Penetration tester are the so-called “ethical hackers,” or the good guys. Also known as assurance validators, penetration testers are hired by network system owners and web-based application providers to probe for vulnerabilities that hackers with nefarious intent might be able to exploit to gather secure data and intelligence.
Penetration testers, or pen testers for short, perform simulated cyberattacks on a company’s computer systems and networks. These authorized tests help identify security vulnerabilities and weaknesses before malicious hackers have the chance to exploit them.
Ethical hackers perform vulnerability assessments (along with other tasks) by exercising their skills and knowledge — and actually get paid to perform the equivalent of digital break-ins.
They simulate actual cyberattacks using a broad range of tools and methods, some of their own creation, leaving no stone unturned to unearth cracks in security protocols for networks, systems, and web-based applications.
The idea of a penetration test, or pen test for short, is to probe all possible ways to penetrate any given computer system, to find gaps in security systems BEFORE the real hackers can get in. As a result, pen testers often work on highly confidential and time-sensitive projects, so being trustworthy and cool under pressure are important skills.
Having the creativity to think on the fly, and being organized enough to track, record, and report on projects are also good qualities in penetration testing.
Penetration tester tasks and responsibilities
Contents
The day-to-day tasks of a pen tester will vary depending on the organization. Here are some common tasks and responsibilities you may encounter in this role, all pulled from real job listings:
- Perform tests on applications, network devices, and cloud infrastructures
- Design and conduct simulated social engineering attacks
- Research and experiment with different types of attacks
- Develop methodologies for penetration testing
- Review code for security vulnerabilities
- Reverse engineer malware or spam
- Document security and compliance issues
- Automate common testing techniques to improve efficiency
- Write technical and executive reports
- Communicate findings to both technical staff and executive leadership
- Validate security improvements with additional testing
Where do penetration testers work?
Penetration testers typically work in one of three environments.
- In-house: As an in-house penetration tester, you work directly for a company or organization. This typically allows you to get to know the company’s security protocols well. You may also have more input into new security features and fixes.
- Security firm: Some organizations hire an outside security firm to conduct penetration testing. Working for a security firm offers greater variety in the types of tests you’ll get to design and perform.
- Freelance: Some penetration testers choose to work as freelancers. Choosing this path can give you greater flexibility in your schedule, but you may need to spend more time looking for clients early in your career.
- Industries:
Major industries that employ penetration testers include financial services, healthcare, and government. Many companies in the technology sector also hire penetration testers in large numbers, as do businesses that specialize in information security.
Employment opportunities in financial services cover jobs with banks, credit card companies, payment processors, and brokerages. These companies tend to pay relatively well, in large part due to the sensitive nature of the information and assets they control and the potential consequences that can result from successful cyberattacks. Similar trends extend to healthcare and government, although public-sector organizations tend to pay less due to budgetary limitations.
Many leading technology companies employ internal penetration testers as part of their quality assurance commitments. Information security firms typically assign testing teams to short-term jobs for individual end clients, offering more variation in day-to-day duties. Pay rates in these industries also tend to range toward the higher end.
Major Employers
Amazon
A global online retail giant, Amazon is among the world’s largest and most valuable companies. Given the volume of financial transactions that take place through its network and the sensitive nature of the customer information it stores, Amazon also ranks among the leading employers of pen testers.
Paylocity
Founded in 1997, Paylocity is one of the largest providers of online payroll services in the country. The company’s services draw heavily on cloud computing, meaning that Paylocity must constantly strive to stay ahead of hackers and cybercriminals targeting their data.
International Business Machines (IBM)
According to PayScale, IBM ranks among the top-paying employers of pen testers. A trusted name in technology for decades, IBM offers a complete lineup of information security services to end clients through its branded X-Force Red program.
Penetration Tester Salary
According to PayScale data from August 2020, the average penetration tester salary in the U.S. sits at $84,690 per year. However, many factors affect a professional’s salary, such as experience. The chart below explains the typical salaries earned by penetration testers at various stages of their careers.
Education also affects salary; applicants with advanced degrees and industry-standard certifications tend to attract offers with higher rates of pay. The same trend applies to positions with more responsibility. Senior team members and team leads usually earn more than junior and entry-level employees.
Industry is another key factor that affects salary. Some industries, such as financial services and military contracting, face greater levels of risk and potential loss in the event of a successful cyberattack. Thus, they tend to pay their testers more in order to attract the best and most qualified job applicants.
Penetration testing vs. ethical hacking
The terms penetration testing and ethical hacking are sometimes used interchangeably in the cybersecurity world. But the two terms have slightly different meanings. Penetration testing focuses on locating security issues in specific information systems without causing any damage. Ethical hacking is a broader umbrella term that includes a wider range of hacking methods. You can think of penetration testing as one facet of ethical hacking. Both roles have overlap with a cybersecurity Red Team—the group that gives security feedback from the adversary’s perspective.
