Penetration Tester vs Security Engineer Salary: Close to a Tie, Testers 3.0% Ahead at the Same Employer

The penetration tester vs security engineer salary answer, as of November 13, 2026: it is close to a tie. In 9,511 certified H-1B wage filings decided July 2021 to June 2026, penetration tester titles had a median offer of $140,689 and security engineer titles $135,000. At the same employer and wage level, testers were paid 3.0% more. Federal contract ceilings agree: $152.19 vs $152.86 an hour.

Two public ledgers record these jobs by name. The Labor Department’s Labor Condition Application file shows the salary an employer offered, with the job title, worksite and a government wage level. The General Services Administration’s CALC+ database shows the most a contractor may bill the federal government per hour for each labor category, with the experience it requires. Neither was built to answer this question, and they reach the same answer from opposite ends of the market. Security analyst, the third job in the Autocomplete query, runs well behind both.

Key findings

• Penetration tester titles drew a median H-1B offer of $140,689 (158 filings, 67 employers) and security engineer titles $135,000 (9,353 filings, 2,394 employers), July 2021 to June 2026.
• At the same employer and DOL wage level, testers were paid 3.0% more (95% interval 0.2% to 5.9%; 653 filings at 40 employers). Adding the year as a control gives +2.3%, an interval (-1.6% to +6.4%) that includes zero.
• In the latest year alone (July 2025 to June 2026), engineers lead as filed: $145,000 on 2,112 offers vs $141,767 on 36 tester offers.
• 59% of tester offers were above the security engineer median of $135,000.
• On GSA schedules, the median ceiling rate is $152.19 an hour for 626 penetration tester labor categories and $152.86 for 3,092 security engineer categories; security analyst categories sit at $131.96.
• Security analyst titles trail both: $104,790 median, and 11.9% below testers at the same employer and level.
• BLS cannot settle the question: O*NET lists Penetration Testers (15-1299.04) and Information Security Engineers (15-1299.05) under the same catch-all code, reported at one median, $116,580.

Where the three salaries overlap

A median hides how much the ranges share. The middle half of tester offers runs $114,015 to $175,457; for engineers it is $104,333 to $166,962; for analysts $89,898 to $125,433. The tester and engineer boxes cover almost the same ground, and the tester range is a little higher at both ends: a 90th percentile of $210,544 against $195,000.

Penetration tester vs security engineer salary, like for like

The raw five-year medians put testers $5,689 ahead. That comparison is loose: tester filings lean to the later years (21 in the year to June 2022, 36 in the year to June 2026) and to large tech employers. So we compared the two titles inside groups that hold both, one control at a time, with 95% intervals clustered by employer.

Matching on wage level and year leaves testers +4.1% ahead, with an interval from -8.0% to +17.8%: no detectable difference. The sharpest test is inside one employer, because it removes the gap between, say, Meta and a staffing firm. There, the 48 employers that filed both titles paid testers +4.7% more, and +3.0% at the same wage level. The claim on page one of Google, that the engineer title carries “a higher salary band in general,” does not show up in offers made by the same company. The figures most often quoted, such as Coursera’s Glassdoor-based $154,000 median total pay for penetration testers and $162,000 for cybersecurity engineers (updated May 21, 2026), mix different employers and count bonus, so they are not a like-for-like test.

By DOL wage level

DOL assigns each offer one of four prevailing wage levels, from Level I, for “beginning level employees who have only a basic understanding of the occupation,” to Level IV, for “competent employees who have sufficient experience in the occupation to plan and conduct work requiring judgment” (2009 prevailing wage guidance). Testers lead at Level II ($135,000 vs $109,400) and Level IV ($179,296 vs $165,000), trail at Level I, and tie at Level III. Only 15 tester offers were at Level I (9% of tester filings, against 12% of engineer and 19% of analyst filings), so entry-level tester pay has its own page: our penetration tester salary entry level report reads every Level I offer since 2020.

Same company, both titles

48 employers filed at least one offer under each title; testers had the higher median at 33 of them. 11 filed three or more of each, and testers came out ahead at 7 of those. Microsoft filed the most tester offers (30), at a median of $174,491 against $159,980 for its 57 security engineer offers. These are raw medians, not level-matched.

Tech vendor, end customer or consultancy

Tech vendors filed 44% of tester offers and 38% of engineer offers. Matched on wage level and year, the tester premium is +3.8% at tech vendors, +4.5% at end-customer employers such as banks and retailers, and -5.9% at consulting and staffing firms (95% interval -11.5% to 0.0%), where the tester sample is 29 filings at a median of $92,100. Big consultancies rarely put “penetration tester” in an H-1B title, which keeps that last number small.

