Penetration Tester (or Pen Tester): Career Outlook & Education Requirements

Can you imagine getting paid to break into someone’s house? Penetration testers are cybersecurity professionals launching planned computer systems attacks to identify and assess security vulnerabilities. These ethical hackers are the secret service, club bouncers, and counterintelligence agents in the network security industry.

Known by many titles such as “pen testers,” information security analysts, and software developers, these positions have shared goals to protect privacy, eliminate threats, and prevent information theft. Corporations and government agencies such as the US Department of Homeland Security are prioritizing information security to maintain democracy, avoid litigation, prevent the spread of misinformation through disinfodemics, and keep supply chains resilient.

As proof of point, in 2022, the US News & World Report ranked information security analysts number one on three lists: best jobs, best STEM jobs, and best technology jobs. Notably, these positions are known for their growth potential, strong occupational outlook, and high salary while ranking low on stress overall. The Bureau of Labor Statistics (BLS 2022) shows the top three working environments for information security analysts are computer systems design services, finance and insurance, and information industries.

Not all combat heroes wear camouflage. Penetration testers protect our nation’s computer systems using a keyboard and computer science credentials. Read on to learn more about the career outlook, salary, educational programs, and certifications to become a pen tester.

Job Outlook & Salary of Pen Testers (Information Security Analysts)

Internet-based crimes are rising, and so is the demand for highly-qualified information security professionals. The FBI’s Internet Crimes Complaint Center (IC3) shows a record number of Americans filed complaints in 2021, ranging from ransomware to business email compromise schemes. This represents a 7 percent increase compared to 2020, with potential losses calculated at more than 6.9 billion US dollars.

The BLS data confirms these trends, showing that information security analyst careers, an occupation similar to pen testers, are highly in-demand. From 2021 to 2031, the BLS (2022) shows information security analyst jobs will grow by 35 percent. This is seven times the national average (5 percent), and will create an estimated 56,500 new jobs in the same decade.

As stated, the BLS doesn’t track salary data for penetration testers but shows the median annual wage for information security analysts is $102,600 per year (BLS 2022). However, PayScale (2022), an aggregator of self-reported salary data, shows penetration testers, on average, earn $88,376 per year, based on 408 reported salaries. This figure doesn’t include bonuses and profit-sharing, which can add $705 to $20,000 more to an annual salary. Self-reported annual salary percentiles are as follows:

• Entry-level (less than one year of experience): $70,000
• Mid-career (5-9 years): $106,000
• Experienced (10-19 years): $118,884

A key factor that affects salaries is the cost of living. The Missouri Economic Research and Information Center (MERIC) provides a cost of living data series that parses out each state’s housing, grocery, and utility costs and ranks them in terms of affordability. For example, MERIC shows that Mississippi is the most affordable state in the nation, while Hawaii is the most expensive. When considering salary offers, cost of living data helps determine a fair offer in the context of one’s place of residence.

Another significant factor to consider when job searching is which states employ the highest numbers of pen testers. Here are the top five employing states for information security analysts (BLS May 2021):

• Virginia: 16,930 information security analysts employed
• Texas: 13,530
• Florida: 9,360
• New York: 7,500
• Maryland: 7,330

As for metropolitan areas, the BLS shows the following five cities employ the most information security analysts:

• Washington-Arlington-Alexandria, DC-VA-MD-WV: 15,690 employed
• New York-Newark, Jersey City, NY-NJ-PA: 10,250
• Dallas-Fort Worth-Arlington, TX: 5,400
• Baltimore-Columbia-Towson, MD: 4,050
• Atlanta-Sandy Springs-Roswell, GA: 4,020

Interestingly, two of the top-employing states also pay the highest wages: New York and Maryland, meaning job prospects and compensation opportunities are high in these states. Iowa is the fifth most affordable state in the nation (MERIC September 2022) and the fourth-highest state for information security analysts, meaning those living and working in Iowa can statistically stretch their dollars the furthest.

Here are the top-paying states for information security analysts and their annual mean wages (BLS May 2021):

• California: $135,200 per year
• New York: $133,210
• Maryland: $126,650
• Iowa: $125,650
• District of Columbia: $124,980

The metropolitan areas with the highest salaries according to the BLS are as follows:

• San Jose-Sunnyvale-Santa Clara, CA: $150,820 average annual salary
• San Francisco-Oakland-Hayward, CA: $149,250
• Des Moines-West Des Moines, IA: $135,080
• New York-Newark-Jersey City, NY, NJ, PA: $134,390
• Idaho Falls, ID: $134,100

In short, becoming a penetration tester or information security analyst is a lucrative career that pays nearly double the national average salary for all occupations: $58,260 (BLS May 2021). The highest concentration of jobs and top salaries are located in east or west coast states and a few inland states.

To learn how to pursue this career, read a step-by-step guide to becoming a penetration tester.