Offensive Security Specialist — Red Team & Deception (CyBearTrack)

Offensive Security Specialist — Red Team & Deception | CyBearTrack

Location: Nes Ziona, Israel (on-site) · Hours: Sunday–Thursday, 07:00–15:00 · Base: ₪18,000/month + performance bonuses on every successful authorised engagement

Contact: [email protected]

Read this first.

Right now, somewhere, a 74-year-old is being talked out of their pension by a stranger on a fake trading platform. By the time the family notices, the house is remortgaged and the money is three hops into a mixer. These are organised cartels running industrial fraud operations — call centres, phishing kits, cloned exchanges, laundering pipelines — and they target the old, the lonely, and the trusting on purpose, because it works.

We exist to hunt them.

CyBearTrack is a cyber-investigation firm working cryptocurrency fraud, blockchain tracing and OSINT. We work directly with victims, law enforcement and enforcement partners to trace stolen funds, unmask the operators, and build the cases that freeze money and put people in cuffs. We are an authorised preferred vendor to law-enforcement partners, and we go on the offensive only under lawful tasking, granted case by case for specific referred matters.

The role

You will go head-to-head with scam infrastructure — the fake platforms, admin panels, phishing kits and command channels these crews run — and you will build the traps that lure them into the open.

Two sides, most weeks you move between both:

• Deception — design and run the honeypots: decoy victims, instrumented wallets and environments that draw operators in and quietly record exactly how they work, what they use, and who they are. This is our own turf and the heart of the job.
• Authorised offensive operations — go directly at the cartel’s infrastructure, but only ever inside the authority granted for that matter: defined target, defined scope, defined objective, signed off before you touch a thing.

The difference between you and the people we hunt is one word: authorisation. You read a scam operator’s stack and you already know how the panel is held together — and you stop dead at the edge of scope without being told twice. That discipline isn’t paperwork. It’s what keeps you clean, keeps the case admissible, and keeps the bad guys the only ones who go to prison.

This is the sharp end of the work. When we get it right, money gets frozen, infrastructure gets burned down, and a family gets a phone call that says we got some of it back. If that’s the fight you want, this is your seat.

What you’ll be doing

• Build and run honeypots, decoy victims and instrumented environments that capture operator tooling, infrastructure and identifiers.
• Run authorised offensive engagements against scam infrastructure — recon, enumeration, web exploitation, panel and CMS internals — to an evidence-grade standard, inside signed scope.
• Scam-infrastructure recon: domain history, hosting, certs, exposed source, panel fingerprinting, kit identification, passive mapping from open sources.
• Capture and preserve evidence that survives court and law-enforcement scrutiny: chain of custody, hashing, contemporaneous notes, reproducible method.
• Feed technical findings back into the blockchain traces and OSINT attribution that drive our cases.
• Build and maintain custom tooling and honeypot instrumentation.

What we need

• Proven offensive-security experience — real penetration testing or red team work, years not weekends. CTF and bug-bounty track records count on top, not instead.
• Strong web-app and infrastructure skills: recon, enumeration, web exploitation, panel/CMS internals, network services.
• Honeypot / deception experience, or the clear ability to build it — instrumented environments, logging, capture pipelines.
• A working grasp of the legal line: the Israeli Computer Law, unauthorised-access rules, and why scope and authorisation are load-bearing. You know exactly where the line is and you do not cross it on your own initiative.
• Comfortable inside a documented, evidence-grade process — not freelancing.
• Scripting for custom tooling: Python, JavaScript, Bash.
• Discretion and professionalism. Our clients are victims and our matters are sensitive.
• Hebrew and English.
• OSCP, OSWE or equivalent strongly preferred.

Bonus points

• Honeypot/deception frameworks, malware and tooling analysis.
• Crypto laundering typologies and VASP disclosure processes.
• Prior law-enforcement, military intelligence (8200 or similar unit), or PI background.
• Reverse-engineering and threat-intel experience.

Compensation

Base ₪18,000/month, plus performance bonuses on every successful authorised engagement — completed in-scope operations, and honeypot captures and intelligence that move a live matter forward. Bonuses are tied to lawful, in-scope outcomes only. Nothing outside a granted authorisation is ever tasked or rewarded.

How to apply

Email [email protected] with your CV and a short note — a relevant engagement, a honeypot you built, or a result you’re proud of (redacted as needed), plus your availability. Show us how you think, and show us you know where the line is.