Offensive security roles share a common purpose: to evaluate systems, applications, and organizations from the viewpoint of a motivated adversary, then report what they find so defenders can address it. These are constructive professions carried out under authorization and clear rules of engagement. Their value lies not in breaking things but in producing evidence that helps an organization understand and reduce its real exposure.
Although the roles are related, they differ in depth, scope, and time horizon. Some focus on broad, repeatable assessments against defined targets, while others pursue narrow, deep questions about how a single technology can fail. The pages beneath this section describe each role in turn, including its typical responsibilities, the skills it draws on, and how it fits alongside defensive and governance work.
The Penetration Tester conducts scoped assessments that identify and validate weaknesses within an agreed boundary, producing findings and remediation guidance. The Red Team Operator takes a broader, goal-oriented view, emulating realistic adversary behavior to test an organization's detection and response as a whole. The Purple Team Specialist works at the meeting point of offense and defense, coordinating exercises so that offensive findings translate directly into improved defensive coverage.
Two further roles sit closer to research and engineering. The Vulnerability Researcher studies software, hardware, and protocols to discover previously unknown weaknesses and understand their root causes, often working through responsible disclosure. The Exploit Developer builds reliable proof-of-concept code that demonstrates the practical impact of a weakness, work that supports both testing engagements and defensive research.
Careers in this area rarely follow a single path. Many practitioners move between these roles over time, and the boundaries shift from one organization to another. Reading the individual pages alongside this overview helps a professional see where their interests fit and how the roles complement one another and the wider security program.