Lowe’s

Sr Analyst - Red Team Operator

Posted Yesterday

Be an Early Applicant

Charlotte, NC, USA

Hybrid

Senior level

Consumer Web • eCommerce • Information Technology • Retail • Software • Analytics • App development

Curiosity wanted. Innovation required.

The Role

Plan and execute authorized red team and adversary emulation operations across enterprise, cloud, identity, endpoint, application, and retail environments. Conduct initial-access testing, operate C2 infrastructure, develop offensive tooling, research endpoint evasion, validate Active Directory and cloud attack paths, and map findings to MITRE ATT&CK. Partner with defensive security teams to improve detection and response, produce technical and executive reports, recommend remediation, support purple-team exercises, and mentor team members.

Summary Generated by Built In

Innovate in Charlotte
Thank you for dedicating your time and talent to Lowe's. We want to give you more opportunities to learn and grow, so if you find a position you're interested in below, we encourage you to apply!
Your Impact
The Offensive Security Team is seeking a highly skilled Red Team Operator to help plan and execute authorized, threat-informed offensive security operations across Lowe's enterprise, cloud, identity, endpoint, and retail technology environments. This role will focus on realistic adversary emulation, initial access, C2 infrastructure, operational security, endpoint telemetry, evasion research, Active Directory, cloud identity, and offensive tooling.
What You Will Do

Plan, scope, and execute authorized red team and adversary emulation operations across enterprise, cloud, identity, endpoint, application, and retail technology environments.
Conduct realistic initial-access scenarios aligned to approved rules of engagement, including external attack surface testing, phishing simulation, identity abuse, public-facing application exploitation, SaaS/cloud footholds, and other authorized access paths.
Design, deploy, operate, and safely decommission C2 infrastructure used during approved red team operations.
Maintain strong operational security practices across tooling, infrastructure, logging exposure, operator behavior, payload safety, engagement deconfliction, and post-operation cleanup.
Develop, modify, test, and review offensive tooling, payloads, automation, and tradecraft in controlled and authorized environments.
Conduct endpoint telemetry and evasion research to understand how security controls detect, block, or miss adversary behavior.
Identify and validate attack paths involving Active Directory, ADCS, Kerberos, privileged access, trust relationships, Microsoft Entra ID, cloud IAM, SaaS platforms, and endpoint controls.
Partner with Detection Engineering, SOC, Threat Hunting, and Incident Response teams to improve visibility, alerting, response playbooks, and control effectiveness.
Translate red team findings into clear technical reports, executive summaries, attack narratives, detection gaps, and prioritized remediation recommendations.
Map adversary behaviors, findings, and emulation plans to common frameworks such as MITRE ATT&CK.
Support purple team exercises that validate detection logic, response workflows, and defensive control improvements.
Stay current on adversary tradecraft, offensive security research, cloud and identity attack paths, endpoint security capabilities, and emerging defensive technologies.
Mentor other offensive security team members and contribute to the development of repeatable methodologies, lab environments, tooling standards, and operational processes.

Minimum Qualifications

Bachelor's degree in computer science, computer information systems, engineering, business administration, cybersecurity, or related field or equivalent years of experience in lieu of education requirement, if applicable

4 years of experience in information security

Preferred Skills/Education

7+ years of hands-on offensive security experience, including 5+ years leading or executing full-scope red team and adversary emulation operations in complex enterprise environments, from initial access through post-exploitation and objective completion.
Experience planning and executing authorized operations involving phishing, external/application exploitation, identity abuse, cloud/SaaS footholds, and third-party scenarios, with strong command of C2 infrastructure, redirectors, engagement deconfliction, attribution control, payload safety, detection exposure, burn procedures, teardown, and rules of engagement.
Ability to develop, modify, and review offensive tooling, payloads, implants, or agents using languages such as Python, PowerShell, C/C++, C#, Go, or Rust, combined with hands-on knowledge of EDR/AV behavior, endpoint telemetry, SIEM visibility, evasion research, malware analysis, or reverse engineering.
Deep understanding of Windows and Active Directory attack paths including Kerberos, ADCS, delegation, trusts, privileged access, and lateral movement-along with cloud/SaaS attack paths involving Entra ID/Azure, Google Cloud/Workspace, OAuth, IAM, service accounts, and cloud security controls.
Experience building adversary emulation plans based on real-world threats, mapping activity to MITRE ATT&CK, and translating offensive findings into actionable detection gaps, control weaknesses, attack-path narratives, and remediation recommendations. Familiarity with EDR, SIEM/SOAR, CSPM/CNAPP, vulnerability management, attack surface management, and identity security technologies is expected.
Ability to operate effectively in large, complex enterprise environments and clearly communicate technical findings, business risk, and recommended actions to offensive and defensive security teams, engineering partners, and leadership. Experience in retail, e-commerce, supply chain, payments, or fraud environments and relevant offensive/cloud security certifications are preferred.