How to become a penetration tester
As a penetration tester, you can earn a paycheck by legally hacking into security systems. It can be a fast-paced, exciting job if you have an interest in cybersecurity and problem solving. In this section, we’ll take a closer look at the steps you might take to get your first job as a penetration tester.
1. Develop penetration testing skills.
Penetration testers need a solid understanding of information technology (IT) and security systems in order to test them for vulnerabilities. Skills you might find on a pen tester job description include:
- Network and application security
- Programming languages, especially for scripting (Python, BASH, Java, Ruby, Perl)
- Threat modeling
- Linux, Windows, and MacOS environments
- Security assessment tools
- Pentest management platforms
- Technical writing and documentation
- Cryptography
- Cloud architecture
- Remote access technologies
Popular penetration tester tools
Today’s penetration testers have a range of tools to help make their jobs faster and more efficient. If you’re interested in becoming a pen tester, it can help to gain familiarity with one or more of these tools.
*Kali Linux: Popular pentesting operating system
*Nmap: Port scanner for network discovery
*Wireshark: Packet sniffer to analyze traffic on your network
*John the Ripper: Open-source password cracker
*Burp Suite: Application security testing tools
*Nessus: Vulnerability assessment tool
*OWASP ZAP Proxy: Web application security scanner
Get hands-on experience with some of these tools in two hours or less with a Guided Project on Coursera. Start with Wireshark for Basic Network Security Analysis or Web Application Security Testing with OWASP ZAP.
2. Enroll in a course or training program.
One of the best ways to start developing the skills you’ll need as a penetration tester is to enroll in a specialized course or training program. With these types of programs, you can learn in a more structured environment while building multiple skills at once.
If you’re new to cybersecurity, consider an option like the IBM Cybersecurity Analyst Professional Certificate, which includes an entire unit on penetration testing and incident response. The entire program is online and at your own pace, so you can learn job-ready skills while working or managing life’s other responsibilities.
Do I need a degree to become a penetration tester?
While it can be helpful to have a degree in computer science, information technology, or cybersecurity, not all penetration testing jobs require a degree. Typically, your level of experience and ability to complete the task matter more than what degree (if any) you have. If you’re starting in cybersecurity without a related degree, it might be helpful to pursue a certification to validate your skills.
3. Get certified.
Cybersecurity certifications demonstrate to recruiters and hiring managers that you have the skills required to succeed in the industry. In addition to these more general cybersecurity certifications, you can also get certified in penetration testing or ethical hacking. Reputable certifications to consider include:
- Certified Ethical Hacker (CEH)
- CompTIA PenTest+
- GIAC Penetration Tester (GPEN)
- GIAC Web Application Penetration Tester (GWAPT)
- Offensive Security Certified Professional (OSCP)
- Certified Penetration Tester (CPT)
Earning one of these certifications generally requires passing an exam. Besides earning a credential for your resume, preparing for a certification exam can often help you develop your skill set as well.
4. Practice in real and simulated environments.
Many companies want to hire penetration testers with previous experience. Luckily, there are ways to start gaining experience outside of the workplace. Many pen testing training programs include hands-on testing in simulated environments.
Another way to gain experience (and make your resume stand out) is to participate in bug bounty programs. In these programs, companies typically offer cash bonuses to independent pen testers and security researchers who find and report security flaws or bugs in their code. It’s an excellent way to test your skills and start networking with other security professionals. You can find a list of bounties on sites like Bugcrowd and HackerOne.
Finally, you’ll find several websites designed to allow penetration testers to legally practice and experiment through fun, gamified experiences. Here are a few to get your started:
5. Start in an entry-level IT position.
Many penetration testers start out in more entry-level IT and cybersecurity roles before advancing into pen testing. If you want to pursue a career in pen testing, consider starting out in a role like network or systems administrator or information security analyst to start building your IT skills.
6. Begin your job search.
When you’re ready to begin applying for pen tester jobs, be sure to extend your search beyond the usual job sites. While LinkedIn, Indeed, and ZipRecruiter are excellent resources, you should also scan specialized cybersecurity job boards, like Dice and CyberSecJobs.com.
Why pursue a career in penetration testing?
A career as a pen tester gives you the opportunity to apply your hacking skills for the greater good by helping organizations protect themselves from cyber criminals. It’s also an in-demand, high-paying career path.
Penetration tester salary
Penetration testers in the US make an average salary of $103,260, according to Glassdoor in July 2021. Your salary will depend on a variety of factors, including your location, experience, education, and certifications. Some industries, like financial services and military contracting, tend to pay higher salaries than others.
Job outlook
The US Bureau of Labor Statistics projects 31 percent job growth for information security analysts, including penetration testers, between 2019 and 2029. This is much faster than the average for all occupations in the US.
Career path for penetration testers
As you gain experience as a penetration tester, you may advance to lead a pen-testing team. Some penetration testers go on to become information security managers and may even move into executive roles.
