Hiring a red teamer: what sets them apart from a pentester

Plenty of job ads mention "red team" while describing a pentester role. The confusion is costly: you attract candidates who expect long, stealthy operations, then keep them busy auditing web applications. This guide helps you decide whether you really need a red teamer, what sets them apart from a pentester and how to assess them on what they can actually do.

Pentesting and red teaming: two different goals

Pentesters and red teamers often use the same techniques. What changes is the question they answer.

A penetration test looks for as many vulnerabilities as possible within a defined scope and time frame. The defence team is usually aware of it. The deliverable is a prioritised list of weaknesses with recommended fixes.

A red team operation simulates a realistic attacker pursuing a specific goal: reaching sensitive data, taking control of a critical system, hijacking a business process. It tests the organisation as a whole, including its ability to detect and respond. Only a handful of people know it is happening. The deliverable tells the story of an attack, what the defence saw or missed, and what needs to improve.

A good pentester is not automatically a good red teamer, and the reverse is true too. If what you need is classic penetration testing, our guide to hiring a pentester is a better starting point.

Do you need an in-house red teamer?

A red team operation measures your defensive capability. It only makes sense if that capability exists. Before opening a role, check these prerequisites:

• Detection in place. An in-house or managed SOC, usable telemetry, alerts that get handled. Without it, the operation will mostly prove that nobody is watching, which you probably already know.
• Regular penetration testing. If basic vulnerabilities are not being fixed, a pentest delivers more value at lower cost.
• A sponsor at the top. A stealthy operation involves teams who are not told. You need a clear mandate from leadership and a solid legal framework.
• A real intent to act on the findings. The most useful work starts after the operation, with the defence team.

Many organisations bring in a provider for red team exercises, and that is often the right call at first. An in-house role makes more sense once exercises become regular, the environment is complex or regulation requires advanced testing. That is the case in finance, where the DORA regulation provides for threat-led penetration testing at certain entities: our article on DORA and cyber hiring in finance covers the roles involved. Even when the exercise is outsourced, someone in-house must be able to prepare it, steer it and get value from it.

Skills to check

A solid offensive foundation

A red teamer must master what a senior pentester masters: Active Directory and its attack paths, privilege escalation on Windows and Linux, lateral movement, cloud environments and identities. Our guide to hiring an Active Directory expert lists useful concepts to check.

Stealth and knowledge of the defence

This is the real difference. A red teamer knows what an EDR, a SIEM and a SOC team can see. They choose their actions based on the traces those actions leave, and they can explain why. A candidate who only thinks in terms of exploitation and never mentions detection is still a pentester.

Attack infrastructure and tooling

An operation means building and running infrastructure: command and control servers, redirectors, initial access handling. The candidate should be able to set it up cleanly, secure it and tear it down. Development skills (scripts, custom tools, adapting existing ones) are often expected in senior roles.

Initial access and the human side

Depending on scope, an operation may include targeted phishing, social engineering or physical intrusion testing. These are sensitive, legally and for the people involved. Check that the candidate knows the limits and can frame them with leadership, HR and legal.

Planning and debriefing

An operation needs preparation: intelligence on the target, scenarios based on realistic threats, rules of engagement, checkpoints with the control group. At the end, the red teamer must deliver a precise timeline, match each action with what the defence saw or missed, and lead a constructive session with the blue team.

Rules and ethics

Even more than in pentesting, the framework is not negotiable. A red team operation involves people who do not know they are being tested and can disrupt production if handled badly. A good candidate brings up, unprompted:

• the authorisation letter and the approved scope, including what is explicitly excluded;
• the control group, kept informed, who can stop the exercise at any time;
• the deconfliction procedure if the defence detects the operation and launches a real incident response;
• protection of any data accessed during the operation and its destruction at the end;
• the legal and human limits of social engineering.

A candidate who talks lightly about actions taken outside their mandate should be ruled out, whatever their technical level.

Profiles that succeed

Most red teamers come from pentesting, after several years of varied engagements. They have grown fond of long scenarios and stealth. Others come from defence: senior SOC analysts, detection engineers or incident responders who know exactly what the blue team sees. They bring a real asset, provided they also have genuine offensive practice.

The opposite move happens too: red teamers join the defence side as threat hunters or detection engineers. If your priority is to improve detection rather than test it, one of those roles may fit better than a red teamer.

How to assess a candidate

Advanced offensive certifications and public contributions give hints, but they do not show how a candidate runs an operation against a defended environment. As with any technical role, a hands-on exercise remains the most reliable approach, as explained in our article on assessing skills beyond the CV.

A process that works well:

1. A conversation about past operations. Ask for one specific operation: objective, scenario, what was detected, what failed, what the client fixed afterwards. Without asking for confidential details.
2. A hands-on lab with active defence. A training environment with basic detection and a goal to reach. You watch stealth as much as results.
3. A debrief. The candidate walks through their timeline and what a defender should have seen. This step best reveals their value to the blue team.
4. A conversation with the manager about the framework, rules of engagement and how the team works.

Useful interview questions

• "How do you tell a pentest from a red team operation?" A convincing answer covers objective, stealth and measuring the defence, not just duration.
• "How do you choose one technique over another during an operation?" Look for reasoning about traces left and the assumed level of monitoring.
• "You are detected on day two. What do you do?" Look for a controlled response: alert the control group, document, avoid triggering a real crisis.
• "Tell me about an operation where the defence surprised you." The best candidates respect the blue team and learn from it.
• "What goes into your final report, and who is it for?" The answer should separate the leadership summary from the detail the SOC can act on.

Mistakes to avoid

• Calling a pentest role red team. Candidates notice fast and leave. Describe the day-to-day honestly.
• Hiring before you have a defence to test. The red teamer will end up running classic audits or getting bored.
• Neglecting the debrief. A brilliant operation with no exchange with the blue team improves almost nothing.
• Isolating the red teamer. Their work should feed detection. Plan regular sessions with the SOC, or even joint exercises.
• Having the candidate assessed by someone who does not practise. Without an offensive peer or an experienced defender, the interview rewards confidence over skill.

In short

A red teamer does not hunt for vulnerabilities: they check whether a realistic attacker would reach a goal without being stopped. The role makes sense once your detection is in place and you are ready to act on the findings. Assess the offensive foundation, but above all stealth, knowledge of the defence, respect for the rules and the quality of the debrief.

Thinking about hiring a red teamer or clarifying the need? At Cyber Recrut, a recruiter and a security practitioner help you choose between pentesting, red teaming and stronger detection, then run the search with you. Our shortlisted candidates prove their skills on hands-on labs. See how we work or tell us about your hire.