As Red Team Lead , you will lead and further develop SEB’s red team capability. You will combine extensive hands-on offensive security expertise with technical leadership, stakeholder coordination, and continuous improvement of methods, tooling, automation, and reporting.

This is a senior, hands-on technical role rather than solely a coordination or management position. You will lead complex engagements while remaining actively involved in security testing, adversary emulation, attack-path analysis, and the development of offensive security tooling.

You will work closely with penetration testers, security engineers, incident responders, threat intelligence specialists, application and platform teams, and external partners.

A key part of the role is to responsibly explore and operationalize AI-assisted offensive security . This includes using AI to accelerate research, analysis, automation, scenario development, security testing, and reporting while maintaining strong human oversight, security controls, and professional judgment.

• Lead red and purple team engagements from planning and scoping through execution, reporting, remediation follow-up, and lessons learned.
• Design realistic, threat-informed attack scenarios across applications, APIs, identities, endpoints, cloud services, infrastructure, and externally exposed assets.
• Perform and guide hands-on offensive security activities, including penetration testing, adversary emulation, exploitation, attack-path analysis, lateral movement, and security control validation.
• Define objectives, rules of engagement, test constraints, communication procedures, and escalation paths.
• Coordinate engagements with technical teams, business stakeholders, risk functions, and external security testing providers.
• Partner with detection engineering, incident response, threat intelligence, and security engineering teams to validate telemetry and defensive capabilities.
• Help improve security detections, response playbooks, and technical controls based on the outcomes of red and purple team exercises.
• Integrate findings with vulnerability management, secure development practices, technology risk reporting, and the wider penetration testing program.
• Define and continuously improve red team methodologies, quality criteria, tools, automation, metrics, and reporting standards.
• Translate complex technical findings and attack chains into clear business impact, actionable recommendations, and concise briefings for senior stakeholders.
• Coach and support offensive security specialists and contribute to a collaborative, learning-focused team culture.

• Apply AI and automation to reconnaissance, attack-surface analysis, hypothesis generation, scenario development, test-case creation, data analysis, evidence handling, and reporting.
• Develop or integrate secure AI-assisted workflows that improve the speed, quality, scalability, and repeatability of offensive security activities.
• Use coding and scripting to build prototypes, integrations, automation, and tooling for red team and penetration testing services.
• Explore how generative AI, large language models, and AI agents can support advanced security testing and security research.
• Evaluate AI-specific attack surfaces and security risks, including prompt injection, insecure tool use, sensitive-data exposure, excessive agency, and model or agent misuse.
• Assess weaknesses in AI-enabled applications, services, integrations, and agent-based workflows.
• Establish guardrails for responsible AI use in offensive security, including human validation, data handling, traceability, access control, and safe testing practices.
• Evaluate new AI-assisted offensive security tools and determine where they can provide genuine technical and operational value.
• Stay current with developments in adversary tradecraft, AI security, security research, automation, and emerging offensive security tooling.

To thrive in this role, we believe you have

• A minimum of 10 years of hands-on professional experience in offensive security, penetration testing, red teaming, adversary emulation, or closely related security testing. This is a mandatory requirement.
• Fluency in Swedish is a requirement.
• Demonstrated experience leading complex red team or offensive security engagements in large enterprise environments.
• The technical depth required to perform and guide hands-on testing, not only coordinate engagements.
• Extensive knowledge of common attack techniques, adversary behaviors, and attack paths.
• Strong knowledge of application security, identity attacks, cloud security, infrastructure security, APIs, and modern enterprise environments.
• Practical knowledge of frameworks and methodologies such as MITRE ATT&CK, OWASP, and PTES.
• Hands-on experience using offensive security tools and developing or adapting testing techniques.
• Practical experience with scripting, automation, and software development.
• Experience with Python, PowerShell, C#, or comparable programming and scripting languages.
• Practical understanding of generative AI, large language models, AI agents, and their application in technical security workflows.
• Experience assessing AI-enabled applications or applying AI within offensive security is highly desirable.
• The ability to evaluate new technologies critically and distinguish practical security value from experimentation or hype.
• A structured, risk-based mindset and the ability to balance technical depth with business impact, priorities, and operational constraints.
• Excellent analytical and problem-solving skills.
• Strong communication skills and the ability to explain complex technical findings to both specialist and senior audiences.
• Relevant certifications such as OSCP, OSEP, OSCE3, CRTO, GXPN, GPEN, or equivalent practical experience are considered an advantage.

The Team

You will be part of SEB’s Operational Security Center, working with specialists across penetration testing, security engineering, vulnerability management, threat intelligence, and incident response.

Together, we identify realistic attack paths, challenge defensive capabilities, validate security controls, and ensure that technical findings lead to concrete improvements in SEB’s cyber resilience.

The role provides an opportunity to combine deep offensive security expertise with AI, automation, and security engineering in a large and complex technology environment.

• A leading role in developing and evolving an advanced red team capability.
• The opportunity to remain technically hands-on while providing technical direction and leadership.
• The opportunity to combine deep offensive security expertise with AI, automation, and security engineering.
• Challenging, high-impact engagements that influence SEB’s security posture and defensive priorities.
• Opportunities to experiment with and develop new AI-assisted offensive security capabilities.
• A collaborative environment with highly skilled security specialists.
• Continuous learning and professional development opportunities.
• A hybrid workplace model based in Stockholm.

Do you want to be part of SEB?

It is our fundamental belief that inclusion and diversity is crucial for our future success. We strive to have an inclusive, value-driven culture where employees feel valued, respected, and involved irrespective of who they are, what they believe or where they come from.

Since we select candidates continuously, feel free to send in your application today via the link in this ad, but no later than 2026-10-26. If you have questions about the position, please contact Talent Acquisition Partner Linn Odén at , note that we will not process applications via email.

Please be aware that our final candidates undergo background checks, a process that includes for example identity control, verification of qualifications, credit checks, company engagements and history of crime. In some cases, we also apply random drug checks. During employment, employees within SEB can also expect to undergo recurring background checks.

SEB Sweden has a redeployment responsibility, which means that this position might be covered by internal redeployment.