How to Become a Penetration Tester: India and US Path (2026)
A step-by-step path to becoming a penetration tester in India or the US: skills, free labs, eJPT, PNPT, CEH and OSCP costs, and what the job pays.
A penetration tester gets paid to break into computer systems, with permission, and then explain how it was done. It sounds like a movie job. Most days it is closer to careful note-taking, reading, and writing reports that a company can act on.
The path is open to students with no experience, in India and in the US. This post lays out the steps, the four certifications people ask about, what each costs from official pages, and what the job pays.
To become a penetration tester, learn networking, Linux and one scripting language, practise on legal lab platforms, earn one hands-on certification, and apply for security analyst or junior tester roles. Many people spend a year or two on this path before a full tester role. Fewer jobs hire pure beginners, so the early steps matter.
Know what a penetration tester does
A penetration tester (also called a pen tester or ethical hacker) attacks a company's own systems with written permission to find weak points before criminals do. The output is a report with proof, risk ratings and fixes.
The work includes scanning networks, testing websites and APIs, checking weak passwords and settings, and sometimes testing staff with fake emails. The US government groups this work with information security analysts, who plan and carry out security measures. See the Bureau of Labor Statistics page. That page does not give a separate figure for penetration testers.
Learn the prerequisites first
Penetration testing prerequisites are simple to list and slow to learn. You do not need a famous college. You need these basics.
Networking
IP addresses, DNS, HTTP, TCP and the ports behind common services.
Linux
The command line, file permissions, users and processes.
One scripting language
Python is the usual pick. You will write small tools to automate boring steps.
Web basics
How a login, a cookie and a database query work, so you can see how they break.
Security ideas
The CIA triad (confidentiality, integrity, availability), and why weak passwords matter.
The EC-Council CEH page lists no formal prerequisites, and it recommends at least two years of IT security experience. Entry-level INE eJPT says it is built for people with little or no security experience. Both pages are linked in the cost section below.
Choose your path in India or the US
Employers in both countries care about proof of skill. The route to that proof differs a little.
| Point | India | US |
|---|---|---|
| Common starting degree | BTech or BSc in computer science or IT, or BCA | Bachelor's degree. BLS lists it as the typical entry education for security analysts |
| Common first job | SOC analyst, security analyst trainee, VAPT trainee | SOC analyst, IT support, junior security analyst |
| Where jobs cluster | Bengaluru, Hyderabad, Pune, Mumbai, Chennai and Delhi NCR (security services firms and IT companies) | Consulting firms, banks, tech companies, government contractors |
| Certification that opens interviews | CEH is widely named in Indian job posts. OSCP and PNPT stand out | OSCP and PNPT are widely named. Some employers list Security+ for entry roles |
| Extra step | Campus drives rarely hire testers directly, so build a public lab portfolio | Some government work asks for citizenship or clearance |
In India, "VAPT" (vulnerability assessment and penetration testing) is the phrase on most job posts, so search for it as well as "penetration tester". If you are weighing the first job pay, our cyber security analyst fresher salary guide shows the entry-level ranges.
Practise on legal labs
Hands-on practice is what interviewers ask about first. Use platforms designed for it, and never test a system you do not have permission to test.
- PortSwigger Web Security Academy teaches web attacks with free labs.
- TryHackMe has guided rooms for beginners.
- Hack The Box has harder machines once you are comfortable.
- The OWASP Top 10 is the standard list of web risks to study.
Write a short report after every lab: what you found, how you proved it and how to fix it. After twenty such reports you have a portfolio, and you have practised the part of the job that clients pay for.
Pick one certification
A certification does not replace skill, but it gets your resume read. Here are the four most asked about. Prices change often, so confirm them on the vendor page before buying.
| Certification | Level | Reported cost | Format |
|---|---|---|---|
| eJPT (INE) | Entry | About $249 for an exam voucher, per HackerDNA's guide. INE's official page lists the voucher inside its training bundles | Hands-on lab, one free retake. The vendor page says it needs no prior security experience |
| PNPT (TCM Security) | Intermediate | $499 with training, one free retake, per the TCM Security page | Practical network test with a report |
| CEH (EC-Council) | Entry to intermediate | $950 for the remote exam or $1,199 at a Pearson VUE centre, per Securium Academy. This is a training provider, so check EC-Council | 125 multiple-choice questions in 4 hours, per EC-Council |
| OSCP+ (OffSec) | Advanced entry | $1,749 for PEN-200 with 90 days of labs and one exam attempt, or $1,699 for the exam alone, per OffSec | Hands-on exam against live machines |
For most beginners, I would start with eJPT or PNPT. Both are hands-on and cost the least. CEH is a theory exam, yet Indian job posts name it often, so it can help a campus resume get through the first filter. OSCP is the one that makes testers take a resume seriously, and it is best after a year of lab practice.
For India, convert dollars at the day's rate and add the taxes your seller charges. Training providers in India also sell CEH bundles at their own prices, and the figures differ widely, so compare two or three before paying.
Get your first security job
Very few companies hire a pure beginner as a tester. A realistic route is a security analyst or SOC role first. You learn how attacks look from the defence side, which makes you a better tester later.
Apply for internships and trainee roles marked VAPT, application security or SOC. Put your lab reports, certification and a short GitHub page on your resume, and follow the advice in skills for a fresher resume. Bug bounty programs, such as those on HackerOne, are another way to show real findings, but read each program's rules first. Reports sent outside the rules can cause legal trouble.
Salary: what penetration testers earn
Pay depends on city, employer and certification. Treat the figures below as ranges, not promises.
- India: PayScale reports an average of ₹508,189 a year for a penetration tester in India, with a range of about ₹202,000 to ₹2 million from 117 profiles. For people with under one year of experience, it shows an average total pay of ₹500,070 from 60 salaries. Source: PayScale India, updated October 2026.
- US: The BLS reports a median of $129,180 a year in 2025 for information security analysts, the nearest official group. Penetration testers have no separate BLS category, so a tester's pay can differ. Source: BLS Occupational Outlook Handbook.
The BLS page also projects 21% growth for this group from 2025 to 2035, which it calls much faster than average. The sample is small for the India figures, so check a few job posts in your city before you plan around a number.
Common mistakes
- Testing real websites for practice. Without written permission this can be illegal. Use labs.
- Collecting certificates without labs. Interviewers ask you to explain what you did, not what you studied.
- Skipping networking. Tools hide the basics until a tool fails, and then you are stuck.
- Weak reports. A finding nobody understands is a finding nobody fixes.
What to do next
This week, create a free account on a lab platform and finish one beginner room. Write a half-page report on it, then save it to a public GitHub repository. Then check the eJPT and PNPT pages and choose which exam you will book in the next three months.
