Good test reports explain the authorized target, the confirmed problem, its impact, and the fix; running a scanner alone is not a complete penetration test.
Penetration testers are paid to check whether attackers could break into an organization’s systems. They test only systems they have permission to examine, confirm security weaknesses, and explain how to fix them.
The career suits people who like solving technical problems and communicating what they find.
Ad
cybersecurityguide.org is an advertising-supported site. Clicking in this box will show you programs related to your search from schools that compensate us. This compensation does not influence our school rankings, resource guides, or other information published on this site.
Featured Cybersecurity Training
| School Name | Program | More Info |
|---|---|---|
| Southern New Hampshire University | Online BS in Cybersecurity | website |
| Purdue Global | Online BS in Cybersecurity | website |
| UC Berkeley School of Information | Online MS in Cybersecurity | No GRE/GMAT Required | website |
What does a penetration tester actually do?
A test begins with an agreement about which websites, networks, or other systems the tester can examine. The tester gathers information about those systems, checks for weaknesses, and, when allowed, shows what a weakness might let an attacker do.
The work ends with a report that explains the evidence, possible impact, and recommended fixes. This is not just clicking a scan button. Scanners flag possible security problems.
Pen testers use judgment and manual checks to confirm which problems are real. Some test websites, while others specialize in company networks, cloud services, or mobile applications.
Penetration testing versus related jobs
| Role | Main focus |
|---|---|
| Penetration tester | Authorized attempts to confirm security weaknesses and explain their impact |
| Vulnerability analyst | Finds, tracks, and helps prioritize weaknesses; may not attempt to use them |
| Red team member | May conduct wider attack simulations to test detection and response |
| Security analyst | Often monitors and helps defend systems rather than performing attack simulations |
Titles vary by employer. A posting that mentions several roles should be judged by its duties, not the title alone. NIST also distinguishes cybersecurity work roles from actual job titles.
How to get started
- Learn computer and network basics. Study IP addresses, common services, Windows and Linux, and how websites handle user accounts.
- Practice in a safe lab. Use practice systems built for learning or systems you own and control. Never assume a public website is yours to test.
- Write down what you did. For each lab, explain the problem, the steps that confirmed it, and how the system could be made safer.
- Build experience. IT support, network administration, coding, and security operations can all provide useful preparation. Search for junior testing jobs and related entry-level roles.
- Match your learning to real openings. Compare employers’ requirements before spending money on courses or certification exams.
A strong beginner portfolio might contain two short reports from authorized labs. Show the reasoning as well as the result. Avoid publishing sensitive information from real organizations.
Skills, education, and certifications
Useful skills include networking, Linux and Windows, web application basics, basic Python or shell scripting, and clear report writing. Nmap and Burp Suite are examples of tools used for network and web tests, but knowing what their results mean is more important than knowing many product names.
Employers value practical testing and reporting skills, but their formal requirements differ. Some employers consider equivalent experience; others set specific requirements.
For example, a 2026 Peraton position in Arlington, Virginia required an active Secret clearance, U.S. citizenship, and substantial experience. That is one government-contractor position, not a rule for every pen tester.
Three certifications to compare are GPEN, which covers penetration testing methods and reporting; OSCP/OSCP+, which tests practical penetration testing skills; and CEH, which covers ethical hacking knowledge and has issuer-defined exam eligibility routes.
OffSec currently describes OSCP as a lifetime credential and OSCP+ as a separate three-year designation. Compare these credentials with the skills listed in jobs you want to apply for.
Penetration tester salary in the United States
Different sources report different figures because their data are not collected the same way:
| Source | Annual U.S. figure | Meaning |
|---|---|---|
| PayScale | $106,261 | Average base salary, 287 Penetration Tester salary profiles |
| Indeed | $126,229 | Average base salary, 278 job-posting salaries over 36 months |
| Peraton | $86,000 to $138,000 | Advertised range for an experienced job in Arlington, Virginia |
PayScale reflects survey responses, Indeed summarizes salaries in job ads, and Peraton describes one experienced clearance position. These figures answer different questions about pay and cannot be used as a single starting salary.
BLS reported a May 2025 median of $129,180 for information security analysts, a much broader occupation. It is not the official median salary for penetration testers.
Are penetration tester jobs growing?
The government does not publish a separate national job-growth forecast for penetration testers. BLS projects 21% employment growth from 2025 to 2035 for the broader information security analyst occupation, with about 14,100 annual openings across that occupation. These numbers cannot be used as exact penetration tester projections.
Pen testing work appears in consulting, software, corporate security, and government contracting. Demand and qualifications differ across those settings, so look at current local or remote vacancies for a better picture of opportunities.
What to check before applying
Read the posting for the systems being tested, experience level, report-writing expectations, and any citizenship or clearance conditions. Confirm whether the employer wants someone who performs technical tests, manages vulnerability reports, or leads wider red team exercises. Those distinctions can change the skills you need.
Frequently asked questions
A penetration tester is an authorized security tester who checks whether weaknesses in systems can be used and tells the owner what needs fixing.
They plan tests, check systems, review results, document confirmed problems, and discuss repairs. Time is often spent researching and reporting, not only testing.
There is no separate BLS forecast for this precise title. The broader information security analyst occupation is projected to grow 21% from 2025 to 2035.
Networking, Linux and Windows, how websites and user accounts work, basic scripting, and writing short technical reports.
Yes, some employers accept relevant work experience or practical skills. Others require a degree, certification, or clearance. Always check the actual job advertisement.
Authorized testing within an agreed scope is legitimate work. Testing a system without permission is not made acceptable by calling it ‘ethical hacking.’ Written boundaries matter.
References
- NIST | Guide to Information Security Testing & Assessment | Accessed October 2026
- OWASP | Web Security Testing Guide | Accessed October 2026
- NIST | Occupations | Jobs | and Work Roles | Accessed October 2026
- Peraton | 2026 penetration tester posting | Accessed October 2026
- GIAC | GPEN | Accessed October 2026
- OffSec | PEN-200 and OSCP/OSCP+ | Accessed October 2026
- EC-Council | CEH | Accessed October 2026
- PayScale | Penetration Tester Salary | Accessed October 2026
- Indeed | Penetration Tester Salary | Accessed October 2026
- BLS | Information Security Analysts | Accessed October 2026
- NIST | Rules of Engagement | Accessed October 2026