Learn/Penetration Testing & Red Team

Face the attacker

Penetration Testing & Red Team

Break into systems with written permission, then show the owners exactly how and what to fix.

Entry barrier: HighFirst role: 2 to 3 years, often via IT or the SOC$169k–$320k/yrtypical now

Looking for the salary side? Pay, the employers hiring and open offensive security roles, together on one page.

The job, briefly

Offensive security professionals attack systems the way a real adversary would, under a signed scope and rules of engagement. Penetration testers assess a defined target (a web application, a network, a cloud environment, a device) over days or weeks and report every weakness found. Red teams run longer operations that emulate a specific threat end to end, testing whether defenders notice. Vulnerability researchers and exploit developers go deeper still, finding new flaws in software and hardware.

Day to day

Agree the scope with the client: what is in bounds, what is off limits, testing windows and emergency contacts
Map the attack surface with reconnaissance and scanning, then test by hand for what scanners miss
Exploit weaknesses and chain them to show real impact, such as moving from one web bug to a database or from a phished laptop to domain admin
Keep careful notes and evidence of every step so findings can be reproduced and the client can confirm nothing was left behind
Write the report: an executive summary, then each finding with its risk, reproduction steps and a practical fix
Walk the client's engineers through the results and retest their fixes

Worked examples

Go from a domain user to domain admin on an internal test

An internal network test starts with one ordinary domain account. BloodHound shows a service account with a weak password, reachable through Kerberoasting, that has local admin rights on a server where a domain administrator is signed in. You crack the ticket offline, move to the server, extract the administrator's credentials and demonstrate control of the domain. The report lists each link in the chain with its own fix, so breaking any one of them closes the path.

Write up a web application finding

On a customer portal, changing the numeric order ID in a request returns other customers' orders, addresses included. You record the request and response, show three examples using test accounts the client set up, rate it high severity because personal data is exposed and recommend a server-side ownership check plus identifiers that cannot be guessed. You also list the other endpoints that follow the same pattern, so developers fix the class rather than one instance.

Run a phishing-led red team operation

The objective is to reach the source code of the company's payments service without being stopped. You stand up infrastructure that looks legitimate, phish a small agreed group of employees, gain a foothold on one laptop, stay under the EDR by using built-in tools and work toward the target over two weeks. Afterwards you sit with the blue team and replay the timeline: which actions they caught, which they missed and which detections would have stopped you.

Who does well here

Offensive security suits people with deep curiosity about how systems work and a habit of asking what happens if they do the unexpected. Most testers come from system administration, networking, development or a SOC, and spent years practising on labs and capture-the-flag challenges in their own time. Writing matters more than outsiders expect: the report is what the client pays for, so testers who explain findings clearly move up faster.

Signs it suits you

You have spent evenings on Hack The Box, TryHackMe or CTF challenges because you enjoy them
You keep trying new angles after the obvious ones fail
You can write a precise report on something technical for both engineers and executives
You respect boundaries strictly, since written authorization is the only thing separating this job from a crime

Requirements

Strong foundations in networking, Windows and Active Directory, Linux and web technologies
Scripting (Python, Bash, PowerShell) to adapt tools and automate steps
For most consulting roles, a recognized hands-on certification such as OSCP, PNPT or CRTO plus evidence of practical work; some government roles add a clearance

Useful skills

Active Directory attacksWeb application testing (Burp Suite)Network exploitationScripting and tool developmentReport writingCommand-and-control frameworks

A route in

1Build the foundations first: networking, Linux, Windows administration and how web applications work; time in IT or a SOC is a common launch pad
2Practise every week on Hack The Box, TryHackMe, PortSwigger's Web Security Academy and OffSec's Proving Grounds
3Earn a practical certification: eJPT or PNPT as a first step, OSCP as the long-standing benchmark employers recognize, CRTO if red teaming is the goal
4Write up retired lab machines or CTF challenges in a blog or repository to show how you think and how you write
5Report real vulnerabilities through bug bounty programs or responsible disclosure, staying strictly inside each program's scope
6Apply for junior penetration tester roles at consultancies, internal red teams at large companies, and vulnerability management or AppSec roles that lead toward testing

Myths and reality

Myth: Pentesting is hacking all day with no paperwork.

Reality: Scoping, note-taking and report writing take a large share of every engagement. A brilliant exploit that is badly documented is worth little to the client.

Myth: It is an entry-level way into security.

Reality: True junior pentesting roles are scarce, and most people who land one already had IT, development or SOC experience plus a hands-on certification. Expect to build that base first.

Myth: Red teaming is just a bigger penetration test.

Reality: A pentest tries to find as many weaknesses as it can within a scope. A red team pursues one objective while staying hidden, to test detection and response. Different goals, different skills and a much closer debrief with the defenders afterwards.

Salary

Salary ranges on open offensive security roles currently center on $169k–$320k/yr. The median sits at $200000, measured over the 41 openings that publish a range.

Salaries, employers and open offensive security roles Every kind of security work, side by side →

Questions career changers ask

Is OSCP still worth it?

For consulting penetration testing roles it remains a credential hiring managers recognize at once, because the exam is long and hands-on rather than multiple choice. It is not the only route: PNPT and CRTO are respected, and a strong portfolio of write-ups, CVEs or bounty findings can carry as much weight. Check what the postings you want ask for on the offensive security roles page.

Is penetration testing legal?

Only with explicit written authorization from someone entitled to give it, inside an agreed scope. Testing systems you do not own or have permission for is a crime in most countries, good intentions or not. Professional testers keep their authorization letter at hand and stop the moment something falls outside it.

How much of the job is travel or on-site work?

Less than it used to be. Most web, cloud and external tests run remotely, and many internal tests use a small device or virtual machine the client places on its network. Physical security assessments and some red team work still involve travel.

What is the difference between a pentester and a vulnerability researcher?

A pentester assesses a client's environment with known techniques inside a time box. A vulnerability researcher looks for flaws nobody has found yet in software or hardware, often by reverse engineering it, and may write exploits or work with vendors on fixes. Research roles sit at security vendors and specialized teams, close to threat intelligence and research.