Career profile · live from the Careermash careers engine
Careermash
ExploreCareer profile
Ethical Hacker and Penetration Tester
Are you fascinated by technology and love solving puzzles? As an Ethical Hacker, you'll get to outsmart cybercriminals and protect vital information! Dive into the thrilling world of cybersecurity where your skills can make a real difference in keeping people and businesses safe online.
No degree needed for many routesApprenticeship route
AI impact: low£££ payApprenticeship route
38
AI impact
how much AI is reshaping it
Robin · your guide
Curious about being a ethical hacker and penetration tester? Here's the honest picture - what you'd really do, what you'd earn, and every way in. No need to decide anything yet.
What you'd actually do
An Ethical Hacker, also known as a Penetration Tester, is someone who breaks into computer systems on purpose - but with permission. They are hired by businesses to find weak spots before real criminals do. It matters because so much of our money, data and daily life now lives online, and a single security gap can cause huge harm to people and companies.
Day to day, you spend time testing websites, networks, apps and devices to see if you can get in. You run scans, try different attack methods and look for flaws in how systems are built. When you find a weakness, you write a clear report explaining what you found, how serious it is, and how to fix it. You often work closely with developers and IT teams to make sure those fixes actually work.
You need strong problem-solving skills, patience and a curious mind that enjoys puzzles. Good writing skills matter too, because you have to explain technical issues simply. The rewarding part is knowing your work keeps real people and organisations safe - and there is a real thrill in cracking a system that was meant to be secure.
- Curiosity: You enjoy figuring out how things work and how they might fail.
- Technical know-how: You understand networks, operating systems and common programming basics.
- Attention to detail: Small flaws can lead to big breaches, so you notice things others miss.
- Clear communication: You can explain complex problems in plain language for non-technical people.
- Ethics and trust: You handle sensitive systems responsibly and always work within the law.
- Always learning: Threats change fast, so you keep your skills and knowledge up to date.
1Scanning networks and websites to find security vulnerabilities.
2Simulating cyber attacks to test how well systems hold up.
3Trying different methods to break into apps, devices or accounts with permission.
4Writing detailed reports that explain what you found and how to fix it.
5Meeting with developers and IT teams to discuss security weaknesses.
6Researching new hacking techniques and emerging online threats.
7Retesting systems after fixes to confirm the problems are solved.
Career progression & pay
01
Getting in
Junior Penetration Tester
£25,000 - £35,000
Basic cybersecurity certifications (e.g., CompTIA Security+, CEH)
In this role, you'll assist in testing systems for vulnerabilities, learning from experienced professionals while gaining hands-on experience in ethical hacking techniques.
02
Building up
Penetration Tester
£40,000 - £60,000
Advanced certifications (e.g., OSCP, CISSP), relevant degree
As a Penetration Tester, you'll conduct thorough security assessments, simulate attacks, and provide recommendations to strengthen defenses, all while collaborating with various teams.
03
At the top
Senior Ethical Hacker
£70,000+
Expert-level certifications, extensive experience, leadership skills
At the peak of your career, you'll lead security initiatives, mentor junior staff, and develop strategies to combat emerging threats, playing a crucial role in safeguarding digital assets.
Degrees that lead here via Computer Science
2D Animation and Stop Motion
Teesside University
2D Animation and Stop Motion
Teesside University
2D Animation and Stop Motion (with Foundation Year)
Teesside University
3D Animation
Ravensbourne University London
3D Animation and Visualisation
Glasgow Caledonian University
3D Animation for Games and Film
Middlesex University
Apprenticeships that lead here
Who hires - top UK employers
IBM
A global leader in technology and consulting, IBM offers innovative cybersecurity solutions and services.
Accenture
Accenture provides a wide range of cybersecurity services, helping clients protect their data and systems.
BT Group
BT Group is a major telecommunications company in the UK, focusing on securing networks and systems for businesses.
AI & the future of this job
Ethical hacking sits in an interesting position where AI is simultaneously a threat and a tool. Automated vulnerability scanners and AI-driven penetration testing platforms like Pentera and NodeZero are handling routine reconnaissance and known exploit testing, compressing the repetitive groundwork that once filled junior roles. However, the craft of chaining vulnerabilities together, social engineering assessments, red team operations, and novel zero-day research still demands creative, adversarial human thinking that AI cannot replicate. The field is growing faster than AI can shrink it, driven by an expanding attack surface and a global cybersecurity talent shortage.
Within 5 Years
Routine Tasks Automated
AI tools will absorb the low-hanging fruit of penetration testing: standard port scanning, known CVE exploitation, and basic report drafting. Junior roles that consist mostly of running automated tools and writing templated reports will thin out, making it harder to land a first job without demonstrable hands-on skill. The roles that remain will expect practitioners to interpret AI-generated outputs critically, customise attack chains, and engage in genuine creative thinking from day one. Certifications like OSCP, which demand manual exploitation skills, will carry more weight precisely because they prove you can go beyond the automated layer.
Within 10 Years
Human Adversarial Edge Valued
By the mid-2030s, AI will likely conduct most commodity vulnerability assessments autonomously, reshaping the junior end of the market significantly. Senior penetration testers and red team operators will be in higher demand than ever, tasked with adversarial simulation that mirrors sophisticated human threat actors, something AI tools struggle to replicate convincingly. The profession will bifurcate into those who manage and interpret AI-driven security platforms and those who conduct deep, bespoke offensive operations. Specialists who understand AI systems themselves as attack surfaces, including LLM prompt injection and model poisoning, will command premium rates.
Within 20 Years
Strategic and AI-Focused Security
The penetration tester of the 2040s will look quite different from today, operating primarily as a strategic adversary and AI security architect rather than a hands-on script runner. Much of traditional pen testing will be continuous and automated, integrated directly into development pipelines. The human role will centre on adversarial AI research, critical infrastructure red teaming, and governance, areas where accountability, judgement, and creativity are non-negotiable. This is a career with a genuine long-term future, but it will reward those who evolve their skills rather than those who master today's toolset and stop there.
How to stay ahead
Get Hands-On Credentials Early
The OSCP certification is widely respected in UK hiring and deliberately tests manual exploitation skills that automated tools cannot replicate. Completing platforms like HackTheBox and TryHackMe before or during your degree signals to employers that you have genuine practical ability, not just academic knowledge. This distinction will matter more as AI handles the surface-level work.
Specialise in AI and Cloud Security
LLM security, adversarial machine learning, and cloud-native attack surfaces are emerging specialisms with very few qualified practitioners. Understanding how to attack and defend AI systems positions you at the frontier of the field rather than competing in its most commoditised areas. A focused dissertation or personal research project in this space can open doors that a generalist profile will not.
Build a Public Track Record
Bug bounty programmes through platforms like HackerOne and Bugcrowd let you earn real money while building a verifiable portfolio of vulnerabilities discovered in production systems. A CVE to your name or a consistent bug bounty ranking is far more persuasive to hiring managers than a transcript alone. Start these activities while studying, not after you graduate.
Learn to Communicate Risk in Business Terms
The penetration testers who progress into senior and consulting roles are those who can translate technical findings into business risk that a board or CISO can act on. Develop your report writing and presentation skills deliberately, treating a pen test report as a business document rather than a technical log. This human communication layer is exactly where AI-generated outputs still fall short and where your value will compound over time.
How to get in - your routes
Careermash · your kind of work, the careers in it, and every route in - all in one place.