Red teaming is one of the most sought-after offensive security jobs, yet most people who want it apply too early, with penetration testing skills and no evidence they can operate as a disciplined, authorised adversary inside a governed exercise. This guide explains what red teamers actually do, how the work differs from penetration testing and purple teaming, the skills and experience employers look for, realistic routes in, and which certifications help at each stage. It is written for penetration testers, SOC and detection staff, and engineers considering the move, and for managers building or hiring a red team. It covers careers and credentials only, not attack techniques. Certification facts are summarised from the providers' pages as checked in October 2026; terms and prices change, so confirm them before you book.
Key takeaways
- Red teaming tests people and process, not just systems. The job is to show whether an organisation would detect and respond to a realistic adversary pursuing a business objective, inside rules set by a control team that can halt the test at any time.
- Penetration testing is the usual entry point. Most red teamers spend several years as penetration testers or in a SOC first; regulated schemes expect experienced leads, with DORA requiring an external red team manager with at least five years' penetration testing and red team testing experience.
- Judgement and discipline matter as much as technical skill. Staying in scope, keeping evidence, deconflicting with the control team and writing a report that defenders can act on are what separate an operator from a hobbyist.
- Certifications signal stages, not readiness. Practical penetration testing exams (OSCP+, HTB CPTS, PNPT) prove foundations; adversary simulation and Active Directory credentials (CRTO, CRTP, OSEP) and CREST red team qualifications signal specialisation.
- The work is legal only with written authority. Every action rests on a signed scope and rules of engagement from someone entitled to give permission; outside that, the same activity is a criminal offence in most jurisdictions.
What the role does
A red team runs a controlled, goal-driven simulation of a realistic adversary against production systems, usually without the defenders being told. The output is evidence of how far the adversary got, what the defenders saw and how they reacted. The Red Teaming Guide covers how organisations commission and govern these exercises; this page is about the people who do the work.
| Role | Main question | Defenders told? | Typical day-to-day work |
|---|---|---|---|
| Penetration tester | What vulnerabilities exist in this scope? | Yes | Time-boxed tests of applications, networks or cloud estates, ending in a findings report |
| Red team operator | Can an adversary reach a business objective, and would we notice? | No, only the control team | Executing approved scenarios, maintaining access within the rules, recording every action with timestamps |
| Red team lead or manager | Is the exercise realistic, safe and useful? | No, only the control team | Scoping with the control team, test planning from threat intelligence, risk decisions, client communication, report sign-off |
| Purple team practitioner | Which attacker behaviours do our controls detect? | Yes, working together | Joint sessions with detection engineers, replaying behaviours and tracking detection gaps. See the Purple Teaming Guide |
Red teams exist in three settings: consultancies that deliver exercises for clients (including regulated threat-led tests), in-house teams in large enterprises and governments, and product or research teams building emulation tools. Consultancy work brings variety and travel; in-house work brings depth in one estate and closer ties to the blue team.
The regulated end of the market
Financial regulators run threat-led schemes that shape what senior red teamers need to know:
- TIBER-EU and DORA TLPT: the European Central Bank's framework and the EU threat-led penetration testing rules under Commission Delegated Regulation (EU) 2025/1190, which set at least 12 weeks of active testing and a closure purple teaming exercise. See the Threat-Led Penetration Testing Guide.
- CBEST: the Bank of England's intelligence-led assessment for UK financial firms, delivered by accredited providers whose staff hold qualifications such as CREST Certified Red Team Manager (CCRTM).
Working on these engagements means following a control team's process, working from a threat intelligence provider's scenarios, and expecting vetting and background checks.
