# AI red teaming interview questions and salaries for AI security roles

Source: https://www.techinterview.org/post/3233477874/ai-red-teaming-interview-questions/
Updated: 2026-11-05 · techinterview.org

"AI red teamer" covers three kinds of work. Generalist raters on Handshake earn $32–$95 an hour, W-2 through TCWGlobal, writing adversarial prompts and scoring outputs. Expert contractors with offensive-security, CBRNE or software engineering backgrounds earn up to $158 an hour. AI red team engineers at Anthropic, OpenAI, Google DeepMind, Microsoft and the UK AI Security Institute build the attack tooling and metrics, at posted base ranges reaching $405K. These interview questions are derived from job posts and public red-team reports; no verified first-hand reports turned up.

Handshake's generalist posting lists Python as a nice-to-have and welcomes fandom, improv and writing backgrounds. [Anthropic](/companies/anthropic/)'s Red Team Engineer, Safeguards posting wants pentest or appsec experience, Burp Suite, Metasploit and "a public body of work such as CVEs, blog posts, or disclosed bug bounty reports." The wider field is in the [security engineer interview guides](/security-engineer-interview-guides/).

## AI red teamer gigs versus AI red team engineer jobs

Generalist raters write adversarial prompts and multi-turn chains, score outputs "against structured harm taxonomies and severity rubrics," calibrate with other raters and see harmful content regularly. Handshake's version excludes California residents, and its screening steps aren't confirmed.

Expert contractors are paid for domain judgment. Handshake's cybersecurity listing wants offensive-security experience plus ATT&CK and OWASP fluency, and its CBRNE listing pays experts to separate open-literature knowledge from operational uplift. Outlier's cybersecurity track asks for 4+ years of pentesting, prefers OSCP, and has you design CTF environments and rubrics. Screens are light: Mercor ran an AI video interview of about 20 minutes and a Persona ID check, and Outlier checks resume and ID, then pays lower rates during onboarding.

On the engineering side, Anthropic's Safeguards team runs "full kill chain" attacks that emulate real threat actors, builds automated frameworks for continuous assessment and designs metrics for how well novel abuse gets detected. Google DeepMind's Agentic Red Team posting describes turning manual findings into "Auto Red Teaming" regression tests. The split: generalist raters fill the harness, expert contractors judge uplift and design challenges and rubrics, and engineers build the harness and metrics, then drive fixes through the teams that own them.

Bridges exist. Gray Swan says it hired 10+ contractors from its Arena competitions. Anthropic's public-work requirement sits on top of the pentest or appsec experience in its minimums, though, and NDA-bound gig output may not count as public.

## Who hires AI red team engineers, with posted salaries

Figures are posted ranges from the employer's board unless marked as a mirror; hourly tiers stay separate.

| Tier | Employer and AI red team or adjacent role | Posted pay, base salary unless noted (Nov 2026) | Location and terms |
| --- | --- | --- | --- |
| AI lab | Anthropic, Red Team Engineer, Safeguards | $320K–$405K | San Francisco |
| AI lab | OpenAI, Red Team – Cyber | $198K–$320K plus equity | San Francisco or Seattle |
| AI lab | Scale AI, Research Scientist, Agent Robustness | $302.4K–$378K | Wants RL post-training and publications; no LeetCode-style questions |
| AI safety lab | Apollo Research, AI Security & Control Researcher | $204K–$385K; £136K–£258K | San Francisco; London |
| Big tech | Google DeepMind, Senior Security Engineer, Agentic Red Team | $174K–$253K plus 15% bonus target and equity | Mountain View, NYC or Zürich; mirror; closed |
| Big tech | Microsoft AI Red Team, Security Researcher; AI Security Researcher II (closed) | $102.1K–$202.2K US; $133.8K–$219.2K SF and NYC | Redmond; mirror |
| Big tech | NVIDIA, Senior AI Security Engineer | $184K–$287.5K L4; $224K–$356.5K L5 | Seattle; a Tel Aviv red-team role posts no range |
| Government | UK AI Security Institute, Offensive Security Engineer | £65K–£145K including technical allowance | Plus 28.97% employer pension on base; SC clearance; deadline 15 Nov 2026 |
| Hourly: generalist rater | Handshake, AI Red Teamer (LLM Generalist) | $32–$95 per hour | Remote, US; W-2 hourly through TCWGlobal, 40 hrs/wk |
| Hourly: expert contractor | Handshake, AI Red Teamer, Cybersecurity and CBRNE | $65–$125 and $65–$158 per hour | Remote, US; contract |
| Hourly: expert contractor | Mercor, AI Red-Teamer | $54–$111 per hour | US, UK or Canada; software engineering expertise; pay via mirror; closed on Mercor |
| Hourly: expert contractor | Outlier, Cybersecurity Expert | Up to $100 per hour | 1099 contract |

