Photo: U.S. Marine Corps photo by Cpl. Bridgette Rodriguez (Public domain)
Job description
Penetration testers simulate cyberattacks against an organization's networks, applications, or systems, writing scripts or tools to automate parts of an attack or scan for weaknesses. Once an engagement wraps, they document findings in detailed reports that rank vulnerabilities by severity, brief technical teams and executives on what needs fixing, and retest the systems afterward to confirm the holes are actually closed. The work is highly independent and demands creative, adversarial thinking, and because engagements run on fixed timelines, there's real pressure to find and document everything before the window closes.
Pros
- High pay ceiling near $188k with much faster than average growth (8.2%)
- Highly independent, creative work, since finding real vulnerabilities rewards original thinking
- Often remote-friendly, with real variety across engagements rather than one repetitive system
Cons
- Above-average hours, compressed further by fixed engagement deadlines
- Findings can prompt tense pushback from the teams responsible for the systems tested
- Requires constantly tracking new attack techniques and tools just to stay effective
A typical day
The engagement kicked off Monday, and by Wednesday morning the tester is deep in the client's external perimeter: subdomains enumerated overnight, a forgotten staging server found running an outdated framework, and the morning spent building a careful exploit chain — proof, not damage, is the deliverable. Every step lands in the log with timestamps, because the report is the product and reproducibility is its spine. After lunch the phishing campaign's results come in: 9 of 40 employees clicked, two entered credentials, screenshots captured for the awareness section. The afternoon's pivot gets the blood moving — the staging server yields internal network access, and domain admin falls by 4pm via a misconfigured service account. The client's CISO gets the critical findings called in immediately rather than saved for the report; that's the ethic. Two days of writing remain: findings ranked, fixes specified, and an executive summary a board can understand. Breaking in legally is the fun; the writing is the job.
Tasks at the job
- Simulate cyberattacks against an organization's networks, applications, or systems to find exploitable vulnerabilities before real attackers do.
- Write scripts or tools to automate parts of an attack or scan for weaknesses.
- Document findings in detailed reports ranking vulnerabilities by severity and suggesting fixes.
- Brief technical teams and executives on findings and remediation priorities.
- Track new attack techniques, exploits, and defensive tools.
- Retest systems after fixes are applied to confirm vulnerabilities are closed.
Workplace & working conditions
Work happens indoors at a computer, often remote, though some engagements involve on-site testing of physical security or internal networks.
The work is highly independent and self-directed, requiring creative, adversarial thinking to find weaknesses others missed. Engagements run on fixed timelines, which can create pressure to find and document everything before the window closes, and findings sometimes prompt tense conversations with the teams responsible for the systems tested.
Education necessary or common
Bachelor's degree
Common college majors
Licenses & certifications
- CompTIA Security+
- eJPT or PNPT (entry practical certs)
- OSCP (the field's respected practical benchmark)
- CEH
Career path
Related fields
Courses to take
- AP Computer Science A — code fluency underlies exploitation and tooling
- Networking or Cisco CTE courses — attacks travel networks; know them cold
- AP Computer Science Principles — systems and internet architecture
- AP English Language and Composition — the report is half the profession
- AP Statistics — risk quantification
Clubs, activities & competitions
- CyberPatriot — the national high school cyber defense competition
- picoCTF and other capture-the-flag events — legal hacking practice built for students
- Programming club or personal security projects
- Math team — puzzle stamina
First steps you can take now
- Play picoCTF this month — free, legal, built by Carnegie Mellon for exactly your age group
- Set up a home lab with virtual machines and practice on deliberately vulnerable systems (only ever on machines you own)
- Learn Linux command line fundamentals cold
- Read the ethics first: authorization is the entire difference between this career and a felony
