tbcsec.io
dossier

About

I'm Tom Collier — a red team operator in the defense industry, based on the UK's south coast. For the last three years I've emulated advanced threat actors against enterprise-scale environments: intelligence-driven campaigns, covert and overt, planned and executed end-to-end and reported all the way up to the executives who need to act on them.

The other thread of my career is competition infrastructure. I'm the technical lead behind an international cyber-defense competition — 1,200+ cloud instances serving 1,900+ students on three continents — and that experience became Flagpost, an open-source CTF platform built the way I wished the tooling had worked.

timeline
  1. 2024 —

    Red Team Operator

    Defense industry · UK
    • Led 20+ end-to-end engagements, from targeted assessments to multi-week covert operations — technical execution through executive debrief.
    • OSINT against high-profile government programs; surfaced leaked credentials that triggered an internal access review.
    • Built internal tooling that cut registry reconnaissance time by 80%, adopted across the team.
    • Designed and executed controlled ransomware-emulation campaigns to validate detection gaps at enterprise scale.
  2. 2023 —

    Technical Lead

    International cyber-defense competition
    • Architect of the competition’s AWS environment — 1,200+ EC2 instances, VPCs, S3 and Directory Services — supporting 1,900+ students across three continents.
    • Wrote open-source CTFd plugins improving the player and volunteer experience, and structured feedback capture.
    • Led new defensive challenges built on a custom Linux agent, and pioneered AI red-team challenges.
  3. 2021 — 2024

    Engineering Leadership Development Program

    Rotational · red team & network engineering
    • Red team rotation: Linux endpoint testing lead across enterprise RHEL and Ubuntu images; white-box vendor application testing with coordinated responsible disclosure; integrated AI capabilities into team tooling.
    • Network engineering rotation: hardened 200+ sovereign network devices against known CVEs; supported 15+ EMEA sites and 2,000+ users.
  4. 2019 — 2021

    Service Desk Analyst

    Global enterprise
    • Global application support; rebuilt the UK restricted account-creation process with scripted automation, eliminating manual steps.
  5. 2018 — 2019

    Technical Support Specialist

    CCD Solutions · Southampton
    • Sole engineer for a seven-site, 100+ user business — Active Directory, network, firewall and hardware.
  6. 2015 — 2019

    Field Network Engineer

    The Great Run Company · Southampton
    • Event network infrastructure including the 2017 World Athletics Championships in London — low-latency uplinks for live national-broadcast TV coverage.
capabilities
offense
  • Adversary emulation
  • C2 — Cobalt Strike, Mythic, Sliver
  • Active Directory attacks
  • Web & application testing
  • Reconnaissance & OSINT
  • MITRE ATT&CK / kill chain
platforms
  • Kali Linux
  • Burp Suite
  • Windows & Linux internals
  • AWS at competition scale
  • Python & automation
delivery
  • Intelligence-driven assessment design
  • Findings & remediation reporting
  • Technical writing
  • Executive briefing
certifications
CompTIA Network+ achieved
AI Red Teaming Professional (AIRTP+) achieved
Certified Red Team Operator (CRTO) in progress
OffSec Certified Professional (OSCP) in progress

Full CV available on request — tom@tbcsec.io.