Technology

How to become a Penetration Tester

From cybersecurity analyst: every step, how long it takes, and the credential it earns.

Time to get there

1–3 years

Typical pay

$95k–$140k

Starting from

Cybersecurity analyst

Pay is an estimate of typical US entry-level pay for this role and varies by state, employer and shift. The timeline assumes you are starting from cybersecurity analyst and includes any licence or programme legally required — not just course length.

The route

1. 1

   1–2 years

   Build a real security foundation first

   Networks, operating systems and web application internals. There is no shortcut past this.

   Course that covers thisCompTIA Security+ (SY0-701) Real Practice TestsUdemy · around $19.99 →
2. 2

   6–12 months

   Learn to exploit deliberately vulnerable targets

   HackTheBox and similar. Volume of practice is what makes this skill.

3. 3

   Earn a hands-on certification

   OSCP is the recognised proof because it is a 24-hour practical exam, not multiple choice.

   ◆ OSCP (OffSec)

4. 4

   1–3 years

   Move across from a defensive role

   Most testers start in SOC, sysadmin or development work. Straight-in hires are rare.

5. ✓

   Destination

   Penetration Tester

   Browse jobs now →

Course links are Udemy affiliate links. We earn a commission if you buy, at no extra cost to you.