Adversarial Simulation Lead

Floridafull timeRemote

Apply on Employer Site

senior

H1B: no

Ardentmc Adversarial Simulation Lead at Ardentmc plans and executes controlled, threat-informed simulations to test access controls and detection processes under realistic conditions. Ensures safe execution and operational relevance across multi-agency environments.

Responsibilities

Translate approved control objectives into safe adversary-behavior simulations and test cases aligned to selected kill-chain stages and MITRE ATT&CK techniques.
Develop agency-specific Rules of Engagement inputs covering authorized systems, windows, accounts, techniques, tools, prohibitions, notifications, deconfliction, stop-work conditions, evidence handling, and escalation.
Execute approved access-control stress tests, privilege-boundary attempts, anomaly generation, endpoint/network activity, vulnerability validation, and related verification techniques.
Coordinate closely with the Detection & Monitoring Analyst to trace events from activity initiation through telemetry, alerting, triage, escalation, and response.
Minimize operational risk by confirming preconditions, rollback considerations, safety constraints, communications, and stop conditions before testing.
Capture reproducible evidence, including command or tool context, screenshots, packet or event data, logs, timestamps, affected assets, observed outcomes, and analytic notes.
Perform root-cause analysis and develop technically feasible hardening or detection-improvement recommendations, clearly separated from factual AUP reporting.
Support retesting of approved remediated findings and document whether expected control performance is demonstrated.
Contribute to workshops and reusable job aids explaining simulation design, evidence, and defensive lessons.

Qualification

Bachelor’s degree in cybersecurity7 years in adversary simulationHands-on knowledge of MITRE ATT&CKCloudArdent is an equal opportunity employer

Required

Bachelor’s degree in cybersecurity, digital forensics, information technology, computer science, or related field.
Proof of relevant professional certifications such as CISSP, CISA, PMP, CEH, or other relevant certifications.
7 years in adversary simulation, penetration testing, threat hunting, digital forensics, incident response, vulnerability assessment, or security engineering.
Demonstrated ability to conduct controlled testing in production-sensitive or regulated environments under formal authorization.
Hands-on knowledge of MITRE ATT&CK, identity and access control, endpoint and network telemetry, SIEM/EDR/XDR, vulnerability tools, cloud security, and evidence preservation.
Ability to explain operational consequences and mitigation options to technical and executive audiences.

Preferred

Experience leading purple-team exercises or adversary campaigns.
Experience testing Zero Trust or identity-centric controls.
Cloud, web application, API, Active Directory, firewall, and multi-tenant security operations experience.
GIAC penetration testing or forensic certifications.
Due to the nature of the work we support, all candidates in consideration for this role must be willing to undergo the government issued background investigation process.
Ardent is an equal opportunity employer. We will not discriminate in employment, recruitment, advertisements for employment, compensation, termination, upgrading, promotions, and other conditions of employment against any employee or job applicant on the bases of race, color, gender, national origin, age, religion, creed, disability, veteran's status, sexual orientation, gender identity, gender expression, or any other basis protected by state, local, or federal law.