Career · Cyber Security and IT Infrastructure

Ethical hacker (penetration tester)

Also called: Ethical hacker, VAPT analyst

Legally hacks into systems to find weaknesses before criminals do.

Do you fit as an Ethical hacker (penetration tester)?Find out now

DemandGrowing

Starting pay₹5-9 LPA

Time to first job1 to 2 years, often after a SOC or IT role

Who can enterIT degree or equivalent skills, plus hands-on certifications

Compass career assessment

Picture yourself as an Ethical hacker (penetration tester) five years from now. Happy?

People grow fastest in work that suits who they are. Compass shows where your strengths, interests and values point.

Instant report
Your top career fits
A fit score on every career here

I am in:Class 8-10 Class 11-12 College or fresher Working or switching

Pick your stage. Each Compass edition is made for it.

What the work is

Penetration testers, or ethical hackers, are hired to attack an organisation's websites, apps, networks and cloud systems, with permission, to find weaknesses. They then explain the risks and how to fix them. Red teams simulate real attackers over longer engagements.

It is an exciting and respected role, but you usually need a strong base in networking, operating systems and web technologies first. Bug bounty programmes let you practise and even earn while learning.

A typical week

Test web apps, networks and APIs for vulnerabilities
Use tools like Burp Suite, Nmap and Metasploit
Write clear reports with fixes
Retest after fixes

It suits people who

Love puzzles and figuring out how things break
Are persistent and creative
Have strong ethics

Your path to get there

School (Class 8-10)Class 11-12College or fresherWorking or switching

School (Class 8-10)

Learn programming and networking basics; join beginner capture-the-flag contests

Class 11-12

B.Tech CS or IT, BCA or B.Sc with cyber security electives

College or fresher

Practise on legal platforms (Hack The Box, TryHackMe, PortSwigger Academy)
Learn web technologies and scripting
Aim for eJPT, then OSCP

Working or switching

Developers and SOC analysts move in through certifications and bug bounty practice

Returning after a break?

Start with a skills refresh of 6 to 12 weeks: one short course and one TalentMeter assessment to show where you stand today.
Use returnship and second-career programmes; many large employers in India run them for people back after a break.
Explain the gap in one honest line on your CV and LinkedIn, and list what you did in it (caregiving, freelancing, courses, volunteering).
Contract, part-time and freelance roles are a common way back in; they turn into full-time offers often.

Exams and certifications

Name	What it is for	When
OSCP (Offensive Security) ↗	Respected hands-on penetration testing certificate	After 1 to 2 years of practice
eJPT	Entry penetration testing certificate	Any time
EC-Council CEH	Ethical hacking basics	Any time

Exam names, eligibility and dates change. Always check the official website for this year's notice.

Job market

Job titles to search

Penetration testerEthical hackerApplication security engineerRed team specialistVAPT analyst

Who hires

Security consultanciesBig Four and audit firmsBanksProduct companiesGovernment agencies

Where the jobs are

BengaluruHyderabadPuneChennaiDelhi NCRMumbai

See openings on Naukri ↗See openings on LinkedIn Jobs ↗See openings on Indeed ↗

These buttons open a live search for "Penetration tester" on each job site. TalentMeter does not list or vouch for the jobs there.

Know which careers fit you

Create a free account, take the Compass career assessment for your stage, and every cluster and career here will show how well it fits you.