Did You Know?
A Hollywood movie helped shape American cybersecurity policy. After President Reagan watched WarGames in 1983 and asked whether such a hack was possible, his top general reported the problem was worse than the president thought, and Reagan later signed a national security directive on computer security.
The Numbers Behind the Career
There were about 192,900 information security analysts in the U.S. in 2025.
About 14,100 information security analyst job openings are projected each year over the next decade.
The median salary for information security analysts in the U.S. in 2025 was $129,180.
Where This Career Is Headed
Penetration testing is growing because everything is now connected and nearly everything can be attacked. Cars, medical devices, factory equipment, power grids, and household appliances all run software and talk to networks, and each one is a new target that needs to be tested before someone hostile tests it first. Cloud computing has moved most organizations' systems onto shared infrastructure with its own unique weaknesses, and the spread of artificial intelligence has created entirely new kinds of vulnerabilities, including ways to manipulate AI systems into misbehaving, that testers are only beginning to map. At the same time, the profession is becoming more formal. Governments now run bug bounty programs, international standards govern how vulnerabilities are reported, and regulators in many industries require regular penetration testing. The penetration tester of the next decade will need the same adversarial creativity the job has always required, along with the ability to test systems that did not exist a few years ago.
Employment for information security roles is projected to grow much faster than average, and organizations in every industry, from hospitals to automakers, now need people who can test their defenses.
Bug bounty programs run by companies and governments let skilled testers earn money and reputation independently, often before they hold a formal job in the field.
New attack surfaces, including connected vehicles, medical devices, industrial systems, cloud platforms, and AI systems, are creating specialties that reward testers who learn them early.
Education & Certification
Many penetration testers hold a bachelor's degree in computer science, cybersecurity, information technology, or a related field. The degree matters less than the skills underneath it: a working knowledge of networks, operating systems such as Windows and Linux, at least one programming or scripting language, and how web applications and databases work. Many testers enter the field after working in IT support, system administration, network engineering, or software development, and some are self-taught through online labs, capture-the-flag competitions, and bug bounty programs. Because the work is hands-on, employers care more about what a candidate can demonstrate than where they studied.
No license is required to work as a penetration tester, but certifications carry weight in hiring. CompTIA Security+ is a common starting credential for anyone entering security. CompTIA PenTest+, EC-Council's Certified Ethical Hacker (CEH), and GIAC's GPEN are widely recognized penetration testing certifications. The Offensive Security Certified Professional (OSCP) from OffSec is well regarded as a hands-on credential, since its exam requires candidates to compromise systems in a lab environment rather than answer multiple-choice questions. The profession also runs on written authorization: a penetration tester never tests a system without a signed agreement defining what may be attacked, when, and how. Unauthorized access to computer systems is a crime under U.S. federal law.
To Prepare...
Take every computer science, programming, and networking course your school offers, and learn how the Internet actually works: what happens when you type a web address, how data travels, and where it can be intercepted.
Learn a scripting language such as Python, which penetration testers use daily to automate tasks and write their own tools.
Practice writing. Testers spend as much time explaining vulnerabilities in reports as they do finding them, and clear technical writing is what turns a discovery into a fix.
