Penetration Tester job description template

Last updated 2026-10-22

Short answer

A good penetration tester job description lists concrete responsibilities, separates required from preferred skills, names the tools and states contract type, location and work authorization. Use the template below and edit the bracketed fields.

Staffing teams write or rewrite job descriptions all the time: to post a requirement, to brief a recruiter or to tailor a resume. This penetration tester template is a starting point built from the skills and tools that decide a fit.

Copy-ready job description

Edit the bracketed fields for your requirement.

Penetration Tester

About the role
We are looking for a Penetration Tester to join our team. You will plan and run authorized penetration tests.

Responsibilities
- Plan and run authorized penetration tests.
- Exploit and document vulnerabilities.
- Write clear reports with remediation.
- Retest fixes.
- Work with developers and security teams.

Required
- Web and network penetration testing
- Tools such as Burp Suite and Nmap
- OWASP Top 10
- Scripting
- Report writing

Preferred
- OSCP or similar certification
- Cloud security testing
- Active Directory attacks
- Mobile testing
- Remediation guidance

Tools and stack
Burp Suite, Nmap, Metasploit, OWASP guidance, Scripting, Reporting templates

Employment type: [Contract / W2 / C2C / Full-time]
Location: [City, ST / Remote]
Duration: [months]
Work authorization: [accepted types]

Responsibilities explained

Each responsibility maps to something a candidate should be able to describe.

  • Plan and run authorized penetration tests.
  • Exploit and document vulnerabilities.
  • Write clear reports with remediation.
  • Retest fixes.
  • Work with developers and security teams.

Required skills

Treat these as the screen. If a candidate cannot speak to them, they are rarely a fit.

  • Web and network penetration testing
  • Tools such as Burp Suite and Nmap
  • OWASP Top 10
  • Scripting
  • Report writing

Preferred skills

Use these to rank candidates who meet the required list.

  • OSCP or similar certification
  • Cloud security testing
  • Active Directory attacks
  • Mobile testing
  • Remediation guidance

Other titles this role appears under

Search and post under the variants your clients use.

  • Penetration Tester
  • Ethical Hacker
  • Red Team Operator
  • Security Consultant (Offensive)

Seniority guide

Pick the level you need and state it plainly in the posting.

  • Junior: supports tests.
  • Mid: leads web or network tests.
  • Senior: leads engagements and methodology.

Tailoring a resume to this description

When you submit a consultant, mirror the required skills and tools in the summary and the most recent role, using only experience the candidate really has. MatchWire’s resume tailoring drafts this from the candidate’s stored work history and the posting.

Frequently asked questions

How long should a job description be?

Long enough to list the responsibilities, required and preferred skills, tools and logistics, usually 300 to 500 words.

Should I list a rate in the description?

If the client allows it, a range helps candidates self-select. Otherwise state it as “rate to be discussed” and confirm it before submitting.