Penetration Tester
Penetration testers evaluate network and system security by running simulated internal and external cyberattacks with adversary tools and techniques, trying to breach critical systems and reach sensitive information. They also check systems and networks for deviations from acceptable configurations and policy, and test defense-in-depth architecture against known vulnerabilities.
Related job titles
- Ethical hacker
- Vulnerability assessment analyst
- Vulnerability assessor
- Red team technician
- Security consultant
What They Do
12 tasks- Identify weaknesses in security systems by running penetration tests.
- Test the security of systems by attempting to gain access to networks, web-based applications, or computers.
- Develop and run tests that simulate the techniques of known cyber threat actors.
- Perform technical and nontechnical risk and vulnerability assessments of computing environments, networks, enclave boundaries, and applications.
- Analyze the organization's cyber defense policies and configurations and evaluate their compliance with regulations and directives.
- Gather cyber intelligence to identify vulnerabilities and identify new tactics, techniques, and procedures used by threat actors.
- Document penetration test findings in audit reports that state technical and procedural findings and recommend remediation.
- Discuss security solutions with information technology teams or management.
- Plan each test before it starts, setting the rules and testing goals and getting management approval documented.
- Develop penetration testing processes for areas such as wireless, data network, and telecommunication security.
- Assess the physical security of servers, systems, and network devices for exposure to temperature, vandalism, or natural disasters.
- Keep up with hacking trends and with new penetration testing tools and methods.
Knowledge and Skills
- Penetration testing principles, tools, and techniques
- Network security architecture concepts, including defense-in-depth
- How traffic flows across the network, including TCP/IP and the OSI model
- System and application security threats and vulnerabilities
- Network attacks and their relationship to threats and vulnerabilities
- Vulnerability scanning and network analysis tools such as Nmap
- Network and system vulnerabilities and exploits, and techniques to evade security detection
- Application vulnerabilities and web application security risks
- Social engineering tools and techniques
- Writing code in a currently supported programming language
How to Become a Penetration Tester
In O*NET's survey of the occupation, 40 percent of respondents said a new hire needs a bachelor's degree, 20 percent a post-secondary certificate, and 15 percent a high school diploma or equivalent. The U.S. Department of Labor has approved penetration tester and hardware hacker as registered apprenticeship titles for the occupation.
NIST SP 800-115 says security assessors need significant security and networking knowledge, including network security, firewalls, intrusion detection systems, operating systems, programming, and networking protocols such as TCP/IP. It prefers operational experience to classroom or laboratory training.
Because testers may see sensitive information about network architecture, security posture, and weaknesses, some organizations require background checks or security clearances. NIST also advises assessors to keep their skills current through training courses, hands-on testing in test and operational environments, and research into the latest vulnerabilities and exploits.
CompTIA lists 3 to 4 years in a penetration tester job role, with Network+ and Security+ or equivalent knowledge, as the recommended experience for its PenTest+ certification.
Certifications
19 certificationsThe DoD 8140 Qualification Matrix V2.1 lists 19 certifications as qualification options for DCWF work role 541 Vulnerability Assessment Analyst, up to the proficiency level shown. Options aligned to a higher proficiency level also qualify for the lower levels.
| Certification | Issuer | DoD 8140 level |
|---|---|---|
| CFR CyberSec First Responder · CertNexus | CertNexus | Up to Advanced |
| CISA Certified Information Systems Auditor · ISACA | ISACA | Up to Advanced |
| CISM Certified Information Security Manager · ISACA | ISACA | Up to Advanced |
| CySA+ CompTIA Cybersecurity Analyst · CompTIA | CompTIA | Up to Advanced |
| GPEN GIAC Penetration Tester · GIAC | GIAC | Up to Advanced |
| GSNA GIAC Systems and Network Auditor · GIAC | GIAC | Up to Advanced |
| CEH(P) Certified Ethical Hacker (Practical) · EC-Council | EC-Council | Up to Intermediate |
| Cloud+ CompTIA Cloud+ · CompTIA | CompTIA | Up to Intermediate |
| CPTE Certified Penetration Testing Engineer · United America Technoloiges, LLC | United America Technoloiges, LLC | Up to Intermediate |
| FITSP-A Federal IT Security Professional-Auditor-NG · Federal IT Security Institute | Federal IT Security Institute | Up to Intermediate |
| GCED GIAC Certified Enterprise Defender · GIAC | GIAC | Up to Intermediate |
| GCIH GIAC Certified Incident Handler · GIAC | GIAC | Up to Intermediate |
| GCSA GIAC Cloud Security Automation · GIAC | GIAC | Up to Intermediate |
| GICSP Global Industrial Cyber Security Professional · GIAC | GIAC | Up to Intermediate |
| GSEC GIAC Security Essentials · GIAC | GIAC | Up to Intermediate |
| PenTest+ CompTIA PenTest+ · CompTIA | CompTIA | Up to Intermediate |
| RCCE Level 1 Rocheston Certified Cybersecurity Engineer Level 1 · Rocheston LLC | Rocheston LLC | Up to Intermediate |
| Security+ CompTIA Security+ · CompTIA | CompTIA | Up to Intermediate |
| CEH Certified Ethical Hacker · EC-Council | EC-Council | Up to Basic |
Frequently Asked Questions
What does a penetration tester do?→
A penetration tester evaluates network and system security by conducting simulated cyberattacks, identifies weaknesses in security systems, and documents the findings in reports that recommend solutions.
Is an ethical hacker the same as a penetration tester?→
CISA lists both ethical hacker and penetration tester as alternative titles for the Vulnerability Assessment Analyst work role, DCWF work role code 541.
What skills does a penetration tester need?→
CISA lists knowledge of penetration testing principles, tools, and techniques for this work role, along with skill in conducting vulnerability scans and in using network analysis tools such as Nmap to identify vulnerabilities.
What tools do penetration testers use?→
O*NET lists software used in the occupation that includes Kali Linux, MITRE ATT&CK, Metasploit, Tenable Nessus, and Wireshark.
How do you become a penetration tester?→
In O*NET's survey of the occupation, 40 percent of respondents said a new hire needs a bachelor's degree, and penetration tester is a registered apprenticeship title. NIST SP 800-115 prefers operational experience to classroom or laboratory training and calls for significant security and networking knowledge.
What is the difference between a vulnerability scan and a penetration test?→
NIST SP 800-115 describes penetration testing as mimicking real-world attacks, often with real attacks on real systems and data using the tools and techniques attackers use. Most penetration tests look for combinations of vulnerabilities that give more access than a single vulnerability would. Vulnerability scanning is the less extensive option when an assessment has a short timeframe.
Role descriptions follow the sources listed above: U.S. government workforce data first, then standards bodies and, where named in the text, certification issuers. Certification options come from the DoD 8140 Qualification Matrix V2.1 (2025-09-19); the matrix and a specific job posting are the authority for a given position. This site is not affiliated with CISA, the Department of Labor, or the Department of Defense. Last verified Oct 28, 2026.