Core skills and tools
| Skill area | What employers look for | How to show it |
|---|---|---|
| Operating systems and Active Directory | Deep Windows and Linux administration knowledge; how domains, trusts, Kerberos and group policy work in real estates | Home lab you built and documented; Active Directory-focused certifications |
| Networking and cloud | Routing, DNS, proxies and egress controls; identity and permission models in major cloud platforms | Cloud certifications or lab write-ups; see the Cloud Penetration Testing Guide |
| Programming and tooling | Reading and modifying code; writing small tools and automation; understanding command and control frameworks at an architectural level | Public, responsibly scoped open source contributions |
| Detection awareness | Knowing what endpoint, identity and network telemetry defenders collect, so you can report what was and was not seen | SOC or detection engineering experience; purple team work |
| Threat intelligence literacy | Turning a threat intelligence report into a realistic scenario; using MITRE ATT&CK as a shared language with defenders | Scenario write-ups mapped to ATT&CK tactics |
| Operational discipline | Logging every action, protecting client data, deconflicting with the control team, stopping when told | References from engagement leads; clean reports |
| Communication | Reports and debriefs that explain business impact to executives and give defenders precise, actionable findings | Sample reports from labs; conference or meetup talks |
Where identity fits
Most modern red team narratives turn on identities: a phished user, a reused password, an over-privileged service account, a leaked API key or a cloud role that grants more than it should. Red teamers who understand identity governance write findings that identity teams can fix, such as which non-human identity enabled lateral movement and which control would have broken the chain. The Red Teaming AI Agents for Identity Abuse guide covers the newest part of this, and the AI Red Teaming Guide covers testing AI systems themselves.
Ethics and legal limits
- Written authority: scope and rules of engagement signed by someone entitled to authorise testing of each system. A client cannot authorise testing of a third-party platform it does not control. The Red Team Rules of Engagement Template shows what to agree.
- The law: in the UK, unauthorised access is an offence under section 1 of the Computer Misuse Act 1990, and section 3A covers making or supplying articles for use in offences. Other jurisdictions have equivalents. Authorisation is what makes the work lawful.
- Safety: the control team can order a temporary or complete halt. Operators who hide problems or push past a stop instruction do not keep red team jobs.
- Data handling: treat anything you access as the client's confidential data; collect proof of access, not bulk data.
Routes into the role
| Starting point | Typical bridge | Gap to close |
|---|---|---|
| Penetration tester (most common) | Join red team engagements as a junior operator after two or more years of testing | Stealth and patience, detection awareness, long-running operations, threat-led scenario work |
| SOC analyst or detection engineer | Purple team work, then an internal red team | Offensive tooling, Active Directory depth, report writing for clients |
| Systems, network or cloud engineer | Internal security testing, then penetration testing | Testing method and ethics, offensive certifications |
| Software developer | Red team tooling and infrastructure roles | Operational experience and engagement governance |
| Graduate or apprentice | Consultancy graduate scheme in penetration testing | Usually several years before red team work; build foundations first |
Very few employers hire straight into red teaming without prior offensive or defensive experience. The Penetration Tester Career Guide covers the first step in detail, and the Cybersecurity Careers Guide maps adjacent roles. Bug bounty work, done within published programme rules, can also build a public record; see the Bug Bounty and Vulnerability Disclosure Guide.
For employers, the choice is between growing operators from an existing penetration testing or SOC team, which keeps knowledge of the estate in-house, and hiring experienced consultants, which is faster but costlier. Small organisations rarely need a standing red team; they buy exercises and invest internally in purple teaming.
Certifications that help
Facts are summarised from our certification guides, each checked against the provider's own pages in October 2026. The table is descriptive, not a ranking.
| Stage | Credential (provider) | What it shows | Notable rules |
|---|---|---|---|
| Foundation | OSCP / OSCP+ (OffSec) | Practical penetration testing under a tight clock, including Active Directory | 23 hours 45 minutes, proctored, report required; OSCP+ expires after three years |
| Foundation | HTB CPTS (Hack The Box) | A full engagement and a commercial-grade report | 28-module path first; 10 days to test and report |
| Foundation | PNPT (TCM Security) | Consultancy workflow from OSINT to debrief | 5 days testing, 2 days reporting, live 15-minute debrief; does not expire per TCM Security |
| Specialist | Red Team Operator, CRTO (Zero-Point Security, acquired by Fortra in 2026) | Adversary simulation from an assumed breach with a command and control framework | Flag based, at least 6 of 8 flags; up to 48 hours runtime in a 4-day window |
| Specialist | CRTP (Altered Security) | Active Directory assessment across domains and forests, with mitigations | 24-hour exam plus report; expires after three years with a free renewal exam |
| Specialist | OSEP (OffSec) | Advanced evasion and breaching defences, positioned after PEN-200 and OSCP | See the OSEP and OSWE Certification Guide |
| Senior and regulated | CREST CCRTS and CCRTM | Red team specialist and manager competence recognised in UK regulated schemes | Check CREST for the current syllabus and requirements |
- Choosing: one practical foundation credential is enough to reach interview; pick by employer demand (OSCP is the most often named) and how you learn. Then choose a specialist credential by the work you want: CRTO for adversary simulation, CRTP for Active Directory depth, OSEP for evasion-heavy work.
