Penetration testers recruiting
Penetration testers find the weaknesses before an adversary does: in web applications, networks, cloud environments, wireless systems and, on some programs, the physical and human controls around them.
Recruiters Workforce recruits testers and red team operators for cyber commands, defense contractors' assessment teams, civilian agency programs and commercial security firms.
What penetration testers do
A tester scopes an engagement with the program or client, performs reconnaissance, exploits vulnerabilities within the agreed rules of engagement, documents findings with evidence and risk ratings, and presents remediation to the engineers who own the systems. Red team operators run longer adversary emulation campaigns against detection and response. On federal programs the work supports security control assessments and authorizations, and on defense programs it may extend to weapon systems, industrial control systems and embedded platforms.
Requisitions name the target types, the tooling, and whether the tester will work inside a classified environment. They also name the reporting standard, because a program office wants findings mapped to the controls it is accountable for.
Certifications commonly requested
Offensive security requisitions name hands-on credentials, and the issuing bodies describe them as follows.
- OffSec OSCP and OSCP+
- OffSec's PEN-200 course leads to both credentials through a 24-hour proctored exam; OffSec recommends TCP/IP networking knowledge, Windows and Linux administration experience and basic Bash or Python scripting. The credential most often named for hands-on testers.
- CompTIA PenTest+
- CompTIA's penetration testing certification, at version V3, exam code PT0-003, validating the ability to identify, mitigate and report system vulnerabilities. Named on Department of Defense requisitions.
- GIAC Penetration Tester
- One proctored exam of 82 questions in three hours with a minimum passing score of 73 percent; no formal prerequisites are listed.
- EC-Council Certified Ethical Hacker
- At version 13, with no formal prerequisites; EC-Council recommends a minimum of two years of IT security experience before attempting it. Named on many federal requisitions as an acceptable baseline.
- CompTIA Security+
- Requested alongside a hands-on credential on Department of Defense programs where the tester holds privileged access. Current version V7.
Clearance levels commonly required
Testing of unclassified federal systems requires Public Trust or Secret depending on the agency, and testing of classified systems requires the system's clearance, up to TS/SCI with a polygraph at the cyber and cryptologic commands. Commercial testing firms hire without a clearance requirement, and their testers are the usual candidates for contractors willing to sponsor an investigation. Because the tester's work product is sensitive, the submittal records any prior investigation and the candidate's willingness to work on site.
Engagement models that fit
Assessment work is project-based, which suits contract staffing for defined engagements and contract-to-hire for testers joining a standing team. Direct hire fits red teams and assessment practices with approved headcount, and retained search fits red team leads and heads of offensive security. The engagement models page compares them.
Industries that hire penetration testers
Markets where penetration testers are in demand
Questions about recruiting penetration testers
Which credential carries the most weight on a penetration testing requisition?
The OSCP, because its 24-hour practical exam is the closest proxy for the work, followed by the GIAC Penetration Tester credential. Department of Defense contracts often accept PenTest+ or CEH as the baseline and add OSCP as preferred. The requisition summary should say which are required and which are preferred.
Are penetration testers hired remotely?
For commercial and unclassified federal assessments, often. For assessments of classified systems the work is on site in the accredited environment, and the requisition says so. Testers who will accept travel to client sites for on-site engagements are noted as such on the submittal.