Meta's GenAI red team postings couldn't be verified, and Amazon, Apple, Cisco, Palo Alto and CrowdStrike weren't checked. Few employers publish a loop. The UK AISI does: initial assessment, screening call, technical assessment, research interview, behavioural interview, senior leadership. For the labs, see the [Anthropic security engineer interview](/post/3233477864/anthropic-security-engineer-interview/) and the [OpenAI security engineer interview](/post/3233477865/openai-security-engineer-interview/).

## AI red teaming vs penetration testing

The sourced answer has three parts. Scope comes first: Microsoft calls AI red teaming "an umbrella term for probing both security and RAI outcomes," RAI being responsible AI. It covers benign users who stumble into harm, where traditional red teaming "mostly focuses on only malicious adversaries."

Then determinism. A pentest targets "well-defined system compromises (e.g., domain administration credential theft)." With a model, as Microsoft puts it, "running the same input twice may provide different outputs," so OWASP's GenAI Red Teaming Guide shifts success criteria to statistical thresholds.

Then the fix. AI systems "change at a faster rate," so testing repeats every release, and remediation "requires a defense-in-depth approach."

Coming from pentesting, you're closer than the framing suggests. OWASP builds GenAI red teaming on the classic phases, recon through lateral movement and exfiltration. DeepMind's now-closed posting set a 5-year minimum in red teaming, offensive security or adversarial ML. Per a job-board mirror, Microsoft prefers OSCP, GPEN or GWAPT plus bug bounties and CTFs: "Prior knowledge of Generative AI not required, though experience testing agents is preferred." AISI's Offensive Security Engineer role is close to a pentest of evaluation infrastructure.

## AI red teaming interview questions, with worked answers

None come from candidate reports; I found no verified first-hand accounts. They're derived from posted duties plus public red-team reports: Microsoft's "Lessons From Red Teaming 100 Generative AI Products" and the Claude Opus 5.5 and GPT-5 system cards.

### Classifying GCG, PAIR, TAP, Crescendo and Best-of-N

*"Define jailbreak versus prompt injection. Then classify GCG, PAIR, TAP, Crescendo and Best-of-N."*

A jailbreak beats the model's safety training; prompt injection gets an application to obey instructions hidden in untrusted data, often planted by a third party (more in [AI security interview questions](/post/3233477871/ai-security-interview-questions/)). Sort by access and turns. GCG is white-box, a gradient-optimized adversarial suffix. PAIR and TAP are black-box, with an attacker model refining prompts over many queries; TAP adds tree search. Crescendo is black-box and multi-turn. Best-of-N samples augmented prompt variants until one lands. Defenses are in the [prompt injection interview questions](/post/3233477256/prompt-injection-llm-security-interview-questions/).

### ASR@k and evals on stochastic outputs

*"Gray Swan's indirect prompt injection benchmark reports attack success at k=1, 10 and 15. Why several values of k, and what does k=1 hide?"*

ASR@k is the share of attack scenarios where at least one of k attempts succeeds; the Opus 5.5 system card reports 0.1%, 0.7% and 1.0%. k=1 models an attacker who tries once, but real attackers retry for free. The same numbers show retries are correlated: independent 0.1% attempts would reach about 1.5% by k=15, not 1.0%. Zero successes in 100 attempts still allows a true rate near 3% at 95% confidence (the rule of three). Score over-refusal in the same run, as OpenAI's posting asks, because a model that refuses everything passes the jailbreak half for free.

