Occupation · SOC 15-1299.04
Penetration Testers
Evaluate network system security by conducting simulated internal and external cyberattacks using adversary tools and techniques. Attempt to breach and exploit critical systems and gain access to sensitive information to assess system security.
Median wage
$108,970
$52,650–$176,800
Projected growth
+8.2%
Faster than average
Annual openings
3,850
per year
Employed (US)
439,380
Job Zone 4
Typical preparation
Considerable preparation
Stackable credential programs
2,518 mapped
Core skills
Critical ThinkingReading ComprehensionActive ListeningComplex Problem SolvingSpeakingJudgment and Decision MakingWritingActive Learning
Knowledge areas
Computers and ElectronicsEnglish LanguageMathematicsEngineering and TechnologyCustomer and Personal Service
Technology & tools
Amazon Web Services AWS softwareAnsible softwareApple iOSApple macOSBashCC#C++Database management systemsDockerFirewall softwareGhidraGitHubGoGoogle AndroidGoogle Cloud softwareHP WebInspectHex-Rays IDA ProIBM MiddlewareIBM QRadar SIEMIBM TerraformInvicti AcunetixJavaScriptKali LinuxKubernetesLinuxMITRE ATT&CK softwareMagellan FirmwareManagement information systems MISMetasploitMicrosoft Active DirectoryMicrosoft Active Server Pages ASPMicrosoft Azure DevOps ServicesMicrosoft Azure softwareMicrosoft ExcelMicrosoft Office softwareMicrosoft PowerShellMicrosoft SQL ServerMicrosoft Visual Basic Scripting Edition VBScriptNmap
Representative tasks
Troubleshoot program and system malfunctions to restore normal functioning.Provide staff and users with assistance solving computer-related problems, such as malfunctions and Test, maintain, and monitor computer programs and systems, including coordinating the installation o
Competency framework
Skill expectations by proficiency level.
emerging
Basic penetration testing tools and scanning utilities — execute under direct supervision to enumerate open ports and services on a controlled lab network.Common vulnerability databases and CVE repositories — reference and interpret to identify known weaknesses in target systems during guided assessments.Operating system software environments including Linux and Windows — navigate and configure under direction to support initial reconnaissance activities.Structured test plans and assessment checklists — follow precisely to conduct entry-level security scans within a defined scope and rules of engagement.Program and system malfunctions identified during testing — document observations and escalate to senior testers for diagnosis and remediation guidance.Network security and VPN equipment software — operate under supervision to establish secure testing connections and monitor basic network traffic.Technical findings from automated vulnerability scanners — compile into preliminary reports using standardized templates under reviewer oversight.Database user interface and query software — apply foundational SQL knowledge to test for basic injection vulnerabilities in supervised web application assessments.Reading comprehension skills and vendor security advisories — apply to understand patch notes, exploit disclosures, and testing prerequisites before each engagement.Organizational security policies and rules of engagement — adhere to with strict attention to detail to ensure authorized-only testing on client systems.
developing
Multi-phase penetration testing methodologies — execute with reduced oversight across network, web application, and social engineering test vectors in client environments.Exploitation frameworks such as Metasploit and custom scripts — deploy independently to validate discovered vulnerabilities and demonstrate proof-of-concept exploits.Operating system and application server software — analyze configurations and misconfigurations to identify privilege escalation paths on enterprise infrastructure.Complex problem-solving techniques — apply when encountering non-standard defenses or unexpected system behaviors during live penetration engagements.Intermediate-level assessment reports — author with clear technical narratives, risk ratings, and remediation recommendations for both IT staff and business stakeholders.Database management system software — test for authentication bypass, privilege abuse, and data exposure vulnerabilities in routine client database assessments.Cloud-based management software and infrastructure — assess for misconfigured permissions, exposed storage buckets, and insecure API endpoints in cloud tenancy reviews.Staff and end users reporting security incidents — assist in troubleshooting and correlating symptoms to identify whether issues stem from active compromise or system malfunction.Object-oriented and scripting development environments — write and adapt exploit proof-of-concept code to validate specific vulnerability classes in target applications.Inductive reasoning and pattern recognition — apply across multiple client engagements to identify recurring vulnerability trends and refine testing efficiency.
proficient
Full-scope penetration testing engagements — plan and execute autonomously across network, application, cloud, and physical attack surfaces for complex enterprise clients.Advanced persistent threat simulation and red team operations — design and conduct to replicate realistic adversary tactics, techniques, and procedures against hardened environments.Non-routine system malfunctions and anomalous behaviors encountered during testing — diagnose independently and differentiate between pre-existing issues and artifacts of the assessment.Custom exploit development and tool creation — produce using expert system software and development environments to address gaps where commercial tooling is insufficient.Business problem analysis and integrated security risk modeling — perform to translate technical findings into quantified business impact for executive decision-making.Computer-aided design and network architecture diagrams — interpret and leverage to identify architectural weaknesses and high-value lateral movement paths before active testing begins.Comprehensive penetration test reports and executive briefings — deliver independently with precise written and oral communication tailored to both technical and non-technical audiences.Adversarial threat intelligence and emerging exploit research — synthesize continuously to keep testing methodologies current with real-world attacker capabilities.Judgment and decision-making in high-stakes testing scenarios — exercise with disciplined cautiousness to halt or modify test activities when unplanned system impact is detected.Integrated production system assessments and regression testing programs — coordinate alongside development and operations teams to embed security validation into software delivery pipelines.
advanced
Organizational penetration testing strategy and program maturity roadmap — define and champion at the executive level to align offensive security capabilities with enterprise risk posture.Enterprise-wide red team and adversary simulation programs — architect and oversee, setting scope, methodology standards, and success criteria across multiple concurrent engagements.Junior and mid-level penetration testers — mentor and develop through structured coaching, technical review, and career progression frameworks within the security organization.Cross-functional security improvement initiatives — lead by translating red team findings into prioritized remediation programs coordinated across engineering, operations, and compliance teams.Novel attack research and proprietary tooling innovation — sponsor and direct to advance the organization's offensive security capabilities beyond commercially available solutions.Organizational security policies, testing governance frameworks, and rules of engagement standards — author and maintain to ensure legally compliant and ethically sound testing practices at scale.Executive and board-level security briefings — deliver with authoritative oral and written communication, contextualizing technical risk findings within strategic business objectives.Industry partnerships, threat intelligence consortia, and external research communities — represent the organization within, fostering knowledge exchange that elevates internal team expertise.Staffing, budget allocation, and technology investments for the penetration testing practice — manage with accountability for demonstrating return on security investment to organizational leadership.Education and training curricula for offensive security disciplines — design and institutionalize to build a continuous pipeline of competent practitioners aligned to evolving threat landscapes.
Also known as
45 alternate job titles map to this occupation.
Application Security AssessorApplication Security HackerApplication Security TesterCertified HackerCertified TesterConsulting Advisory TesterCyber AnalystCyber Assessment TesterCyber AssessorCyber Security EngineerCyber Security TesterCyber TesterCybersecurity Engineer (Cyber Engineer)Cybersecurity SpecialistEmbedded TesterEthical HackerForensic Analysis TesterHackerHardware HackerInformation Security AnalystInformation Security AssessorIT Security Tester (Information Technology Security Tester)Network Exploitation AnalystNetwork Security EngineerNetwork Security TesterOffensive Security EngineerPenetration TesterPenetration Testing ConsultantRisk TesterSecurity Application TesterSecurity ArchitectSecurity Assessment TesterSecurity Automation TesterSecurity ConsultantSecurity Consulting TesterSecurity Control AssessorSecurity EngineerSecurity TesterSystems Security TesterTester