18 Realistic Pen Testing Salaries in the US

The IT salaries posted on blog posts and websites are often entirely out of touch with the vast majority of American cities. 

Here’s how it goes: A company wants to show the importance of certification, so they claim that earning the CompTIA A+ will earn you $100,000 per year. We all know that’s exaggerated. Certainly, there are IT pros that may have earned the A+ along the way and now make six figures, but that salary isn’t the direct result of a foundational exam.

The other type of wildly out-of-touch salaries is the national average scale we so often see. What happens when high-cost areas like California, New York, and Washington, D.C. inflate the average for places like Cleveland and Orlando?

In this article, we’re going to look at 18 (realistic) salaries for penetration testers across the United States — and the reasons for the salary ranges. 

What does a penetration tester do? 

A penetration tester is a security professional who assesses company security defenses — and attempts to find vulnerabilities in their networks, applications, and even associates. A thorough penetration tester may even test physical security. 

Penetration testers are essentially just company-sponsored hackers. That’s why they’re also known as white hat hackers or ethical hackers, which imply they have the company’s permission to gain otherwise unauthorized access to their systems. 

Read More: How to Become a Penetration Tester

18 honest penetration tester salaries

Let's examine a variety of realistic penetration tester salaries. Your salary as a penetration tester hinges on a few different factors, like your education, years of experience, certifications, employer, and location.

As expected, penetration tester salaries in larger markets make more than their smaller-market peers, but there’s still a considerable distance between the salary ranges here. 

For instance, there’s about a $51,000 spread between the highest and lowest paid among the medium-sized cities like Tucson and Cleveland. There’s an even greater range of salaries in the largest metro areas. The lowest-paid San Francisco pen testers make $69,000 less than the highest-paid pen testers. 

Now that we’ve looked at the location as a salary variable, let’s look at the other reasons for the disparity between the highest and lowest penetration testing salaries. 

Salary Considerations for Penetration Testers

As with all jobs, there are a few factors that play into the level of compensation: experience, education, and the type of company. Salaries for penetration testers are no different.

Start your 30-day FREE TRIAL and begin your PenTest+ certification journey today!

Pen Testing Experience Requirement: 6 to 8 years

Penetration testers are fairly well-paid as a whole due to the relative scarcity of security professionals in the United States. In 2018, the U.S. Bureau of Labor Statistics estimated that more than 500,000 cybersecurity positions went unfilled in the United States due to the lack of qualified candidates. 

Next, there’s a high demand for qualified penetration testers. Cybercrime has been prevalent since the dawn of the internet, but companies are paying closer attention to security since the giant Marriott and Yahoo data breaches. Additionally, GDPR takes a bad situation and adds potentially massive fines on top of it. 

For all these reasons, security professionals — and offensive security professionals in particular — are in high demand at the same time as when they’re scarce. That’s great news both for salaries and job prospects. There’s no better time to be a security professional. 

Unfortunately, you can’t become a security professional overnight — and certainly not a pentester. Most companies require at least a few years of pen testing experience, which doesn’t sound like that much until you realize the pen testers didn’t start out in security.

Security professionals typically start out as network engineers, sysadmins, or software engineers, and then move laterally into security. To even get a job in cybersecurity, you’ll probably need at least 3 to 5 years in a non-security role before transitioning to security. 

Tack a few years of penetration testing experience onto another 3 to 5 years in non-security roles and you’re at 6 to 8 years to become a pentester. And that makes sense considering the level of proficiency you need to find and exploit threats. 

Think of it this way: Penetration testers are essentially just company-sponsored hackers. That’s why they’re also known as white hat hackers or ethical hackers, which imply they have the company’s permission to gain otherwise unauthorized access to their systems. Since pentesters are just hackers, they need the same experience as a hacker, which means knowledge, tools, and methods. 

Penetration Testing Tools: Kali Linux

Hackers are both looking for open doors (like open ports, weak passwords, or un-updated software) — and also cracks in your system. Cracks may include user input fields unprotected from SQL injections. To find these open doors and cracks, penetration testers and hackers alike will use the Kali Linux operating system, which is preloaded with more than 600 penetration testing tools. We published another blog post that goes deeper into the specific Kali Linux tools. 

Penetration Testing Methods

Hackers and penetration testers mix and match the 600+ tools available to them in Kali Linux into methods that match the system types, vulnerabilities they unearth, and their goals. But, ultimately, a penetration tester can actually be boiled down into a simple formula:

• Find vulnerabilities
• Exploit the vulnerability
• Document the vulnerability

Penetration testing is an intensely hands-on profession that’s sometimes hard to document for finding a job.

Enroll in our Cybersecurity Bootcamp program to launch your career in cybersecurity.

Pen Testing Education: PenTest+, CEH, OSCP

To be a successful penetration tester, you basically have to know everything: networking, systems, applications, and then security as well. And those requirements are reflected in the penetration tester job descriptions. The easiest way to validate those years of knowledge and experience with pen-testing tools and methods is through three certifications:

CompTIA PenTest+

The CompTIA PenTest+ (PT0-001) is an intermediate-level IT certification that validates the tools and methods a penetration tester would learn in their first couple years on the job. While not as difficult or respected as the other two exams, it’s still a valuable certification to validate your entry-level penetration testing knowledge. 

Salary Impact: The PenTest+ will certainly get you an interview. But to enter in the upper range of the salary brackets, you should consider the other two certifications.

EC-Council CEH

The CEH Practical exam is a 6-hour hands-on exam that tests your ethical hacking skills in a massive virtual environment. It’s a relatively new EC-Council exam but carries with it ANSI-accreditation and approval by the DoD as compliant with 8140 and NICE 2.0 Cybersecurity Framework. 

Salary Impact: Depending on your sector, the CEH Practical will probably open some doors into senior offensive security roles. That’s particularly true if you work within the U.S. federal government or for one of its contractors. 

OffSec OSCP

The OSCP is the gold standard and the one you should pursue at some point. The OSCP exam is a 24-hour practical exam that tests your ability to break into a variety of machines with a wide assortment of penetration testing tools. It’s both rigorous and grueling, but the impact on your career (and salary) will be great. 

Salary Impact: If you’re looking to pull down a salary at the top of the range, then OSCP should be your goal. OSCPs are highly regarded and sought-after by both large companies and security firms. 

What Type of Company Do You Want to Work For?

A penetration tester can be a full-time employee. For instance, Microsoft has two teams of security engineers divided into blue and red teams to test any new products or applications. The red team attempts to break into the systems hardened by the blue team, and then every quarter they switch teams. Then the former red team uses what they learned to harden the systems. 

(In case you were wondering, these security engineers likely make between $116,000 to $159,000 in base salary and bonuses according to Glassdoor.)

For a company like Microsoft, it makes sense to have (at least) two dedicated teams of pentesters-turned-security engineers. However, most companies hire out penetration testing to security firms, which is a perfect opportunity to get exposure to many systems and challenges.

Additionally, offensive security experts are also highly sought after by the federal and state governments. With the growing threat of state-sponsored hackers, the federal government is attempting to recruit as much tech talent as they can find, which absolutely includes penetration testers. 

Penetration testing can either be folded into the job roles of a security engineer or be assigned to a dedicated penetration tester. 

In either case, there’s never been a better time to be in the security field — and the demand is only going to grow.