Penetration Tester: Pay, Certifications and the Path Into the Job

By The Uptime Report Team · Last reviewed: October 2026

A penetration tester is a security specialist hired to attack systems with written permission and report the weaknesses: O*NET files the job under code 15-1299.04, where the May 2025 median wage was $116,580.

What does a penetration tester do?

A penetration tester attacks an organization’s systems with written permission, then documents how far the attack got and how to close each gap. O*NET, the Labor Department’s occupational database, defines the job under code 15-1299.04 as conducting “simulated internal and external cyberattacks using adversary tools and techniques” and lists 22 tasks for it.

The job is easiest to see by what each phase produces. NIST SP 800-115 (September 2008) splits a test into four stages, and CISA’s Risk and Vulnerability Assessment fact sheet (February 2022) shows how a federal team schedules the same work.

NIST’s workforce framework files the work under a different name. In NICE Framework Components v2.2.0 (April 2025), the data set behind NIST SP 800-181 Rev. 1, task T1091 “Perform authorized penetration testing on enterprise network assets” belongs to work role PD-WRL-007, Vulnerability Analysis, which maps to OPM cybersecurity code 541. Engagements also split by target, which is why we cover network penetration testing and web application penetration testing as separate services.

How much does a penetration tester make?

It depends on which federal code you read. The Bureau of Labor Statistics (BLS) publishes no wage line titled penetration tester. O*NET files Penetration Testers inside SOC 15-1299, Computer Occupations, All Other, where the May 2025 median was $116,580. Most of the career guides that rank for this term quote SOC 15-1212, Information Security Analysts, at $129,180. Neither is a sample of testers only.

The 2018 SOC Manual defines 15-1212 as work that assesses “system vulnerabilities for security risks” but names no penetration tester among its examples, and the catch-all 15-1299 also holds data center operators. Some guides note that BLS has no penetration tester line; none of the six we checked cites O*NET’s 15-1299.04 code. Treat $116,580 to $129,180 as the range for the median. In computer systems design (NAICS 5415), where MSSPs and testing firms sit, the 15-1212 median is $132,410, per our cybersecurity salary report.

Where does penetration testing pay the most?

Ranked by the 15-1299 code that holds penetration testers, San Jose leads at a $184,430 median, and Denver moves to third at $160,520 even though it ranks ninth on 15-1212. Across the 52 metros with a published median for both codes, at least 500 information security analysts and at least 500 jobs in 15-1299 where BLS publishes that count, the 15-1212 median is higher in 41. Neither code isolates testers, so read both columns.

BLS does not publish the 15-1299 job count for the Washington, DC metro, though it publishes the median. Our highest paying cities for IT jobs report ranks the 15-1212 side for all 54 metros where it qualifies.

What does a penetration tester bill per hour?

On the General Services Administration’s Multiple Award Schedule, penetration testing labor categories carry a median ceiling rate of $152.04 an hour across 546 rates, with the middle half between $120 and $193, according to our IT hourly rates analysis of GSA CALC+ data retrieved October 12, 2026. That is 2.4 times the 15-1212 median wage and 2.7 times the 15-1299 median.

Should an MSP hire a penetration tester or subcontract?

Hire once testing work fills about half a year. A median-paid 15-1299 hire costs about $148,699 a year with benefits, which buys 978 subcontracted hours at the $152.04 GSA median: 47.0% of 2,080 paid hours, or 53.3% of the roughly 1,836 hours left after paid leave. On the 15-1212 wage the break-even is 1,084 hours (59.0% of worked hours). Below that, subcontracting costs less; above it, the hire does.

Method: we divide the OEWS median wage by 0.784, the share of total compensation that wages plus paid leave make up for private-industry professional and related occupations in BLS ECEC Table 4 (June 2026: $50.98 wages plus $6.78 paid leave, out of $73.69), because OEWS annual wages already include paid-leave pay.

The hire side leaves out recruiting, tooling, management time and the certification fees below, so the true break-even sits a little higher; adding one $1,749 OSCP bundle moves the 15-1299 line from 978 to 990 hours. The subcontract side uses a federal ceiling price, so a commercial quote can land on either side of $152.04.

When you subcontract, put the SP 800-115 rules-of-engagement items listed under the authorization section below into the subcontract, name the credential you expect (CREST CRT if the client needs UK CHECK work), and pass the client’s signed authorization through to the tester. Also tell clients about CISA’s RVA, a two-week test that CISA offers to public and private organizations at no cost, with limited availability.

Which certifications matter, and what do they cost?

Six credentials are built around offensive testing: OSCP from OffSec, PNPT from TCM Security, GPEN from GIAC, PenTest+ from CompTIA, CEH from EC-Council and CRT from CREST. As of October 2026, US dollar exam prices run from $439 for PenTest+ to $1,749 for the OSCP bundle, CREST charges £600 for CRT, and renewal rules range from never expiring to a yearly fee.

What do the certifications cost over six years?

