Vulnerability Analyst / Penetration Tester
What Does a Professional in this Career Do?
A Vulnerability Analyst or Penetration Tester probes for and exploits security vulnerabilities in web-based applications, networks and systems. Penetration Tests are designed to achieve a specific, attacker-simulated goal and should be requested by customers who are already at their desired security posture. A typical goal could be to access the contents of the prized customer database on the internal network, or to modify a record in an HR system. Vulnerability Assessments are designed to yield a prioritized list of vulnerabilities and are generally for clients who already understand they are not where they want to be in terms of security. The customer already knows they have issues and simply need help identifying and prioritizing them.
Job Outlook
There were 120 Vulnerability Analyst / Penetration Tester job postings in North Carolina in the past year and 4915 in the United States.
In combination with other careers in the Cyber / Information Security Engineer / Analyst industry, which includes the Vulnerability Analyst / Penetration Tester career, the following graph shows the number of people employed for each year since 2015:
Salary
Many new Vulnerability Analyst / Penetration Tester jobs have salaries estimated to be in the following ranges, based on the requirements and responsibilities listed in job postings from the past year.
National
The average estimated salary in the United States for this career, based on job postings in the past year, is $105,152.
State
The average estimated salary in North Carolina for this career, based on job postings in the past year, is $94,390.
Percentiles represent the percentage that is lower than the value. For example, 25% of estimated salaries for Vulnerability Analyst / Penetration Tester postings in the United States in the past year were lower than $92,367.
Education and Experience
Posted Vulnerability Analyst / Penetration Tester jobs typically require the following level of education. The numbers below are based on job postings in the United States from the past year. Not all job postings list education requirements.
| Education Level | Percentage |
|---|---|
| Associate's Degree | 0% |
| Bachelor's Degree | 70.89% |
| Master's Degree | 16.09% |
| Doctoral Degree | 3.48% |
| Other | 4.05% |
Posted Vulnerability Analyst / Penetration Tester jobs typically require the following number of years of experience. The numbers below are based on job postings in the United States from the past year. Not all job postings list experience requirements.
| Years of Experience | Percentage |
|---|---|
| 0 to 2 years | 13.98% |
| 3 to 5 years | 46.94% |
| 6 to 8 years | 25.78% |
| 9+ years | 13.31% |
Skills
Below are listings of the most common general and specialized skills Vulnerability Analyst / Penetration Tester positions expect applicants to have as well as the most common skills that distinguish individuals from their peers. The percentage of job postings that specifically mention each skill is also listed.
Baseline Skills
A skill that is required across a broad range of occupations, including this one.
- Communication (47.2%)
- Management (36.48%)
- Research (32.11%)
- Operations (26.71%)
- Problem Solving (25.53%)
- Leadership (23.42%)
- Information Technology (17.03%)
- Presentations (14.93%)
- Writing (14.79%)
- Troubleshooting (Problem Solving) (12%)
Defining Skills
A core skill for this occupation, it occurs frequently in job postings.
- Qualys (14.55%)
- Burp Suite (18.83%)
- Automation (23.52%)
- Penetration Testing (50.9%)
- Linux (21.22%)
- Cyber Security (47.83%)
- Computer Science (40.58%)
- Vulnerability Scanning (27.33%)
- Nmap (10.13%)
- Offensive Security (10.19%)
- Social Engineering (10.41%)
- Kali Linux (12.45%)
- Vulnerability Management (43.28%)
- Nessus (22.62%)
- Red Teaming (7.04%)
- Vulnerability Assessments (40.5%)
- Vulnerability (89.38%)
- Scripting (24.37%)
- Metasploit (14.34%)
Necessary Skills
A skill that is requested frequently in this occupation but isn’t specific to it.
