Penetration Testers
Evaluate network system security by conducting simulated internal and external cyberattacks using adversary tools and techniques. Attempt to breach and exploit critical systems and gain access to sensitive information to assess system security.
- O*NET-SOC code
15-1299.04 - Preparation Job Zone Four: Considerable Preparation Needed
Wages
BLS doesn't publish wages for Penetration Testers separately. These are the figures for Computer Occupations, All Other (15-1299), its parent occupation.
| 10th | 25th | Median | 75th | 90th |
|---|---|---|---|---|
| $55,940 | $79,370 | $116,580 | $157,500 | $188,470 |
By state (51)
| State | Employment | Median annual | Location quotient |
|---|---|---|---|
| Alabama | 2,630 | $106,330 | 0.44 |
| Alaska | 710 | $105,960 | 0.78 |
| Arizona | 5,510 | $105,240 | 0.61 |
| Arkansas | 1,120 | $86,940 | 0.31 |
| California | 80,150 | $134,440 | 1.57 |
| Colorado | 11,800 | $139,580 | 1.47 |
| Connecticut | 3,100 | $127,720 | 0.65 |
| Delaware | 860 | $137,470 | 0.63 |
| District of Columbia | 17,200 | $156,590 | 8.75 |
| Florida | 13,710 | $105,370 | 0.49 |
| Georgia | 20,630 | $104,610 | 1.51 |
| Hawaii | 2,080 | $120,100 | 1.18 |
| Idaho | 1,040 | $98,700 | 0.43 |
| Illinois | 11,160 | $99,360 | 0.65 |
| Indiana | 3,340 | $93,540 | 0.37 |
| Iowa | 3,850 | $107,340 | 0.88 |
| Kansas | 1,340 | $103,380 | 0.33 |
| Kentucky | 1,850 | $89,420 | 0.33 |
| Louisiana | 5,020 | $77,000 | 0.93 |
| Maine | 900 | $107,990 | 0.50 |
| Maryland | 19,060 | $144,680 | 2.46 |
| Massachusetts | 6,170 | $109,590 | 0.61 |
| Michigan | 7,440 | $105,680 | 0.60 |
| Minnesota | 4,180 | $91,750 | 0.51 |
| Mississippi | 1,450 | $86,940 | 0.45 |
| Missouri | 14,340 | $101,040 | 1.74 |
| Montana | 540 | $81,970 | 0.38 |
| Nebraska | 2,280 | $92,480 | 0.79 |
| Nevada | 2,610 | $100,220 | 0.60 |
| New Hampshire | 970 | $91,720 | 0.51 |
| New Jersey | 12,010 | $108,310 | 1.00 |
| New Mexico | 1,650 | $127,090 | 0.67 |
| New York | 11,460 | $116,990 | 0.42 |
| North Carolina | 15,090 | $104,850 | 1.09 |
| North Dakota | 730 | $78,330 | 0.60 |
| Ohio | 6,150 | $109,780 | 0.40 |
| Oklahoma | 3,320 | $102,520 | 0.69 |
| Oregon | 2,450 | $97,350 | 0.45 |
| Pennsylvania | 14,580 | $107,230 | 0.86 |
| Rhode Island | 830 | $102,210 | 0.59 |
| South Carolina | 4,300 | $112,260 | 0.67 |
| South Dakota | 240 | $105,370 | 0.18 |
| Tennessee | 10,930 | $76,470 | 1.19 |
| Texas | 57,020 | $111,530 | 1.45 |
| Utah | 6,680 | $97,470 | 1.37 |
| Vermont | 1,320 | $111,530 | 1.56 |
| Virginia | 17,000 | $139,030 | 1.48 |
| Washington | 14,360 | $128,940 | 1.44 |
| West Virginia | 3,380 | $107,140 | 1.72 |
| Wisconsin | 4,680 | $88,130 | 0.57 |
| Wyoming | 170 | $94,520 | 0.22 |
Similar occupations
Similarity is our measure: the cosine of importance x level over all 120 O*NET skills, knowledge areas and abilities. It is not an O*NET finding. More.
