Senior Offensive Security Specialist (Red Team)

About US Our company Eminevim, the leader of the savings finance sector, continues its activities as a leading brand with 164 branches across the country, nearly 3000 employees and a market share of more than 50%.

Eminevim, which has touched millions of people and enabled more than 300 thousand families to achieve their goals, has been awarded Diamond awards in the housing and automobile categories at the A.C.E. Awards Excellent Customer Satisfaction Achievement Awards in 2021 and 2022 with this approach while moving forward with the understanding of providing the best experience by meeting the expectations and needs of its customers at the highest level.

If you would like to be a part of our team that adopts the understanding of "excellence" in corporate development processes, #We Are Here For You! #Eminevim

About the Job

We are seeking a highly skilled Senior Offensive Security Specialist (Red Team) to join our Information Security team. The successful candidate will be responsible for assessing the organization's attack surface from an adversarial perspective, conducting advanced attack simulations, evaluating the effectiveness of security controls, and contributing to the enhancement of detection and response capabilities across the organization.

Job Description

• Plan and execute Red Team operations across the organization.
• Simulate tactics, techniques, and procedures (TTPs) used by real-world threat actors.
• Develop attack scenarios aligned with the MITRE ATT&CK framework.
• Assess the effectiveness of security controls and defensive technologies.
• Evaluate the detection and response capabilities of SOC and Blue Team functions.
• Demonstrate the business impact of security weaknesses through realistic attack simulations.
• Perform attack path analysis within Active Directory environments.
• Conduct privilege escalation, lateral movement, and domain compromise assessments.
• Analyze trust relationships and authentication mechanisms within identity infrastructures.
• Conduct internal network penetration testing engagements.
• Evaluate network segmentation, access controls, and infrastructure security mechanisms.
• Perform post-exploitation activities and analyze attack surfaces of critical infrastructure components.
• Conduct security assessments of internet banking, mobile banking, customer-facing platforms, and financial applications.
• Assess authentication, authorization, session management, and API security controls.
• Perform security testing of REST and SOAP-based services.
• Collaborate closely with SOC and Blue Team teams through Purple Team exercises.
• Validate the effectiveness of SIEM, IDS/IPS, EDR/XDR, and other security monitoring technologies.
• Develop scripts and tools to support offensive security operations.
• Automate repetitive testing processes and customize open-source security tools when required.
• Research emerging attack techniques, threat trends, and adversary behaviors.
• Analyze threat intelligence sources and translate findings into testing methodologies.
• Provide technical recommendations to improve the organization's security posture.
• Prepare technical reports, risk assessments, and executive summaries for stakeholders.

Qualifications

• Bachelor's degree in Computer Science/Computer Engineering or similar academic disciplines.
• Minimum 5 years of experience in Information Security.
• At least 3 years of hands-on experience in Red Teaming, Offensive Security, or Penetration Testing.
• Proven experience conducting security assessments in enterprise networks and Active Directory environments.
• Experience in banking, financial services, fintech, or regulated industries is considered an advantage.
• Advanced knowledge of Active Directory architecture and Windows security.
• Strong understanding of Kerberos, LDAP, NTLM, and authentication mechanisms.
• Advanced knowledge of TCP/IP, network protocols, and network security architectures.
• Experience performing web, mobile, and API security assessments.
• Familiarity with SIEM, EDR/XDR, and security monitoring technologies.
• Knowledge of Microsoft Azure and Entra ID security architectures.
• Understanding of IAM, PAM, and MFA technologies.
• Hands-on experience with Active Directory attack techniques such as Kerberoasting, AS-REP Roasting, DCSync, Pass-the-Hash, Pass-the-Ticket, Golden Ticket, Silver Ticket, ACL Abuse, RBCD, and ADCS abuse.
• Strong knowledge of OWASP Top 10 and OWASP Mobile Top 10.
• Experience assessing REST and SOAP APIs.
• Knowledge of OAuth2, OpenID Connect, JWT, and API Gateway architectures.
• Proficiency with offensive security tools such as BloodHound, SharpHound, Impacket, NetExec/CrackMapExec, Mimikatz, Rubeus, Sliver, Cobalt Strike, Metasploit, Burp Suite Professional, and Nmap.
• Proficiency in at least one programming language such as Python, PowerShell, C#, or Go.
• Experience with security automation, custom tool development, or extending existing security tools is considered an advantage.
• Knowledge of MITRE ATT&CK, Cyber Kill Chain, and NIST Cybersecurity Framework.
• Experience conducting Purple Team operations is preferred.
• Detection Engineering experience is considered an advantage.
• Knowledge of EDR bypass techniques is preferred.
• Experience performing attack simulations in cloud environments (Azure, AWS, or GCP) is a plus.
• Experience assessing Microsoft Entra ID environments is preferred.
• Experience in Threat Intelligence and Threat Hunting activities is considered an advantage.
• Knowledge of Malware Analysis or Reverse Engineering is a plus.
• Contributions to security research, technical blogs, conference presentations, or open-source projects are highly valued.
• Relevant certifications such as OSCP, CRTP, CRTO, CRTE, OSEP, OSWE, CARTP, or PNPT are preferred.
• Strong analytical thinking, problem-solving, and technical reporting skills.
• Ability to communicate technical findings clearly to both technical and non-technical stakeholders.
• Strong teamwork, collaboration, and stakeholder management skills.
• Passion for continuous learning, research, and improving the organization's security posture.

What We Offer

• Technical and leadership training through Emin Academy, designed to support your career development
• Supplementary health insurance provided for all employees
• Social support in cases such as marriage, childbirth, and bereavement
• Special leave days for occasions such as birthdays, children’s first day of school or report card day, and wedding anniversaries
• Cultural and social programs for employees, nutrition consultancy, and Idea Cube (Fikir Küpü) awards
• Competitive compensation, bonus, and reward system that recognizes and rewards success
• “My Emin Buddy” mentoring program, ensuring fast adaptation and continuous support
• Equal opportunities for all employees and an inclusive working environment