Career role

Penetration Tester

Penetration Testers are professional hackers (the good kind). You'll simulate real attacks to find vulnerabilities before malicious actors do. This role requires technical depth, creativity, and a hacker mindset.

IntermediateAlso known as Ethical Hacker, Security Tester, Red Team Operator

Plan my route to this role

Why choose this role?

If you love problem-solving and thinking like an attacker, this is your dream job. You'll get paid to hack, work with cutting-edge tools, and directly improve security. High pay and intellectual challenge make this role extremely rewarding.

Work environment

Setting: Consultancy firms, in-house security teams, or independent consulting
Schedule: Standard business hours, with some flexibility for client engagements
Remote work: Highly flexible, many remote opportunities available
Experience: Mid-level (2-5 years in IT or security)

Education requirements

Bachelor's degree preferred but not required; practical skills and certifications often valued more

Key responsibilities

Conduct network and application penetration tests
Identify and exploit security vulnerabilities
Perform social engineering assessments
Write detailed technical reports with remediation guidance
Stay current with latest attack techniques and tools
Collaborate with development and security teams

Required skills

Exploitation frameworks (Metasploit, Cobalt Strike)Web application testing (Burp Suite, OWASP Top 10)Network protocols and architectureScripting (Python, Bash, PowerShell)Linux and Windows system internals

Career path

Previous roles
Security Analyst Security EngineerIT Administrator
This role
Penetration Tester
Time to next level: 3-5 years
Next roles
Senior PentesterRed Team Lead Security Consultant

Certifications we recommend

Our editorial picks, based on what each exam covers. They don't show how often employers ask for a certification.

Intermediate2

EC-Council

Intermediate

Certified Ethical Hacker

Tests recognition of attack techniques across nine domains in a 125-question exam, with an optional six-hour hands-on Practical leading to CEH Master

Exam: $950
Study: 4-6 months

CompTIA

Intermediate

CompTIA PenTest+

Covers a full penetration test from scoping to report, including Active Directory, cloud and AI attacks, through scenario-based questions rather than a live lab

Exam: $439
Study: 2-3 months

Advanced2

OffSec

Advanced

OffSec Certified Professional

Proctored 24-hour practical with an Active Directory set; passing now awards lifetime OSCP plus a three-year OSCP+

Exam: $1,699
Study: 3-6 months

GIAC

Advanced

GIAC Penetration Tester

Proves you can plan and run an enterprise penetration test, from reconnaissance to Kerberos and Entra ID attacks, in an exam with CyberLive tasks

Exam: $999
Study: 4-6 months

Annual pay

10th percentile: $75k
Median: $129k
90th percentile: $200k

Information Security Analysts (SOC 15-1212)

BLS doesn't publish figures for penetration testers on their own, and O*NET classes penetration testers under computer occupations, all other. These figures cover information security analysts, the closest security occupation BLS reports on its own.

Source: U.S. Bureau of Labor Statistics, Information Security Analysts: Occupational Outlook Handbook (Pay) (May 2025, United States). Retrieved 2026-10-18.

Occupation outlook

Projected growth (2025–35): 21%
Projected openings per year: 14,100

Information Security Analysts (SOC 15-1212)

Source: U.S. Bureau of Labor Statistics, Table 1.2 Occupational projections, 2025–35, and worker characteristics, 2025 (2025–35, United States). Retrieved 2026-10-18.