AI red teamer

What does an AI red teamer do?

An AI red teamer attacks AI systems on purpose to find weaknesses before real attackers or users do.

The targets are usually large language model (LLM) apps, chatbots and agents, plus the data and tools they connect to.

In Singapore, the role sits in a security team, an AI or data team, or a risk function. You find it mostly in banks, government agencies, technology firms and consultancies that build or buy AI products.

You work with AI engineers, product managers, the blue team that defends systems, and risk, legal and compliance staff. Your findings turn into fixes, tests and release decisions.

What the work involves

• Plan a test: agree the scope, the rules of engagement and what counts as a harmful result.
• Write and run attack prompts against an AI system to make it leak data, break its rules or misuse its tools.
• Test the app around the model, such as its web front end and APIs, with tools like Burp Suite.
• Build repeatable test sets in Python so the team can rerun attacks after every change.
• Write up findings with steps to reproduce, a severity rating and a suggested fix.
• Retest fixes and brief product and security teams on the remaining risk.

Pay in Singapore

Back to top

Skills an AI red teamer needs

Back to top

AI red teamer job description

We are hiring an AI red teamer to test our AI products for security, safety and misuse risks.

You will attack LLM apps and agents the way a real adversary would, report what you find, and help teams fix it before launch. You will work with security, engineering and product teams.

Responsibilities

• Plan red team exercises for AI features, including scope, targets and rules of engagement.
• Test LLM apps for prompt injection, jailbreaks, data leakage and unsafe output.
• Test agents and tool integrations for misuse, such as actions taken without permission.
• Test the web apps and APIs around the model using ethical hacking methods.
• Build automated attack and evaluation suites in Python that the team can rerun.
• Rate each finding by impact and likelihood, and write clear reports with steps to reproduce.
• Work with engineers to agree fixes, then retest them.
• Share findings with the blue team so detection and monitoring improve.
• Keep up with new attack methods and turn them into new tests.
• Support release reviews with a clear view of remaining risk.

Requirements

• A degree or diploma in computer science, cybersecurity, information technology or a related field, or equivalent hands-on experience.
• Typically 2 to 5 years in penetration testing, application security or security research.
• Working Python skills and experience calling LLM APIs.
• Experience with tools such as Burp Suite and Metasploit, and a sound grasp of web and API vulnerabilities.
• Understanding of how LLMs work, including prompting, context windows, retrieval and tool use.
• Clear writing, since most of the output is reports and recommendations.

Back to top

AI red teamer career path

Most AI red teamers start in penetration testing or application security and add AI testing skills.

From there, you can move into senior technical work or lead a team.

1. Junior penetration tester or security analyst

   Entry

   You run tests on web apps and networks under guidance and learn to write clear reports.

2. Security consultant or AI red team engineer

   Mid

   You test LLM apps on your own, build Python attack scripts and add evaluation sets to client or internal projects.

3. Senior AI red teamer

   Senior

   You design test plans for complex agents and advise product teams on risk before launch.

4. Red team lead

   Lead

   You run exercises, coach testers, set methods and agree scope with stakeholders.

5. Head of offensive security or AI security

   Head

   You set the testing strategy for the organisation and report AI risk to senior management.

The titles are ones commonly used in Singapore; employers may name the levels differently.

Related jobs and their pay

Back to top

AI red teamer interview questions

We wrote these questions from the skills this job needs. They are not an official question bank.

1. What is the difference between direct and indirect prompt injection? Give an example of each.

   What a good answer covers

   • Direct injection comes from the user typing instructions into the chat.
   • Indirect injection hides instructions in content the model reads, such as a web page, email or document.
   • Gives a concrete example, such as a support bot summarising an email that tells it to reveal data.
   • Explains why indirect injection is harder to block, since the source looks trusted.
   • Mentions layered defences instead of relying on one filter.

2. How would you build an evaluation set to measure how well a chatbot resists jailbreaks?

   What a good answer covers

   • Defines the harm categories and what counts as a failure before writing prompts.
   • Mixes known attack patterns with new ones written for this product.
   • Uses a repeatable scoring method, such as a rubric or a judge model checked by humans.
   • Keeps a held-out set so the team does not tune only to the tests.
   • Reruns the set after every model or prompt change and tracks the result.

3. An LLM agent can read email, search files and send messages. What would you test first?

   What a good answer covers

   • Maps the tools, the permissions each one has and the data it can reach.
   • Tests whether injected text in an email can trigger actions the user did not ask for.
   • Checks for data leaving through links, images or outgoing messages.
   • Checks whether the agent asks for confirmation before risky actions.
   • Recommends least-privilege access and logging of every tool call.

