Career-PathGPS
← All education and training
Career

Penetration Testers

Typical education: Bachelor's degreeHigh pressure Bright Outlook

What they do

Evaluate network system security by conducting simulated internal and external cyberattacks using adversary tools and techniques. Attempt to breach and exploit critical systems and gain access to sensitive information to assess system security.

Kinds of work

  • Investigative: Science, research, figuring out how things work and solving complex problems.
  • Conventional: Organizing information, following clear procedures and working with data and details.
  • Realistic: Hands-on work with tools, machines, plants or animals, often outdoors.

High pressure: How much pressure workers in this job report: deadlines, conflict, dealing with upset people, the cost of mistakes, responsibility for others' safety, competition and long hours. It varies a lot from one employer to the next. Source: U.S. Department of Labor worker surveys.

Pay, tasks and more

Salary

United States $116,580 Median per year · $56.05/hr Most earn $55,940–$188,470

BLS Occupational Employment and Wage Statistics, 2025.

What you might do

  • Write audit reports to communicate technical and procedural findings and recommend solutions.
  • Evaluate vulnerability assessments of local computing environments, networks, infrastructures, or enclave boundaries.
  • Test the security of systems by attempting to gain access to networks, Web-based applications, or computers.
  • Discuss security solutions with information technology teams or management.
  • Assess the physical security of servers, systems, or network devices to identify vulnerability to temperature, vandalism, or natural disasters.
  • Investigate security incidents, using computer forensics, network forensics, root cause analysis, or malware analysis.

Job outlook

Bright Outlook Rapid Growth; New and Emerging

United States
5% more jobs by 2035, faster than average · about 27,000 openings a year

Openings include new jobs and jobs left by workers who retire or change careers. Projections: U.S. Bureau of Labor Statistics. "Bright Outlook": U.S. Department of Labor.

Where they work

  • Federal government, excluding postal service19.6%
  • Computer systems design and related services16.0%
  • Management of companies and enterprises4.9%
  • Self-employed (their own business)4.9%
  • Computing infrastructure providers, data processing, web hosting, and related services3.5%

Share of all workers in this career. Source: U.S. Bureau of Labor Statistics, National Employment Matrix.

Experience before this job: 2 to 4 years

Career path

How people usually get into this career, from school to their first job and beyond.

Typical education: Bachelor's degreeExperience before this job: 2 to 4 years

Penetration testing is usually not an entry-level job. Most people earn a bachelor's degree, work 2 to 4 years in IT or security first, and then move into it, though a few strong candidates get hired straight out of school.

  1. Bachelor's degree in computer science, cybersecurity, or information technology

    4 years

    You learn how networks, operating systems, and software work, which is the foundation for finding and testing weaknesses in them.

  2. Help Desk Technician or SOC Analyst

    2-3 years

    You troubleshoot real systems, learn how attacks show up in logs, and build the hands-on experience employers look for before trusting you with attack simulations.

  3. Penetration Tester

    2-4 years in prior related work

    You plan and run authorized simulated attacks on networks, applications, and systems, then write reports that help organizations fix what you found.

Where it can lead

  1. Senior Penetration Tester

    3-5 years of experience first

    You take on harder targets, lead testing projects, mentor junior testers, and are trusted to talk with clients about risk and fixes.

  2. Information Security Engineer

    4-6 years of experience first

    You shift from finding weaknesses to designing, building, and maintaining secure systems, which means strong skills in both security and engineering.

What you can do now

Ideas for high school and college students.

In high school

  • Take computer science and programming classesLearning to code, even in a basic language, helps you understand how software can be broken and how to write scripts that automate testing.
  • Take math and any networking or IT course your school offersStrong logic and an early look at how computer networks work will make later security classes much easier.
  • Join a coding, robotics, or cybersecurity clubWorking on team projects builds problem-solving skills and gives you people to learn from.
  • Try a capture-the-flag (CTF) eventMany schools and online communities run beginner-friendly puzzle contests that let you practice security thinking in a safe, legal setting.
  • Get a starter job helping with computersFixing school or family computers, or working a basic tech support job, builds real troubleshooting experience early.

In college

  • Major in computer science or cybersecurity, and take networking, operating systems, and security coursesThese classes cover the core knowledge penetration testers use every day.
  • Join or start a security club or CTF teamRegular practice with teammates sharpens your skills and often leads to contacts who can refer you for jobs.
  • Work a campus IT help desk jobIt gives you paid, real-world troubleshooting experience and a reference that shows you can handle systems people depend on.
  • Apply for a summer internship in IT or securityAn internship lets you see how security teams work and gives you experience to list on your resume before graduating.
  • Earn a beginner security certificationA certification like CompTIA Security+ shows you understand security basics, which helps when you apply for your first IT or security job.

Tips for getting started

  • Practice legally and build a portfolio: capture-the-flag challenges and self-run home labs let you practice attack skills, and writing up what you learned shows employers you can communicate findings.
  • Learn networking and Linux early, since most penetration testing tools and environments depend on them.
  • Consider an entry certification such as CompTIA Security+ once you have some IT experience; it can help you get past the first hiring screen.

Related jobs that often lead here

Related jobs a step up

Education, experience and related careers: U.S. Department of Labor. The step-by-step path, where it can lead and what you can do now were written by AI as typical examples; many people take other ways.

College majors that lead here

Majors: U.S. Department of Education and BLS (CIP–SOC crosswalk). Earnings and debt: College Scorecard, typical across U.S. colleges.

Related careers