Demonstrations and technical evaluations

• Work with to support your sales colleagues in the design and delivery of demonstrations, workshops and proofs of value grounded in realistic customer scenarios.
• Agree success criteria before evaluations begin, including the evidence needed to demonstrate technical and operational value.
• Explain findings clearly, distinguishing demonstrated results from assumptions and capabilities requiring further validation.
• Own technical objections and competitive discussions with accuracy, confidence and sound judgement.
• Develop reusable demonstration assets, technical explanations and reference scenarios that strengthen the sales team’s capability.

Threat-led security conversations

• Explain the distinctions and relationships between penetration testing, red teaming, purple teaming and THG’s black teaming approach.
• Discuss how Living off the Land and modern adversary tradecraft challenge detection, investigation and response.
• Connect threat intelligence and adversary techniques to relevant customer scenarios, rather than relying on generic attack demonstrations.
• Help customers understand how an assessment or simulation can generate evidence about control effectiveness and inform practical improvements.
• Work with delivery specialists to ensure proposed engagements have clear objectives, appropriate scope and achievable outcomes.

What we are looking for

Specialist knowledge and experience

We are looking for broad working knowledge across the following areas, with substantial practical depth in at least one and sufficient fluency across the others to lead credible technical discussions.

Detection and response environments

• Understand how security operations centres (SOCs), security information and event management (SIEM), endpoint detection and response (EDR), extended detection and response (XDR), managed detection and response (MDR), and incident response (IR) fit together.
• Discuss telemetry collection, detection coverage, alert triage, investigation, threat hunting and response workflows.
• Understand the importance of endpoint, identity, cloud and network visibility, including the limitations created by missing data, configuration gaps and fragmented tooling.
• Distinguish between a control being deployed, an activity being logged, a detection firing and an effective operational response.
• Assess how a proposed solution would fit into an existing security environment and operating model.

Red teaming, black teaming and modern tradecraft

• Understand adversary emulation, threat-led testing, purple teaming and the objectives of offensive security engagements.
• Have working knowledge of Living off the Land: the abuse of legitimate tools, native functionality and trusted services to conduct malicious activity.
• Discuss contemporary tradecraft involving identity and credential abuse, privilege escalation, lateral movement, persistence, cloud environments and evasion.
• Explain why apparently legitimate activity can be difficult to distinguish from malicious behaviour, and what this means for defensive visibility and investigation.
• Use MITRE ATT&CK to structure relevant scenarios and communicate coverage, while recognising that technique coverage alone does not prove defensive effectiveness.

AI and security

• Understand the practical application of AI, machine learning, generative AI and agentic systems in security workflows.
• Discuss AI-assisted investigation, threat analysis and automation, including data requirements, reliability, human oversight and operational limitations.
• Distinguish between using AI for security and securing AI-enabled systems.
• Have working familiarity with risks such as prompt injection, sensitive-data exposure, excessive tool permissions and unreliable outputs.
• Evaluate AI claims critically and explain where a capability is demonstrated, where it depends on customer context, and where uncertainty remains.

Threat intelligence

• Understand how strategic, operational and tactical threat intelligence support different security decisions.
• Translate reporting on threat actors, campaigns and tactics, techniques and procedures into relevant discovery questions and evaluation scenarios.
• Assess intelligence for relevance, timeliness, provenance and confidence.
• Connect intelligence to detection priorities and adversary emulation, moving beyond lists of indicators to explain behaviours and implications.

Presales capability and personal attributes

• Experience in security solutions engineering, technical presales, security consulting or a practitioner role involving substantial customer engagement.
• Ability to move between detailed technical discussion and a clear explanation of business value.
• Practical confidence with demonstrations, lab environments and technical troubleshooting.
• Strong discovery, presentation and technical writing skills.
• Commercial judgement: understanding how technical evidence helps customers make buying decisions.
• Intellectual curiosity and the discipline to maintain knowledge as products and adversary techniques evolve.
• Honest technical judgement: comfortable saying what is known, what needs testing and when another specialist should contribute.

Relevant certifications, research, lab work and community contributions are welcome. Demonstrated capability and customer credibility matter more than a particular qualification.

What success looks like

Customers gain a clear, evidence-based understanding of how THG can help them. Technical evaluations have agreed objectives and produce useful results. Sales colleagues receive authoritative support on complex opportunities. Product and delivery teams receive accurate requirements and commitments that can be fulfilled.

Over time, you become a trusted technical authority on HAPTAI, ACE and their relationship, helping THG turn advanced capabilities into solutions customers understand and value.

How to Apply

Tell us about a technically demanding customer conversation, demonstration or evaluation you led. What did the customer need to understand, how did you establish whether the solution fitted, and what changed as a result?

Contact: hr@thg-v.com