- UK and regulated work: if you aim for CBEST or similar engagements, CREST qualifications and vetting matter more than any lab badge.
- Do not stack badges: two or three well-chosen credentials and a record of real engagements beat a long list. The Practical Red Team Certifications Guide and HTB CPTS Certification Guide go deeper.
Progression
| Level | Typical titles | Responsibilities |
|---|---|---|
| Junior | Junior operator, associate red teamer | Executes assigned tasks in approved scenarios under supervision; keeps the operation log; drafts report sections |
| Mid-level | Red team operator, consultant | Runs workstreams end to end; builds and maintains test infrastructure; briefs the control team |
| Senior | Senior operator, technical lead | Designs scenarios from threat intelligence; leads purple team replays; reviews reports; mentors juniors |
| Lead or manager | Red team lead, red team manager | Owns engagements with the control team, risk decisions and client relationships; under DORA TLPT, the external manager needs at least five years' penetration testing and red team testing experience |
| Head of function | Head of offensive security, adversary simulation director | Runs the offensive programme, sets method and quality, links results to risk and investment decisions |
Side moves are common and valuable: into detection engineering (see the Detection Engineer Career Guide), threat intelligence, security architecture or offensive tooling research. Red teamers who can explain findings in business terms also move into security leadership.
Measuring your effectiveness
- Findings remediated: share of red team findings closed by the agreed date, not the number raised.
- Detections created: new or improved detections that came from your purple team replays.
- Objective realism: scenarios traceable to threat intelligence rather than to your favourite tools.
- Operational safety: zero unplanned outages, scope breaches or data-handling incidents.
- Report quality: feedback from defenders and executives on whether the report changed decisions.
Framework mapping
These are the controls red team work most directly supports; the mapping is ours, as a justification aid for training budgets.
| Framework | ID | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | CA-8(2) Red Team Exercises | The control enhancement red teamers deliver |
| NIST SP 800-53 Rev 5 | CA-8(1) Independent Penetration Testing Agent or Team | Independence is why external red teams are hired |
| NIST SP 800-53 Rev 5 | AT-3 Role-based Training | Supports funding of specialist offensive training |
| NIST CSF 2.0 | ID.IM-02 | Improvements are identified from security tests and exercises |
| NIST CSF 2.0 | PR.AT-02 | Individuals in specialised roles are trained for their tasks |
Common failure patterns
- Applying too early: candidates with lab badges but no engagement experience; a few years of penetration testing or SOC work first is the usual route.
- Tool-first thinking: learning frameworks instead of the systems and defences underneath; tools change, fundamentals do not.
- Ignoring the defender's view: red teamers who cannot explain what the blue team should have seen produce reports nobody can act on.
- Weak governance habits: poor logging, scope drift or collecting more data than needed; one incident can end a career and a client relationship.
- Collecting certifications instead of evidence: hiring managers ask what you did and how you reported it.
Practitioner checklist
- Build two or more years of penetration testing, SOC or detection experience before targeting red team roles.
- Earn one practical foundation credential (OSCP+, HTB CPTS or PNPT) chosen by local employer demand.
- Build and document an Active Directory and cloud home lab, and learn what defenders see in it.
- Write sample reports that map scenarios to MITRE ATT&CK and give defenders specific fixes.
- Take part in purple team sessions to learn detection engineering from the other side.
- Learn the governance of TIBER-EU, DORA TLPT or CBEST if you aim for regulated work.
- Choose one specialist credential (CRTO, CRTP, OSEP or a CREST red team qualification) by the work you want.
- Never act outside written authority; know the law in every jurisdiction you test in.
Standards and references
- European Central Bank: TIBER-EU framework and guidance
- EUR-Lex: Commission Delegated Regulation (EU) 2025/1190 on threat-led penetration testing
- Bank of England: CBEST Threat Intelligence-Led Assessments Implementation Guide
- European Central Bank: TIBER-EU Purple Teaming Best Practices
- CISA NICCS: NICE Framework Work Role, Vulnerability Analysis
- UK Government: Computer Misuse Act 1990, section 1
- NCSC: Penetration testing
- Hack The Box: Academy Certifications
Related NHI Mgmt Group resources: Red Teaming Guide · Purple Teaming Guide · Penetration Tester Career Guide · Practical Red Team Certifications Guide · Cybersecurity Careers Guide