Penetration Tester CV Examples & Writing Guide

This sample is a consultant at a security testing firm who runs web application and internal network engagements. Names and companies are invented. Internal red teamers and application security engineers should keep the structure and change the engagement types; there is a section for people breaking in below.

The hiring manager is usually a practice lead or principal consultant who has done the job. They can tell from four lines whether you have tested anything real.

• Engagement types and count. Web, API, mobile, internal, external, cloud, wireless, social engineering, red team, physical. Give the mix and the number a year. "Performed penetration testing" tells a practice lead nothing.
• Depth signals. Attack paths you achieved, privilege escalation techniques, chained findings, custom exploits or scripts written. This is what distinguishes testing from running a scanner and formatting the output.
• Certifications, and specifically the hands-on ones. OSCP is a standard entry signal because it is a 24-hour practical exam. GIAC's GPEN and GWAPT, the PortSwigger Burp Suite Certified Practitioner, PNPT, CRTO and the OffSec follow-ons all carry weight. CEH is recognised but does not prove hands-on skill on its own.
• Report writing and client communication. This is half the job and the most common reason a technically strong candidate is turned down. Say how many reports you write, your turnaround, and whether you present to executives.
• Scoping and legal awareness. Rules of engagement, authorisation letters, testing windows, out-of-scope handling and what you do when you find something you were not authorised to touch. Consultancies ask about this in every interview.

“Show me an attack path, not a tool list. And tell me who reads your reports. This firm has hired brilliant testers who could not write a finding a client could act on, and that costs more than a missed vulnerability.”

Show the technique, the scale and the consequence. Vague findings language is the fastest way to look like someone who ran a scan.

This field weighs practical, exam-in-a-lab certifications far above multiple-choice ones. List the hands-on ones first and put the year on each.

• OSCP from OffSec. A 24-hour practical exam plus a report, and still one of the most common baseline requirements in job adverts. The follow-ons (OSEP for evasion, OSWE for web exploitation, OSED for exploit development) each signal a specialism.
• GIAC certifications: GPEN for network penetration testing, GWAPT for web applications, GXPN for advanced exploitation, GCPN for cloud. Expensive, respected, and common in government and large enterprise environments.
• Burp Suite Certified Practitioner from PortSwigger. Practical, inexpensive and taken seriously for web testing roles.
• CRTO from Zero-Point Security for red team operations, and PNPT from TCM Security, which includes a report and a debrief call and is well regarded for entry level.
• CEH from EC-Council. Widely recognised by HR filters and sometimes asked for in public sector and defence work, but on its own it does not tell a practice lead you can test. Pair it with something practical.
• CISSP is a management-leaning certification. It helps for senior and consulting roles and for contract requirements, not for proving hands-on ability.
• In the UK, CREST certifications (such as CRT and CCT) and CHECK status for government work are the gatekeepers, and many UK adverts require them specifically.
• Bug bounty results, CVEs, conference talks and public tools count as credentials here. Put them in their own short block with links.

Junior penetration testing roles are competitive because a lot of people want them and few companies want to train. The CV has to prove you can already do the work without a job title saying so.

1. 1Get one practical certification. OSCP is the strongest signal; PNPT and the Burp Suite Certified Practitioner are cheaper and still count. A certificate of completion from a course is not the same thing and practice leads know the difference.
2. 2Build a lab and describe it as infrastructure: a domain controller, two workstations, a Linux server, a vulnerable web app, an EDR trial. Say what you attacked and what you learned about detection.
3. 3Show practice platform volume with a link: Hack The Box, TryHackMe, PortSwigger Web Security Academy, proving grounds. Machine counts and rank are legitimate evidence at this level.
4. 4Write. Public writeups are the closest thing to a work sample for a job whose main deliverable is a written report. Five good writeups beat fifty half-finished boxes.
5. 5Try bug bounty, and report honestly. "3 accepted submissions, 1 duplicate, £360 total" is credible; "bug bounty hunter" with nothing behind it is not.
6. 6Use adjacent experience properly. Service desk, sysadmin, network engineering, development and SOC work are all real advantages, because testers who understand how systems are actually built find more. Rewrite those jobs around what you learned about attack surface.
7. 7Apply to consultancies as well as product companies. Consultancies hire and train juniors far more often, and the volume of engagements will teach you faster.

• One page early in your career, two once you have several years of engagements, which is the UK norm. Practice leads read quickly and value density over design.
• Order: header with certifications and GitHub link, personal statement, experience, skills grouped, certifications and community work, education. Junior candidates move labs, platforms and writeups above experience.
• Plain, single column, selectable text. Cyber security CVs with heavy design get mangled by applicant tracking systems, and many security teams still hire through corporate HR portals.
• Group the skills: engagement types, then tools, then languages, then frameworks. Do not list 60 tools; list the ones you would be comfortable being asked about in an interview.
• Link a GitHub or a blog as plain text, and make sure what is there is finished. An empty profile is worse than none.
• Never include client names, real findings, screenshots or anything under a non-disclosure agreement. Describe sectors and sizes instead.
• Mention security clearance if you hold it (SC, or DV for some government work), since a lot of UK testing work is public sector or defence adjacent, and say whether you can travel and how often. Consulting roles often expect 20 to 40 percent travel.
• Mirror the advert's words when true: penetration testing, red team, web application, API, Active Directory, cloud, OWASP, MITRE ATT&CK, PCI DSS, CREST, report writing, remediation.
• PDF named Firstname-Lastname-Penetration-Tester-CV.pdf. UK adverts will often ask for CREST or CHECK status alongside or instead of OSCP, while US employers expect a resume rather than a CV.