Circles are the 20 most similar occupations, coloured by Job Zone. Lines join pairs where one is among the other's 10 most similar; darker lines are pairs O*NET also lists as related. Drag a circle to move it out of the way; select one to open it.
| # | Occupation | Job Zone | Similarity |
|---|---|---|---|
| 1 | Information Security Analysts | 4 | 0.973 |
| 2 | Database Administrators | 4 | 0.965 |
| 3 | Information Security Engineers | 4 | 0.963 |
| 4 | Computer Network Architects | 4 | 0.962 |
| 5 | Blockchain Engineers | 4 | 0.959 |
| 6 | Computer Systems Engineers/Architects | 3 | 0.959 |
| 7 | Digital Forensics Analysts | 4 | 0.959 |
| 8 | Web Administrators | 4 | 0.949 |
| 9 | Database Architects | 4 | 0.944 |
| 10 | Software Quality Assurance Analysts and Testers | 4 | 0.943 |
One skill away
Among the 50 occupations most similar to Penetration Testers, those at the same Job Zone or lower, where exactly one skill rated at least 3 in importance needs a level more than 0.75 points higher (on O*NET's 0-7 level scale). Our definition. Change the thresholds.
| Occupation | Skill to build | Level gap | Similarity |
|---|---|---|---|
| Information Security Analysts | Operations Monitoring | 1.00 | 0.973 |
| Blockchain Engineers | Operations Analysis | 3.00 | 0.959 |
| Web Administrators | Instructing | 1.00 | 0.949 |
| Software Quality Assurance Analysts and Testers | Operations Analysis | 3.38 | 0.943 |
| Computer Network Support Specialists | Operations Monitoring | 1.00 | 0.937 |
| Radio Frequency Identification Device Specialists | Instructing | 0.88 | 0.933 |
| Software Developers | Technology Design | 2.50 | 0.932 |
| Web Developers | Operations Analysis | 4.00 | 0.932 |
| Business Intelligence Analysts | Mathematics | 1.13 | 0.929 |
| Telecommunications Engineering Specialists | Operations Monitoring | 0.88 | 0.918 |
Software to learn next
Software used by at least 3 of the 20 occupations most similar to Penetration Testers, excluding software Penetration Testers already lists and any you named. Ranked by how many of them use it, weighted by how much more common it is among them than across all occupations (lift). Our ranking.
| Software | Similar jobs using it | Lift |
|---|---|---|
| Apache Tomcat | 13 of 20 | 26.1x |
| Unified modeling language UML | 13 of 20 | 24.0x |
| Red Hat Enterprise Linux | 13 of 20 | 23.1x |
| Amazon Web Services AWS CloudFormation | 12 of 20 | 29.1x |
| Microsoft Windows Server | 13 of 20 | 22.2x |
| MongoDB | 13 of 20 | 22.2x |
| Oracle Solaris | 13 of 20 | 21.4x |
| KornShell | 12 of 20 | 26.4x |
| LAMP Stack | 12 of 20 | 26.4x |
| NoSQL | 13 of 20 | 20.0x |
Skills
From O*NET data. Importance is rated 1 to 5 and level 0 to 7.
| Skill | Type | Importance | Level |
|---|---|---|---|
| Critical Thinking | Essential skill | 4.38 | 4.38 |
| Reading Comprehension | Essential skill | 4.00 | 4.50 |
| Writing | Essential skill | 4.00 | 4.12 |
| Programming | Transferable skill | 3.88 | 4.12 |
| Active Listening | Essential skill | 3.88 | 4.00 |
| Complex Problem Solving | Transferable skill | 3.88 | 3.88 |
| Active Learning | Essential skill | 3.62 | 4.12 |
| Systems Evaluation | Transferable skill | 3.62 | 4.12 |
| Judgment and Decision Making | Transferable skill | 3.50 | 4.12 |
| Monitoring | Essential skill | 3.50 | 3.88 |
| Systems Analysis | Transferable skill | 3.50 | 3.75 |
| Speaking | Essential skill | 3.38 | 3.88 |
| Quality Control Analysis | Transferable skill | 3.12 | 3.38 |
| Time Management | Transferable skill | 3.00 | 3.00 |
| Learning Strategies | Essential skill | 2.88 | 3.38 |
| Coordination | Transferable skill | 2.88 | 3.00 |
| Persuasion | Transferable skill | 2.75 | 3.00 |
| Social Perceptiveness | Transferable skill | 2.75 | 3.00 |
| Instructing | Transferable skill | 2.62 | 2.62 |
| Service Orientation | Transferable skill | 2.62 | 2.62 |
| Mathematics | Essential skill | 2.50 | 2.75 |
| Troubleshooting | Transferable skill | 2.38 | 2.38 |
| Operations Monitoring | Transferable skill | 2.38 | 2.12 |
| Negotiation | Transferable skill | 2.25 | 2.38 |
| Operations Analysis | Transferable skill | 2.12 | not rated |
