1 November 2026 · 10 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
What Does a Red Teamer Do? The Role, Skills, Certifications and Career Path of a Red Team Operator
A red teamer emulates a real adversary so an organisation can find out how far an attack would get and whether anyone would notice. This article describes the person behind that work: what they are responsible for, which skills and certifications matter, how people get there, and how a buyer can judge the operators a provider puts forward.
What a red teamer is
A red teamer, or red team operator, is an offensive security specialist who emulates a specific, realistic adversary against an organisation under written authorisation. The aim is not to list every vulnerability but to answer one question: could a capable attacker reach an agreed business objective, such as the payment system or the board's mailbox, and would the defenders detect and stop them in time? The red teamer plays that attacker, keeps the operation controlled and turns what happened into evidence.
Red teamers work in three settings. Most work for specialist consultancies that run engagements for clients across sectors. Large banks, insurers and technology companies increasingly run internal red teams that test their own estate continuously and feed results straight into detection engineering. The third setting is regulatory: in the Netherlands, financial institutions designated by De Nederlandsche Bank undergo TIBER-NL tests, and under DORA Articles 26 and 27 designated financial entities across the EU must run threat-led penetration testing at least every three years.
Red teaming is a specialisation, not an entry-level job. Almost every operator arrives after several years as a penetration tester, a systems administrator, a software developer or a SOC analyst. That background matters: you only understand how enterprise environments really run by first building, administering or defending them.
Red teamer vs penetration tester
The two roles share a toolset and much of their knowledge, but they answer different questions. A penetration tester works to scope and coverage: within an agreed set of systems, find as many exploitable weaknesses as possible in the time available, rate them and explain how to fix them. A red teamer works to an objective and to detection: take one realistic path to a defined goal, move the way the emulated adversary would, and record at each step whether the organisation's controls and people noticed.
The temperament differs as well. Good penetration testers are thorough and systematic, and they are rewarded for breadth. Good red teamers are patient and restrained; they often choose not to exploit something because it would be noisy, they plan for weeks rather than days, and they accept that a quiet, partial result can be more valuable than a loud, complete one. That is why a strong pentester is not automatically a strong red teamer, and why mature teams move people into red team work gradually. Our article on what a penetration tester does describes the other role in full, and our comparison of red teaming and penetration testing explains which engagement an organisation needs when.
What a red teamer is responsible for during an engagement
Seen from the client's side, a red teamer's job is as much governance as it is offence. These are the responsibilities you should expect every operator on an engagement to carry, and to be able to show you.
Working strictly inside the written authorisation
Every action falls within the signed authorisation and the rules of engagement: the agreed objectives, systems and people in scope, permitted hours, and the actions that are explicitly forbidden. If an opportunity falls outside that boundary, the operator does not take it; they raise it with the white cell.
Keeping a complete operations log
Each action is recorded with a timestamp, the system involved and the reason for it. The log lets the client's white cell verify at any moment what the red team has done, and it becomes the backbone of the timeline the blue team later compares with its own telemetry.
Coordinating with the white cell
Significant steps, such as moving towards a sensitive system or escalating a scenario, are agreed with the white cell on a go/no-go basis. The operator also supports deconfliction, confirming quickly whether an alert the defenders are chasing belongs to the exercise.
Handling client data as evidence
Any data the red team touches is treated as proof of access, not as loot. Operators collect the minimum needed to demonstrate impact, store it encrypted, restrict access to the engagement team and destroy it on the agreed schedule, under data-handling rules that respect the GDPR.
Pausing and escalating on signs of a real intrusion
Red teamers sometimes find traces of a genuine attacker: unknown accounts, foreign tooling, data being staged. The operation pauses, the white cell is informed immediately and the organisation's incident response takes over. A responsible operator never treats this as a lucky shortcut.
Producing the attack narrative and detection recommendations
The deliverable is a narrative of the operation, a timeline, a MITRE ATT&CK mapping of every technique used and a set of prioritised recommendations, split into prevention, detection and response. Findings are written so that both executives and detection engineers can act on them.
Running the replay with the blue team
After the report, the operators walk the defenders through the operation step by step while the blue team shows what it saw. This session usually produces more improvements than the report itself.
The skill profile, at concept level
Red teamers are generalists with a few deep specialisms. These six areas describe what the role demands; they are not a curriculum, and the detail of how each is applied stays inside authorised engagements.
Reconnaissance and OSINT
Building a picture of the organisation from public sources: people, roles, suppliers, technology footprint and exposed services. Good reconnaissance shapes the whole scenario.
Social engineering and pretexts
Understanding how people are persuaded, and designing believable, agreed pretexts for initial access, from email to telephone. It demands judgement and ethics, because real employees are on the receiving end.
Identity and Active Directory
Most enterprise attacks are won or lost on identity. Red teamers need a deep understanding of Active Directory, Entra ID, federation and privilege models, so they can see where trust relationships create paths to the objective.
Command and control and OPSEC
Running an operation over weeks means maintaining reliable, controlled access while staying in character as the emulated adversary. The core of this skill is discipline: planning each action, knowing what it will look like to a defender, and never improvising outside the rules.
Physical and on-site awareness
Some scenarios include the office itself: reception, visitor processes, access control and network points. Operators need to recognise when physical access is the realistic route and how to assess it safely and lawfully, always with a signed letter of authorisation.
