Get paid to break into companies' computer systems, with their written permission, so real attackers cannot.
Click through it
Pay, the path, pros and cons and the facts on one printable page. Counsellors: send it to a student from your own email in one click.
The median pay is about $103,000 a year. Across everyone in the job it runs from about $62,000 at the lower end to about $150,000 at the upper end. The source is listed under Sources at the end of this page.
3 to 6 years after high school, on the usual route.
$1,500 to $51,000 all in for tuition, fees, exams and kit. Living costs are not counted.
No. There is no licence to hold, though many employers still ask for training or a certificate.
Moderate demand nationally, from government outlook data. Demand varies by region, so check your area.
Or read the whole thing here
What you earn and what it costs to get there.
Median
$103,000
Lower end
$62,000
Upper end
$150,000
Job Bank pools penetration testers with all cybersecurity analysts (one group, NOC 21220, the National Occupational Classification code). Its national median is $49.52 an hour, about $103,000 a year at 40 hours a week. The lower end ($30) and upper end ($72.12) are the bottom and top of the range for everyone in the group.
$51.28 an hour
The Job Bank median in Ontario, the highest of any province
Alberta is close at $50.51 and Quebec is $49.23. Nova Scotia is lowest at $42.05. These figures cover all cybersecurity analysts, not testers alone.
Roughly, all in
$1,500 to $51,000
Tuition, fees, exams and kit. Not rent, food or travel
The low end is teaching yourself on no-cost practice platforms, paying for one entry level security certification exam, and building a home lab on a computer you already own. The high end is a four year computer science degree at the top of the tuition range plus a well known hands on hacking certification whose course and exam are priced in US dollars. Most employers pay for certifications once you are hired, so the expensive ones are often better left until you have the job. Nothing here is required by law, which means the money buys credibility rather than a licence.
Many employers pay for certifications once you are hired. Practice platforms with no-cost tiers cut the cost of learning.
Remote work
Most testing is done over a secure connection from wherever you are.
Paid training and certifications
Common, because the field changes fast and employers need you current.
Health, dental and a pension plan
Standard at banks, government and large firms. Small consultancies vary.
Conference travel
Security conferences are part of the culture and many employers cover them.
The exact path from high school to qualified.
No licence. Employers hire on proven skill: certifications, a home lab, and practice challenges you can talk about.
High school
Grades 11 and 12
Computer science, math and English. Start learning Linux and basic networking at home now.
Diploma or degree
2 to 4 years
A 2-year college cybersecurity diploma (Seneca, Algonquin, and the polytechnics in Calgary, Edmonton and Vancouver) or a 4-year computer science degree. Co-op programs help a lot.
First job in IT (information technology) or security
1 to 3 years
Help desk, network technician, or security operations analyst. Most testers do 1 to 3 years here first. Practice hacking legally on training platforms in your spare time.
Get certified and move into testing
6 to 12 months of study
The OSCP (Offensive Security Certified Professional) is the certification most employers ask for. Its exam is a 24-hour hands-on test where you break into real machines.
Specialize
Ongoing
Web apps, cloud, mobile, hardware, or red teaming (full attack simulations).
Computer science
Programming basics. Python is the language testers use most for tools and scripts.
Math
Logic and problem solving. Cryptography is math.
English
A tester's real product is a written report a manager can understand.
Any networking or IT (information technology) elective
How data moves between computers is the foundation of the job.
Anyone can call themselves a penetration tester. What separates a professional from a criminal is written permission: a signed scope agreement that says which systems you may attack, when, and how far. Testing anything without that permission is a crime under Canada's Criminal Code, no matter your intent. Employers also run background checks, and government and bank work often needs a security clearance.
Alberta
SAIT (Southern Alberta Institute of Technology) Cyber Security diploma, 2 years. NAIT (Northern Alberta Institute of Technology) also runs security programs.
Ontario
Seneca Cybersecurity and Threat Management (8-month graduate certificate after a diploma or degree), Sheridan, Algonquin, Conestoga.