### Threat-modeling a coding agent as an insider

*"Threat-model a coding agent that holds repo credentials and network access."*

Apollo Research threat-models coding agents "through the lens of insider risk": a new hire who can be talked into anything. List where untrusted text enters (issues, PR comments, dependency READMEs, tool output) and what the agent can do (shell, push, egress, secrets). Map the paths to the OWASP Agentic Top 10: ASI01 goal hijack from an injected issue, ASI02 tool misuse, ASI03 privilege abuse through an org-wide token, ASI06 memory and context poisoning. Fix the capability, not the prompt, with per-repo tokens, an egress allowlist and approval gates on protected branches. The follow-up is from the Opus 5.5 system card: an external team split an exploit chain across 100+ contexts so that "no single conversation named the overall objective." Per-conversation classifiers miss that, so aggregate across sessions. The [threat modeling interview walkthrough](/post/3233477868/threat-modeling-interview/) covers the method.

### Judging harmful-capability uplift

*"The model wrote a working privilege-escalation script. Is that a finding, and how severe?"*

OpenAI's posting names the skill: "Distinguish benchmark or policy failures from behavior that creates meaningful real-world risk," weighing "feasibility, attacker uplift, reliability, and the capabilities already available elsewhere." Run it in a sandbox first. If it targets a known bug with a public exploit, counterfactual uplift is small. Ask who it helps, a novice who couldn't have written it or an operator who saves ten minutes, and check reliability across samples. The policy failure still gets logged, at lower severity.

### Automated red teaming with PyRIT, garak and HarmBench

*"What separates garak, PyRIT and HarmBench, and how would you build an attacker, target and scorer loop?"*

garak is a scanner that runs probes against an endpoint. PyRIT is a framework for building campaigns from targets, converters, scorers, attack techniques and memory. HarmBench is a benchmark for comparing attacks and defenses. Attacker models drift toward the same few attacks, so seed from a harm taxonomy and track coverage per category. LLM judges disagree with people, so measure scorer agreement against human labels, which is what generalist raters produce. Then turn each manual finding into a regression test that gates release.

AISI's Offensive Security Engineer posting (deadline 15 Nov 2026) implies a harder variant: *"Agents produced dozens of candidate findings overnight. How do you triage them, prove them with exploits, and benchmark agents against humans?"* That role attacks the sandboxes holding frontier models during evaluations (container and VM escape, egress controls), finds vulnerabilities in Inspect, AISI's eval framework, and builds agent-assisted red-teaming harnesses. Triage by deduping on root cause, rerunning each in a clean sandbox and dropping what won't reproduce. Without a working exploit, it's a lead, not a finding. To benchmark, give agents and humans the same targets and budget, then compare confirmed findings and false-positive rates after triage.

### Severity and the finding write-up

*"Rate this jailbreak and write it up for the product team."*

The Opus 5.5 system card scores jailbreaks on four axes: capability gain, universality, ease of weaponization and discoverability. My rule of thumb, not the card's: critical means high on all four. The write-up carries exact prompts, model version and sampling settings, ASR over a stated trial count, and harm category. Red teams usually hand remediation to purple or blue teams, so name an owner and an escalation path. For an executive who wants yes or no: at 2% ASR, 50 retries succeed at most about 64% of the time, the ceiling if attempts were independent.

## Framework versions interviewers will check

The OWASP LLM Top 10 2026 and Agentic Top 10 (ASI01–ASI10) are covered in the AI security post above. Red-team references as of November 2026:

- MITRE ATLAS v2026.10 (October 28, 2026), now versioned monthly. Know AML.T0051 for prompt injection and AML.T0054 for jailbreaks.

- PyRIT 1.x (v1.0.0 in July 2026, v1.1.0 in September).

- OWASP GenAI Red Teaming Guide v1.0 (January 2025).

- NIST AI 100-2 E2025 (March 2025), no later edition confirmed.

To move from gig work to the engineering job, build the public work the postings ask for: a garak probe or PyRIT scenario against an open model with its ASR numbers published, or a disclosed bug-bounty report. Paired with pentest or appsec experience, that's evidence you can build the harness rather than work inside one.