A penetration tester in the United States typically earns between $85,000 and $200,000 a year. Indeed's September 2026 job-posting data puts the average base salary at $126,613, and the Bureau of Labor Statistics median for the broader information security analyst occupation is $129,180. Where you land inside that range depends far more on proven skill than on years served. Below: real numbers by level, what each source actually measures, and the levers that move your pay.
Still planning the route in? Our guide on how to become a penetration tester covers the steps; this page is about what the job pays once you are there. The fastest lever on pay is demonstrable, hands-on ability, which is why the practical work in our network penetration testing course maps directly to what hiring managers test in technical interviews. Build the skill, and the salary follows.
TL;DR - Penetration Tester Salary in 2026
Most US penetration testers earn $85,000 to $160,000 in base salary, and seniors and leads pass $150,000, reaching $200,000+ with bonuses. Indeed's average is $126,613 (September 2026) and the BLS median for the parent occupation is $129,180 (May 2025). A respected practical certification like the OSCP, a scarce specialization, a security clearance and a public portfolio move you up the range fastest.
How Much Does a Penetration Tester Make in 2026?
How much does a penetration tester make? The average penetration tester salary in the United States is $126,613 per year according to Indeed (270 job postings, updated September 2026), with most postings between about $83,000 and $194,000. Where you land depends on skill, certifications, location and industry.
That average sounds clean, but averages hide the story. The U.S. Bureau of Labor Statistics does not track "penetration tester" as its own occupation. It rolls the role into information security analysts, which reported a median wage of $129,180 in May 2025, with the top 10 percent earning more than $199,850. The occupation is projected to grow 21 percent from 2025 to 2035, much faster than the average for all jobs, with about 14,100 openings per year.
Here is a realistic snapshot of what the role pays at each stage in 2026:
| Experience Level | Typical Title | Salary Range (US) |
|---|---|---|
| Entry-Level (0-1 years) | Junior Penetration Tester, Associate Security Consultant | $85,000 - $110,000 |
| Early Career (1-3 years) | Penetration Tester, Security Consultant | $100,000 - $130,000 |
| Mid-Career (3-5 years) | Senior Penetration Tester, Red Team Operator | $125,000 - $160,000 |
| Senior (5-9 years) | Lead Pentester, Principal Consultant, Red Team Lead | $150,000 - $200,000 |
| Principal / Management (9+ years) | Offensive Security Manager, Director of Red Team | $180,000 - $250,000+ |
Numbers vary by source, mostly because of what gets counted. Indeed and BLS report base pay. Glassdoor reports total pay including bonuses and profit sharing, which is why Coursera's July 2026 summary of Glassdoor data shows a much higher $155,000 median. The ranges above are typical base salaries, synthesized from those sources. Treat any single "average" with suspicion: the range is what matters, and your job is to climb it.
Penetration Tester Salary by Experience Level
Experience is the axis most people fixate on, and it does matter, but not in a neat linear way. Pay jumps fastest in the first five years as you move from following a methodology to running engagements independently.
Entry-Level (0-1 years): $85,000 - $110,000
A junior penetration tester runs scoped tests under supervision, usually web application or external network assessments, and writes the first draft of findings. Many entry roles now ask for the OSCP or an equivalent practical credential. Glassdoor's total-pay median for 0-1 years of experience is about $117,000 (July 2026), but that includes bonuses and leans toward consulting firms; base offers for true juniors more often start between $85,000 and $100,000. Testers who arrive with a visible portfolio of solved challenges tend to start at the top of the band rather than the bottom.
Early to Mid-Career (1-5 years): $100,000 - $160,000
This is where the steepest raises happen. By year three you should be scoping your own engagements, chaining vulnerabilities into full attack paths, and briefing clients directly. Consultants at boutique offensive security firms often out-earn in-house testers at this stage because billable expertise commands a premium. Specializing here, in cloud, Active Directory, or mobile, pushes you toward the upper end faster than staying a generalist.
Senior and Principal (5+ years): $150,000 - $250,000+
Senior testers lead red team operations, mentor juniors and own client relationships. Glassdoor puts total pay for 7-9 years of experience around $168,000 (July 2026), and at firms where bonuses, on-target earnings and equity stack on top, the ceiling goes well beyond that. In practice, the testers I have seen clear $200,000 combine a hard specialization, a recognizable name in the community, and the ability to sell work, not just do it.
Reality check: The years-of-experience label is a proxy, not the cause. A tester with two years and a strong public track record of exploited machines and disclosed bugs will out-earn a five-year tester who only ever ran automated scans. Skill you can demonstrate beats time served.
What Actually Moves a Penetration Tester's Salary
Two testers with identical resumes can be tens of thousands of dollars apart. These are the factors that explain the gap, ranked by how much each one actually moves your number.
Certifications, Especially the OSCP
No credential carries more weight in offensive security hiring than the OSCP. It is one of the certifications pentest job ads name most often, and listings that require it sit toward the top of the pay bands. It is not cheap: OffSec's pricing is $1,749 for the 90-day course-and-exam bundle or $2,749 for a year of Learn One (September 2026), which the first raise it helps you land usually covers. If you are deciding where to spend your study time, start with our OSCP preparation guide. Beyond the OSCP, the CPTS, PNPT and later the OSEP signal depth that recruiters filter for. Our overview of cybersecurity certifications covers how they stack.
Specialization
Generalists get generalist pay. The testers commanding the top of the range have gone deep somewhere the market is short on talent: Active Directory and internal network attacks, cloud exploitation across AWS and Azure, mobile application testing, or hardware and embedded work. Web application testing is the most crowded specialty, which caps its ceiling. Pick a lane where supply is thin and demand is climbing.
