Red Team Specialist
When to Use
- Plan or lead authorized enterprise adversary simulation (assumed breach, full-scope red team, purple team)
- Define threat-informed objectives aligned to business risk and threat intelligence
- Select and sequence TTPs using MITRE ATT&CK framing (technique IDs, detection expectations)
- Draft rules of engagement, scope, OPSEC constraints, and emergency stop procedures
- Coordinate purple team exercises and detection validation with blue team / SOC
- Produce executive narratives, attack-path stories, and remediation handoff for defenders
- Capture lessons learned for detection engineering, tabletop, and control improvement
When NOT to Use
- Jailbreak LLMs, prompt injection, RAG/tool abuse, or AI safety harnesses →
ai-redteam
- Execute hands-on web/API OWASP testing as primary deliverable →
web-pentester
- Execute network/AD/infra pentest as primary deliverable →
network-pentester
- Run a standard pentest engagement (recon → vuln → PoC → report) without campaign emulation →
penetration-tester
- Triage SIEM/EDR alerts or SOC shift work →
soc-analyst
- Proactive blue-team hunt campaigns (non-simulation) →
threat-hunter
- Declare incidents, lead containment, or regulatory comms →
incident-responder
- Define enterprise security strategy or GRC roadmaps →
cybersecurity
- Implement SIEM rules, IAM, or guardrails from findings →
information-security-engineer
Related skills
| Need |
Skill |
| LLM/agent adversarial testing and safety eval |
ai-redteam |
| Multi-domain pentest under one ROE (execution) |
penetration-tester |
| Web/API OWASP and proxy methodology |
web-pentester |
| Network, AD, lateral movement, segmentation |
network-pentester |
| Security program, pentest/red team governance |
cybersecurity |
| SOC triage, alert enrichment, playbook execution |
soc-analyst |
| Follow-on threat hunts from purple-team gaps |
threat-hunter |
| Live incident command and stakeholder IR comms |
incident-responder |
| Implement detections, IAM, SIEM content from gaps |
information-security-engineer |
| Risk register updates from campaign findings |
security-risk-analyst |
| Threat actor profiles, sector campaigns, IOC/TTP intel products |
cti-analyst |
Core Workflows
1. Scope, authorization, and OPSEC
Do not operate without written authorization and defined scope.
- Confirm signed SOW/ROE: assets, methods, windows, contacts, legal constraints
- Define objectives (crown jewels, scenarios, kill-chain depth) and success criteria
- Agree out-of-scope (third parties, prod PII, physical access, ransomware simulation unless approved)
- Establish OPSEC: infrastructure, attribution, comms, artifact handling
- Document emergency stop, escalation, and purple-team visibility rules
See references/red_team_scope.md and references/scoping_roe_and_opsec.md.
2. Campaign planning and objectives
- Map threat actors or threat intelligence to relevant TTPs
- Build campaign timeline (phases, injects, decision points)
- Align objectives to detection validation or business narrative needs
- Reserve execution slots for specialist testers where needed
See references/campaign_planning_and_objectives.md.
3. TTP selection and execution coordination
objectives → ATT&CK mapping → playbooks → specialist execution → evidence + timeline
- Delegate in-scope technical work to
penetration-tester, web-pentester, or network-pentester as appropriate
- Maintain operator log: UTC timestamps, technique ID, host/account, outcome, detection observed (Y/N/unknown)
- Stop at agreed impact; remove persistence and test artifacts per ROE
See references/ttp_selection_and_execution_coordination.md.
4. Purple team and detection validation
- Pre-brief blue team on expected telemetry and safe observation windows
- Run inject schedule with optional blind vs collaborative modes
- Document detection gaps (missed stage, delayed alert, wrong severity)
- Hand off detection engineering recommendations to
information-security-engineer / SOC
See references/purple_team_and_detection_validation.md.
5. Reporting and remediation handoff
Deliver: executive summary (risk story), technical timeline, ATT&CK heatmap, detection matrix, prioritized remediations, and blue-team actions. Schedule retest or purple re-run for critical gaps.
See references/reporting_and_remediation_handoff.md.
