Penetration Tester
Also advertised as: Application Security Tester, Ethical Hacker, ethical hackers, ICT security tester, network security tester, Penetration Tester
Legally hacks systems to find vulnerabilities before criminals do.
What the job involves
Penetration testers are hired to attack an organisation's systems, applications or networks to find weaknesses before real attackers do. You plan tests, exploit vulnerabilities and write reports explaining what you found and how to fix it. Certifications carry significant weight in hiring alongside demonstrable practical skill.
Typical responsibilities
- Plan and scope penetration tests
- Identify and exploit security vulnerabilities
- Document findings and evidence
- Write reports with remediation advice
- Present findings to technical and non-technical clients
Common employers
- Security consultancies
- Banks
- Government agencies
- Technology companies
Pay, hours and working environment
Typical pay
£30,000 – £40,000 a year
With experience
£50,000 – £85,000 a year
Typical hours
37.5 hours, occasionally outside normal hours for live testing
Working environment
Office, remote or client site depending on engagement
Remote working
hybrid
Demand for this work
high
Pay ranges are indicative guidance drawn from advertised UK vacancies and published careers information. They are not an offer, and actual pay varies by employer, location and experience.
Skills and qualifications
Core skills
- Network and application security
- Scripting
- Vulnerability assessment tools
- Report writing
- Ethical hacking methodology
- Communication
Transferable skills you may already have
- Curiosity and persistence
- Technical writing
- Self-taught security research
Requirements employers ask for
- Network and application security
- Scripting
- Vulnerability assessment tools
- Report writing
- Ethical hacking methodology
- Communication
- No formal qualification required; recognised certification usually expected
- perform security vulnerability assessments
- software anomalies
- cyber attack counter-measures
- computer forensics
- tools for ICT test automation
- identify ICT system weaknesses
- identify ICT security risks
- legal requirements of ICT products
- address problems critically
- develop code exploits
- penetration testing tool
- execute ICT audits
Useful but not essential
- Curiosity and persistence
- Technical writing
- Self-taught security research
- Offensive Security Certified Professional (OSCP)
- CREST Registered Tester
- CompTIA PenTest+
- organisational resilience
- define security policies
- perform project management
- Nessus
- proxy servers
- information confidentiality
- Internet of Things
- solve ICT system problems
Helpful qualifications
- Offensive Security Certified Professional (OSCP)
- CREST Registered Tester
- CompTIA PenTest+
Ways into this career
A degree is only one route. Where an apprenticeship, work-experience or qualification route exists, it is listed here alongside the academic option.
Apprenticeships and work-based routes
- Cyber Security Technologist (Level 4)
Degree and college routes
- Related subject: Cyber security
- Related subject: Computer science
Where this career can lead
next
Senior Penetration Tester
next
Red Team Lead
next
Security Consultant
The good parts and the hard parts
What people enjoy
- Intellectually engaging and varied work
- Strong demand and good salaries
- Certifications provide a clear progression path
What people find hard
- Requires constant learning as attack techniques evolve
- Reporting and paperwork take up significant time
Common questions
- Do you need a degree to become a penetration tester?
- No. As well as degree routes, this career can be entered through an apprenticeship or by building experience and qualifications on the job. not_required
- How much does a penetration tester earn in the UK?
- Typical advertised pay runs from £30,000 to £40,000 a year, rising towards £85,000 with experience. Figures are indicative guidance rather than an offer.
- What skills transfer into this career?
- Skills that transfer well include Curiosity and persistence, Technical writing, Self-taught security research.
Related careers
Scrum Master
Helps agile teams work smoothly and remove obstacles to delivery.
CRM Administrator
Configures and maintains the software a business uses to manage customer relationships.
IT Support Technician
Fixes technology problems for staff or customers, from logins to hardware faults.
Software Developer
Writes, tests and maintains the code behind applications and systems.
Systems Administrator
Keeps servers, networks and business systems running day to day.
Site Reliability Engineer
Applies software engineering to keep large systems reliable at scale.
Where this information comes from
- National Careers Service
- Institute for Apprenticeships
Last reviewed 15 September 2026.
Read how our career data is built and reviewed, or tell us if something here is wrong.