| Management of Personnel Resources | Transferable skill | 2.00 | 2.00 |
| Technology Design | Transferable skill | 1.88 | 1.12 |
| Equipment Maintenance | Transferable skill | 1.75 | 1.00 |
| Repairing | Transferable skill | 1.62 | 1.00 |
| Equipment Selection | Transferable skill | 1.62 | 0.75 |
| Science | Essential skill | 1.50 | not rated |
| Management of Financial Resources | Transferable skill | 1.38 | 0.50 |
| Management of Material Resources | Transferable skill | 1.25 | not rated |
| Operation and Control | Transferable skill | 1.25 | not rated |
| Installation | Transferable skill | 1.00 | not rated |
Knowledge (33) and abilities (52)
| Name | Importance | Level |
|---|---|---|
| Computers and Electronics | 4.95 | 6.55 |
| Telecommunications | 4.15 | 5.20 |
| Engineering and Technology | 3.95 | 5.10 |
| English Language | 3.80 | 4.20 |
| Customer and Personal Service | 3.75 | 4.25 |
| Law and Government | 3.40 | 3.60 |
| Education and Training | 3.20 | 4.35 |
| Administration and Management | 3.15 | 3.85 |
| Public Safety and Security | 3.11 | 3.60 |
| Communications and Media | 3.10 | 3.25 |
| Administrative | 3.05 | 4.40 |
| Mathematics | 3.05 | 3.95 |
| Psychology | 2.85 | 3.60 |
| Design | 2.70 | 3.60 |
| Sales and Marketing | 2.05 | 2.15 |
| Production and Processing | 2.05 | 2.10 |
| Sociology and Anthropology | 2.05 | 1.85 |
| Personnel and Human Resources | 2.05 | 1.80 |
| Economics and Accounting | 1.85 | 1.30 |
| Foreign Language | 1.75 | 1.35 |
| Mechanical | 1.75 | 1.10 |
| Philosophy and Theology | 1.50 | not rated |
| Geography | 1.50 | 1.25 |
| Physics | 1.45 | 0.85 |
| History and Archeology | 1.35 | 0.55 |
| Transportation | 1.30 | 0.60 |
| Building and Construction | 1.20 | not rated |
| Biology | 1.15 | not rated |
| Chemistry | 1.15 | not rated |
| Medicine and Dentistry | 1.10 | not rated |
| Therapy and Counseling | 1.10 | not rated |
| Fine Arts | 1.00 | not rated |
| Food Production | 1.00 | not rated |
| Name | Importance | Level |
|---|---|---|
| Inductive Reasoning | 4.38 | 4.50 |
| Written Expression | 4.25 | 4.38 |
| Deductive Reasoning | 4.12 | 4.62 |
| Problem Sensitivity | 4.12 | 4.38 |
| Oral Comprehension | 4.00 | 4.62 |
| Written Comprehension | 4.00 | 4.50 |
| Oral Expression | 3.88 | 4.50 |
| Fluency of Ideas | 3.88 | 4.12 |
| Information Ordering | 3.88 | 4.00 |
| Near Vision | 3.75 | 3.75 |
| Originality | 3.62 | 4.00 |
| Category Flexibility | 3.62 | 3.75 |
| Speech Clarity | 3.38 | 3.12 |
| Selective Attention | 3.12 | 3.12 |
| Speech Recognition | 3.00 | 3.00 |
| Speed of Closure | 2.88 | 3.25 |
| Flexibility of Closure | 2.88 | 3.00 |
| Perceptual Speed | 2.88 | 2.88 |
| Mathematical Reasoning | 2.62 | 3.00 |
| Number Facility | 2.50 | 2.75 |
| Far Vision | 2.38 | 2.38 |
| Visualization | 2.38 | 2.38 |
| Memorization | 2.12 | 2.12 |
| Time Sharing | 2.12 | 2.12 |
| Trunk Strength | 2.12 | 1.62 |
| Wrist-Finger Speed | 2.12 | 1.50 |
| Auditory Attention | 2.00 | 1.50 |
| Finger Dexterity | 1.88 | 1.25 |
| Arm-Hand Steadiness | 1.88 | 1.12 |
| Visual Color Discrimination | 1.75 | 1.50 |
| Manual Dexterity | 1.75 | 1.12 |
| Control Precision | 1.75 | 1.00 |
| Hearing Sensitivity | 1.62 | 1.25 |
| Depth Perception | 1.62 | 0.88 |
| Dynamic Strength | 1.50 | 0.50 |
| Peripheral Vision | 1.38 | not rated |
| Extent Flexibility | 1.38 | 0.50 |
| Dynamic Flexibility | 1.25 | not rated |
| Night Vision | 1.25 | not rated |
| Sound Localization | 1.25 | not rated |
| Spatial Orientation | 1.25 | not rated |
| Explosive Strength | 1.00 | not rated |
| Glare Sensitivity | 1.00 | not rated |
| Gross Body Coordination | 1.00 | not rated |
| Gross Body Equilibrium | 1.00 | not rated |
| Multilimb Coordination | 1.00 | not rated |
| Rate Control | 1.00 | not rated |
| Reaction Time | 1.00 | not rated |
| Response Orientation | 1.00 | not rated |
| Speed of Limb Movement | 1.00 | not rated |
| Stamina | 1.00 | not rated |
| Static Strength | 1.00 | not rated |
Software used
Examples from O*NET data. "Hot" and "in demand" are O*NET flags for technologies often listed in job postings.
