Technology

How to become a Penetration Tester

From cybersecurity analyst: every step, how long it takes, and the credential it earns.

Time to get there

1–3 years

Typical pay

$95k–$140k

Starting from

Cybersecurity analyst

Pay is an estimate of typical US entry-level pay for this role and varies by state, employer and shift. The timeline assumes you are starting from cybersecurity analyst and includes any licence or programme legally required, not just course length.

The route

1. 1

   1–2 years

   Build a real security foundation first

   Networks, operating systems and web application internals. There is no shortcut past this.

   Course that covers thisCompTIA Security+ (SY0-701) Real Practice TestsUdemy · around $19.99 →
2. 2

   6–12 months

   Learn to exploit deliberately vulnerable targets

   HackTheBox and similar. Volume of practice is what makes this skill.

3. 3

   Earn a hands-on certification

   OSCP is the recognised proof because it is a 24-hour practical exam, not multiple choice.

   ◆ OSCP (OffSec)

4. 4

   1–3 years

   Move across from a defensive role

   Most testers start in SOC, sysadmin or development work. Straight-in hires are rare.

5. ✓

   Destination

   Penetration Tester

   Browse jobs now →

Course links are Udemy affiliate links. We earn a commission if you buy, at no extra cost to you.