An AI Red Team Engineer, also known as an AI Red Teamer, attacks AI systems on purpose so that the organisation building them learns where they break. The work covers the model itself, the data and retrieval pipelines feeding it, the tools and agents it can call, and the product wrapped around it. Findings go back to engineering and safety teams as reproducible issues with a clear severity and a suggested fix.
Companies hire for this role when a model or AI feature is close to release, when internal pilots are becoming customer-facing products, or when regulators, auditors and enterprise buyers start asking for evidence of adversarial testing.
What does an AI Red Team Engineer do?
The role sits between offensive security and machine learning engineering. Day to day, an AI Red Team Engineer plans and runs adversarial exercises, builds tooling that makes those exercises repeatable, and works with model owners on mitigation.
- Scoping red-team exercises against defined threat models covering misuse, data leakage, unsafe outputs and abuse of connected tools
- Running manual and automated attacks such as prompt injection, jailbreaks, indirect injection through retrieved documents and system prompt extraction
- Testing agentic systems for privilege escalation, unsafe tool calls and actions taken outside the user's intent
- Building attack libraries and evaluation harnesses so findings can be rerun against every new model or release
- Probing training and fine-tuning pipelines for data poisoning risk, and checking deployed models for membership inference and model extraction exposure
- Writing reports with reproduction steps, severity ratings and recommended mitigations, then retesting the fixes
- Feeding results into safety evaluations, release decisions and governance documentation
Key skills and backgrounds
Strong candidates usually arrive from one of two directions. Some are penetration testers or application security engineers who have moved into AI and bring discipline around scoping, exploitation and reporting. Others are ML engineers or researchers who understand how models are trained, fine-tuned and served, and who have developed an attacker's instinct. The best hires combine both, and can explain a finding to a security lead and a research scientist in the same meeting.
Look for evidence of hands-on attack work, such as public write-ups, open-source tooling or disclosure records.
- Python for attack automation, plus working experience with PyTorch or a similar framework
- Knowledge of LLM application architecture, including retrieval-augmented generation, tool calling and agent orchestration
- Threat modelling for AI systems using MITRE ATLAS and the OWASP guidance on LLM application risks
- Classic offensive security across web applications, APIs, authentication and cloud environments
- Designing evaluation harnesses and automated red-teaming pipelines that scale beyond manual testing
- Familiarity with the NIST AI RMF and the testing expectations set out in the EU AI Act
- Clear technical writing and the judgement to rate severity honestly
Where AI Red Team Engineers work
Frontier and foundation model labs run dedicated red teams that test models before release and throughout their lifecycle. AI-first scale-ups building assistants, copilots and agent products hire red teamers to test their own applications and the third-party models they depend on. Large enterprises in regulated sectors such as financial services, healthcare and the public sector are building internal AI red-team functions alongside their existing security teams. Security consultancies and specialist AI assurance firms also hire for the role to deliver testing for their clients.
AI Red Team Engineer vs related roles
Titles in AI security overlap and job descriptions often blur them. The differences usually come down to scope and depth.
- An LLM Red Teamer concentrates on language model behaviour and prompt-level attacks, whereas an AI Red Team Engineer usually covers the wider system including infrastructure, data and agents.
- An Adversarial ML Engineer works on the mechanics of attacks and defences against models, such as evasion and poisoning, and tends to sit closer to research.
- An AI Penetration Tester runs scoped, time-boxed security assessments of AI products, often for external clients, with a heavier focus on application and infrastructure security.
Salary and market data
Pay for AI red teamers depends on whether the role leans towards research or security engineering, as well as on location and seniority. For current ranges, see our GenAI and agentic systems salary guide, browse the wider AI and deep tech salary guides, or benchmark a specific offer with the deep tech salary calculator.
Hiring AI Red Team Engineers with DeepRec
DeepRec recruits for AI security and GenAI and agentic systems roles across Europe and the US from offices in London, Berlin, Zurich, Dublin and Boston. Our consultants screen candidates technically before you meet them, checking real attack experience, tooling and reporting quality rather than matching keywords on a CV. We work on a permanent, contract, retained and executive search basis, whether you are making a first red-team hire or appointing a head of AI red teaming. To start a search, visit Looking to Hire.