Cybersecurity Red and Blue Team Exercises Specialist
Sasso Consulting · Johannesburg, Gauteng
Overview
Sasso Consulting is hiring 5 experienced Red and Blue Team Exercises Specialists in Johannesburg. You will plan and run offensive security tests, threat simulations and defensive exercises to help enterprises strengthen their cyber resilience. This permanent role suits cybersecurity professionals with 3 to 5 years of hands-on Red Team, Blue Team or Purple Team experience. If you enjoy penetration testing, threat detection and working with SOC teams, this could be a great next step in your career.
About the role
Join Sasso Consulting as a Red and Blue Team Exercises Specialist and work at the front line of enterprise cybersecurity. You will assess and strengthen security defences through offensive security testing, threat simulation and defensive exercises. This is a permanent, full time role based in Johannesburg with 5 positions available.
What you will do:
- Plan and execute Red Team, Blue Team and Purple Team exercises
- Conduct penetration testing, adversary simulations and security assessments
- Identify vulnerabilities across networks, applications, endpoints, identity systems and cloud environments
- Evaluate security monitoring, threat detection and incident response capabilities
- Analyse security alerts, logs and suspicious activities using SIEM and EDR technologies
- Run threat simulations using the MITRE ATT&CK framework
- Identify security control weaknesses and detection gaps
- Collaborate with SOC analysts, security engineers and incident response teams
- Prepare technical reports and recommend remediation measures
- Validate security improvements through follow-up testing
Important: Candidates must demonstrate practical offensive or defensive cybersecurity experience. General IT support or theoretical cybersecurity knowledge alone will not be sufficient.
Requirements
- Relevant degree or diploma in IT, Computer Science, Cybersecurity or Information Security
- Minimum 3 to 5 years relevant cybersecurity experience
- Proven hands on Red Team, Blue Team or Purple Team exercise experience is essential
- Practical experience in penetration testing, adversary emulation, threat detection or incident response
- Strong knowledge of MITRE ATT&CK and cybersecurity testing methodologies
- Experience with tools such as Kali Linux, Metasploit, Burp Suite, Nmap or BloodHound
- Familiarity with SIEM/EDR platforms such as Microsoft Sentinel, Defender XDR, Splunk, QRadar or CrowdStrike
- Understanding of Active Directory, Windows, Linux, networking and cloud security
- Scripting knowledge in Python, PowerShell or Bash advantageous
- Certifications such as OSCP, CEH, GPEN, GCIH, CompTIA PenTest+ or CySA+ advantageous
Responsibilities
- Plan and execute Red Team, Blue Team and Purple Team cybersecurity exercises
- Conduct penetration testing, adversary simulations and security assessments
- Identify vulnerabilities across networks, applications, endpoints, identity systems and cloud environments
- Evaluate security monitoring, threat detection and incident response capabilities
- Analyse security alerts, logs and suspicious activities using SIEM and EDR technologies
- Conduct threat simulations using the MITRE ATT&CK framework
- Identify security control weaknesses and detection gaps
- Collaborate with SOC analysts, security engineers and incident response teams
- Prepare technical reports and recommend remediation measures
- Validate security improvements through follow up testing
Job details
- Organisation
- Sasso Consulting
- Location
- Johannesburg, Gauteng
- Job type
- Full time
- Experience level
- Mid (3+ years)
- Education
- Diploma
- Category
- Safety & Security
- Application Method
- Apply online
Success Guide
If you are eyeing this role, make sure your CV clearly shows hands on cybersecurity work, not just theory. Sasso Consulting has stressed that general IT support or purely theoretical knowledge will not cut it. Highlight specific Red Team, Blue Team or Purple Team exercises you have run, and name the tools and frameworks you used, such as MITRE ATT&CK, Kali Linux or Splunk. Certifications like OSCP or CEH will help you stand out. In interviews, expect questions about how you plan an exercise, how you analyse alerts and how you work with SOC teams. Be ready to talk through a real example of a vulnerability you found and how you helped fix it. Good luck!
How we help you prepare
This employer takes applications on their own website, so you'll submit this one yourself — but SPAAN NOW gets everything ready for you first. Here's how it works:
- Our AI tailors your CV to match this job's keywords and requirements, so it stands out to recruiters and screening systems.
- A custom cover letter is written specifically for this role — no generic templates.
- We gather the documents this job needs: CV, Diploma certificate and Degree certificate. SPAAN NOW pulls these from your profile and packages them together, ready to attach.
- Once your application is prepared, we show you exactly how and where to apply — just follow the link to the employer and submit your ready-made CV, cover letter and documents.
- Mark it as applied under Applications to keep track, and if you're shortlisted, use AI Interview Prep to practise questions commonly asked for roles like this.
We do the hard part — tailoring and gathering everything — so applying yourself only takes a minute.
Spaan Talk
Nobody has said anything yet. Be the first.