About Lowe's
Lowe's Companies, Inc. (NYSE: LOW) is a FORTUNE® 100 home improvement company with total fiscal year 2025 sales of more than $86 billion. Lowe's employs approximately 300,000 associates and operates over 1,750 home improvement stores, 540 branches and 120 distribution centers. Lowe's is a core value S&P 500 equity stock and a dividend aristocrat. Based in Mooresville, N.C., Lowe's supports the communities it serves through programs focused on creating safe, affordable housing, improving community spaces, helping to develop the next generation of skilled trade experts and providing disaster relief to communities in need. For more information, visit Lowes.com .
Lowe's is an equal opportunity employer and administers all personnel practices without regard to race, color, religious creed, sex, gender, age, ancestry, national origin, mental or physical disability or medical condition, sexual orientation, gender identity or expression, marital status, military or veteran status, genetic information, or any other category protected under federal, state, or local law.

Skills Required

Bachelor's degree in computer science, computer information systems, engineering, business administration, cybersecurity, or a related field, or equivalent years of experience where applicable
4 years of experience in information security
7+ years of hands-on offensive security experience
5+ years leading or executing full-scope red team and adversary emulation operations in complex enterprise environments
Experience with phishing, external and application exploitation, identity abuse, cloud or SaaS footholds, third-party scenarios, C2 infrastructure, redirectors, deconfliction, payload safety, and rules of engagement
Ability to develop, modify, and review offensive tooling, payloads, implants, or agents using Python, PowerShell, C, C++, C#, Go, or Rust
Hands-on knowledge of EDR/AV behavior, endpoint telemetry, SIEM visibility, evasion research, malware analysis, or reverse engineering
Deep understanding of Windows and Active Directory attack paths, including Kerberos, ADCS, delegation, trusts, privileged access, and lateral movement
Experience with cloud and SaaS attack paths involving Entra ID/Azure, Google Cloud/Workspace, OAuth, IAM, service accounts, and cloud security controls
Experience building adversary emulation plans, mapping activity to MITRE ATT&CK, and translating findings into detection gaps and remediation recommendations
Familiarity with EDR, SIEM/SOAR, CSPM/CNAPP, vulnerability management, attack surface management, and identity security technologies
Ability to communicate technical findings, business risk, and recommended actions to security teams, engineering partners, and leadership
Experience in retail, e-commerce, supply chain, payments, or fraud environments and relevant offensive or cloud security certifications

What the Team is Saying

Lowe’s Compensation & Benefits Highlights

Retirement Support — A 401(k) match up to 4.25%—with early eligibility and immediate vesting—is repeatedly highlighted, including access for regular part-time associates. Feedback suggests this makes retirement benefits a notable strength of the package.
Equity Value & Accessibility — An Employee Stock Purchase Plan with a 15% discount allows associates to buy company stock on favorable terms. Feedback suggests this ownership opportunity meaningfully supplements base compensation.
Parental & Family Support — Eligible full-time associates can receive up to 10 weeks of paid maternity leave and 4 weeks of paid parental leave, with adoption assistance and some fertility-related coverage also noted. Descriptions emphasize these as core elements of the family-support offering.

Learn more about Lowe’s's Compensation & Benefits →

Lowe’s Insights

What's It Like to Work at Lowe’s? Lowe’s Culture & Values Lowe’s Career Growth & Development What's the Work-Life Balance Like at Lowe’s? Lowe’s Leadership & Management Lowe’s Company Growth, Stability & Outlook

View all jobs at Lowe’s

View Lowe’s Profile

Report Job

Am I A Good Fit?

beta

Get Personalized Job Insights.

Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.

The Company

HQ: Mooresville, NC

300,000 Employees

Year Founded: 1921

What We Do

It’s curious to think of innovation and stability co-existing. But we pair a 100-year track record of success with a hunger to do things differently. Everyone is in the work — tackling complex problems where your impact can build back or build up the communities we serve. We fill our halls with curious minds from all walks of life. Our differences make us stronger, which is why our leaders build cultures of recognition and inclusion. You are heard, and your curiosities are celebrated and championed here.

Why Work With Us

We have built a space where the curious can move freely. Up in title, up in skills, to the side with teams, or back to try something completely new. We help you find your path — because when you win, we all win.