BC (British Columbia)
BCIT (British Columbia Institute of Technology) Computer Systems Technology, then security courses.
Universities
Any computer science degree works. Concordia, Waterloo, Carleton and UNB (University of New Brunswick) have well-known security research groups.
In Quebec the usual base is a 3 year CEGEP (public college) program, and an English cybersecurity AEC (Attestation of College Studies) exists for adults.
Finish Secondary V
Age 16 or 17
The Computer Science Technology program needs Secondary IV math in the Technical and Scientific or Science sequence, or Secondary V Cultural, Social and Technical math.
Computer Science Technology DEC (Diploma of College Studies, 420.B0)
3 years
3 years. Every student takes information security. Vanier lists ethical hacking as a focus, and John Abbott has a security course. No tuition for full-time Quebec residents.
Work in IT (information technology) first
2 to 4 years
Network, system or developer jobs. Testers need to know how systems are built before they break them.
Or retrain with a cybersecurity AEC (Attestation of College Studies)
Part time
Vanier's 570 hour program, in English, online, evenings and Saturdays. Open to adults who have been out of school for a while or have some post-secondary study.
Certifications and practice
Ongoing
Hacking certifications and practice labs work the same as in the rest of Canada.
Jobs listed: cybersecurity analyst, technician and advisor. Penetration testing usually comes after that.
Things you don't need, but that help.
OSCP (Offensive Security Certified Professional)
The one job ads ask for. A 24-hour practical exam. Hard, and respected because it is hard.
CompTIA Security+
Entry level. Proves you know the basics before you go for the OSCP.
Web and cloud specialties
Advanced OffSec certifications, plus AWS (Amazon Web Services) and Azure security credentials, open more specialized work.
CISSP (Certified Information Systems Security Professional)
A management-level certification that needs 5 years of security experience. Opens the door to leading a security team.
A public record of practice
Write-ups of training challenges, a small tool on GitHub, or a bug bounty acknowledgement.
Capture-the-flag competitions
Team hacking contests. Many colleges and universities have clubs that compete.
Security clearance eligibility
Federal contracts need it. Canadian citizenship or permanent residence and a clean record help.
Scripting
Python and Bash. Testers who can automate get more done and get promoted.
Companies like Shopify and many US tech firms pay outside researchers for reporting real security holes. A handful of people make a full-time living at it, but most earn occasional payouts. It is a good way to build a reputation and a portfolio while you work a regular job. The rules of each program are your permission slip, so read them closely.
Day to day, pros and cons, where you'd work.
A client hires your firm to test a web app, a network or an entire company. Day one is scoping: what you may touch and what you must not. Then a week or two of testing: mapping the systems, hunting for weaknesses, chaining small flaws into a real break-in, and proving impact without causing damage. The last days are writing. The report ranks every finding by risk and tells the client's developers how to fix it. Then a new client, a new target.
The good
The hard parts
Things people don't tell you.
The OSCP (Offensive Security Certified Professional) exam gives you 24 hours to break into a set of machines while an OffSec proctor watches, and then you write a report. The course, labs and one attempt cost US$1,749.
Getting into a computer system without the right to do so can bring up to 10 years in prison under section 342.1 of the Criminal Code. A signed scope letter is what makes the same work a paid job.
The Canadian Centre for Cyber Security is part of the Communications Security Establishment, the country's signals intelligence agency. It publishes threat alerts and advice for businesses and hires security specialists in Ottawa.
Every list is built from the same numbers shown above, so you can see where this career sits next to the others.
Security and networks first, then the rest of the field. See every career in tech.
Last checked October 2026. Pay figures are typical full-time annual amounts in Canadian dollars, based on Government of Canada Job Bank wage data and published salary grids. They vary by province, employer and experience. Tuition is for domestic students. How every figure on this site is sourced and checked.
Tell us about this page. A person reads every message.
No email app on this device? Use Gmail instead: report a mistake in Gmail or say what you like in Gmail.