FunctionRun adversary emulation end-to-end, then feed actionable detection intel back to Blue/Purple. When the op tempo dips, slide into full-stack penetesting to keep the bench at zero. Core Responsibilities 1. Adversary OperationsPlan and execute campaigns from initial access (phish, macro, cloud mis-config) to objective (data theft, privilege escalation).Maintain strict OPSEC: staged infra, domain fronting, cleanup, and burn plans.2. C2 & Payload EngineeringBuild/operate C2 infrastructure (Cobalt/Sliver/DIY), develop loaders, droppers, and phishing kits.Craft cloud-aware implants (AWS STS, Azure MSGraph abuse) and identity-persistence mechanisms.3. Replayable TTP KitsPackage attack chains into Atomic/Caldera/custom modules so Blue can replay them.Document expected telemetry and detection logic.4. Exploit / Malware R&DResearch new vulns, develop PoCs that integrate with ops tooling, weaponise only when ROI justifies.5. Purple-Team LoopAfter every op, debrief D&R: dwell-time vs controls, missed alerts, log gaps.Tune SIEM/EDR rules or write Sigma/YARA as needed.6. Pentest Backfill (rotational)Deliver scoped web/API/infra/cloud tests when red-team bandwidth allows.