Penetration Tester Career Roadmap
A penetration tester is paid to break into things — legally, with a scope document and a signed contract, but break in all the same. The job is one part relentless curiosity and one part disciplined methodology: you enumerate, you exploit, you pivot, and then you write the whole thing up so a defender can close the door you just walked through. It rewards people who refuse to accept that a system works the way the documentation claims. And it runs on proof, not vibes — nobody cares that you 'could' get in; they care that you did, and can show exactly how.
Is this the right path for you?
Penetration testers arrive from three main directions: IT and sysadmin backgrounds who already know how systems fail, developers who understand code well enough to abuse it, and self-taught hobbyists who spent years on TryHackMe and Hack The Box before anyone paid them. A CS degree helps but is genuinely optional here — this is one of the few tech fields where a strong home lab and an OSCP outweigh a diploma.
If you're the kind of person who reads a login form and immediately wonders what happens if you put a quote mark in the username field, you have the right wiring. This work rewards obsessive curiosity, comfort with prolonged frustration, and the discipline to document everything. The people who wash out aren't the ones who lack talent — they're the ones who can't sit with a box for six hours without a walkthrough.
Honest note: 'entry-level' is a stretch in offensive security. Most junior pentest roles expect an OSCP and a visible track record before you send the first application, which is why the realistic timeline is 12–18 months, not three. The upside is that once you're in, the ceiling is high and the demand is real — but nobody hands this one to you on enthusiasm alone.
Career Progression
Where does this role lead?
Click any role to explore timeline, key skills and, where the Department of Labor publishes it, pay.
Entry
Junior Pentester
~0–2 yrs
$70,117 (Level I)
You'll run scoped tests under supervision and write a lot of reports. The finding matters less than how clearly you explain it — writing is half this job.
Key skills
Pay shown is the U.S. Department of Labor prevailing wage for Level I (entry), Level III (mid) and Level IV (senior) in the nearest BLS occupation, base wage for the typical metro, wage year 2025, shown for the main track only. It is a benchmark, not an offer; branches and lead, staff and executive stages have no official figure.
Visual roadmap
Penetration Tester learning path
Work down the line, one step at a time. Tick each skill as you can do it.
- 1
Build Linux, Networking & Scripting Foundations
8–12 weeksYou cannot exploit what you do not understand. Get comfortable living on a Linux command line, know how TCP/IP, DNS, HTTP, and Active Directory actually move packets around, and learn enough Python and Bash to automate the boring parts. TryHackMe's beginner paths are the least painful on-ramp here.
Skills to learn
- Linux CLI & file permissions
- TCP/IP & the OSI model
- DNS, HTTP, SMB, LDAP
- Bash scripting
- Python for tooling
- Networking with Wireshark
- Windows & Active Directory basics
- Virtualisation (VMware / VirtualBox)
Start with
- 2
Master Web Application Attacks
10–14 weeksWeb is where most real-world findings live, so this is where you should spend disproportionate time. PortSwigger's Web Security Academy is free, authoritative, and written by the people who make Burp Suite. Work every lab — SQLi, XSS, SSRF, auth bypass, access control — until the patterns are reflexive.
Skills to learn
- SQL injection
- Cross-site scripting (XSS)
- SSRF & XXE
- Authentication & access control flaws
- Burp Suite proxy & Repeater
- OWASP Top 10
- API security testing
- Request smuggling basics
Start with
- 3
Grind Hack The Box & Lock In a Methodology
12–16 weeksNow apply everything against machines that fight back. Root 20+ boxes on Hack The Box, and — critically — take structured notes on your enumeration-to-exploitation-to-privilege-escalation flow. The goal isn't collecting flags; it's building a repeatable methodology you trust under time pressure.
Skills to learn
- Service enumeration (nmap, gobuster)
- Exploitation & foothold
- Linux & Windows privilege escalation
- Pivoting & lateral movement
- Note-taking discipline (CherryTree / Obsidian)
- Password cracking (Hashcat)
- Metasploit & manual exploitation
Start with
- 4
Prepare for and Pass the OSCP
12–20 weeksThe OSCP is still the certificate that opens the door for entry-level pentest roles — a 24-hour hands-on exam that proves you can actually break in, not just answer multiple choice. Work OffSec's PEN-200 labs hard, do the Proving Grounds and TJ Null box list, and treat report writing as part of the exam, because it is.
