Penetration Tester.

An authorized offensive-security professional who simulates real-world attacks against systems, applications, or people to find exploitable weaknesses before adversaries do. It belongs to the Roles & Careers category of cybersecurity.

An authorized offensive-security professional who simulates real-world attacks against systems, applications, or people to find exploitable weaknesses before adversaries do.

A Penetration Tester (pentester) is an authorized offensive-security professional who emulates real-world attackers to find exploitable weaknesses in networks, cloud, applications, mobile, hardware, and people. Engagements range from black-box external assessments to assumed-breach exercises and full red-team operations, and each ends in a written report with reproducible proofs of concept and prioritized remediation guidance. Pentesters typically work in internal red teams, consultancies, or for managed-security vendors, reporting to a head of offensive security or service-line lead. Common qualifications combine deep practical skills with certifications such as OSCP, OSCE/OSEP, CRTO, GPEN, GXPN, or BSCP, and a track record of public CVEs, CTF results, or research.

Defences for Penetration Tester typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Ethical hacker, Offensive security engineer.