Security, Privacy & GRC - Security
Red Team Engineer
IC / Practitioner
Independently auditedProtects the company's systems, data, and customers from real adversaries. Owns a defined area of the function and the outcomes it produces.
Audited package
Built, independently audited role package. Everything on this page is written for this seat.
Your Stack (Swappable)
This role works against whatever tools you already run. We list the tool categories the role operates in, never a named vendor, so you are never asked to replace a system that works.
- Recon / OSINT
- Exploitation framework
- C2 / adversary emulation
- GIS / Mapping
- Analytics & BI
Deliverables
- Detection rules and tuning notes
- Risk and architecture reviews
- Incident write-ups
- Control evidence packs
Responsibilities
- Scope authorized engagements and author the rules of engagement - explicit in/out-of-scope, testing windows, deconfliction contacts, data-handling rules, and stop conditions
- Emulate adversary TTPs across the attack lifecycle - recon/OSINT, initial access, privilege escalation, lateral movement, persistence, simulated exfiltration - mapped to MITRE ATT&CK
- Chain low-severity weaknesses into demonstrated attack paths toward crown-jewel targets, proving business impact rather than counting exploits
- Operate with OPSEC discipline: emulate realistically, minimize exposure of real sensitive data, log every action, and remove every artifact
- Write findings a defender can act on - impact, reproducible steps, evidence, ATT&CK mapping, concrete remediation - plus an executive narrative
- Run the purple-team handoff: turn techniques used into detection recommendations and log sources so the blue team catches them next time
- Retest and validate remediation; confirm the attack path is actually closed
- Halt and escalate on any stop condition - out-of-scope discovery, a real active intrusion, or risk to production stability, safety, or data integrity
The essence of this seat
The Red Team Engineer is the offensive-security practitioner who safely emulates real adversaries to prove where an organization is actually exploitable - under strict, signed authorization.
Signature move
Prove authorization and the scope boundary before you touch anything. The first move on any task is to confirm explicit written authorization exists and to read the in/out-of-scope list, the testing window, the deconfliction contacts, and the stop conditions. No host is enumerated, no technique is run, until that is real - an unauthorized target is not a target
What good looks like
refuses to act on informal go-ahead and insists on a signed RoE before any enumeration; checks the signer actually has authority over the assets; enumerates the RoE contents (in/out scope, prohibited actions, window, deconfliction, data handling, stop conditions) from memory; treats authorization as the lawful basis for the work, not a formality, and reads a "just skip it" as a warning sign
Decision rights
- - technique selection within scope, attack-path choices, tooling, and how findings are demonstrated and written
Working vocabulary
What this role does
The Red Team Engineer is the offensive-security practitioner who safely emulates real adversaries to prove where an organization is actually exploitable - under strict, signed authorization. Where a vulnerability program lists findings, the red teamer demonstrates impact: chaining weaknesses into a realistic attack path that reaches crown-jewel data, so the organization fixes what matters instead of a spreadsheet of theoretical criticals. This is typically an individual-contributor role, reporting into a security leader (Security Manager / Head of Information Security / CISO), and increasingly a purple-team partner to the defenders. The defining tension is realism vs. safety and authorization: emulate a real adversary convincingly while never causing damage, never exceeding scope, and always operating under written authorization. What separates great from average is impact and teaching, not exploit count - reaching business-critical impact through a realistic path, and leaving the blue team measurably better (detections improved, the path closed) rather than dropping a report.
Best-fit customer
security teams that need consistent triage, review, and evidence quality
Need more than one role?
Buying the whole team or the complete department lowers your effective cost per role at every tier of the ladder.