A private minute before you read on

A 3×3 bingo card, each square labelled with a risk from the OWASP Top 10 for LLM (large language model) Applications (2025) — prompt injection, sensitive information disclosure, system prompt leakage, excessive agency, misinformation, and more. As you read short, harmless scenarios ("the bot summarised an email that told it to forward all mail"), you tap the matching square. Complete a line and the card celebrates gently, then shows you the defence for each risk you marked. Learning the vocabulary as a game.

What you test. Chatbots, AI search, document summarisers, agents that take actions, coding assistants.

What you look for. The risk categories on OWASP's 2025 list. Start with the five easiest to practise: prompt injection (direct and hidden in documents), sensitive information disclosure, system prompt leakage, excessive agency, and misinformation.

How you work. A written scope and authorisation; an attack plan by category; manual exploration; automated scans; findings with evidence; retesting after fixes.

What you produce. A report: scope, summary, findings table (category, severity, pass rate, status), and an appendix of prompts and responses.

Tools. garak — NVIDIA's free LLM vulnerability scanner. PyRIT — Microsoft's open-source Python Risk Identification Tool for generative AI. Both verified 23 Oct 2026.

Who hires. AI product companies, security consultancies, labs, and QA teams adding AI safety checks.

The rule that never bends. Test only what you own or are authorised in writing to test.

Tap a card to flip it.

• "It's a chatbot, it can't do any harm."
• "One fix closes the hole."
• "Scanners find everything."
• "You need to be a hacker."
• "Red-teaming means harmful content."
• "Publish what you find."

Manual testers bring exploratory instincts and clear bug reports. Automation testers bring scanners, data-driven attacks and safety regression. Security testers, evaluators and trust-and-safety staff also arrive here.

Build a small chatbot you control, give it fake secrets and rules, and try to break them. Then add a document it reads, with a hidden instruction inside. It's legal, safe, and makes a real portfolio.

A small company is about to launch a support bot and asks for a check. You agree a one-page scope: which bot, which test environment, which dates, and what's off-limits (no real customer data, no load testing). You spend the first session exploring by hand, the second running a scanner, the third writing up. The report leads with the two issues that matter most and a plain fix for each. A week later, you retest. That shape — scope, explore, automate, report, retest — is the same whether the client is a start-up or a large firm; only the depth changes.

Safety work can include upsetting material. Take breaks, set limits, and choose projects that fit. Saying no to a content area is professional, not weak.

Manual testers, security analysts and content moderators land here. Red teamers try to make AI systems misbehave — leak data, give harmful advice, break rules — and write it up so it can be fixed. Your starting artefact is a negative-test list or a bug report you wrote.

Assumes 2–3 hours a day alongside job applications, a laptop and a phone, and free plans only. Every step has a smaller version and a way to pause. Use them. It runs in three blocks of 30 days, each ending with a signal that you're on track. A signal is not a promise of a job or income.

What AI changed in your old tasks

Your first 7 days

Days 1–30: A responsible findings pack

Signal by day 30: A security or QA lead engages with a finding.

Days 31–60: Hands-on lab

Signal by day 60: A screening call or bug-bounty acceptance.

Days 61–90: Disclosed properly

Signal by day 90: A second round.

Worries people bring to this route

• Is this a young hacker's field? Patience and documentation win here. Testers with years of edge cases fit well.
• Career gap. A responsible write-up of failures you found in a public model (reported properly) shows recent work.
• No security degree. Not required by most listings we saw; a clear findings report matters more.
• English for reports. Findings follow a fixed template: steps, impact, severity. Reuse it.
• Family hears 'hacking' and panics. It's paid, authorised testing. Never test systems without permission.
• Work is contract-heavy. Treat it as one income stream; keep QA applications going.

Where the openings are, and what to type

Also worth a weekly look: Instahyre, Cutshort, Wellfound, and iimjobs or hirist for senior roles. Upwork and Contra if you want freelance work.

AI labs' vendor teams, security firms adding AI testing, and bug-bounty style programmes. LinkedIn carries 'AI red team' and 'AI safety tester' posts; many are contract.

• LinkedIn search string: ("red team" OR "AI safety" OR "adversarial testing" OR "prompt injection") AND (AI OR LLM)
• Naukri / foundit keywords: AI red teaming, prompt injection testing, AI safety tester

Job-hunt moves that matter for this route

• Search 'red team AI', 'LLM security', 'trust and safety analyst' on LinkedIn.
• Only test systems you're allowed to; follow disclosure rules.
• A clean write-up beats a long list of jailbreaks.

We haven't verified pay data for red-team roles.

Paid "AI hacker certifications" sold by chat, or "projects" that need deposits. Never share OTPs or UPI PINs. Official domains only. Report: cybercrime.gov.in / 1930 (India), ReportFraud.ftc.gov (US).

Is it legal? With written authorisation, yes. Without it, don't. Can I start without coding? Yes; scanners come later.

Take the quiz · From: Manual tester · Automation tester · Related: AI evaluator · AI test automation