- Cyber Threat Intelligence (18.19%)
- Workflow Management (8.27%)
- MITRE ATT&CK Framework (6.85%)
- Ruby (Programming Language) (9.47%)
- Defense In Depth (7.08%)
- Amazon Web Services (12.55%)
- Cyber Risk (5.78%)
- Java (Programming Language) (10.66%)
- C (Programming Language) (13.42%)
- IT Security Architecture (4.12%)
- C++ (Programming Language) (11.63%)
- Auditing (19.43%)
- Application Development (3.44%)
- Cloud Security (8.79%)
- C# (Programming Language) (5.72%)
- Software Development (7.47%)
- Application Programming Interface (API) (12.66%)
- Microsoft Azure (10.93%)
- Dashboard (5.37%)
- Application Security (12.04%)
- Bash (Scripting Language) (13.75%)
- Python (Programming Language) (38.03%)
- Perl (Programming Language) (7.61%)
- Security Controls (10.13%)
- Computer Networks (7.43%)
- Unix (8.64%)
- Information Systems (14.55%)
- Incident Response (17%)
- Federal Information Security Management Act (5.58%)
- Operating Systems (30.54%)
- Enterprise Security (5.23%)
- Firewall (9.2%)
- Data Analysis (8.83%)
- Network Security (11.61%)
- Risk Management (9.8%)
- Debugging (6.4%)
- Code Review (6.57%)
- Computer Engineering (7.37%)
- Open Web Application Security Project (OWASP) (16.79%)
- Project Management (8.73%)
- Web Applications (7.04%)
- TCP/IP (8.27%)
- Security Testing (9.47%)
- Network Protocols (12.97%)
- Programming Languages (6.69%)
- Process Improvement (7.64%)
- Threat Modeling (5.23%)
- Triage (6.05%)
- Mitigation (14.88%)
- Windows PowerShell (14.69%)
- Risk Analysis (14.06%)
- Tooling (4.73%)
- ServiceNow (8.79%)
- IT Security (13.89%)
Distinguishing Skills
A skill that may distinguish a subset of the occupation.
- Rapid7 (5.58%)
- Binary Ninja (Reverse Engineering Software) (4.9%)
- Attack Surface Management (9.38%)
- IDA Pro (4.98%)
- X86-64 (4.14%)
- Ghidra (Reverse Engineering Software) (6.36%)
- Fuzz Testing (4.14%)
- Ethical Hacking (6.96%)
- SQL Injection (3.85%)
- HP WebInspect (2.7%)
- Common Vulnerability Scoring System (CVSS) (5.6%)
- WinDBg (2.74%)
- Web Application Penetration Testing (4.65%)
- Kenna Security (4.71%)
Salary Boosting Skills
A professional who wishes to excel in this career path may consider developing the following highly valued skills. The percentage of job postings that specifically mention each skill is listed.
- Rapid7 (6.3%)
- Qualys (16.43%)
- Web Application Penetration Testing (5.25%)
- Red Teaming (7.95%)
- Nexpose (Vulnerability Scanning Software) (2.86%)
- Ghidra (Reverse Engineering Software) (7.18%)
- Attack Surface Management (10.6%)
- Binary Ninja (Reverse Engineering Software) (5.53%)
- X86-64 (4.67%)
- Burp Suite (21.26%)
- Common Vulnerability Scoring System (CVSS) (6.32%)
- Cyber Security (54.01%)
- Ethical Hacking (7.85%)
- Kali Linux (14.06%)
- Vulnerability Scanning (30.86%)
- Offensive Security (11.5%)
- Social Engineering (11.76%)
- HP WebInspect (3.04%)
- Scripting (27.52%)
- Nessus (25.54%)
Alternative Job Titles
Sometimes employers post jobs with Vulnerability Analyst / Penetration Tester skills but a different job title. Some common alternative job titles include:
- Penetration Tester
- Vulnerability Analyst
- Vulnerability Management Analyst
- Vulnerability Researcher
- Vulnerability Assessment Analyst
- Vulnerability Management Engineer
- Ethical Hacker
- Information Security Analyst/Penetration Tester
- Security Analyst
- Cybersecurity Analyst
Similar Occupations
If you are interested in exploring occupations with similar skills, you may want to research the following job titles. Note that we only list occupations that have at least one corresponding NC State Online and Distance Education program.
- Cyber Security Engineer
- Cyber Security Manager / Administrator
- Cyber Security Architect
- Incident Analyst / Responder
Common Employers
Here are the employers that have posted the most Vulnerability Analyst / Penetration Tester jobs in the past year along with how many they have posted.
United States
- Marriott International (278)
- Leidos (155)
- Deloitte (107)
- Raytheon Technologies (98)
- Booz Allen Hamilton (76)
- Nelnet (72)
- Ryder (67)
- Mindpoint Group (62)
- KPMG (56)
- GovCIO (54)
North Carolina
- Smx Corporation Limited (7)
- Marriott International (4)
- Bank of America (4)
- Deloitte (4)
- MetLife (4)
- Randstad (4)
- Digital Technology Solutions (3)
- Insight Global (3)
- TEKsystems (3)
- Truist Financial (3)
NC State Programs Relevant to this Career
If you are interested in preparing for a career in this field, the following NC State Online and Distance Education programs offer a great place to start!
All wages, job posting statistics, employment trend projections, and information about skill desirability on this page represents historical data and does not guarantee future conditions. Data is provided by and downloaded regularly from Lightcast. For more information about how Lightcast gathers data and what it represents, see Lightcast Data: Basic Overview on Lightcast's Knowledge Base website.