Skills to learn
- Time-boxed exploitation
- Buffer overflow fundamentals
- Active Directory attack chains
- Exam-grade report writing
- Manual over automated exploitation
- Stress management under a 24h clock
Start with
- 5
Write Reports & Build a Public Portfolio
8–12 weeksA finding nobody can act on is worthless, so professional-grade reporting is the skill that separates a hobbyist from a hire. Meanwhile, build public proof: bug bounty findings on HackerOne, write-ups of retired HTB boxes, or a blog. Hiring managers want evidence you can communicate risk to a non-hacker.
Skills to learn
- Executive & technical report writing
- Risk scoring (CVSS)
- Bug bounty triage & disclosure
- Technical blogging
- Client communication
- Remediation guidance
Start with
- 6
Specialise: Active Directory, Red Team, or Cloud
OngoingOnce you're working, depth pays more than breadth. Pick a lane — enterprise Active Directory and evasion (OSEP), full adversary-emulation red teaming (CRTO), or cloud attack paths in AWS and Azure — and go deep enough that teams call you specifically for it.
Skills to learn
- Advanced Active Directory attacks
- C2 frameworks (Cobalt Strike / Sliver)
- AV & EDR evasion
- Cloud pentesting (AWS / Azure)
- Adversary emulation & MITRE ATT&CK
- Assumed-breach engagements
Start with
jobroadmaps.com/roadmaps/penetration-tester · Pay, demand and employer data for this role are further down the page.
Job Market Insights for Penetration Tester
Data-backed
Which tools and artifacts appear most in job postings?
Read from live job postings, ranked from most to least often named.
Cosmos tops the list and is named frequent. That is not a preference, it is what this market has standardised on.
One tool sits at the top of the scale. At that level it is less a differentiator than a prerequisite, and a gap shows up in first-round screens.
Tool / Artifact
How often named
Cosmos
Sorted by how often named · JobRoadmaps
Industry overlay
Targeting a specific industry?
The core roadmap gets you through the door anywhere. The difference between "qualified" and "they hired someone else" often lives in industry-specific context — the norms, the compliance floors, the tools assumed fluent in that sector.
Web & API testing depth
The product is a web application, so deep OWASP-and-beyond skill matters more than breadth across networks and physical.
OAuth & SSO attack paths
SaaS authentication stacks are built on OAuth, SAML, and OIDC — token and assertion flaws are recurring high-severity finds.
Multi-tenant isolation testing
Cross-tenant data leakage is an existential bug for SaaS — verifying tenant boundaries is a standing test objective.
Bug bounty triage
Most SaaS security teams run public bounty programs, and validating external reports becomes part of the internal tester's job.
Secure SDLC collaboration
Findings go straight to the engineers who wrote the code — writing actionable tickets and threat-modeling with dev teams is daily work.
Companies hiring:
SalesforceAtlassianOktaGitLabDatadogTS/SCI clearance
The most interesting government red team work sits behind Top Secret clearance — clearability is the primary hiring gate.
DoD 8140 certifications
Contracts specify required certs by role — Security+, CEH, or OSCP are contractual line items, not preferences.
Rules-of-engagement discipline
Testing operational government systems means strict ROE documents, deconfliction, and no improvisation outside the letter of the authorisation.
Adversary emulation (ATT&CK)
Engagements replicate specific nation-state TTPs mapped to MITRE ATT&CK rather than just hunting any available vulnerability.
On-site & air-gapped testing
Classified networks are not reachable from your home lab — expect travel, SCIFs, and tooling constraints remote testers never face.
Companies hiring:
Booz Allen HamiltonMITRELeidosCACIRaytheonIndustry premiums based on aggregated job posting data · Updated quarterly
Books worth reading as a Penetration Tester
Where to start, in order. The full list of 12, grouped by career stage, is on its own page.
