As AI features move from demos into production — chat assistants, retrieval over internal data, agents that take actions — organizations need people whose job is to break those systems before attackers do. That is the job of an AI red team.
This guide covers what an AI red team does, who to hire first, and how to tell real practitioners apart from enthusiasts.
What an AI red team actually does
An AI red team tests AI systems the way a real adversary would. Typical targets include:
- Prompt injection — direct, and indirect through documents, emails, or web pages the model reads.
- Jailbreaks — bypassing safety policies and content controls.
- Sensitive data leakage — extracting system prompts, training data, or data from connected sources.
- Tool and agent abuse — tricking an agent into taking harmful actions with the permissions it has.
- Model-level attacks — data poisoning, model extraction, and adversarial inputs.
Good AI red teams map their work to shared frameworks, such as the OWASP Top 10 for LLM Applications and MITRE ATLAS, and connect findings to risk-management practices like the NIST AI Risk Management Framework.
Who to hire first
Most organizations should not start with a large team. A typical progression:
Hire 1: Senior AI Red Teamer (the founding member)
Someone with real offensive security experience who has moved into LLM and AI systems. Their first job is to build methodology and tooling: a threat model for your AI products, a reusable attack library, and an evaluation harness that turns one-off findings into regression tests. See our AI Red Teamer hiring guide.
Hire 2: ML-focused researcher or engineer
Someone who understands how models are trained, fine-tuned, and evaluated. They extend testing from the application layer down to the model itself, and design better automated evaluations.
Hire 3+: Specialists, based on what you ship
- Agent and tooling specialists if you ship autonomous agents.
- Domain or safety specialists for harmful-content testing in regulated or sensitive areas.
- Tooling engineers to scale automated red-teaming across many models and releases.
Pair the red team with at least one LLM Security Engineer who builds defenses. A red team without someone to fix findings quickly becomes a report factory.
Skills that matter most
| Skill | Why it matters |
|---|---|
| Offensive security tradecraft | AI applications are still web apps, APIs, and cloud services underneath |
| LLM application architecture | You can’t attack retrieval, tools, and agents you don’t understand |
| Python and tooling | Manual testing doesn’t scale across releases |
| Threat modeling | Prioritizes the attacks that matter for your product |
| ML fundamentals | Needed for model-level attacks and evaluation design |
| Clear writing | Findings must be reproducible and convincing to product teams |
There is no dominant AI red-team certification yet. Published research, conference talks, CTF results, and AI bug-bounty findings are better signals than credentials.
Interview exercises that reveal real skill
- Live attack walkthrough. Give the candidate a description of a support agent with access to an order-lookup tool and customer data. Ask them to plan the first hour of an attack. Look for structure: reconnaissance, threat model, prioritized attacks, and how they would prove impact.
- Indirect injection scenario. “Our assistant summarizes inbound emails. How could an attacker abuse that?” Strong candidates quickly reach data exfiltration and tool misuse, not just offensive output.
- Findings review. Share a weak, vague finding and ask them to rewrite it with severity, reproduction steps, and a recommended fix.
- From jailbreak to regression test. “You found a jailbreak. How do you make sure it never ships again?” This separates practitioners from prompt collectors.
Red flags
- A portfolio that is just a list of jailbreak prompts, with no methodology.
- No understanding of how the target is wired — retrieval, tools, permissions.
- Findings without severity reasoning or reproduction steps.
- Dismissing traditional application security as irrelevant to AI systems.
- No interest in how findings get fixed.
Build in-house or extend your existing red team?
If you already have a strong offensive security team, the fastest path is often to add one senior AI red teamer who upskills the rest of the team on LLM attacks, then hire ML specialists as your AI footprint grows. If you have no offensive team at all, start with the founding senior hire described above.
Compensation
AI red-team compensation is moving quickly. See our AI Security Salary Guide 2026 for indicative ranges by level, or request a free benchmark for your exact role and location.
Where Fortium helps
AI red teamers are among the hardest security profiles to find and assess — most interviewers have never done the job themselves. Every candidate Fortium presents has been screened by an active security practitioner. Brief us on your AI red team build.