Job Title: Breach & Attack Simulation (BAS) Engineer
Contract Duration: 6+ month with potential to Convert or Extend
Location: Remote - Must reside in US
Remote (preferred locations): Missouri, Texas, Florida, Minnesota, Illinois, Georgia, South Carolina, North Carolina, Arizona, Michigan, California, Pennsylvania, Kentucky, Ohio
Qualifications/Skills Needed:
Breach & Attack Simulation (BAS) Engineer
Overview We are looking for a Breach & Attack Simulation Engineer to continuously test how well an organization’s security controls hold up against real-world attacks. The engineer will emulate adversary tactics, techniques, and procedures (TTPs) across network, endpoint, web application, and cloud environments. They will then turn the results into better detections and stronger defenses. The role sits between offensive security and detection engineering: it covers both finding the gaps and helping close them.
Key Responsibilities
· Design, run, and maintain breach and attack simulations mapped to the MITRE ATT&CK framework, focusing on threats relevant to the financial services sector.
· Emulate realistic adversary behavior across network, endpoint, web application, and cloud attack surfaces.
· Analyze simulation results to find gaps in prevention, detection, and response controls, and prioritize those gaps by risk.
· Build, tune, and validate detection content in SIEM/XDR platforms such as Splunk, CrowdStrike NG-SIEM, and Microsoft Sentinel.
· Develop Python and other scripts to automate attack scenarios, create custom test cases, and streamline reporting.
· Work with SOC, Incident Response, and Detection Engineering teams to confirm that alerts fire, get triaged correctly, and lead to the right response.
· Track remediation of identified gaps and re-test to verify fixes.
· Produce clear reports and metrics on control effectiveness for technical teams and leadership.
Required Experience
· Hands-on offensive security experience, including red teaming, network penetration testing, and web application security testing.
· Detection engineering experience with one or more of Splunk, CrowdStrike NG-SIEM, or Microsoft Sentinel, including writing and tuning detection logic.
· Proficiency in Python or similar scripting languages for automation and tool development.
Preferred Experience
· Background in software development or application security.
· Networking and cloud security knowledge (AWS, Azure, and/or Google Cloud Platform).
· Incident response or SOC experience, especially an understanding of how alerts are triaged and investigated.
· Familiarity with commercial BAS platforms (e.g., AttackIQ, SafeBreach, Cymulate, Picus) or adversary emulation frameworks (e.g., Atomic Red Team, MITRE Caldera).
· Relevant certifications such as OSCP, OSEP, CRTO, GPEN, DA
Not eligible for Corp2Corp
Candidates must be legally authorized to work in the US without sponsorship.
CLIENT does not discriminate in employment on the basis of race, color, religion, sex (including pregnancy and gender identity), national origin, political affiliation, sexual orientation, marital status, disability, genetic information, age, membership in an employee organization, retaliation, parental status, military service, or other non-merit factor.