Getting started
Linux Basics for Hackers: Getting Started with Networking, Scripting, and Security in Kali
by OccupyTheWeb · 2018
~250 pages~6 hrs to read
Teaches the Linux command line, networking and scripting through Kali. Read it first if the shell still slows you down, since every later tool in this path assumes you are comfortable there.
View book →
Penetration Testing: A Hands-On Introduction to Hacking
by Georgia Weidman · 2014
~530 pages~13 hrs to read
Builds a small lab and walks through the stages of a test: reconnaissance, exploitation, post-exploitation and web and wireless attacks. A good first book once you can use Linux.
View book →
Doing the job
The Hacker Playbook 3: Practical Guide To Penetration Testing
by Peter Kim · 2018
~290 pages~7 hrs to read
Frames testing as a sequence of plays from reconnaissance to red team tactics, with lab setups and tool walkthroughs. Read it once you can finish easy machines and want to see a full engagement.
View book →
Black Hat Python: Python Programming for Hackers and Pentesters
by Justin Seitz, Tim Arnold · 2014
~220 pages~6 hrs to read
Uses Python to write network tools, sniffers, scanners and post-exploitation tooling. Reach for it when you want to automate your own testing instead of depending on someone else's scripts.
View book →
Senior and leading
Advanced Penetration Testing: Hacking the World's Most Secure Networks
by Wil Allsopp · 2017
~290 pages~7 hrs to read
Looks at long-running, evasive engagements against well-defended targets, including custom tooling and red team techniques. For testers moving beyond scanner-driven work.
View book →
Evading EDR: The Definitive Guide to Defeating Endpoint Detection Systems
by Matt Hand · 2023
Explains how endpoint detection and response products work internally and where their visibility ends. Read it as you move into red team work, where knowing the defender's sensors shapes your tradecraft.
View book →
All 12 books for a Penetration Tester →Browse all books →
Some book links are affiliate links: we earn a small commission if you buy, at no cost to you. It does not affect what we list.
Prerequisites & Education
What credentials do employers look for?
These are the most common paths into this role — no single one is required.
Education Level
View list — coming soon- Bachelor's in cybersecurity or computer science — helpful but routinely bypassed by proof of skill
- Bachelor's in any field plus OSCP — a standard profile at consultancies
- No degree — Hack The Box rank, CTF results, and certs get interviews on their own
- Associate's degree with strong hands-on labs and an entry cert
Offensive security is the most meritocratic corner of cybersecurity. Demonstrated exploitation skill — labs, CTFs, bug bounties — consistently outweighs formal education.
Certifications
View list — coming soon- OSCP (OffSec Certified Professional) — the anchor cert; a 24-hour practical exam most job posts name explicitly
- eJPT (INE Junior Penetration Tester) — the accessible entry point; validates fundamentals before OSCP
- PNPT (TCM Security) — practical AD-focused exam with a live report debrief; growing employer recognition
- CompTIA PenTest+ or Security+ — HR-filter certs; Security+ also satisfies DoD 8140 for government work
OSCP remains the credential that opens doors — plan 3–6 months of lab time for it. Take eJPT or PNPT first if you are new to offensive tooling.
Bootcamps & Training
View list — coming soon- TCM Security Academy — practical, affordable courses that feed directly into the PNPT
- Hack The Box Academy — the CPTS path is arguably the most technically rigorous pentest training available
- TryHackMe — guided learning paths that take you from zero to OSCP-ready fundamentals
- SANS SEC560 / GPEN — excellent but expensive; worth it only when an employer pays
Skip generic cybersecurity bootcamps. The platforms the industry actually respects — HTB, THM, TCM — cost a fraction of a bootcamp and map directly to the certs that matter.
Portfolio & Other
View list — coming soon- Hack The Box rank and Pro Lab completions — a public, verifiable skill signal recruiters check
- CTF writeups on a blog or GitHub — show methodology and clear reporting, the half of the job certs miss
- Bug bounty findings — even low-severity accepted reports on HackerOne or Bugcrowd prove real-world skill
- Home Active Directory lab — most corporate pentests are AD pentests; document your attack paths
- Report-writing samples — a sanitised mock pentest report demonstrates the deliverable clients pay for
Pentesting is half exploitation, half communication. A writeup that explains impact to a non-technical reader is the differentiator most candidates lack.