Reporting and executive communication
An operation is only as valuable as the story told about it. Red teamers write for boards and for detection engineers in the same report, and present results to executives in terms of business risk rather than technique.
Certifications that say something about a red teamer
No single certification makes someone a red teamer, but a handful of practical, lab-based exams do show that a candidate has worked through realistic adversary scenarios. These are the credentials buyers and hiring managers look for in 2026.
| Certification | Issuer | What it demonstrates | Where it sits |
|---|---|---|---|
| OSCP (Offensive Security Certified Professional) | OffSec | Hands-on ability to compromise systems in a timed practical exam and report on it | Entry baseline; every HackersHub tester holds it |
| CRTO (Certified Red Team Operator) | Zero-Point Security | Practical lab exam focused on operating against an Active Directory environment as a red team would | First red-team-specific credential |
| CRTL (Certified Red Team Lead) | Zero-Point Security | Advanced follow-on to CRTO covering more mature, defended environments | Advanced |
| OSEP (OffSec Experienced Penetration Tester) | OffSec | Course PEN-300 'Evasion Techniques and Breaching Defenses' and a 48-hour practical exam against a defended network | Advanced |
| OSCE3 (OffSec Certified Expert 3) | OffSec | Awarded for holding OSEP, OSWE and OSED together: breadth across infrastructure, web and exploit development | Expert |
| GXPN (GIAC Exploit Researcher and Advanced Penetration Tester) | GIAC (SANS SEC660) | Advanced exploitation and attack concepts, assessed by a proctored exam | Advanced |
| CREST CCSAS (Certified Simulated Attack Specialist) | CREST | Competence to perform intelligence-led simulated attacks of the kind used in CBEST and TIBER-style regulated engagements | Regulated engagements, operator |
| CREST CCSAM (Certified Simulated Attack Manager) | CREST | Competence to lead and manage a simulated attack engagement, including risk management and client coordination | Regulated engagements, lead |
What certifications do not measure
Certifications are necessary but not sufficient. They show that someone can solve technical problems under exam conditions; they do not show judgement about when to stop, discipline in keeping an operations log, restraint around production systems, or the ability to write a report a board will read. Those qualities come from supervised engagements and are best checked through references and sample reports. Our article on penetration testing certifications explains how to verify individual credentials and how they relate to company accreditations.
How to become a red teamer
There is no shortcut into red teaming. The route below is the one most working operators recognise, and it is a career path rather than a technical syllabus.
- Spend your foundation years in penetration testing, systems administration, software development or a SOC, so you understand how real environments are built, run and defended
- Build depth in Windows, identity (Active Directory and Entra ID) and networking, because that is where enterprise operations are decided
- Earn OSCP as your practical baseline, then progress to a red-team-specific credential such as CRTO and later OSEP or CRTL
- Practise in home labs and training environments that you own or that are built for that purpose, never against systems you have no permission to test
- Learn to write and present: turn your lab work into short reports and explain them to non-technical colleagues
- Join a team that runs real engagements and work under supervision of experienced operators before you lead anything yourself
- Stay inside the law: in the Netherlands, accessing a computer system without authorisation is computervredebreuk under Article 138ab of the Wetboek van Strafrecht, and other countries have equivalent offences. Only ever test with explicit written permission
How to assess a red team provider's people
When you buy a red team engagement you are buying the judgement of a small number of individuals. Ask for the following before you sign.
- Named operators for your engagement, with certifications you can verify through the issuer
- An engagement lead with management credentials such as CREST CCSAM, or demonstrable experience leading comparable operations
- The number of full red team operations (not penetration tests) each operator has run in the last few years
- References from exercises that involved a blue team, ideally from organisations of your size and sector
- A written rules-of-engagement template, a deconfliction procedure and an example of how the operations log is kept
- Proof of professional indemnity insurance appropriate to the engagement
- A data-handling and evidence destruction procedure, including how long evidence is kept and how its destruction is confirmed
- Experience with TIBER-NL or DORA threat-led penetration testing where your organisation falls under those regimes
- How the team keeps its skills current: research time, internal labs, training budgets and recent certifications
Red teamers at HackersHub
HackersHub is an offensive security firm based in Amsterdam, Netherlands, with more than 10 years of experience in penetration testing and red teaming. Every tester on the team holds at least OSCP, and the team includes OSWE and CREST-certified testers. Our methodology is aligned with PTES and NIST SP 800-115, and red team operations are mapped to MITRE ATT&CK throughout.
Every report names the operators who carried out the work, so you know exactly who had access to your environment. A verification retest of medium and higher findings within 90 days is included, and clients rate our work 4.9 out of 5 across 127 reviews.
Frequently asked questions
Related reading
- Red teaming services by HackersHub
- What is red teaming? Phases, scenarios and deliverables
- Red team vs blue team: how an exercise runs
- Purple teaming: red and blue in one room
- Red team vs penetration test: which one do you need?
- What is a penetration tester and what does a penetration tester do?
- Penetration testing certifications and how to verify them
Want to meet the operators who would test you?
We scope red team engagements around your business objectives and name the operators in every proposal and report. Talk to an expert about what a realistic operation against your organisation would look like.