Penetration Tester Salary Entry Level: Only 17 H-1B Level I Offers Since 2020, at an $85,550 Median

Penetration tester salary entry level, from Labor Department filings decided through June 30, 2026: just 17 H-1B offers at wage Level I for penetration tester and close titles since October 2020, with an $85,550 median base (95% interval $77,000 to $106,150). That matches the $86,000 for 2,671 Level I security analyst filings and sits well under the $117,000 widely quoted.

How thin this is, and why we still publish it

We read the job title on all 3,119,855 H-1B Labor Condition Applications in 21 quarterly files. After removing managers, 173 certified full-time filings name penetration testing, ethical hacking, red teaming, offensive security or vulnerability research, about 0.006% of the total, and 17 of those carry DOL’s Level I. No single year has more than 7 Level I offers, so we pool every year and say so. Pooling mixes older and newer dollars: the 12 offers since October 2023 have an $87,984 median, and without Fidelity the 13 remaining offers have an $80,000 median. Bureau of Labor Statistics data has no pen tester code at all, because testers fall inside SOC 15-1212, so these filings are the only government source that names the job.

The Labor Department defines Level I as “beginning level employees who have only a basic understanding of the occupation.” The employer picks the level and filings have no experience field, so Level I is the nearest public stand-in for entry level rather than a measure of years on the job. These are base wages on visa filings: H-1B only, no bonus or equity, and offers rather than wages actually paid.

Every offer, dated: filter by level or employer type

The table opens on Level I and holds all 173 filings. Fidelity’s four Level I filings run from $85,550 to $106,150, and Microsoft’s two are at $118,000 and $118,400. The newest Level I filing, decided 2026-06-17, is at $89,440. Click a heading to sort.

Source: DOL LCA filings. A filing is one employer’s stated job, not proof of a hire. 5 of the 17 Level I offers equal the prevailing wage to the dollar, the legal floor, and the median offer is 1.14 times it, so the floor shapes this end of the range.

The climb from Level I to Level IV

Median offers rise from $85,550 at Level I to $179,916 at Level IV, a multiple of 2.10. The first step looks huge at $46,294, but much of it is one employer: Microsoft files 15 of the 62 Level II offers under the title “Penetration Testing.” Without Microsoft, Level II falls to $114,795 and Level I to $80,413. Security analyst filings climb less steeply, from $86,000 to $163,000. Levels are job ratings, so this ladder compares different jobs at one point in time and is not the raise a person gets by staying.

Pooled October 2020 to June 2026, nominal, unless marked. 5 tester filings state no level and are left out. Intervals resample employers, so Level I’s wide interval reflects how few employers file at it.

Is pen testing better paid at entry level than other security jobs?

Not on these filings. Level I tester offers ($85,550) sit with security analysts ($84,460) and security consultants ($85,000), and below security engineers ($101,800). What differs is how often the job is entry level: 34.8% of SOC analyst filings are Level I against 10.1% of tester filings. SOC titles are more than three times as likely to be rated Level I, though filings cannot show anyone’s career path. In the latest 12 months, software developers at Level I had a $108,422 median on 17,043 filings.

Roles are title regexes, excluding managers and tester titles, pooled October 2020 to June 2026, except software developers (FY2022 to FY2026 Q3, from our entry level DevOps extract). For the BLS view of the whole occupation, see our cybersecurity salary report.

Consulting versus in-house

Tester titles and the wider occupation give different answers, and the difference is the useful part. Among tester titles, in-house employers pay 42% more than consulting and staffing firms at the same level and year (95% interval 26% to 61%, 168 filings), and end customers alone pay 24% more (11% to 38%). But 27 of the 32 consulting filings with tester titles are NAICS 5415 IT services firms such as Techflurry Solutions and Infinite Computer Solutions, none is at Level IV, and neither EY nor Deloitte files a tester title. Across the 20,617 SOC 15-1212 filings with a stated level, the same in-house gap is 6.8% (-6.9% to 22.5%), not distinguishable from zero, and end customers pay 4.1% less than consulting firms (-14.9% to 8.0%). At Level III and IV, consulting firms pay more than end customers ($150,000 against $130,406 at Level III). The clear premium is at tech vendors: $136,000 at Level I against $85,612 for end customers, though Amazon alone is 371 of those 527 vendor filings.

