Purple Team Operator

About the role

The Purple Team Operator designs and runs realistic attack simulations, validates detection and response capabilities, and documents findings to improve the organization’s security posture. The role blends offensive testing with defensive tuning and requires close collaboration with stakeholders.

Key responsibilities

• Monitor, triage and investigate alerts across SIEM, EDR, email security and identity platforms.
• Respond to incidents such as phishing, account compromise, malware and suspicious activity, performing root‑cause analysis and driving cases to closure.
• Conduct penetration tests on infrastructure, web applications, Microsoft 365 and cloud environments, and run phishing and adversary‑emulation exercises aligned with MITRE ATT&CK.
• Use offensive findings to validate and tune detection rules, identify gaps and improve overall detection coverage.
• Document investigations, prepare detailed reports and present actionable recommendations to technical and non‑technical audiences.

Required profile

• Hands‑on penetration testing experience with common tools and methodologies.
• Strong understanding of SIEM, EDR and email security technologies.
• Deep knowledge of Microsoft 365, Entra ID (Azure AD) and Active Directory security.
• Incident response experience, especially phishing and account takeover investigations.
• Excellent written communication and a methodical approach under pressure.

Required skills

• Penetration testing tools (e.g., Metasploit, Burp Suite)
• SIEM platforms
• Endpoint Detection and Response (EDR) solutions
• Email security solutions
• Microsoft 365, Entra ID, Active Directory
• PowerShell scripting
• Python scripting
• MITRE ATT&CK framework
• Cloud security (Azure, AWS)
• Linux and Windows hardening