Penetration Tester Career Guide 2024 Salary,Training

Author Dr. Ewan Fleischmann 25.02.2023

The most important things in a nutshell

Pentesting is challenging, but doable. A background as IT system administrator or (web) developer are a good starting point. But also motivated career changers have good chances.
The salary as a pentester is on average between € 50.300 and € 68.900, depending on qualifications and experience.
The job as a penetration tester has many facets, is varied and future-proof and with good opportunities for further development
Recommended certifications: OSCP, GIAC, GPEN

What does a penetration tester do?

As a penetration tester, or pentester for short, you conduct simulated cyberattacks on a company's networks and computer systems. In doing so, you use a variety of hacking tools and techniques to find security vulnerabilities that can be exploited by attackers.

A penetration test helps organizations identify and close security gaps and vulnerabilities before malicious hackers exploit them.

A career as a pentester often begins with an entry-level position in IT or IT security.

Salary of penetration testers

Pentesters can expect starting salaries starting 50.300. Pentesters with experience, seniors and team leads well above that as well.

Junior pentester (up to 3 years of experience).	50.300 euro per year
Pentester (3-6 years experience)	57.500 euros per year
Senior pentester and team leads (6 and more years of experience).	68.900 euros per year

These are current averages for Germany in the year 2024, which depend on factors such as company, industry, state, city and not last but not least, one's own resume.

Tasks of penetration testers

The day-to-day tasks of a pen tester vary by company. The following are typical tasks and responsibilities, you'll encounter in this role:

Conduct security testing on applications, network devices, and cloud infrastructure
Designing and executing emulated social engineering attacks
Researching and experimenting with different types of attacks
Developing new and enhanced methods for penetration testing
Reviewing code for security vulnerabilities (code review)
Reverse engineering of malware or spam
Documentation of security and compliance issues
Automating common testing procedures to improve efficiency
Writing technical reports and reports
Communicating results to both technical staff and management
Reviewing safety improvements

Where do pentesters work?

Penetration testers almost always work in one of the three environments listed below.

In-house pentester: As an in-house penetration tester, you work directly for a company or organization. This usually gives you a good understanding of the company's strengths and weaknesses. You may also have a lot of influence on IT security architecture and the selection of new security technologies.

Consulting firm: Many companies hire an outside security firm to perform penetration testing. This work, by its nature, offers more variety in the types of tests you plan and perform.

Freelance: Some penetration testers work as freelancers. This route offers even more flexibility, but you'll have to spend additional time and effort acquiring clients and projects.

Penetration tester or ethical hacker - what are the differences?

The terms ethical hacking and pentesting are sometimes used interchangeably in the cybersecurity world. However, the two terms have slightly different meanings. Penetration testing is about, detecting security vulnerabilities in specific information systems without causing harm. Ethical hacking is a broader term that encompasses a wider range of hacking methods. You can think of penetration testing as one facet of ethical hacking.

How does one become a penetration tester now?

As a penetration tester, you can make a living as a "professional hacker" - hacking into systems legally. If you're interested in IT security, cybersecurity, and IT in general, this can be a tremendously exciting job. Below, I go into more detail about the steps you can take to land your first job as a penetration tester.

Penetration testers need a solid technical understanding of information technology and the security systems to test for vulnerabilities. These include:

Knowledge of network technologies, operating systems, and (web) application security
Knowledge of web development frameworks (backend and frontend)
Cloud architecture and micro-services, Kubernetes
Cloud services (Azure, AWS, GCP)
Knowledge of systems-related programming languages (for example, C)
Scripting (Python, BASH, Java, Ruby, Perl, PowerShell)
Attack techniques (exploits, code injections, exploits, phishing, etc.)
Using pentesting tools and toolkits such as Burp, Nessus, Metasploit, nmap, Kali Linux, Bloodhound, etc.
Virtualization with VMWare, VirtualBox or XEN
Technical writing and documentation
Threat Modeling
Basics of encryption and cryptography
Remote Access Technologies

The procedure for acquiring the necessary theoretical knowledge and practical skills is certainly very individual. It should also be mentioned that pentesters often start with a focus on a special field, for example penetration testing of web applications, and become "at home" in other areas in the course of their career.

Below are some suggestions that have worked well in practice.