Location and Remote Work
Testers in major tech hubs and the Washington, D.C. area have historically earned noticeably more than the national median. Remote work has softened that gap, since many firms now hire nationally and pay closer to a single band regardless of address. That is good news if you live somewhere affordable and bad news if your entire pitch was your zip code. Skill travels; location arbitrage is fading.
Industry and Security Clearance
Finance, defense contracting, and large tech pay the most. Government and defense work often requires a security clearance, and cleared testers command a durable premium because the candidate pool is small and slow to grow. If you can obtain a clearance, it is one of the few non-technical levers that reliably adds to your number for years.
How Pentester Pay Compares to Other Security Roles
Penetration testing sits near the top of the technical security pay scale, above most defensive analyst roles and roughly level with security engineering. Here is how the common paths compare in 2026 (approximate US base ranges from job-posting data, for orientation rather than negotiation):
- SOC Analyst (Tier 1-2): $65,000 - $95,000. The most common entry point into security, and a frequent stepping stone into offensive work.
- Penetration Tester: $90,000 - $150,000. Higher floor than defensive analyst roles because the barrier to entry (proven exploitation skill) is higher.
- Red Team Operator: $120,000 - $200,000+. Long-running, realistic adversary emulation against a whole organization. Usually a senior pentester progression.
- Security Engineer: $110,000 - $170,000. Builds and defends infrastructure. Comparable pay, different day-to-day.
- Bug Bounty Hunter: Highly variable. A few earn more than any salaried tester; most earn far less. Uncapped upside, zero floor.
The takeaway: offensive security pays well relative to its defensive counterparts, but the entry bar is steeper. You trade an easier start for a higher ceiling.
How to Increase Your Penetration Tester Salary
The advice that actually works is boring and effective: get demonstrably good, then prove it in public. Here is the order that produces raises.
- Build exploitation reps, not just theory. Reading about SQL injection does not pay. Exploiting a hundred varied machines does. Grind realistic targets until attack chains feel automatic.
- Earn a practical certification. The OSCP is the highest-return single purchase in this career. Time your attempt for when your hands-on skills are already sharp so you pass on the first try.
- Specialize deliberately. Pick Active Directory, cloud, or mobile and go deeper than your peers. Depth in a scarce area is what breaks you past the mid-career plateau.
- Publish your work. CTF writeups, disclosed bugs, and a tidy GitHub turn "trust me" into "look here." Visibility is what converts skill into offers.
- Negotiate with the range, not the average. You now know the bands. Anchor to the top of your level and let your portfolio justify it.
Every one of those steps starts with hands-on practice. The penetration testing careers module maps the path from first lab to first offer, and the labs give you the reps that make certifications and interviews feel routine. For the broader picture of the profession itself, our penetration testing guide covers what the day-to-day work actually involves.
Legal and Ethical Considerations
Critical reminder: A penetration tester's entire career rests on authorization. The same techniques that pay six figures under a signed contract are felonies without one. Always get explicit written permission before testing any system you do not own.
The salary exists because the work is trusted. Clients hand testers the keys to their networks on the strength of that trust, and a single unauthorized action ends careers and invites prosecution. Responsible testers work only within an agreed scope, follow responsible disclosure, protect anything sensitive they encounter, and refuse work that crosses legal lines. Build your skills exclusively in legal practice environments, then apply them only where you have written consent.
Penetration Tester Salary FAQ
Is penetration testing a well-paid career?
Yes. Most US penetration testers earn between $85,000 and $160,000 in base salary, and senior specialists exceed $200,000 in total pay. The BLS occupation that includes the role (information security analysts) reported a $129,180 median in May 2025 and is projected to grow 21 percent from 2025 to 2035.
How much does an entry-level penetration tester make?
Entry-level penetration testers in the U.S. usually start around $85,000 to $110,000 in base salary. Glassdoor's total-pay median for 0-1 years of experience is higher, about $117,000 (July 2026), because it includes bonuses. Candidates with the OSCP and a visible portfolio of solved challenges start at the higher end.
Does the OSCP increase your salary?
Usually, yes. The OSCP is one of the certifications pentest job ads name most often, and listings that require it sit toward the top of the pay bands. At $1,749 to $2,749 depending on the OffSec plan, it typically pays for itself with the first raise it helps you land.
Do penetration testers earn more than SOC analysts?
Generally yes. Penetration testers have a higher pay floor than Tier 1-2 SOC analysts ($65,000 to $95,000) because the entry bar (demonstrable exploitation skill) is steeper. Many testers begin in a SOC role and move into offensive work as their skills grow.
What raises a penetration tester's salary the fastest?
In order of impact: a practical certification like the OSCP, deep specialization in a scarce area (Active Directory, cloud, or mobile), a security clearance where applicable, and a public track record of solved challenges and disclosed vulnerabilities.
Your Next Steps
A penetration tester salary rewards proven ability more than any credential on paper. Entry-level testers start around $85,000 to $110,000, mid-career professionals reach $125,000 to $160,000, and the seniors past $200,000 got there by specializing hard and building a track record anyone could verify. The path up the range is the same at every level: get demonstrably good, then show it.
Last verified: September 2026. Figures checked against BLS (May 2025 data), Indeed (September 2026), Glassdoor via Coursera (July 2026) and OffSec's pricing page.
Ready to build the skills that justify the salary? Start with HackerDNA Labs and work real exploitation challenges in your browser, no setup and no credit card required. Every machine you solve is one more line on the portfolio that gets you to the top of the pay band. Your next raise starts with the next flag.
