Manager, Offensive Security

About the role

Our Global Cyber Defense team protects Pfizer’s digital assets across on‑premises, cloud and hybrid environments. The Manager, Offensive Security leads offensive security operations, including penetration testing, red‑team, purple‑team and adversary simulation activities, ensuring findings are turned into actionable risk reduction.

Key responsibilities

• Lead day‑to‑day execution of offensive security activities such as penetration testing, red‑team engagements, purple‑team exercises and adversary simulations.
• Guide and mentor a team of offensive security engineers, providing technical direction, prioritization and coaching.
• Oversee planning, scoping and delivery of assessments to ensure risk‑based, repeatable outcomes aligned with business priorities.
• Document, validate and communicate findings to detection, remediation, engineering and risk teams.
• Partner with Threat Detection, Incident Response, Vulnerability Management and Engineering to translate findings into measurable improvements.
• Drive continuous improvement of offensive security tools, methodologies and processes for greater coverage and realism.
• Track engagement outcomes, recurring control gaps and risk trends, escalating material issues.
• Ensure activities comply with internal policies, regulatory expectations and ethical testing standards.
• Contribute to offensive security documentation, playbooks and reporting standards.

Required profile

• Bachelor’s degree in Information Security, Computer Science, Engineering or a related field, or equivalent practical experience.
• Minimum 4 years of experience in cybersecurity with a focus on offensive security, penetration testing, red‑team or adversary simulation.
• Proven ability to lead and mentor technical teams.
• Strong communication skills to convey findings to cross‑functional stakeholders.
• Experience working in regulated environments such as the pharmaceutical industry.

Required skills

• MITRE ATT&CK framework and adversary emulation methodologies.
• Application, cloud, network and identity penetration testing.
• Red‑team and purple‑team operations.
• Social engineering and phishing simulation techniques.
• Offensive security tooling and frameworks (e.g., Cobalt Strike, Metasploit, BloodHound).
• Understanding of modern enterprise environments (cloud, SaaS, hybrid).