{"v":"2026-11-02","dataVersion":"ONET-30.3+BLS-MAY25","code":"15-1299.04","slug":"penetration-testers","title":"Penetration Testers","alt":["Security Tester","Tester","Cyber Security Tester","Application Security Tester","Security Application Tester","Cyber Tester","Network Security Tester","Security Assessment Tester","Security Consulting Tester","IT Security Tester","Vulnerability Management Analyst","Certified Hacker"],"employment":435370,"wage":{"median":116580,"p25":79370,"p75":157500},"growthPct":8.2,"exposure":60,"taskCount":22,"highCount":13,"midCount":5,"lowCount":4,"aeiObserved":3,"fit":{"mix":{"none":0,"efficient":31.8,"standard":45.5,"frontier":22.7},"counts":{"none":0,"efficient":7,"standard":10,"frontier":5},"recommended":"frontier","coveragePct":100,"addressablePct":100},"tasks":[{"t":"Assess the physical security of servers, systems, or network devices to identify vulnerability to temperature, vandalism, or natural disasters.","imp":3,"exp":65,"src":"heuristic","tier":"standard","gwa":"Judging the Qualities of Objects, Services, or People"},{"t":"Collect stakeholder data to evaluate risk and to develop mitigation strategies.","imp":3,"exp":65,"src":"heuristic","tier":"standard","gwa":"Analyzing Data or Information"},{"t":"Conduct network and security system audits, using established criteria.","imp":3,"exp":40,"src":"aei","tier":"standard","gwa":"Analyzing Data or Information","auto":0.7734,"aug":0.2266},{"t":"Configure information systems to incorporate principles of least functionality and least access.","imp":3,"exp":75,"src":"heuristic","tier":"frontier","gwa":"Thinking Creatively","auto":0.5714,"aug":0.4286},{"t":"Design security solutions to address known device vulnerabilities.","imp":3,"exp":50,"src":"heuristic","tier":"frontier","gwa":"Developing Objectives and Strategies"},{"t":"Develop and execute tests that simulate the techniques of known cyber threat actors.","imp":3,"exp":50,"src":"heuristic","tier":"standard","gwa":"Inspecting Equipment, Structures, or Materials"},{"t":"Develop infiltration tests that exploit device vulnerabilities.","imp":3,"exp":50,"src":"heuristic","tier":"frontier","gwa":"Developing Objectives and Strategies"},{"t":"Develop presentations on threat intelligence.","imp":3,"exp":50,"src":"heuristic","tier":"efficient","gwa":"Documenting/Recording Information"},{"t":"Develop security penetration testing processes, such as wireless, data networks, and telecommunication security tests.","imp":3,"exp":50,"src":"heuristic","tier":"frontier","gwa":"Developing Objectives and Strategies"},{"t":"Discuss security solutions with information technology teams or management.","imp":3,"exp":75,"src":"heuristic","tier":"standard","gwa":"Communicating with Supervisors, Peers, or Subordinates"},{"t":"Document penetration test findings.","imp":3,"exp":40,"src":"aei","tier":"efficient","gwa":"Documenting/Recording Information","auto":0.6353,"aug":0.3647},{"t":"Evaluate vulnerability assessments of local computing environments, networks, infrastructures, or enclave boundaries.","imp":3,"exp":65,"src":"heuristic","tier":"standard","gwa":"Analyzing Data or Information"},{"t":"Gather cyber intelligence to identify vulnerabilities.","imp":3,"exp":75,"src":"heuristic","tier":"standard","gwa":"Getting Information","auto":0.8974,"aug":0.1026},{"t":"Identify new threat tactics, techniques, or procedures used by cyber threat actors.","imp":3,"exp":75,"src":"heuristic","tier":"efficient","gwa":"Getting Information"},{"t":"Identify security system weaknesses, using penetration tests.","imp":3,"exp":40,"src":"aei","tier":"standard","gwa":"Analyzing Data or Information","auto":0.831,"aug":0.169},{"t":"Investigate security incidents, using computer forensics, network forensics, root cause analysis, or malware analysis.","imp":3,"exp":75,"src":"heuristic","tier":"efficient","gwa":"Getting Information"},{"t":"Keep up with new penetration testing tools and methods.","imp":3,"exp":75,"src":"heuristic","tier":"standard","gwa":"Updating and Using Relevant Knowledge"},{"t":"Maintain up-to-date knowledge of hacking trends.","imp":3,"exp":20,"src":"heuristic","tier":"efficient","gwa":"Updating and Using Relevant Knowledge"},{"t":"Prepare and submit reports describing the results of security fixes.","imp":3,"exp":75,"src":"heuristic","tier":"efficient","gwa":"Documenting/Recording Information"},{"t":"Test the security of systems by attempting to gain access to networks, Web-based applications, or computers.","imp":3,"exp":75,"src":"heuristic","tier":"standard","gwa":"Inspecting Equipment, Structures, or Materials"},{"t":"Update corporate policies to improve cyber security.","imp":3,"exp":75,"src":"heuristic","tier":"frontier","gwa":"Developing Objectives and Strategies"},{"t":"Write audit reports to communicate technical and procedural findings and recommend solutions.","imp":3,"exp":60,"src":"heuristic","tier":"efficient","gwa":"Documenting/Recording Information"}],"adjacent":[{"code":"15-1299.05","slug":"information-security-engineers","title":"Information Security Engineers","overlap":0.66,"months":12,"exposure":58.2,"strong":true},{"code":"15-1212.00","slug":"information-security-analysts","title":"Information Security Analysts","overlap":0.66,"months":12,"exposure":65.1,"strong":true},{"code":"15-1253.00","slug":"software-quality-assurance-analysts-and-testers","title":"Software Quality Assurance Analysts and Testers","overlap":0.64,"months":13,"exposure":62,"strong":false},{"code":"13-1199.07","slug":"security-management-specialists","title":"Security Management Specialists","overlap":0.6,"months":14,"exposure":42.5,"strong":false},{"code":"15-1299.08","slug":"computer-systems-engineers-architects","title":"Computer Systems Engineers/Architects","overlap":0.56,"months":16,"exposure":57.9,"strong":false}]}