Penetration Tester CV Example

Format and structure

Use reverse-chronological order, keep it to one page for entry-level or two for experienced testers, and export to PDF. Use a clean sans-serif font and an ATS-friendly layout with clear section headings. On a UK CV, omit the photo and date of birth, and use a professional personal email address, never list a current employer's internal or work email, especially in a security role.

Sections to include

Personal statement

Your personal statement is 2-3 sentences at the top of the CV. Name your specialism, headline certifications, years of experience (or key training if junior), and one standout strength. Make it specific.

Experience and impact

Every bullet should show what you tested, what you found, and what happened. Quantify vulnerabilities by severity (critical/high), systems in scope, and the remediation or business outcome. Show the full engagement cycle: scoping, testing, reporting, and working with clients or dev teams to fix issues. Recruiters value client-facing skills as much as technical chops.

Skills and tooling

Name the actual offensive tools: Burp Suite, Metasploit, Nmap, Kali Linux, Wireshark, Nessus, plus AD-attack tools like BloodHound and Mimikatz. List a scripting language (Python, Bash, PowerShell) and show you have used it to automate recon or build custom tooling. Reference the methodologies you test against: OWASP Top 10, MITRE ATT&CK, PTES, NIST, CREST. ATS and recruiters keyword-match on these.

Certifications and credentials

Lead with the certifications recruiters filter on: OSCP, CREST (CRT/CCT/CTL), CHECK Team Member or Team Leader, CEH, CISSP, GPEN, PenTest+, Security+. For UK roles, CREST and CHECK carry the most weight and belong in the CV headline, not buried at the bottom. Tie certifications to real engagements in your bullets where possible.

Projects and community proof (juniors)

If you lack commercial experience, use a Projects section to prove hands-on skill: CTF placements (HackTheBox/TryHackMe rank, competition wins), a documented home lab, write-ups on a blog, and mock pentest reports on Vulnhub or HTB boxes. For juniors, this section often carries the CV. Surface community credibility: assigned CVEs, responsible-disclosure reports, bug-bounty payouts, published research, conference talks or a security blog. A real CVE or bounty hall-of-fame entry is third-party proof of offensive skill that no certification provides.

The result-plus-metric pattern

Pentest bullets must show what you tested, what you found (quantified by severity and count), and what happened next. The most common mistake is listing duties without impact: "Conducted vulnerability scans," "Performed penetration tests." Recruiters cannot tell a scanner-runner from a real tester. Quantify instead: vulnerabilities found and their severity (critical/high), systems in scope, and the remediation that followed.

Structure: Action verb + what you tested + what you found (severity, count) + outcome (remediation, client impact, efficiency gain).

Before and after examples

Action verbs for pentesters

Executed, identified, authored, conducted, discovered, exploited, compromised, enumerated, automated, developed, presented, collaborated, validated, reduced, improved, delivered, mentored, led.

Tie certifications to real engagements where possible: "Conducted OSCP-style internal pentests using pivoting and password-cracking to compromise domain controllers" beats a bare OSCP acronym in a certifications block.

Education

List your degree, institution, dates and honours in reverse-chronological order. A relevant dissertation or final-year project can go in a bullet if it demonstrates offensive security skill (for example, "Dissertation: Automated Detection of SQL Injection Vulnerabilities in Legacy Web Applications"). If you studied computer science, cyber security or a related field, that is enough, you do not need to list every module. If you lack a degree, lead with certifications and hands-on projects instead.

Certifications

Lead with the certifications recruiters filter on: OSCP (Offensive Security Certified Professional), CREST (CRT, CCT, CTL), CHECK Team Member or Team Leader, CEH (Certified Ethical Hacker), CISSP, GPEN (GIAC Penetration Tester), CompTIA PenTest+ and CompTIA Security+. For UK roles, CREST and CHECK carry the most weight and belong in the CV headline, not buried at the bottom.

Do not just list a certification, tie it to a result where possible. For example, "Led an OSCP-style internal pentest using pivoting and password-cracking to reach the domain controller" connects the credential to a real engagement and proves you can apply the skill, not just pass an exam.

If you hold UK security clearance (SC, DV, or NPPV), put it in the CV headline. Many UK pentest roles (government, defence, critical national infrastructure, CHECK engagements) are clearance-gated, so "SC Cleared" up top instantly qualifies you and can be the deciding filter.

What matters for juniors

If you lack commercial experience, certifications and hands-on projects carry the CV. OSCP is the gold standard for proving offensive skill. Pair it with CTF achievements (HackTheBox rank, competition placements), a documented home lab, write-ups on a blog, and mock pentest reports on Vulnhub or HTB boxes. Surface community credibility: assigned CVEs, responsible-disclosure reports, bug-bounty payouts (HackerOne, Bugcrowd), published research or a security blog. A real CVE or bounty hall-of-fame entry is third-party proof of offensive skill that no certification provides.