Where a penetration test catalogs weaknesses, a red team operator pursues a single objective the way a real attacker would. The operator runs goal-based, full-scope campaigns that emulate a credible threat actor, working toward a defined outcome such as reaching a specific dataset or demonstrating a particular business impact, and does so in a way that tests people, process, and technology together. The defining question is not only whether a path into the organization exists, but whether the organization notices and responds when that path is taken.
Responsibilities#
- Plan and run engagements that unfold over weeks rather than hours.
- Study the target environment and select techniques that mirror a chosen threat actor.
- Operate beneath the defenders' detection thresholds while making progress toward the objective.
- Manage command and control, maintaining a quiet, resilient channel to compromised systems.
- Weigh each action against the engagement goals and the risk of being caught.
- Keep careful records of what was done and when, so the campaign can be reconstructed and compared against what defenders observed.
Skills and background#
- Technical breadth: a broad foundation across operating systems, networks, identity systems, and common enterprise software.
- Defensive awareness: a strong grasp of how defensive tooling and security operations teams work, so activity can be shaped around them.
- Judgment: patience and discipline to balance progress against stealth and the rules of engagement.
- Communication: clear writing that turns a campaign into lessons defenders and leadership can act on.
Getting into the role#
Most operators arrive after experience in a related discipline rather than starting here directly. A common path runs through penetration testing or security operations, where a practitioner builds the technical range and operational awareness that red teaming demands. Recognized training and certifications in adversary emulation can support the move, though demonstrated experience carries particular weight.
Career progression#
Growth tends to move from executing portions of a campaign under guidance, toward leading engagements, designing scenarios tied to specific threats, and eventually shaping a team's methodology and its relationship with the organizations it serves. From there, operators often influence detection strategy and broader security architecture.
Related roles#
- Penetration Tester: aims for breadth of exploitable findings within a defined scope, where a red team prioritizes stealth and one realistic objective.
- Purple Team Specialist: works openly with defenders to improve controls, a collaborative counterpart to the covert red team campaign.
- Exploit Developer: supplies the reliable capabilities an operator may need to demonstrate impact during an engagement.