Apply

Ready to go for it?

AI Apply speeds things up—apply directly if you prefer.

FREE ACCESS
5,000–10,000 jobs/day
Scoutfield Logo

See all jobs on Scoutfield

Search thousands of fresh jobs every day.

Discover
  • Fresh listings
  • Fast filters
  • No subscription required
Create a free account and start exploring right away.
Armadin

Senior Red Team Operator, Applications

Armadin

. Run full kill chains against web, mobile, API, and thick/thin client applications .

Posted 10/14/2026full-timeRemote • United StatesSeniorWebsite

Core Competencies

Role fit
Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates deep, hands-on application offense with expertise in web app and API exploitation, including advanced techniques for vulnerability assessment and exploitation. Proficient in scripting and utilizing AI tools for analysis and tooling, with strong communication skills to convey complex attack strategies to diverse stakeholders.

Highest-signal resume keywords
Web Application ExploitationAPI ExploitationBurp SuiteScripting in PythonSource Code Review

ATS Keywords

Tailor your resume
Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills
Application Vulnerability AssessmentStatic and Dynamic AnalysisBinary ReversingRuntime InstrumentationInjection ChainsBusiness Logic AbuseNetwork ProtocolsClient-Server ArchitectureAI Tools for ReconOffensive Automation
Soft Skills
Self-DirectedComfortable with AmbiguityTime-Sensitive Decision MakingEffective Communication
Tools & Technologies
Burp SuiteCaidoZAPFridaJadxGhidraIDA ProLinuxWindowsMacOS
Certifications & Qualifications
OSWEBurp Suite Certified PractitionerGWAPTCWESEWPTXEMAPTTCM Practical Web and Mobile Pentest
Industry Keywords
Kill ChainAttack SurfaceVulnerability ClassesAI-Driven TradecraftBug BountyCVECTFApplication-Security Conference

Tech Stack

Tools & technologies
CloudLinuxMacOSPython

About the role

Key responsibilities & impact
  • Run full kill chains against web, mobile, API, and thick/thin client applications
  • Turn candidate findings into working exploits with clear evidence and distinguish real risk from noise
  • Map the blast radius from application compromise through identity, cloud, and data
  • Review source code for control-flow flaws, injection paths, and insecure design using AI-assisted analysis
  • Perform static and dynamic analysis, binary reversing, runtime instrumentation, and API testing
  • Translate tradecraft into techniques, decision logic, and evaluation data for AI agents
  • Pressure-test AI swarm attack paths and identify naive or incorrect behavior
  • Write scripts, tools, and plugins to extend offensive capabilities
  • Deliver attack reports and debriefs for engineers, executives, and counsel
  • Research emerging vulnerability classes, exploitation techniques, and AI-driven attacker tradecraft
  • Balance concurrent operations and internal research with startup-level autonomy

Requirements

What you’ll need
  • Deep, hands-on application offense: web app and API exploitation beyond the OWASP Top 10, including business logic abuse, authentication and authorization bypass, and injection chains
  • Depth in at least one additional attack surface: mobile, thick/thin clients, source code review, or reverse engineering
  • Fluency with Burp Suite, Caido, ZAP, Frida, jadx, Ghidra, and IDA Pro
  • Strong grasp of network protocols, client-server architecture, and application vulnerability classes
  • Proficiency across Linux, Windows, and macOS
  • Scripting in Bash, Python, or similar
  • Experience using AI tools for recon, analysis, or tooling
  • Ability to make time-sensitive human-in-the-loop judgments and explain reasoning to safety and engineering teams
  • Self-directed, scrappy, and comfortable with ambiguity
  • Ability to communicate complex attack chains to engineers, executives, and legal counsel
  • Must be eligible to work in the United States without sponsorship
  • Ability to travel up to 20% for on-site engagements or client meetings
  • Offensive automation or AI/ML experience is an advantage
  • Offensive tooling experience is an advantage
  • Bug bounty findings, CVEs, CTF wins, or application-security conference talks are an advantage
  • Active use of PortSwigger Web Security Academy, Hack The Box, or TryHackMe is an advantage
  • Relevant certifications such as OSWE, Burp Suite Certified Practitioner, GWAPT, CWES, eWPTX, eMAPT, or TCM Practical Web and Mobile Pentest tracks are an advantage

Benefits

Comp & perks
  • Full Health, Dental, & Vision Coverage
  • Meaningful Equity Ownership
  • In-Office Meals
  • Haircuts at the Office
  • Company Sponsored Conferences & Events
  • 401(k), HSA, and FSA Plans
  • Flexible PTO