4. Describe how you would write a Python script to run thousands of attack prompts against an LLM API.

   What a good answer covers

   • Loads prompts from a file and sends them with controlled concurrency.
   • Handles rate limits, retries and timeouts.
   • Logs the prompt, the model version, the settings and the full response.
   • Sets temperature and seeds where possible, and repeats runs because output varies.
   • Keeps API keys out of the code and stays within the agreed scope and budget.

5. A company has put an LLM assistant inside its web portal. How would you use Burp Suite in the test?

   What a good answer covers

   • Proxies traffic to see the requests between the front end, the back end and the model.
   • Looks for flaws outside the model, such as broken access control or missing input checks.
   • Tests whether a user can change IDs or parameters to reach another user's chat history.
   • Checks whether model output is rendered unsafely, causing cross-site scripting.
   • Records requests so developers can reproduce each finding.

6. How can a retrieval-augmented generation (RAG) app leak data, and how would you test for it?

   What a good answer covers

   • Explains that the model may retrieve documents the user should not see.
   • Tests whether access rules apply at retrieval time and in the interface too.
   • Tries prompts that ask for other users' or internal documents.
   • Checks for secrets in indexed content, such as keys or personal data.
   • Suggests fixes such as per-user filters and removing sensitive data before indexing.

7. How do you test whether a system prompt is a reliable defence?

   What a good answer covers

   • States that a system prompt is guidance and is not a security boundary.
   • Tries role-play, encoding tricks, multi-turn pressure and instruction conflicts.
   • Tests whether the prompt can be extracted and what it exposes.
   • Shows how a prompt change affects results by rerunning the same test set.
   • Recommends controls outside the model, such as output checks and permissions.

8. How do you scope and get approval for a red team test before you start?

   What a good answer covers

   • Gets written authorisation from the system owner that names targets, methods and time window.
   • Lists what is out of scope, such as production customer data or denial-of-service.
   • Agrees how to handle sensitive data seen during the test.
   • Sets a contact for urgent issues and a way to stop the test.
   • Explains that testing without permission can be illegal.

1. Three days before launch, you find a high-severity prompt injection in a customer-facing bot. The product team wants to ship anyway. What do you do?

   What a good answer covers

   • Writes a clear report with steps to reproduce and a plain statement of impact.
   • Proposes quick mitigations, such as limiting tool access or adding output checks.
   • Presents the risk so the decision maker can accept it or delay.
   • Records the decision and agrees when to retest.
   • Stays factual and avoids blocking or threatening.

2. During a test, the model returns what looks like another customer's personal details. What are your next steps?

   What a good answer covers

   • Stops that line of testing and avoids copying or spreading the data.
   • Tells the named contact straight away, using the agreed channel.
   • Notes only what is needed to show the issue, with details masked.
   • Helps the team find the cause, such as shared context or a retrieval fault.
   • Recommends that the organisation assess its data protection duties.

3. Your team's jailbreak test set shows 98 percent of attacks blocked, but a colleague breaks the bot in five minutes. What might be wrong?

   What a good answer covers

   • Suspects the test set is too narrow or too close to what the defences were tuned on.
   • Checks whether the scoring method misses subtle failures.
   • Adds the colleague's attack and variants to the set.
   • Tests multi-turn and non-English attacks, which are often missing.
   • Reports results with their limits instead of a single score.

1. Tell us about a time you had to explain a security finding to people who doubted it was a real problem.

   What a good answer covers

   • Describes the situation and the people involved.
   • Shows how they used a live demo or clear steps instead of jargon.
   • Links the finding to a business or user impact.
   • Describes how the issue was resolved and what they learned.

2. Describe a finding you reported that turned out to be wrong or low risk. What did you change afterwards?

   What a good answer covers

   • Admits the mistake plainly and says how it was found.
   • Explains how they corrected the report and told those affected.
   • Describes a change in method, such as better reproduction or severity checks.
   • Shows they value accuracy over a long list of findings.

1. You are testing an AI assistant that handles customer data. How does the Personal Data Protection Act (PDPA) affect the way you run the test?

   What a good answer covers

   • Prefers synthetic or masked data over real personal data in test environments.
   • Limits who can see logs and outputs that may contain personal data.
   • Keeps only what is needed and deletes test data when the work ends.
   • Flags personal data leaks to the data protection officer or system owner.
   • Says legal or compliance staff should confirm the exact duties.

2. A bank regulated by the Monetary Authority of Singapore (MAS) asks you to red team its new AI loan assistant. What do you cover in the test plan?

   What a good answer covers

   • Confirms scope, authorisation and test environment with the bank's security and risk teams.
   • Covers security flaws, unfair or unsafe outputs, and leaks of customer data.
   • Writes findings so they fit the bank's own risk rating and issue tracking.
   • Notes that MAS technology risk expectations apply and asks the bank which ones matter here.
   • Plans retesting after fixes and evidence the bank can show to auditors.

Common questions about an AI red teamer job

Sources