What is a Penetration Tester? And How Can You Become One?

Penetration testers – sometimes referred to as ethical hackers – have become a fundamental role in modern cybersecurity, helping companies to expose serious vulnerabilities in their systems.

In this article, we’d like to talk about why penetration testers are so important, what exactly they do, and how you can become one.

What Is a Penetration Tester?

At its core, a penetration tester’s job is to play the role of a benign attacker. They probe the system as if they were an outsider looking for vulnerabilities. In doing so, they catch weak points where malicious actors would look to take advantage.

It’s a job that requires a lot of technical security knowledge as well as the ability to think about practical, real-world use cases. Keep in mind just because cybersecurity can be highly sophisticated, that doesn’t mean it always is. Data breaches rarely happen due to advanced encryption breaking. More often than not, a password gets leaked or a server is overloaded with incoming requests.

All this to say that a pen tester needs a very broad skillset. You need to understand things like network architecture and web application frameworks but you also need to be on the look out for social exploits. A penetration tester cannot afford to be a bubbled-off cybersecurity expert because, ultimately, the most vulnerable point in any IT system is the user who doesn’t understand what’s going on under the hood and just wants to do their job.

In fact, pen testing often includes a huge social engineering component. For example, fake phishing emails will sometimes be sent to real workplace email addresses in order to test click through rate.

This isn’t a name and shame exercise. It’s not about getting someone in trouble for clicking a dodgy link. It’s just a way to test the effectiveness of workplace training. If people are clicking on those links, then you know the system is vulnerable. The solution might genuinely be as simple as teaching your employees to spot a fake email.

All told, a fake phishing campaign and bit of workplace training is always cheaper than a real cyber attack.

How to Become a Penetration Tester?

It’s important to note that penetration testing is rarely an entry-level job. Most professionals start off in IT roles like systems administration or network engineering.

This is one of those industries where your experience matters a lot. As we’ve already noted, the best penetration testers are those who understand real world applications. You need to be able to predict how people will interact with a system and what the most likely vulnerabilities will be. That’s not something you can become an expert in from a textbook.

But how much experience do you need? How long does it take to actually become a penetration tester?

Realistically, if this job is your main goal, then you’re looking at about two to four years of experience. That should give you the time to develop a solid foundation in the relevant concepts as well as some perspective on how they apply in the real world.

You will also need relevant qualifications. A computer science degree is the standard route along with a respected cybersecurity certification such as eJPT or OSCP.

Penetration Tester Career Paths

It takes a lot of effort to become a penetration tester, but is it worth it?

By all traditional metrics, penetration testing is an excellent career. It’s a valuable role that’s only likely to become more so. The hours are generally hospitable with most working a standard 9-5.

The role is also an excellent balance of earnings potential and job security. In the UK, a standard salary is between £50K and £60K while in the US, you’re looking at a minimum of $100,000.

If there’s a downside then it’s the downside that comes with all IT jobs. You never stop learning. Technology is always changing and a cybersecurity expert in particular has to be aware of that, keeping their knowledge up to date. It’s not uncommon for really successful pen testers to put in plenty of extra hours on top of that 9-5 with personal side projects in order to keep their knowledge current and up-to-date.