You break into computer systems on purpose, with written permission, and then explain exactly how you did it.
Click through it
Pay, the path, pros and cons and the facts on one printable page. Counsellors: send it to a student from your own email in one click.
The median pay is about $129,180 a year. Across everyone in the job it runs from about $75,090 at the lower end to about $199,850 at the upper end. The source is listed under Sources at the end of this page.
1 to 4 years after high school, on the usual route.
$500 to $46,000 all in for tuition, fees, exams and kit. Living costs are not counted.
No. There is no license to hold, though many employers still ask for training or a certificate.
Very high demand nationally, from government outlook data. Demand varies by region, so check your area.
Or read the whole thing here
What you earn and what it costs to get there.
Median
$129,180
Bottom tenth
$75,090
Top tenth
$199,850
The federal survey has no separate line for penetration testers. It counts them inside Information Security Analysts, where the 2025 national median is $129,180 a year and the bottom tenth earn $75,090 or less.
$75,090 to $97,810
The bottom tenth to the bottom quarter of the national wage survey, 2025, for all information security analysts
Few people get hired straight into offensive work. Many start in information technology support or on a defensive security team, then move across once they have a certification and some proof they can do it.
$163,500 a year or more
The 75th percentile of information security analysts, 2025
The survey does not say who is at the top. Independent consultants and bug bounty hunters work outside it, with no salary and no benefits.
Roughly, all in
$500 to $46,000
Tuition, fees, exams and kit. Not rent, food or travel
Almost all of the skill here can be built at no cost using practice labs, capture the flag events, deliberately vulnerable machines and the federal training catalog, so the low end is one entry level certification exam fee and nothing else. The high end is a four year bachelor's degree in cybersecurity at an in state public university plus the Offensive Security Certified Professional certification, which is $1,699 for the exam alone. A six day vendor course can add $8,780 on its own, and employers frequently pay for that one once you are already hired. The cheap door is harder to walk through than the price suggests, because self taught candidates have to prove themselves through public write ups and lab rankings that a degree holder does not need.
You can get most of the skill at no cost. Practice labs, capture the flag events and deliberately vulnerable machines cost nothing, and the federal government publishes a training catalog you can use at no charge. The money goes on the certification that makes a hiring manager take you seriously.
Remote work
Most testing is done over a network, so much of the work can be done remotely.
Employer-paid certifications
Good firms budget for a course and exam every year, which is thousands of dollars of training.
Conference travel
Security conferences are a real part of the culture, and employers often pay.
Security clearance
Government and defense work often needs a security clearance, and the clearance follows you.
The exact path from high school to qualified.
Nobody licenses this. You get hired on evidence that you can actually do it.
High school
Grades 11 and 12
Learn to program a little, build a home lab out of old machines or no-cost virtual ones, and start breaking things you own.
Degree or certification, or both
0 to 4 years
A two-year or four-year cybersecurity or computer science degree is the common route. Self-taught people get in too, but they need a certification to prove it.
A first technical job
1 to 3 years
Help desk, systems administration, network support or a security operations center. You need to understand how systems are built before you can break them.
Get a hands-on certification
3 to 12 months of study
The Offensive Security Certified Professional (OSCP) exam is 24 hours of proctored practical hacking. The CompTIA PenTest+ exam runs 165 minutes with up to 90 questions.
Junior penetration tester
First role
Join a consulting firm or an in-house red team. You learn the report writing and the client side on the job.
Computer science
Any programming. Python and scripting turn up constantly in this work.
Math
Logic and discrete math underpin cryptography and how you reason about systems.
English
Half this job is writing a report a manager can act on. Testers who cannot write stay junior.
Networking or information technology courses
If your school offers them, they teach the plumbing you will attack.
There is no state or federal license for penetration testing, and anyone can call themselves one. What is not optional is authorization. Accessing a computer system without permission is a federal crime in the United States, and the only thing separating this career from that crime is a signed scope document saying what you may test, when and how. Professional engagements start with that paperwork every single time, and a tester who goes outside the agreed scope is the one holding the risk.
Community colleges
Two-year cybersecurity degrees at in-state tuition, often with an internship attached.
Universities
Computer science or cybersecurity degrees, and many campuses run a competitive hacking team.
Federal resources at no cost
The National Initiative for Cybersecurity Careers and Studies, run by the Cybersecurity and Infrastructure Security Agency (CISA), publishes a training catalog and career pathway tools.
Practice platforms
Online labs full of deliberately vulnerable machines. This is where almost everyone actually learns the craft.
Things you don't need, but that help.
Offensive Security Certified Professional (OSCP)
A 24-hour practical exam where you have to compromise real machines. It is widely respected by hiring managers.
CompTIA PenTest+
Covers planning, reconnaissance, exploitation and reporting. Easier to reach than the practical exams and useful for a first job.
GIAC Penetration Tester (GPEN)
From the SANS Institute (a private security training company). Expensive, common in government and defense work.
Cloud security certifications
Many targets now live in cloud accounts, and testers who understand cloud identity are in short supply.
A public portfolio
Write-ups of practice boxes, a tool you built, a talk you gave. This substitutes for experience you do not have yet.
Programming beyond scripting
Reading source code lets you find bugs nobody has found yet, instead of running other people's tools.
Capture the flag competitions
Team hacking events. Good practice, and recruiters watch the scoreboards.
A clean record
Client work and clearances involve background checks. Illegal hacking as a teenager closes doors permanently.
Many companies pay outsiders for reported vulnerabilities through public bug bounty programs. It is a legal way to practice on real systems within rules the company publishes, and a way to build a name before anyone will hire you. Be clear-eyed about the money: many reports earn nothing, and few people make a living at it. Treat it as a portfolio and training, not income.
Day to day, pros and cons, where you'd work.
An engagement usually runs one or two weeks. Day one is scoping and reconnaissance: mapping what the client actually has exposed. Then scanning, finding a way in, escalating from a normal account to an administrator, and moving sideways through the network to see how far you get. You keep notes and screenshots of everything, because the deliverable is a written report ranking each finding and telling the client how to fix it. Then you present it to people who may not want to hear it.
The good
The hard parts
Things people don't tell you.
The Offensive Security Certified Professional exam gives you 24 hours inside a private network to break into three separate machines and one linked set of company machines, watched by a proctor, and then you write the report.
Federal projections expect much faster than average growth for information security analysts, the group that includes penetration testers, from 2025 to 2035, with about 14,100 openings a year.
Some engagements include getting into the building: tailgating through a door, cloning a badge, or leaving a device plugged in under a desk. Testers carry a signed letter in case security detains them.
Every list is built from the same numbers shown above, so you can see where this career sits next to the others.
Security and networks first, then the rest of the field. See every career in tech.
Last checked October 2026. Pay figures are typical full-time annual amounts in United States dollars, based on Bureau of Labor Statistics wage data and published pay scales. They vary by state, employer and experience. Tuition is for in-state students at public schools unless the card says otherwise. How every figure on this site is sourced and checked.
Tell us about this page. A person reads every message.
No email app on this device? Use Gmail instead: report a mistake in Gmail or say what you like in Gmail.