1. Start in an entry-level IT position

Many penetration testers start in IT systems administration, application development, or a technical IT security role, before they specialize in performing pentests. If you want a career in this field, you should start in a position like network or systems administrator, Programmer or Web Application Developer, or IT Security Analyst to expand your IT skills.

2. Educate yourself - and talk about it

This is perhaps the most important point. As an extension to the other options listed here, there is a ton of material on the Internet (Google helps...) and tutorial videos, as well as books, that support self-study. Build your own pentesting lab with virtual machines or with a cloud provider, and just get started!

3. Take a good pentesting course

One of the best ways to acquire skills you'll need as a penetration tester is to attend specialized courses or a training program. With such programs, you can learn in a more structured environment while acquiring multiple skills at the same time.

There are quite a few offerings for this on the market. The courses from Coursera and Cybrary or from Pentester Academy should be mentioned here as representatives. Somewhat more expensive, but highly recommended, are the courses with the associated labs from Offensive Security, e.g. the PEN-200 as preparation for the OSCP certification.

4. Get certified

By getting certified in penetration testing or ethical hacking, you'll show recruiters that you have the necessary skills to be successful in the industry. When choosing a certification, make sure, Your market value as a penetration tester will increase as a result of earning the certification. It is also easy to check the relevance of the certifications you are considering in the job portals themselves certificates that are explicitly searched for are more valuable. Basically, I can classify the following certifications as recommendable - even though this is certainly not a closed list:

Offensive Security Certified Professional (OSCP)
GIAC Penetration Tester (GPEN) as a related certification to SANS Course 560
GIAC Web Application Penetration Tester (GWAPT) as a related certification to SANS course 542
Also recommended: Certified Ethical Hacker (CEH)

To obtain one of these certifications, you usually have to take an exam. Since these certifications are sometimes associated with high costs, some companies also support their employees financially.

5. Practice in real and simulated environments.

Many companies want to hire penetration testers with prior experience. Fortunately, there are ways to gain experience outside the workplace. Many online pentest training programs include hands-on testing in simulated environments.

Another way to gain experience (and stand out on your resume) is to participate in bug bounty programs, for example, through Bugcrowd or HackerOne. In these programs, companies typically offer cash rewards to independent pentesters and security researchers who find Find and report security vulnerabilities or bugs in their code. This is an excellent opportunity, to improve your skills and make contacts.

Finally, there are several websites that offer penetration testers the opportunity to practice and experiment legally, and in a fun way. Here are a few to get you started:

Do I need a degree to become a penetration tester?

While it can be helpful to have a degree in computer science or IT security, not all jobs in the field of Penetration Testing, one is required. It usually depends more on your experience and ability to do the job than your degree (if any). If you want to start in the IT security field without having a relevant degree, however, it can be very helpful to seek certification to have your skills validated, so to speak, by an external party.

Reasons to become a pentester

A career as a pen tester offers you the opportunity to use your hacking skills for the greater good by helping others better protect themselves from cyber criminals. It is also an in-demand and well-paid career path.

Career prospects of pentesters

As the protection of IT infrastructures grows in importance with increasing digitization, the number of job openings this decade for IT security analysts, including pentesters, disproportionately at 31%. According to a study by ISC2, the growth is nearly three times higher than for IT specialists.

Career path for penetration testers

As you gain experience as a penetration tester, you can move up to lead a pentest team. Some penetration testers become IT security managers and can also advance to high management positions in companies.

But to be honest: The high level of technical understanding that pentesters acquire means that almost all doors in IT are open to them.

Fancy penetration testing?

If this all sounds exciting to you, drop us a line. We're always on the lookout for new team members! .

BREAK & BOLD

How long does it take to become a penetration tester?

No two career paths are alike, but it is possible to move into a penetration testing role after one to four years of professional experience in IT and information security.

What degree do you need to become a penetration tester?

A relevant degree is not necessarily required to work as a penetration tester. A bachelor's or master's degree in computer science, IT security or information security can make you a more competitive candidate.

Can penetration testers work from home?

As more and more technologies move to the cloud, many of the tasks performed by penetration testers are also changing. Often, in practice, it is a mix of on-site and remotely performed activities. However, the trend in penetration testing, as with many other jobs, continues to be clearly toward telecommuting.