Get paid to break into companies' computer systems, with their written permission, so real attackers cannot.
Click through it
Pay, the path, pros and cons and the facts on one printable page. Good for a wall or a guidance counsellor.
Or read the whole thing here
What you earn and what it costs to get there.
Typical
$103,000
Junior tester
$62,000
Senior or lead
$150,000
Job Bank pools penetration testers with all cybersecurity analysts (one group, NOC 21220). Its national median is $49.52 an hour, about $103,000 a year full time. Testers with a strong certification and a few years of experience tend to sit at or above that median.
$60,000 to $75,000
Junior tester or security analyst, first 1 to 2 years
Most people start in a broader security or IT role and move into testing. Toronto, Ottawa, Montreal, Calgary and Vancouver have the most jobs. Banks and big consulting firms pay the most for juniors.
$130,000 to $150,000+
Senior tester, red team lead, or independent consultant
Consultants who bill by the day, and testers who specialize in hard targets like cloud, mobile apps or industrial control systems, earn the most. Bug bounty payouts can add to this but are not steady income.
Tuition, fees, exams and kit. Not rent, food or travel
The low end is teaching yourself on free practice platforms, paying for one entry level security certification exam, and building a home lab on a computer you already own. The high end is a four year computer science degree at the top of the tuition range plus a well known hands on hacking certification whose course and exam are priced in US dollars. Most employers pay for certifications once you are hired, so the expensive ones are often better left until you have the job. Nothing here is required by law, which means the money buys credibility rather than a licence.
Many employers pay for certifications once you are hired. Practice platforms with free tiers cut the cost of learning.
Remote work
Most testing is done over a secure connection from wherever you are.
Paid training and certifications
Common, because the field changes fast and employers need you current.
Health, dental and a pension plan
Standard at banks, government and large firms. Small consultancies vary.
Conference travel
Security conferences are part of the culture and many employers cover them.
The exact path from high school to qualified.
No licence. Employers hire on proven skill: certifications, a home lab, and practice challenges you can talk about.
High school
Grades 11 and 12
Computer science, math and English. Start learning Linux and basic networking at home now.
Diploma or degree
2 to 4 years
A 2-year college cybersecurity diploma (Seneca, Algonquin, and the polytechnics in Calgary, Edmonton and Vancouver) or a 4-year computer science degree. Co-op programs help a lot.
First job in IT or security
1 to 3 years
Help desk, network technician, or security operations analyst. Most testers do 1 to 3 years here first. Practice hacking legally on training platforms in your spare time.
Get certified and move into testing
6 to 12 months of study
The OSCP (Offensive Security Certified Professional) is the certification most employers ask for. Its exam is a 24-hour hands-on test where you break into real machines.
Specialize
Ongoing
Web apps, cloud, mobile, hardware, or red teaming (full attack simulations). Each specialty raises your rate.
Computer science
Programming basics. Python is the language testers use most for tools and scripts.
Math
Logic and problem solving. Cryptography is math.
English
A tester's real product is a written report a manager can understand.
Any networking or IT elective
How data moves between computers is the foundation of the job.
Anyone can call themselves a penetration tester. What separates a professional from a criminal is written permission: a signed scope agreement that says which systems you may attack, when, and how far. Testing anything without that permission is a crime under Canada's Criminal Code, no matter your intent. Employers also run background checks, and government and bank work often needs a security clearance.
Alberta
SAIT (Southern Alberta Institute of Technology) Cyber Security diploma, 2 years. NAIT (Northern Alberta Institute of Technology) also runs security programs.
Ontario
Seneca Cybersecurity and Threat Management (8-month graduate certificate after a diploma or degree), Sheridan, Algonquin, Conestoga.
BC
BCIT (British Columbia Institute of Technology) Computer Systems Technology, then security courses.
Universities
Any computer science degree works. Concordia, Waterloo, Carleton and UNB (University of New Brunswick) have well-known security research groups.
Things you don't need, but that help.
OSCP (Offensive Security Certified Professional)
The one job ads ask for. A 24-hour practical exam. Hard, and respected because it is hard.
CompTIA Security+
Entry level. Proves you know the basics before you go for the OSCP.
Web and cloud specialties
Advanced OffSec certifications, plus AWS (Amazon Web Services) and Azure security credentials, open higher-paying work.
CISSP (Certified Information Systems Security Professional)
A management-level certification that needs 5 years of security experience. Opens the door to leading a security team.
A public record of practice
Write-ups of training challenges, a small tool on GitHub, or a bug bounty acknowledgement.
Capture-the-flag competitions
Team hacking contests. Many colleges and universities have clubs that compete.
Security clearance eligibility
Federal contracts need it. Canadian citizenship or permanent residence and a clean record help.
Scripting
Python and Bash. Testers who can automate get more done and get promoted.
Companies like Shopify and many US tech firms pay outside researchers for reporting real security holes. A handful of people make a full-time living at it, but most earn occasional payouts. It is a good way to build a reputation and a portfolio while you work a regular job. The rules of each program are your permission slip, so read them closely.
Day to day, pros and cons, where you'd work.
A client hires your firm to test a web app, a network or an entire company. Day one is scoping: what you may touch and what you must not. Then a week or two of testing: mapping the systems, hunting for weaknesses, chaining small flaws into a real break-in, and proving impact without causing damage. The last days are writing. The report ranks every finding by risk and tells the client's developers how to fix it. Then a new client, a new target.
The good
The hard parts
Things people don't tell you.
The OSCP (Offensive Security Certified Professional) exam gives you 24 hours to break into a set of machines while a proctor watches over a video link, then another day to write the report. People book time off work to sit it.
The Canadian Centre for Cyber Security is part of the Communications Security Establishment, the country's signals intelligence agency. It publishes threat alerts and advice for businesses and hires security specialists in Ottawa.
The same actions, run against the same server, are a paid job with a signed scope letter and a criminal offence without one. Professional testers keep that letter close.
Penetration testers are counted with cybersecurity analysts in Canada's job statistics, one code (NOC 21220) that covers everything from monitoring alerts to breaking in. That is why pay data for the field is a wide range.
Last checked September 2026. Pay figures are typical full-time annual amounts in Canadian dollars, based on Government of Canada Job Bank wage data and published salary grids. They vary by province, employer and experience. Tuition is for domestic students.