Employer type uses a name list, then the NAICS code on the filing, with four overrides read from the filings: Paylocity and Trend Micro to tech vendor; Kroll and Block Harbor Cybersecurity to consulting. The large consulting filers in the occupation are EY and Deloitte.

Top metros and employers

No metro has more than 2 Level I tester offers, so a metro entry-level figure from tester titles would be an anecdote. Across all levels, Seattle leads with 28 filings, 20 from Microsoft, and Fayetteville, Arkansas appears only because of Walmart. For Level I pay by metro, the occupation table is the honest guide: Seattle’s $133,500 against Dallas at $85,301 and New York at $92,726.

Employers people search for by name

Autocomplete suggests employer searches such as “penetration tester salary deloitte” and “bishop fox penetration tester salary.” Most of these firms never write the phrase on a filing. EY’s filings in this occupation read “Information Security Analysts” plus a job code, Deloitte’s read “Advisory Senior Consultant,” and Amazon’s read “Security Engineer.” So testers at those firms are invisible by title, which is the largest gap in this analysis. Level I offers in the occupation are the closest available number. Past the entry step, testing pays on par with engineering: H-1B tester offers from July 2021 to June 2026 had a $140,689 median, and our penetration tester vs security engineer salary analysis finds testers 3.0% ahead at the same employer and wage level.

Matched on the legal name as filed. Zero means no filing in this extract, and says nothing about whether the firm employs testers.

What changed: the first cap season under weighted selection

H-1B entry-level filings shrank in spring 2026. Level I filings in SOC 15-1212 fell 27%, from 287 in April to June 2025 to 210 in April to June 2026, and their share fell from 19.5% to 16.2%. All H-1B Level I filings fell 24% (54,625 to 41,557), so security moved with the program. Tester titles are too few to test. DHS’s weighted selection rule took effect February 27, 2026, and the agency estimates the chance of selection falls 48 percent at Level I. Proclamation 10973’s $100,000 payment also applies, and Proclamation 11069 of September 18, 2026 extended it to September 21, 2027. The filings cannot separate these causes, and filings include extensions as well as new hires. More on the program is in our H-1B statistics report.

Two proposals are pending. DOL proposed on March 27, 2026 to raise the Level I floor from the 17th to the 34th percentile of OEWS wages, and a Federal Register search on November 5, 2026 found no final rule. Nationally the 34th percentile for the occupation sits above the 25th percentile of $97,810, and only 5 of these 17 offers exceed that figure, though floors are set by area. DHS proposed on August 25, 2026 a $103,265 fee on cap-subject petitions.

What the data can and cannot answer

Why our number differs from the ones on page one

Coursera lists $117,000 for 0 to 1 year, citing Glassdoor in July 2026, and calls it base pay. HackerDNA describes the same Glassdoor figure as total pay and gives its own unsourced $85,000 to $110,000 base range. ZipRecruiter’s Google snippet says $119,895 (we could not open the page: it returned a 403). CyberSecurityJobs’ snippet says $70,200 with no source shown. Those figures use self-reported or job-posting data on a different population, so they are not simply wrong. Our sample is smaller and narrower but every offer can be checked by case number. Only 3 of 17 low-end offers reach $117,000, and HackerDNA’s lower bound of $85,000 is nearly the median here.

What this means for MSPs

TestedIn-house cost: an $85,550 base is $41.13 an hour. BLS says wages are 69.5% of compensation in professional and business services (June 2026), which gives about $59.18 an hour before tools, bench time and overhead. GSA’s federal ceiling for tester labor categories is a $152.52 median across 582 rates, and $127.72 across 111 rates requiring two years or less, 2.16 times that direct cost. These are federal ceilings, not what clients pay MSPs.