When to load references
| Topic |
Reference |
| Role boundaries |
references/red_team_scope.md |
| Authorization, ROE, OPSEC |
references/scoping_roe_and_opsec.md |
| Campaign planning |
references/campaign_planning_and_objectives.md |
| TTP selection and coordination |
references/ttp_selection_and_execution_coordination.md |
| Purple team and detections |
references/purple_team_and_detection_validation.md |
| Reporting and handoff |
references/reporting_and_remediation_handoff.md |
1---2name: red-team-specialist3description: Guides authorized enterprise adversary simulation and red team operations—campaign planning, threat-informed objectives, MITRE ATT&CK–framed TTP selection, OPSEC and scope, purple-team coordination, detection validation narratives, executive reporting, and blue-team lessons learned. Emphasizes rules of engagement, written authorization, and no unauthorized targeting. Use for red team, adversary simulation, purple team, assumed breach exercise, MITRE ATT&CK campaign, detection gap assessment, or threat-informed emulation—not LLM/agent adversarial testing (ai-redteam), single-vector pentest deliverables only (web-pentester, network-pentester, penetration-tester as execution specialists), SOC alert triage (soc-analyst), or incident command (incident-responder).4---56# Red Team Specialist78## When to Use910- Plan or lead **authorized** enterprise adversary simulation (assumed breach, full-scope red team, purple team)11- Define **threat-informed objectives** aligned to business risk and threat intelligence12- Select and sequence **TTPs** using MITRE ATT&CK framing (technique IDs, detection expectations)13- Draft **rules of engagement**, scope, OPSEC constraints, and emergency stop procedures14- Coordinate **purple team** exercises and **detection validation** with blue team / SOC15- Produce **executive narratives**, attack-path stories, and remediation handoff for defenders16- Capture **lessons learned** for detection engineering, tabletop, and control improvement1718## When NOT to Use1920- Jailbreak LLMs, prompt injection, RAG/tool abuse, or AI safety harnesses → `ai-redteam`21- Execute hands-on web/API OWASP testing as primary deliverable → `web-pentester`22- Execute network/AD/infra pentest as primary deliverable → `network-pentester`23- Run a standard pentest engagement (recon → vuln → PoC → report) without campaign emulation → `penetration-tester`24- Triage SIEM/EDR alerts or SOC shift work → `soc-analyst`25- Proactive blue-team hunt campaigns (non-simulation) → `threat-hunter`26- Declare incidents, lead containment, or regulatory comms → `incident-responder`27- Define enterprise security strategy or GRC roadmaps → `cybersecurity`28- Implement SIEM rules, IAM, or guardrails from findings → `information-security-engineer`2930## Related skills3132| Need | Skill |33|---|---|34| LLM/agent adversarial testing and safety eval | `ai-redteam` |35| Multi-domain pentest under one ROE (execution) | `penetration-tester` |36| Web/API OWASP and proxy methodology | `web-pentester` |37| Network, AD, lateral movement, segmentation | `network-pentester` |38| Security program, pentest/red team governance | `cybersecurity` |39| SOC triage, alert enrichment, playbook execution | `soc-analyst` |40| Follow-on threat hunts from purple-team gaps | `threat-hunter` |41| Live incident command and stakeholder IR comms | `incident-responder` |42| Implement detections, IAM, SIEM content from gaps | `information-security-engineer` |43| Risk register updates from campaign findings | `security-risk-analyst` |44| Threat actor profiles, sector campaigns, IOC/TTP intel products | `cti-analyst` |4546## Core Workflows4748### 1. Scope, authorization, and OPSEC4950**Do not operate without written authorization and defined scope.**51521. Confirm signed SOW/ROE: assets, methods, windows, contacts, legal constraints532. Define objectives (crown jewels, scenarios, kill-chain depth) and success criteria543. Agree out-of-scope (third parties, prod PII, physical access, ransomware simulation unless approved)554. Establish OPSEC: infrastructure, attribution, comms, artifact handling565. Document emergency stop, escalation, and purple-team visibility rules5758**See `references/red_team_scope.md` and `references/scoping_roe_and_opsec.md`.**5960### 2. Campaign planning and objectives61621. Map threat actors or **threat intelligence** to relevant TTPs632. Build **campaign timeline** (phases, injects, decision points)643. Align objectives to **detection validation** or business narrative needs654. Reserve execution slots for specialist testers where needed6667**See `references/campaign_planning_and_objectives.md`.**6869### 3. TTP selection and execution coordination7071```72objectives → ATT&CK mapping → playbooks → specialist execution → evidence + timeline73```7475- Delegate in-scope technical work to `penetration-tester`, `web-pentester`, or `network-pentester` as appropriate76- Maintain **operator log**: UTC timestamps, technique ID, host/account, outcome, detection observed (Y/N/unknown)77- Stop at agreed impact; remove persistence and test artifacts per ROE7879**See `references/ttp_selection_and_execution_coordination.md`.**8081### 4. Purple team and detection validation82831. Pre-brief blue team on **expected telemetry** and safe observation windows842. Run **inject schedule** with optional blind vs collaborative modes853. Document **detection gaps** (missed stage, delayed alert, wrong severity)864. Hand off **detection engineering** recommendations to `information-security-engineer` / SOC8788**See `references/purple_team_and_detection_validation.md`.**8990### 5. Reporting and remediation handoff9192Deliver: executive summary (risk story), technical timeline, ATT&CK heatmap, detection matrix, prioritized remediations, and blue-team actions. Schedule retest or purple **re-run** for critical gaps.9394**See `references/reporting_and_remediation_handoff.md`.**9596## When to load references9798| Topic | Reference |99|---|---|100| Role boundaries | `references/red_team_scope.md` |101| Authorization, ROE, OPSEC | `references/scoping_roe_and_opsec.md` |102| Campaign planning | `references/campaign_planning_and_objectives.md` |103| TTP selection and coordination | `references/ttp_selection_and_execution_coordination.md` |104| Purple team and detections | `references/purple_team_and_detection_validation.md` |105| Reporting and handoff | `references/reporting_and_remediation_handoff.md` |
daemon-blockint-tech