Purple Team Operator

This role involves planning and executing realistic attack simulations, validating detection and response capabilities, and documenting findings to drive measurable improvements in security posture. The Purple Team Operator will analyze security events, tune monitoring and alerting systems, and assist in developing playbooks and response procedures. On a day-to-day basis, the role includes coordinating exercises with stakeholders, preparing detailed reports, presenting recommendations, and supporting security awareness and continuous improvement initiatives across the organization. Key Responsibilities Security Operations - Monitor, triage and investigate security alerts across SIEM, endpoint detection and response (EDR), email security and identity platforms - Respond to incidents such as phishing, account compromise, malware and suspicious user activity, performing root cause analysis and driving each case to closure - Carry out containment and remediation actions, including account recovery and communication with affected users - Document investigations clearly and completely, and maintain accurate records for shift handovers and reporting - Keep security controls and configurations, particularly around identity and access, effective and enforced Offensive Security - Plan and perform penetration tests, including external and internal infrastructure, web applications, and Microsoft 365 and cloud environments - Run phishing simulations and adversary emulation exercises aligned with the MITRE ATT&CK framework - Write clear, actionable reports with prioritized findings and remediation guidance for technical and non-technical audiences Purple Team - Use the results of your offensive work to improve detection: validate alert coverage, identify gaps and tune detection rules - Use what you see in live incidents to shape more realistic attack scenarios - Work with the wider security team to continuously raise detection and response maturity Required Qualifi