TestedBudget for the real local number, not the widely quoted one. Among the 12 busiest metros, Level I occupation medians run from $78,114 in Houston to $133,500 in Seattle.

Advice, not dataA Level I tester rarely pays for itself on billable work alone, because a junior needs a reviewer on every report. Most MSPs will do better promoting a strong SOC analyst into testing part time, or reselling a testing firm, until there is steady demand. If you do hire, write the job as a security analyst or consultant ladder with defined steps to Level II, since these filings show how rarely employers use a tester title at the bottom.

Questions people ask

What is the entry level penetration tester salary?

On 17 H-1B filings at DOL wage Level I from October 2020 to June 2026, the median base offer is $85,550 (95% interval $77,000 to $106,150), or $41.13 an hour and about $7,129 a month. The 7 offers from the latest 12 months have a $97,594 median. That is a small sample of visa filings, not a survey of all testers.

Is pentesting an entry level job?

Rarely, going by these filings. Only 10.1% of penetration tester filings with a stated level are Level I, against 34.8% for SOC analyst titles and 13.0% for all information security analyst filings. Only 5 of 173 titles use a word such as associate or junior.

Do penetration testers make good money?

The median across all levels is $140,000 on 173 filings, against a $50,980 BLS median for all U.S. occupations and $129,180 for information security analysts. Level IV offers reach $179,916. These are base offers on H-1B filings, so bonus and equity are not included.

What does a junior penetration tester make?

Only 5 filings use a junior-type word, all of them “associate,” with offers from $60,000 to $140,000. None says “junior” or “entry.” Title words are too rare to rate, so DOL Level I is the better guide: $85,550.

What is the entry level penetration tester salary in Texas?

Too thin to say from tester titles: 2 Level I filings, both at $106,150 from one employer. All Level I information security analyst filings in Texas (507) have an $84,000 median.

Can you make $500,000 a year in cyber security?

As base pay it is very rare in these filings: 3 of 22,040 information security analyst filings offer $500,000 or more, and 85 offer $300,000 or more. BLS puts the 90th percentile of the occupation at $199,850. Filings exclude bonus and equity, so total pay can be higher.

Methodology and limits

References

1. U.S. Department of Labor, OFLC Performance Data: LCA Disclosure Data FY2021 to FY2026 Q3, with record layout. Accessed November 2026.
2. U.S. Department of Labor, Prevailing Wage Determination Policy Guidance (revised November 2009). Accessed November 2026.
3. U.S. Department of Labor, Wage and Hour Division, Fact Sheet 62G: Must an H-1B employer pay a certain wage rate?. Accessed November 2026.
4. U.S. Bureau of Labor Statistics, OEWS May 2025 national estimates, SOC 15-1212. Accessed November 2026.
5. BLS, Employer Costs for Employee Compensation, June 2026, Table 6. Accessed November 2026.
6. U.S. General Services Administration, CALC+ labor rates (API: api.gsa.gov/acquisition/calc/v3). Accessed November 2026.
7. DHS, Weighted Selection Process final rule, 90 FR 60864. Accessed November 2026.
8. Proclamation 10973, 90 FR 46027. Accessed November 2026.
9. Proclamation 11069, 91 FR 60497. Accessed November 2026.
10. DOL, Improving Wage Protections, proposed rule, 91 FR 15454. Accessed November 2026.
11. DHS, Fee for Certain H-1B Petitions, proposed rule, 91 FR 54817. Accessed November 2026.
12. Coursera, Penetration Tester Salary: Your 2026 Guide. Accessed November 2026.
13. HackerDNA, Penetration Tester Salary 2026. Accessed November 2026.
14. ZipRecruiter, Entry Level Penetration Tester Salary (Google result snippet only). Accessed November 2026.
15. CyberSecurityJobs, How Much Can You Expect to Earn as a Pen Tester? (Google result snippet only). Accessed November 2026.