Senior Offensive Security Specialist — Red Team & Deception (CyBearTrack)

SSenior Offensive Security Specialist — Red Team & Deception (CyBearTrack)

Location: Nes Ziona, Israel (on-site) Type: Full-time, five-day week — Monday to Friday, 07:00–15:00 (40 hours/week) Compensation: Base ₪30,000/month Contact: [email protected]

CyBearTrack is a specialist cyber-investigation firm working cryptocurrency fraud, blockchain forensic tracing, and OSINT. We work directly with scam victims, law enforcement, and enforcement partners to trace stolen funds, unmask threat actors, and build cases that lead to real outcomes. CyBearTrack is an authorised preferred vendor to law-enforcement partners and takes offensive engagements only under lawful tasking granted case-by-case for specific referred matters.

This is a senior seat. We're looking for an offensive-security specialist who has already led engagements end-to-end and can own the hardest technical work we do — against the fake trading platforms, phishing kits, admin panels and command channels that fraud operators run against our clients — and who sets the standard for how it's scoped, authorised and documented.

You'll own two sides of the work. The first is deception: designing and running the honeypots — decoy victims, wallets and instrumented environments that draw fraud operators in and quietly capture how they work. The second is authorised offensive operations against scam infrastructure, conducted only within the authority granted for each referred matter — a defined target, scope and objective, signed off before anything is touched. You won't just execute within that boundary; you'll be trusted to define it, defend it, and call a halt when something falls outside it.

This is the seat for someone who reads an operator's stack and already knows how the panel is held together — and who treats the authorisation line as load-bearing, not bureaucracy.

• Deception infrastructure — architecting and running decoy victims, instrumented environments, decoy wallets and capture pipelines that attract fraud operators and harvest their tooling, infrastructure, identifiers and behaviour. This is CyBearTrack's own environment and the core of the role.
• Authorised offensive engagements — leading penetration testing and active operations against scam infrastructure, under the lawful authority granted for each matter, to a documented, evidence-grade standard you're responsible for.
• Scope and authorisation judgment — scoping engagements, assessing what a given authorisation does and does not permit, and owning the call on where the line sits.
• Scam-infrastructure reconnaissance — domain history, hosting, SSL certs, exposed source, panel fingerprinting, kit identification, and passive mapping of operator infrastructure.
• Evidence capture and preservation — to a standard that survives legal and law-enforcement scrutiny: chain of custody, hashing, contemporaneous notes, reproducible method.
• Authorised testing of CyBearTrack and client systems — under signed scope, to keep the recovery and evidence work defensible.
• Correlation — feeding infrastructure, identifiers and captures back into the blockchain traces and OSINT attribution that drive our cases.
• Tooling — building and maintaining custom scripts and honeypot instrumentation, and raising the bar on how we work.

• 5+ years of hands-on offensive security — penetration testing, red team or equivalent professional background, with a track record of engagements you scoped and ran yourself, not just contributed to.
• Deep web-application and infrastructure skills — recon, enumeration, web exploitation, panel and CMS internals, network services — at a level where you're the person others escalate to.
• OSCP, OSWE or an equivalent demonstrable track record — we expect proof you operate at this level, whether by certification or by work you can show.
• Sound judgment on legal boundaries — the Israeli Computer Law, unauthorised-access rules, and why scope and authorisation are load-bearing. You know exactly where the line is and you do not cross it on your own initiative.
• Deception / honeypot experience, or the proven ability to build it — instrumented environments, logging, capture pipelines.
• Discipline — you work within a documented, evidence-grade process and you make others' work defensible too.
• Familiarity with scam infrastructure — phishing kits, fake trading platforms, clone sites, Telegram/WhatsApp operations.
• Strong scripting — Python, JavaScript, Bash — for custom tooling and automation.
• Discretion and professionalism — our clients are fraud victims and our matters are sensitive.
• Hebrew and English.

• Honeypot/deception frameworks and malware/tooling analysis.
• Cryptocurrency laundering typologies and VASP disclosure processes.
• Prior law-enforcement, military-intelligence or private-investigation background.
• Reverse-engineering and threat-intelligence experience.

• Base: ₪30,000/month.
• Early-finish schedule — on-site, but done by mid-afternoon every day (07:00–15:00, Monday to Friday). Senior-level work without the always-on grind.

This isn't corporate security theatre and it isn't cowboy work. Every matter has a real victim behind it and a real authorisation in front of it. You get the interesting half of offensive security — against people who genuinely deserve the attention — inside a framework that keeps you, and the case, clean. When we get it right, money gets frozen, infrastructure gets exposed, and people get arrested. As the senior specialist, you're the one who makes that work hold up.

Email [email protected] with:

• A short intro — who you are and the shape of your offensive-security career.
• Two or three engagements you led (redacted as needed) — what the target was, how you scoped and authorised it, what you found, how you evidenced it. Honeypot builds and notable CTF/bug-bounty results welcome alongside.
• Your availability.

A CV is welcome but optional — what we care about is real work you've owned and the judgment you brought to it. Shortlisted candidates move to a technical conversation with the principal.