The exam fee is only the first charge. Adding every renewal and continuing education fee each issuer publishes, including CompTIA’s $150 CE fee per 3-year cycle, PenTest+ costs $589 by year 3 and $739 by year 6, while CEH’s $80 yearly fee, counted from year 1, lifts it past GPEN by year 6. Retakes and the cost of earning credits are left out.

Does OSCP count toward CREST CRT?

Yes, under conditions. CREST’s equivalency programme with OffSec grants CRT to candidates who passed OSCP or OSCP+ within the last 3 years and hold a valid CPSA, for a £100 fee and about 5 days of processing. A CRT gained this way does not count for the UK government CHECK scheme, which still requires passing the CRT exam.

How do you become a penetration tester?

Learn the systems, take a job that touches them, practice only where you have permission, then certify. Issuers set the pace: EC-Council requires 2 years of IT security experience to sit CEH without official training, CREST aims CRT at candidates with 6,000 hours or more, and CompTIA recommends 3 to 4 years in a pen tester role before PenTest+.

1. Learn the platforms you will attack. OffSec suggests Linux and Windows administration, networking and scripting before PEN-200, which teaches Nmap, Metasploit, Burp Suite and sqlmap. Our penetration testing tools guide covers each one.
2. Take a job that touches production systems. Help desk and admin roles teach the accounts and networks testers later exploit, and BLS lists under 5 years of related experience as typical for security analysts; see our help desk technician guide.
3. Practice only on targets built for it. PEN-200 includes 9 challenge labs. Any other system needs written permission (see 18 U.S.C. 1030 below).
4. Pick a first certification from the decision table below.
5. Write reports from the first lab. PNPT grades a written report plus a 15-minute debrief.
6. Log your hours. CREST pegs Practitioner to about 2,500 hours, Registered to 6,000 and Certified to about 10,000.

Do you need a degree?

Not always. When O*NET asked incumbents in 15-1299.04 what a new hire needs, 40% said a bachelor’s degree, 20% a post-secondary certificate and 15% a high school diploma. BLS lists a bachelor’s degree as typical for information security analysts. OffSec, TCM Security, CompTIA, EC-Council and CREST set experience, training or a prerequisite exam as entry conditions, not a degree.

Why is written authorization required?

Because the same actions can be federal crimes without it. The Computer Fraud and Abuse Act, 18 U.S.C. 1030, makes it an offense to access a computer “without authorization or exceeds authorized access” and obtain information from a protected computer, or to transmit code that intentionally causes damage without authorization. A signed scope separates a test from those offenses.

CompTIA’s PenTest+ PT0-003 objectives list “ensuring authorization letters” under legal compliance. SP 800-115 defines rules of engagement as giving the team “authority to conduct defined activities without the need for additional permissions”, and its Appendix B template doubles as a checklist for the authorization or subcontract:

1. Purpose and scope: who is tested, who tests, and the test boundaries.
2. Personnel: every tester by name, plus client contacts and the incident response team.
3. Schedule, including the hours testing may run.
4. Target systems: authorized and unauthorized IP addresses or other identifiers.
5. Allowable and unallowable activities.
6. Data handling, and criteria for halting the test.
7. Reporting deliverables and a signature page naming the accountable parties.

This summarizes public law and NIST guidance; it is not legal advice. Before a first engagement, ask counsel whether the signer has authority over every listed asset, including hosted systems, and whether the client’s state computer crime statute adds conditions to 18 U.S.C. 1030.

Which certification should you get first?

Pick by background and by who will read the credential. For UK government CHECK work, sit CREST CRT directly. With no professional hacking experience, TCM Security recommends its PJPT before the $499 PNPT. If an employer or contract names a credential, take that one. Otherwise, OffSec’s OSCP is a hands-on option at $1,749 with course access.

Is penetration testing a good career?

By federal data, yes. BLS projects employment of information security analysts, the closest occupation with a projection, to grow 21% from 2025 to 2035, with about 14,100 openings a year (BLS OOH). O*NET flags 15-1299.04 as a Bright Outlook occupation, and the 15-1212 10th percentile, $75,090, is 47% above the $50,980 median for all occupations.

How we compiled this

We compiled this guide from 31 primary documents accessed in October 2026: BLS OEWS May 2025 national and metro files, BLS ECEC Table 4 (June 2026), the BLS Occupational Outlook Handbook and 2018 SOC definitions, O*NET records for 15-1299.04 and 15-1212.00, NIST NICE Framework Components v2.2.0, SP 800-181 Rev. 1 and SP 800-115, CISA’s RVA fact sheet and advisory AA23-349A, 18 U.S.C. 1030 and the Van Buren opinion, and exam, pricing and renewal pages from OffSec, TCM Security, GIAC, CompTIA, EC-Council and CREST. GSA contract rates come from our own analysis of GSA CALC+. We did not sit these exams or survey testers. Prices exclude tax and can change; nothing here is legal advice.

Frequently asked questions

Can I test my employer’s network to practice?

