trusted security partner, enabling organisations to protect today and prepare for tomorrow. We exist to secure organisations, empowering them to thrive in a digital world.

We live by our values: we are brave, we raise the bar, we tell it how it is, we own the outcome, and we care for all.

The Role

We're building something most security teams only talk about: a living, breathing fictional organisation purpose-built for attacking, defending, and learning. We need someone brave enough to build it, break it, and then build it back better. If you've ever wanted to run a Purple Team program without the politics, the legacy baggage, or someone telling you "we've always done it this way" this is it.

As our Adversarial Emulation Specialist, you'll sit right at the intersection of offence and defence. One day you're crafting a kill-chain that would make a real adversary proud; the next you're in the trenches with our SOC turning that same attack into a detection rule that actually works. You won't be stuck picking a lane. You'll own the whole road.

What You'll Do

You'll design, build and maintain a organisational environment that becomes the proving ground for our attack and defence capability,



and you'll lead purple team exercises from planning through to execution and analysis, acting as the translator between red and blue so nothing gets lost in jargon or ego. You'll develop adversary emulation plans grounded in real-world TTPs, run automated attack sequences through modern C2 frameworks, build custom payloads and tooling, and chain sophisticated attacks across platforms, documenting every kill-chain and the detection pattern it should trigger.

On the defensive side, you'll work shoulder to shoulder with our SOC to sharpen detection engineering, validate detection rules across multiple tools, strengthen incident response playbooks off the back of real exercise findings, and coach analysts through threat hunting techniques that go beyond ticking boxes. You'll also keep one eye firmly on the horizon, researching emerging threat actor behaviour, building out our library of adversary emulation procedures, trialling new tools and technologies, and sharing what you learn with the wider security community because valuable research deserves an audience.

What You'll Need

- You'll bring at least five years across combined offensive and defensive security roles, with genuine hands-on experience in adversary emulation, purple team operations,



and the automation and tooling that makes it all repeatable rather than a one-off party trick.
- You'll know your way around C2 frameworks like Cobalt Strike, Mythic or PowerShell Empire, be fluent in post-exploitation and custom payload development, and have a solid grip on web application security testing.
- On the blue side, you're comfortable in SIEM platforms such as Splunk, LogScale or CrowdStrike NGSIEM, confident configuring EDR/XDR, and no stranger to network security monitoring, security automation, and incident response procedures.
- Python should feel like a second language, and PowerShell and Bash should feel like the third and fourth; Go is a welcome bonus.
- You'll have exposure to AWS, Azure or GCP security, container security, Infrastructure as Code, and Zero Trust architecture, because modern adversaries don't stick to on-prem and neither should you.
- On paper, you'll hold at least two offensive certifications (think OSCP, OSCE, OSEP, GXPN, GPEN, CRTO, CRTP, PNPT, eWPT or eWPTX) and at least two defensive certifications (GCFA, GCIH, GCIA, GRID, Splunk Enterprise Security Certified Admin, CrowdStrike Certified Falcon Administrator, or Blue Team Level 1/2). CISSP, cloud security certifications, CCSP or CREST credentials will only add to your case.
- Beyond the tooling and the letters after your name, we need someone genuinely curious, sharp with documentation, creative under pressure, and just as comfortable explaining a kill-chain to a board as you are building one in a lab. If you'd rather prove a point with evidence than an opinion, you'll fit right in.

Any questions? Give Tim Smith a call on 0425 814 791.

📌 Adversarial Emulation Specialist (Australia)
🏢 Sekuro
📍 Australia