Penetration Testers
Evaluate network system security by conducting simulated internal and external cyberattacks using adversary tools and techniques. Attempt to breach and exploit critical systems and gain access to sensitive information to assess system security.
Also called: Application Security Assessor, Application Security Hacker, Application Security Tester, Certified Tester, Cyber Assessment Tester, Cyber Assessor
Median pay
$116,580
Pay for the broader BLS group “Computer Occupations, All Other”
Pay range (10th–90th)
$55,940 – $188,470
People employed
435,370
Whole BLS group
Holland code
ICR
Investigative · Conventional · Realistic
Updated October 2026 · Data: O*NET 31.0 and BLS OEWS May 2025 · How we match careers
Is this career right for you?
These are the things that stand out in this job compared with other U.S. jobs (O*NET 31.0 work context). Answer honestly.
- 1.Are you comfortable sitting at a desk most of the day?
- 2.Are you OK repeating the same tasks most of the day?
- 3.Are you OK working more than 40 hours a week?
- 4.Are you happy working mostly on your own, with little contact with others?
The hard parts
- Tight deadlines are common
- Mistakes can have serious consequences
Penetration Testers pay by state
Highest-paying states
Annual median pay by state (50 states and DC with published data). Source: BLS OEWS May 2025, for the broader group “Computer Occupations, All Other”.
What penetration testers do
- 01Document penetration test findings.
- 02Identify security system weaknesses, using penetration tests.
- 03Write audit reports to communicate technical and procedural findings and recommend solutions.
- 04Gather cyber intelligence to identify vulnerabilities.
- 05Maintain up-to-date knowledge of hacking trends.
- 06Keep up with new penetration testing tools and methods.
Skills that matter most
- Critical Thinking
- Writing
- Reading Comprehension
- Active Listening
- Active Learning
- Monitoring
Knowledge
- Computers and Electronics
- Telecommunications
- Engineering and Technology
- English Language
- Customer and Personal Service
Work styles that stand out
- Dependability
- Attention to Detail
- Integrity
- Cautiousness
- Intellectual Curiosity
Education and first steps
O*NET has no education survey data for this job.
How people get started
- Usually needs a bachelor's degree (O*NET Job Zone 4).
- Related work experience: over 2 years, up to and including 4 years.
- On-the-job training: over 1 month, up to and including 3 months.
- A professional certification is often expected.
Most common answers from O*NET 31.0 Education, Training and Experience.
Interest fit (Holland code)
O*NET occupational interest scores, scale 1–7. Take the Free Career Test to compare with your own.
Career changes
Change from penetration testers
- Radio Frequency Identification Device Specialists77% · group pay
- Validation Engineers76% · group pay
- Computer Hardware Engineers75% · —
- Security Management Specialists74% · group pay
- Statistical Assistants74% · —
Change into penetration testers
Jobs whose skills carry over best (skill match, their median pay).
- Radio Frequency Identification Device Specialists77% · $130,220
- Data Scientists74% · $120,230
- Remote Sensing Technicians74% · $62,280
- Security Management Specialists74% · $83,050
- Validation Engineers73% · $102,440
Majors that lead here
- Computer and Information Sciences, General
- Data Processing and Data Processing Technology/Technician
- Information Science/Studies
- Computer Science
- Information Technology Project Management
- Bioinformatics
- Computational Biology
- Mathematics and Computer Science
- Accounting and Computer Science
- Computational Science
- Human Computer Interaction
- Cheminformatics/Chemistry Informatics
From the NCES CIP 2020 to SOC 2018 crosswalk.