Not without written permission for that scope. In Van Buren v. United States (2021), the Supreme Court held that a person exceeds authorized access under 18 U.S.C. 1030 by entering parts of a computer, such as files, folders or databases, that are off-limits to them. Having a work login does not authorize scanning or exploiting systems outside your job.

What is the difference between a vulnerability assessment and a penetration test?

Exploitation. NIST SP 800-115 says vulnerability scanners check only for the possible existence of a vulnerability, while the attack phase of a penetration test exploits it to confirm it exists and to see what further access it gives. A scan can run unattended; a test needs rules of engagement, a tester and a report with risk ratings.

What is the difference between a penetration tester and an ethical hacker?

The terms overlap. Penetration tester is the occupation title O*NET uses (15-1299.04), while ethical hacker is the name EC-Council gives its CEH credential; OffSec describes its PEN-200 course as both ethical hacking and penetration testing. Neither title has its own BLS wage series, and both need written authorization under 18 U.S.C. 1030.

Does CISA offer free penetration testing?

Yes, with limits. CISA’s Risk and Vulnerability Assessment includes network, web application, wireless and phishing tests and is available to public and private organizations at no cost, but availability is limited and CISA manages a queue. An RVA runs two weeks, one external and one internal, with a final report within 10 days. Requests go to vulnerability@cisa.dhs.gov.

Does the OSCP certification expire?

No. Passing the exam earns both OSCP and OSCP+. According to OffSec, OSCP has no expiration date, while the OSCP+ designation expires three years from issuance. Holders can keep the plus by passing a recertification exam, passing another qualifying OffSec exam, or completing OffSec’s CPE program before it lapses.

Sources

1. U.S. Bureau of Labor Statistics, OEWS May 2025 profile: 15-1299 Computer Occupations, All Other. Accessed October 2026.
2. U.S. Bureau of Labor Statistics, OEWS May 2025 profile: 15-1212 Information Security Analysts. Accessed October 2026.
3. U.S. Bureau of Labor Statistics, OEWS May 2025 national and metropolitan files (oesm25nat, oesm25ma). Accessed October 2026.
4. U.S. Bureau of Labor Statistics, Employer Costs for Employee Compensation, Table 4, June 2026. Accessed October 2026.
5. U.S. Bureau of Labor Statistics, Occupational Outlook Handbook: Information Security Analysts. Accessed October 2026.
6. U.S. Bureau of Labor Statistics, 2018 SOC definitions (major groups). Accessed October 2026.
7. O*NET OnLine, 15-1299.04 Penetration Testers. Accessed October 2026.
8. O*NET OnLine, 15-1212.00 Information Security Analysts. Accessed October 2026.
9. NIST, NICE Framework current versions (Components v2.2.0). Accessed October 2026.
10. NIST, NICE Framework Components v2.2.0 (JSON). Accessed October 2026.
11. NIST, SP 800-181 Rev. 1, Workforce Framework for Cybersecurity (NICE Framework). Accessed October 2026.
12. NIST, SP 800-115, Technical Guide to Information Security Testing and Assessment. Accessed October 2026.
13. CISA, Risk and Vulnerability Assessment fact sheet (February 2022). Accessed October 2026.
14. CISA, Advisory AA23-349A, Healthcare and Public Health Sector Risk and Vulnerability Assessment (December 2023). Accessed October 2026.
15. 18 U.S.C. 1030, Fraud and related activity in connection with computers (Cornell LII). Accessed October 2026.
16. Supreme Court of the United States, Van Buren v. United States, No. 19-783 (June 3, 2021). Accessed October 2026.
17. OffSec, PEN-200 and OSCP+ course page. Accessed October 2026.
18. OffSec, Pricing. Accessed October 2026.
19. TCM Security, Practical Network Penetration Tester (PNPT). Accessed October 2026.
20. GIAC, GIAC Penetration Tester (GPEN). Accessed October 2026.
21. GIAC, Certification pricing and fees. Accessed October 2026.
22. GIAC, How to renew. Accessed October 2026.
23. CompTIA, PenTest+ certification (PT0-003). Accessed October 2026.
24. CompTIA, Continuing education renewal fees. Accessed October 2026.
25. EC-Council, Certified Ethical Hacker (CEH). Accessed October 2026.
26. EC-Council, Certification eligibility and voucher prices. Accessed October 2026.
27. EC-Council, Continuing education policy. Accessed October 2026.
28. CREST, Registered Penetration Tester (CRT). Accessed October 2026.
29. CREST, Certifications pricing and booking. Accessed October 2026.
30. CREST, Certification Equivalency Recognition Programme. Accessed October 2026.
31. CREST, About CREST exams. Accessed October 2026.
32. The Uptime Report, IT Hourly Rates 2026 (GSA CALC+ analysis). Accessed October 2026.
33. The Uptime Report, Cybersecurity Salary 2026. Accessed October 2026.
34. The Uptime Report, Highest Paying Cities for IT Jobs in 2026. Accessed October 2026.