- Amazon Web Services AWS software in demand
- Bash in demand
- C in demand
- C# in demand
- C++ in demand
- JavaScript in demand
- Linux in demand
- Microsoft Active Directory in demand
- Microsoft Azure software in demand
- Microsoft PowerShell in demand
- Oracle Java in demand
- Python in demand
- Splunk Enterprise in demand
- UNIX in demand
- Firewall software in demand
- Kali Linux in demand
- MITRE ATT&CK software in demand
- Metasploit in demand
- Nmap in demand
- Portswigger BurP Suite in demand
- Qualys Cloud Platform in demand
- Tenable Nessus in demand
- Ansible software hot
- Apple iOS hot
- Apple macOS hot
- Docker hot
- GitHub hot
- Go hot
- Google Android hot
- IBM Terraform hot
All 67
- Kubernetes hot
- Microsoft Active Server Pages ASP hot
- Microsoft Excel hot
- Microsoft Office software hot
- Microsoft SQL Server hot
- Oracle Java 2 Platform Enterprise Edition J2EE hot
- PHP hot
- Perl hot
- Ruby hot
- ServiceNow hot
- Shell script hot
- Structured query language SQL hot
- Database management systems
- Ghidra
- Google Cloud software
- HP WebInspect
- Hex-Rays IDA Pro
- IBM Middleware
- IBM QRadar SIEM
- Invicti Acunetix
- Magellan Firmware
- Management information systems MIS
- Microsoft Azure DevOps Services
- Microsoft Visual Basic Scripting Edition VBScript
- Objective C
- RESTful API
- Rapid7 Nexpose
- Rapid7 software
- Rust programming language
- Security assertion markup language SAML
- Software development tools
- Software libraries
- System testing software
- Vector 35 Binary Ninja
- Web application software
- Web server software
- Wireshark
Where it concentrates
BLS doesn't publish wages for Penetration Testers separately. These are the figures for Computer Occupations, All Other (15-1299), its parent occupation.
Metro areas ranked by BLS location quotient: the occupation's share of the area's jobs divided by its share of all US jobs. Above 1 means more concentrated than the nation. Metros employing fewer than 100 are left out.
| Metro area | Employment | Location quotient | Median annual |
|---|---|---|---|
| Sierra Vista-Douglas, AZ | 500 | 5.29 | $118,120 |
| San Jose-Sunnyvale-Santa Clara, CA | 16,680 | 5.25 | $184,430 |
| Lexington Park, MD | 1,000 | 5.05 | $144,680 |
| Parkersburg-Vienna, WV | 350 | 3.46 | $106,330 |
| Warner Robins, GA | 690 | 3.26 | $100,260 |
| Elizabethtown, KY | 450 | 3.14 | $106,330 |
| Austin-Round Rock-San Marcos, TX | 10,100 | 2.79 | $129,470 |
| Fayetteville, NC | 970 | 2.65 | $101,800 |
| San Francisco-Oakland-Fremont, CA | 16,930 | 2.55 | $161,700 |
| Burlington-South Burlington, VT | 840 | 2.51 | $121,850 |