Red Teamer
Long campaigns, adversary emulation, AD chains, evasion against modern EDR.
Glamorous from the outside; mostly tooling, OPSEC, and long quiet weeks.
Read the full role verdict and reasoning
Adversary simulation that tests an agreed defensive objective under explicit operating boundaries.
- Domain
- Cybersecurity
- Entry
- Not mapped
- Senior
- Not mapped
- You've got serious pentest, malware or detection-engineering background already
- You think in objectives and TTPs, not vulnerabilities and CVSS scores
- You can write tooling that survives contact with a competent blue team
- You're comfortable working alone for weeks before you have anything to show
- You want unsupervised offensive work before developing scope and operational-safety evidence
- You prefer rapid feedback to the preparation and reporting of the advertised engagement
- You'd struggle with operating quietly and never getting public credit
What "doing well" looks like in the seat
- You build, lose, and rebuild infrastructure without breaking stride
- Your TTPs evolve with the target, you don't run the same playbook twice
- Blue teams find your work hard to detect even when they're warned in advance
- You can defend every operational decision in a post-engagement debrief
Preparation and coordination are substantial parts of the work. Check authorisation, stop conditions and how observations become defensive improvements.
Tradeoffs at a glance
Open a tradeoff for its meaning. Ratings are directional, not absolute.
Promotion ceiling
High at senior IC; small market, mostly large enterprises and gov.
Who actually gets in
- +Pentester
- +Malware analyst
- +Offensive consultant
Common misconceptions
- −That it's the natural next step from pentest, different skillset entirely.
Where this leads
- Adversary Emulation
- Tooling / C2 dev
- Detection (purple)
Certifications people pair with this
Listed because the graph connects them to this role, not because you need all of them. Most practitioners pick one or two.
Pathways that pass through here
What this is based on
Editorial route and career guidance. No separate external evidence review is recorded for this assessment.
Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.