How to Become a Penetration Tester in the UK
Penetration testers are paid to break into systems legally, with written permission, so organisations can fix weaknesses before criminals find them. A typical engagement might involve testing a web application, an internal network or a cloud environment, finding and exploiting vulnerabilities, then writing a clear report explaining the risk and how to fix it. Report writing takes up a large part of the job.
Most testers come from IT support, networking, software development or a cybersecurity analyst role, and prove their skills with hands-on labs and respected certifications rather than a specific degree.
Quick facts
- Starting salary
- £30,000 - £45,000
- Mid-career salary
- £50,000 - £80,000
- Senior salary
- £85,000 - £130,000+
- Work environment
- Office, remote, or client-site engagements
- Time to entry
- 1 - 3 years (often via certifications + home lab)
- Degree required
- Not required - OSCP and similar certs matter most
- Category
- Technology
Compare pay across careers in the UK salaries by career report. Also in: High-paying careers, No-degree careers, Creative careers, Stable careers, Career change.
What a Penetration Tester does
Get paid to legally hack into systems and find vulnerabilities before criminals do.
- Web App Pen Tester - Find bugs in web applications and APIs.
- Red Team Operator - Simulate full attacker campaigns against an organisation.
How to become a penetration tester in the UK
No degree is required, though a computing or cyber security degree helps. Employers care most about practical skill and certifications. In the UK, CREST qualifications are widely recognised: the CREST Practitioner Security Analyst (CPSA) is a common first step and the CREST Registered Penetration Tester (CRT) a common next one. OffSec's OSCP is highly respected for hands-on ability, and The Cyber Scheme offers alternative exams. Testing government systems under the NCSC's CHECK scheme usually needs security clearance. The Level 4 Cyber security technologist apprenticeship is another route. Only ever test systems with written authorisation, or you risk breaking the Computer Misuse Act 1990.
- Learn networking, Linux and Windows fundamentals, including how Active Directory works, as most internal infrastructure tests depend on them.
- Practise legally on deliberately vulnerable labs such as Hack The Box or TryHackMe, writing up each machine you compromise as a short report.
- Learn a scripting language such as Python or Bash so you can automate tasks, adapt exploits and parse tool output.
- Study web application security using the OWASP Top 10, and practise with tools such as Burp Suite against intentionally vulnerable apps.
- Take the CREST CPSA as an entry credential, then work towards the OSCP or CREST CRT to show hands-on testing ability.
- If you need a foothold, get an IT support, SOC or junior security role first, then apply for junior penetration tester roles at security consultancies.
- Practise report writing, as clients judge your work on clear findings, accurate risk ratings and fixes their developers can follow.
| Route | How long | Cost | Best for |
|---|---|---|---|
| Self-study, home lab and certifications | 1-3 years | Exam fees, varies by certification | Self-motivated career changers |
| IT support or SOC role, then pen testing | 1-3 years | Certs often employer-funded | People who need a salary while learning |
| Level 4 Cyber security technologist apprenticeship | About 2 years | Paid by the employer | School leavers |
| Computing or cyber security degree | 3 years | Tuition fee loan | Graduate security schemes |
How long it takes
Expect 1 to 3 years to land your first penetration testing role, depending on your starting point. People already working in IT or as a SOC analyst who study consistently and earn a hands-on certification can often move across in about a year.
Penetration Tester salary in the UK
Junior penetration testers in the UK typically start on around £30,000 to £45,000. With a few years' experience and certifications such as OSCP or CREST CRT, pay rises to around £50,000 to £80,000, and senior testers, team leads and red team operators earn around £85,000 to £130,000 or more. Security clearance, CHECK status and London consultancy roles push pay up. Experienced testers can also work as self-employed contractors on day rates, which pays well but means finding your own work.
Key skills
- Networking
- Linux
- Web app security
- Scripting (Python, Bash)
- Report writing
Penetration Tester FAQs
How do I become a penetration tester in the UK?
Learn networking, Linux, Windows and web application security, practise on legal labs such as Hack The Box or TryHackMe, and earn certifications such as CREST CPSA and OSCP. Many testers start in IT support or a SOC before moving into a junior role at a security consultancy.
Do I need a degree to be a penetration tester?
No. Many penetration testers have no degree. Employers focus on practical skill, certifications such as CREST and OSCP, and clear report writing. A computing degree or cyber security apprenticeship can help you get noticed for graduate schemes.
How much does a penetration tester earn in the UK?
Junior testers usually earn £30,000 to £45,000. Experienced testers earn around £50,000 to £80,000, and senior testers or red team operators £85,000 to £130,000 or more. Security clearance and CHECK status raise pay.
Is penetration testing legal?
Yes, when you have written authorisation from the system owner that defines exactly what you may test. Accessing systems without permission is an offence under the Computer Misuse Act 1990, even if you mean well, so only practise on your own systems or legal training labs.
Related careers
Is Penetration Tester right for you?
Career Compass ranks careers from your interests and priorities and explains every suggestion, with UK routes and trade-offs. See how well Penetration Tester actually fits you. £19.99 once, full report included.
Comparing penetration tester with other careers? A career quiz gives you a type; a proper assessment gives you reasons, routes and trade-offs.