Ledger 2: what a tester hour and an engineer hour bill

GSA’s CALC+ database lists the ceiling hourly price each schedule contractor has agreed for each labor category, with a minimum experience requirement. We pulled every rate whose category matched six keywords on November 13, 2026 (6,728 unique rates), kept Information Technology categories, and sorted them with title rules parallel to the salary rules. Across the five experience bands, the gap between tester and engineer medians runs from engineers ahead by $1.39 to testers ahead by $8.66 an hour, while the five-year salary medians differ by about $2.74 an hour. Analyst categories trail both until the 15+ years band, where their median ($203.39 on 32 rates) passes both.

Rates that require a security clearance are higher for both: $173.53 for 39 tester rates and $162.00 for 262 engineer rates. 88% of tester rates sit under special item number 54151HACS, against 36% of engineer rates. Dividing the median ceiling by the median H-1B offer per hour (salary over 2,080 hours) gives 2.25 for testers and 2.36 for engineers. A ceiling is a maximum for federal buyers, not what a commercial client pays, so read the ratio as a rough markup, not a margin. Our IT hourly rates report for 2026 covers the wider rate card.

Security analyst vs penetration tester vs security engineer salary

The three-way Autocomplete query has a clear answer on the analyst side. Analyst titles drew $104,790, $35,899 below testers. Matched on wage level, testers lead analysts by +20.3%; inside the same employer and level the lead is +11.9% (95% interval +4.4% to +20.0%, 126 filings at 22 employers). The analyst and engineer comparison has its own data page, our security analyst vs security engineer salary report, which walks that gap up the four wage levels.

Five years of offers

Tester filings run at 19 to 45 a year, so a single year’s tester median moves with a handful of offers. The engineer median rose every year, from $124,600 to $145,000. The tester median ranged from $138,189 to $153,000 with no clear trend.

Penetration tester vs security engineer salary by state

11 states had at least five tester offers over the five years. Washington and Texas lead on tester counts; 20 of Washington’s 27 are Microsoft offers. Pennsylvania, which shows up in related searches, had 5 tester, 178 engineer and 67 analyst filings over the five years; just enough to make the table, so treat its tester median as indicative.

Why the government numbers cannot answer this

BLS OEWS publishes one security pay series, Information Security Analysts (15-1212), at a $129,180 median for May 2025. O*NET places both Penetration Testers (15-1299.04) and Information Security Engineers (15-1299.05) under Computer Occupations, All Other (15-1299), and shows the same $116,580 median on both pages. O*NET even lists “Security Engineer” among the reported job titles for penetration testers. Employers split the codes when they file: 45% of tester offers and 30% of engineer offers carry 15-1212, and 28% and 31% carry 15-1299. Our cybersecurity salary report for 2026 breaks the BLS series down by metro and percentile.

What this means for MSPs and IT teams

Do not budget a discount for the tester title. At employers that hire both, tester offers ran +3.0% against engineers at the same level. At Level II, the step where most offers sit, the tester median was $135,000.

Price the hour, then check the ceiling. The median GSA ceiling is $152.19 for a tester hour and $152.86 for an engineer hour; categories requiring 0 to 2 years list at $128.55 for testers. A federal ceiling is a cap, so it is a sanity check on a quote, not a target.

An analyst is the cheaper hire, and a different job. Analyst titles ran $35,899 below testers at the median and 11.9% below at the same employer and level. If the job is monitoring and triage, the analyst rate applies; if it is attack work, it does not.

FAQ

Who earns more, a penetration tester or a security engineer?

Close to a tie, with testers slightly ahead like for like. In 9,511 certified H-1B filings decided July 2021 to June 2026, penetration tester titles had a median offer of $140,689 and security engineer titles $135,000. Inside the same employer at the same DOL wage level, testers were paid 3.0% more (95% interval 0.2% to 5.9%). In the latest year alone engineers were ahead as filed, $145,000 to $141,767.

Security analyst vs penetration tester vs security engineer salary: which pays most?

Penetration tester $140,689, security engineer $135,000, security analyst $104,790 (median H-1B offers, July 2021 to June 2026). The analyst gap is real: at the same employer and wage level testers earn 11.9% more than analysts. On GSA contract ceilings testers and engineers tie ($152.19 and $152.86 an hour) and analysts trail at $131.96.

How much does a senior penetration tester make?

At DOL wage Level IV, the step for fully competent staff, tester titles had a median of $179,296 on 34 filings, against $165,000 for 2,163 engineer filings. Titles containing senior, principal, lead or staff: 49 tester filings at $140,000.

What is a penetration tester salary per month?

About $11,724 a month before tax, from the $140,689 median H-1B offer over five years ($11,814 a month in the year to June 2026). The security engineer equivalent is $11,250 a month. These are base salaries; bonus and stock are not filed.

Can you make $500,000 a year in cyber security?