Your Roadmap
6 stepsBuild Linux, Networking & Scripting Foundations
8–12 weeksYou cannot exploit what you do not understand. Get comfortable living on a Linux command line, know how TCP/IP, DNS, HTTP, and Active Directory actually move packets around, and learn enough Python and Bash to automate the boring parts. TryHackMe's beginner paths are the least painful on-ramp here.
Skills to learn
Master Web Application Attacks
10–14 weeksWeb is where most real-world findings live, so this is where you should spend disproportionate time. PortSwigger's Web Security Academy is free, authoritative, and written by the people who make Burp Suite. Work every lab — SQLi, XSS, SSRF, auth bypass, access control — until the patterns are reflexive.
Skills to learn
Grind Hack The Box & Lock In a Methodology
12–16 weeksNow apply everything against machines that fight back. Root 20+ boxes on Hack The Box, and — critically — take structured notes on your enumeration-to-exploitation-to-privilege-escalation flow. The goal isn't collecting flags; it's building a repeatable methodology you trust under time pressure.
Skills to learn
Prepare for and Pass the OSCP
12–20 weeksThe OSCP is still the certificate that opens the door for entry-level pentest roles — a 24-hour hands-on exam that proves you can actually break in, not just answer multiple choice. Work OffSec's PEN-200 labs hard, do the Proving Grounds and TJ Null box list, and treat report writing as part of the exam, because it is.
Skills to learn
Write Reports & Build a Public Portfolio
8–12 weeksA finding nobody can act on is worthless, so professional-grade reporting is the skill that separates a hobbyist from a hire. Meanwhile, build public proof: bug bounty findings on HackerOne, write-ups of retired HTB boxes, or a blog. Hiring managers want evidence you can communicate risk to a non-hacker.
Skills to learn
Specialise: Active Directory, Red Team, or Cloud
OngoingOnce you're working, depth pays more than breadth. Pick a lane — enterprise Active Directory and evasion (OSEP), full adversary-emulation red teaming (CRTO), or cloud attack paths in AWS and Azure — and go deep enough that teams call you specifically for it.
Skills to learn
Start here this week
This week: make a free TryHackMe account and finish the Pre-Security path, then open PortSwigger's Web Security Academy and complete your first SQL injection lab. Both are free. The point is to confirm you actually enjoy the grind before you spend money on a lab subscription or an OSCP voucher — plenty of people love the idea of hacking and hate the reality of enumeration.
For a structured path: spend three to four months on TryHackMe fundamentals, move to a Hack The Box VIP subscription and root the TJ Null prep list, then book OSCP once you can root a medium box without hints. Keep a running note-vault the entire time — those notes become both your methodology and, later, your portfolio write-ups.
Pay
U.S. Department of Labor data for the nearest BLS occupation, Information security analysts. BLS has no occupation for this exact title, so treat these as a benchmark.
Median: U.S. Bureau of Labor Statistics, Occupational Employment and Wage Statistics (median wage, May 2024) and Employment Projections (2024–34). Levels: U.S. Department of Labor Office of Foreign Labor Certification prevailing wage levels (wage year 2025, typical metro), a base-wage benchmark for the metro in the middle of 303 areas, not an offer. See every metro.
Job Titles at Each Level
Entry
Junior Penetration Tester
Mid
Penetration Tester
Senior
Senior Pentester / Red Team Operator
Steps Overview
- 1
Build Linux, Networking & Scripting Foundations
8–12 weeks
- 2
Master Web Application Attacks
10–14 weeks
- 3
Grind Hack The Box & Lock In a Methodology
12–16 weeks
- 4
Prepare for and Pass the OSCP
12–20 weeks
- 5
Write Reports & Build a Public Portfolio
8–12 weeks
- 6
Specialise: Active Directory, Red Team, or Cloud
Ongoing
Explore more roadmaps
Not sure this is the right path? Browse all tech career roadmaps.
View Similar RoadmapsBuilt a project while following this roadmap?
Turn it into a hiring-ready case study in 10 seconds — free.
Ready to explore more?
Browse all career roadmaps across tech, business, and creative fields.