Career path
Penetration Testing
Penetration testers are hired to attack systems the way a criminal would, but legally and with written permission, so the organisation can fix the gaps first. It is a demanding, hands-on career that rewards curiosity and patience. Testing anything without authorisation is a crime in most countries, including under the UK Computer Misuse Act, so every step here assumes you only test systems you own or have been given clear, written permission to test.
Is this path for you?
- You love working out how things can be made to misbehave
- You enjoy long, puzzle-like problems and keep going when stuck
- You can write a clear report for people who are not technical
Quick facts
- Typical first job
- SOC analyst, IT support or junior security analyst
- Core skills
- Networking, Linux, web apps, scripting, report writing
- Career levels
- 5, from beginner to architect
Career levels at a glance
Select a level to jump to the details.
Level by level: what to learn and do
-
Foundations
0–2 yearsIT support · SOC analyst · Junior security analyst
What you do
Build strong IT and networking basics in a normal job while practising offensive skills in legal training labs and capture-the-flag (CTF) events in your own time.
Skills to learn
- Networking, TCP/UDP ports and common protocols
- Linux command line and Windows internals
- How web applications work: HTTP, cookies, sessions
- The law and ethics of testing: computer misuse law, scope and permission
Certifications to consider: CompTIA Security+; INE eJPT as a first practical certificate
To reach the next level: Complete a series of legal practice labs and write each one up as if it were a client report.
-
Junior penetration tester
1–3 yearsJunior penetration tester · Associate security consultant
What you do
Work alongside senior testers on agreed jobs: scan in-scope networks, check for known weaknesses, test web applications, collect evidence and draft parts of the report.
Skills to learn
- Scanning and enumeration within an agreed scope
- Common web vulnerabilities (the OWASP Top 10)
- Password attacks and privilege escalation in lab conditions
- Python or Bash for small tools
- Careful note-taking and evidence handling
Certifications to consider: TCM Security PNPT, CompTIA PenTest+, or CREST CRT (common in the UK)
To reach the next level: Aim for a tougher hands-on exam and start leading small tests from scoping call to final report.
-
Penetration tester
3–5 yearsPenetration tester · Security consultant
What you do
Run tests on your own: agree the scope and rules of engagement, test networks, web apps and Active Directory, explain the risk of each finding and recommend fixes.
Skills to learn
- Active Directory attack paths and defences
- Web application and API testing
- Cloud configuration reviews
- Risk rating and clear, honest reporting
- Talking to clients about findings without blame
Certifications to consider: OffSec OSCP+; CREST CRT moving towards CREST CCT
To reach the next level: Pick a speciality such as web apps, cloud, red teaming or hardware, and go deep.
-
Senior tester or red teamer
5–8 yearsSenior penetration tester · Red team operator · Principal consultant
What you do
Lead complex jobs and red-team exercises that test people, processes and detection as well as technology, review junior reports and help clients improve over time.
Skills to learn
- Adversary simulation that matches real threat groups
- Evading and testing detection, in agreement with the client
- Custom tooling and exploit development
- Mentoring and quality checking reports
Certifications to consider: OffSec OSEP or OSWE; Zero-Point Security CRTO; CREST CCT Infrastructure or Application
To reach the next level: Learn how your findings shape a client's whole security programme, not just one test.
-
Lead and leadership
8+ yearsHead of offensive security · Red team lead · Security practice manager
What you do
Run a testing team or practice, set methods and quality standards, manage legal and contractual risk, and advise leadership on where the real weaknesses lie.
Skills to learn
- Building and leading a testing team
- Contracts, scoping and legal safeguards
- Threat-led testing frameworks
- Communicating risk to boards
Certifications to consider: ISC2 CISSP; advanced OffSec or CREST qualifications
To reach the next level: Use what attackers can do to help the whole organisation defend better.
Years of experience are typical ranges, not rules: some people move faster, others take longer. Certification names and versions change, so always check the exam provider's website before you book.
How to become a penetration testing professional: step by step
- Get solid foundations first: how networks work, ports and protocols, Linux and Windows.
- Learn the rules before the tools: read about IT law and the Computer Misuse Act. Never test anything you do not own or have written permission to test.
- Understand what you are trying to break: firewalls, threats and vulnerabilities and social engineering.
- Practise only in legal places: your own home lab, deliberately vulnerable training machines, and CTF events.
- Write up every lab like a professional report: scope, findings, evidence, risk and how to fix it.
- Earn a practical certificate such as eJPT, then PNPT, PenTest+ or CREST CRT, while working in IT or a SOC.
- Apply for junior tester roles with your reports as evidence, then work towards OSCP+.
Ways to specialise
After a few years, most security professionals focus on one area.
Start learning now
Notes libraryCompare with other paths
Many professionals move between these areas during their career. Strong networking is the foundation for all three.