Basic Red Team Operator

The Basic Red Team Operator supports OPTEVFOR Cyber Operational Test & Evaluation (OT&E) activities by conducting penetration testing and red team operations under the guidance of intermediate or advanced red team operators. The role contributes to test planning, preparation, execution, and post-test activities in support of cooperative vulnerability penetration assessments, adversarial assessments, and cyber tabletop events.

Qualifications

• Certified Ethical Hacker (CEH) certification or equivalent/higher offensive cybersecurity certification
• Minimum of one (1) year of experience performing penetration testing, red teaming, and/or exploitation development
• Proficiency in at least two operating systems, including Windows, Linux, or Unix variants
• Proficiency with at least one offensive security tool, such as:
• Metasploit
• Cobalt Strike
• Core Impact
• Ability to operate independently to conduct penetration testing or red team activities under guidance from senior or intermediate operators
• Ability to independently generate red team reports and supporting documentation

Key Responsibilities

Orientation and Tooling

• Become proficient in OPTEVFOR Cyber Test & Evaluation CONOPS, SOPs, policies, and guidance
• Research and submit operational requirements for acquisition of cyber tools and equipment in accordance with the 01D tool approval process
• Support development and execution of tactics, techniques, and procedures (TTPs) for penetration testing and red team operations
  
  
  

Test Planning

• Participate in OPTEVFOR cyber test planning activities, including:
• Conducting open-source research and reviewing system-under-test (SUT) documentation to understand mission, architecture, interfaces, and critical components
• Identifying attack surfaces and potential threat vectors
• Participating in checkpoint meetings
• Supporting development of test objectives
• Reviewing test plans to ensure objectives are feasible and executable
• Participating in test planning site visits
  
  

Test Preparation

• Support preparation for cyber OT&E execution, including:
• Participation in site pre-test coordination visits and delivery of test site in-briefs
• Reviewing approved test plans
• Adding relevant information and artifacts to the test library
• Conducting focused research on SUTs and presenting findings to the red team
• Preparing OPTEVFOR Red Team test assets and environments
  
  

Test Execution

• Execute assigned cyber test events, including Cooperative Vulnerability Penetration Assessments, Adversarial Assessments, and Cyber Tabletops, in support of Operational Testing, Developmental Testing, risk reduction events, and other assigned events
• Employ OPTEVFOR-provided and NAO-approved commercial and open-source cyber assessment tools, including but not limited to:
• Core Impact, Nmap, Burp Suite, Metasploit, Nessus
• Apply ethical hacking techniques to exploit discovered vulnerabilities and misconfigurations associated with:
• Operating systems (Windows, Linux, Unix)
• Network protocols and services (HTTP, FTP, DNS, PKI, HTTPS)
• Execute assigned tasks independently with oversight from intermediate or advanced operators
• Ensure all testing is conducted safely, in accordance with approved test plans and OPTEVFOR policies
• Adhere to JFHQ-DoDIN deconfliction procedures
• Verify accuracy and completeness of collected test data

Post-Test Activities

• Participate in the post-test iterative process, including development of deficiency and risk documentation
• Document lessons learned and contribute to continuous improvement of red team operations
• Participate in capture-the-flag events, cyber off-sites, red team huddles, and technical exchange meetings; develop required products and materials to support these activities
• Attend OPTEVFOR-required meetings in support of OT&E activities
  
  
  

DCWF Knowledge, Skills, Abilities, and Tasks (KSATs)

Tasks & Abilities

• Analyze target operational architectures to identify access vectors
• Conduct network reconnaissance, scouting, and vulnerability analysis
• Perform on-net and off-net activities to control and exfiltrate data
• Conduct open-source intelligence (OSINT) collection
• Deploy and utilize exploitation tools (e.g., backdoors, sniffers)
• Exploit network, security, and endpoint devices using approved methods
• Facilitate access via physical or wireless means
• Identify network strengths, weaknesses, and vulnerabilities
• Translate customer requirements into operational actions
  
  
  

Skills

• Interpreting vulnerability scan results
• Extracting and analyzing packet capture data
• Using remote command-line and GUI tools
• Processing collected data for follow-on analysis
• Verifying file integrity
• Determining patch levels and identifying patch signatures
  
  
  

Knowledge

• Computer hardware components and architectures (CPU, NICs, storage)
• Auditing and logging procedures
• Programming fundamentals
• Malware concepts
• Network infrastructure devices (routers, switches, firewalls)
• Exploitation tool structures and techniques
• System administration concepts for Windows and Unix/Linux
• Network architectures, protocols, and services (TCP/IP, DNS, web, mail)
• Virtual machine technologies
• Collection management processes, capabilities, and limitations