Not in base salary, judging by these filings. The highest annual tester offer from July 2021 to June 2026 was $287,000; 0 tester and 41 engineer offers reached $300,000, and 1 engineer offers reached $500,000. Equity and bonus, where big totals come from, are not in the data.

Do penetration testers make good money?

Yes by national standards. The $140,689 median tester offer is 2.8 times the BLS median for all U.S. occupations ($50,980, May 2025). BLS has no separate tester figure: O*NET files Penetration Testers under 15-1299, which OEWS reports at $116,580.

Free to cite and republish with a link. The CSV holds every aggregate on this page: H-1B offer quartiles for the three titles by wage level, year, state and employer type, the tester premium under each control, and GSA ceiling-rate quartiles by experience band.

Methodology

Ledger 1 source. U.S. Department of Labor, Office of Foreign Labor Certification, LCA Disclosure Data, quarterly files through FY2026 Q3. On November 13, 2026 the newest file on the DOL performance page was still LCA_Disclosure_Data_FY2026_Q3.xlsx. We used one extract of every H-1B row whose title mentions security, cyber, penetration and related terms, or whose SOC code is 15-1212 or 15-1122 (35,805 unique case numbers). Kept: certified, full-time, wage between $30,000 and $1,000,000 after annualizing the low end of the offered range (hourly x 2,080, monthly x 12), decisions July 1, 2021 to June 30, 2026.

Title rules, applied to the upper-cased title. Penetration tester: contains PEN TEST|PENETRATION|ETHICAL HACK, or the close terms RED TEAM|OFFENSIVE|VULNERABILITY RESEARCH|EXPLOIT DEVELOP|ADVERSARY EMULATION, with marketing, sports and data scientist titles and MANAGER|DIRECTOR|HEAD|VP|CHIEF|SUPERVISOR|PROGRAM excluded (116 core and 42 close titles). Security engineer and security analyst: the published rules of our analyst vs engineer report (an ENGINEER or ANALYST word plus a security word, managers, architects, consultants and data or QA roles excluded). A title that matches the tester rule counts as a tester even if it also says engineer: 33 tester filings, such as “Senior Penetration Testing Engineer,” would otherwise be engineers, and 6 would be analysts.

Controls. Premiums are differences in mean log wage within cells that hold both titles, with standard errors clustered on the employer parent. Wage level is PW_WAGE_LEVEL as filed; filings with no level are left out of level comparisons. Employer type uses the name and NAICS rule from our earlier title-pay reports.

Ledger 2 source. GSA CALC+ ceiling rates API, keyword searches “penetration test”, “penetration tester”, “red team”, “ethical hack”, “security engineer” and “security analyst” on November 13, 2026, deduplicated by rate ID: 6,728 rates. Kept: categories tagged Information Technology. Tester: category contains PENETRATION, PEN TEST, RED TEAM or ETHICAL HACK, no manager, director or program word. Engineer: SECURITY ENGINEER, no tester, analyst, manager, architect or director word. Analyst: SECURITY ANALYST, no tester, engineer, manager, architect, director or lead word. 170 vendors list tester rates, 787 engineer rates and 671 analyst rates. The current-year price is used.

Limits. H-1B offers are a slice of the market, weighted to large employers and to Washington, Texas and California worksites; 158 tester offers over five years is a small sample, and many testers at consultancies are filed under generic titles. Offered base salary only: no bonus, stock or benefits. GSA rates are ceilings for federal buyers, not paid wages. BLS OEWS figures are May 2025, the newest release on the BLS tables page on November 13, 2026. Not career or immigration advice.

Cite as: The Uptime Report. “Penetration Tester vs Security Engineer Salary: Close to a Tie, Testers 3.0% Ahead at the Same Employer.” November 2026. https://theuptimereport.com/penetration-tester-vs-security-engineer-salary/

References

1. U.S. Department of Labor, OFLC Performance Data: LCA Disclosure Data, FY2021 to FY2026 Q3. Accessed November 2026.
2. U.S. Department of Labor, Prevailing Wage Determination Policy Guidance, Nonagricultural Immigration Programs (revised November 2009). Accessed November 2026.
3. U.S. General Services Administration, CALC+ Quick Rate API (ceiling rates), api.gsa.gov/acquisition/calc/v3. Accessed November 2026.
4. U.S. Bureau of Labor Statistics, Occupational Employment and Wage Statistics, May 2025 national estimates. Accessed November 2026.
5. O*NET OnLine, 15-1299.04 Penetration Testers. Accessed November 2026.
6. Coursera, CompTIA PenTest+ Salary Guide (updated May 21, 2026), quoting Glassdoor. Accessed November 2026.
7. O*NET OnLine, 15-1299.05 Information Security Engineers. Accessed November 2026.