Penetration Tester CV Example for 2026

Use a clean, reverse-chronological layout with plain section headings and consistent dates. Two pages will suit many applicants, but relevance matters more than squeezing or padding the document to meet an arbitrary limit. Start with your name and contact details, then add a personal statement, skills, relevant certifications, professional experience and education. Candidates without much paid experience can place a clearly labelled projects section above employment, provided each project explains its scope, method and outcome.

Open with evidence

Keep the personal statement to three or four lines. State your present level, the kinds of assessment you have completed and the evidence that makes your application worth reading. Useful evidence can include the number of authorised engagements completed, systems or endpoints assessed, validated findings, time taken to reach a defined test objective, reports delivered or a script you wrote. Figures must come from records you can defend. A junior applicant can use supervised projects, labs and transferable technical work. An experienced tester should lead with engagement scale, judgement, reporting quality and client impact.

Make the experience section easy to assess

For each position, provide the employer, title, location and dates, followed by focused achievement bullets. Show the engagement story: how the scope was agreed, what environment you assessed, what you did, how you checked the findings and what action followed. Penetration testing work can cover authorised tests of systems, networks, infrastructure, websites, and web or mobile applications. It can also involve identifying vulnerabilities and compliance issues, reporting their risk, recommending remediation and presenting conclusions to technical or senior audiences.

Five or six concise bullets can work better than a dense paragraph when a position contains enough substantial evidence. Give earlier or less relevant jobs fewer bullets. Write in plain language before adding technical terms; the reader should not need to decode a wall of acronyms to understand the result.

Group skills by purpose rather than creating a keyword strip. Possible categories include testing methods, operating systems, networking, scripting and reporting. Python and PowerShell can be relevant, as can work across macOS, Windows and Linux. Entry-level evidence may cover Linux command-line work; TCP/IP, DNS, routing, firewalls and packet-level traffic; Windows and Active Directory; web application testing; or network testing. Mention individual tools only where your experience shows how you used them.

Tailor the CV to each vacancy by using relevant language from the job description naturally. Do not copy whole passages. If the advert stresses communication with executives, use a genuine example of translating a technical flaw into business impact and remediation priorities. If it stresses web testing, move the most relevant engagement evidence nearer the top.

A useful experience bullet joins an action, a defined scope and a result. Start with what you did, identify the environment or engagement boundary, then state the defensible outcome. Numbers are helpful when they explain scale or improvement: engagements completed, systems assessed, findings validated, false positives removed, reports delivered, remediation agreed, retests closed or preparation time saved. Use only figures supported by your own records, and remove details that could identify a client or expose a target.

Penetration testers carry out authorised tests that simulate attacks against systems, networks, infrastructure and internet sites. They may agree testing requirements with clients, plan remote assessments of networks and applications, identify vulnerabilities or security gaps, validate findings, assign risk and recommend remediation. The experience section should make this accountable process visible. A list of exploits or scanner names does not show whether you understood the scope, checked the output or communicated the result.

The revised bullets reveal scale, judgement and outcome. They also distinguish a completed assessment from running an automated scan. When you created a method, script or tool, explain the problem it solved. "Built a Python evidence parser that reduced report preparation from 90 to 55 minutes across 12 engagements" tells the reader far more than "Proficient in Python".

Use direct verbs that fit the work: assessed, scoped, enumerated, tested, validated, reproduced, documented, prioritised, automated, briefed and advised. Use "led" only when you genuinely directed the engagement or team. Senior bullets can cover setting scope, reviewing finding accuracy, explaining business consequences or presenting risk to executives. Junior bullets can be just as credible when they specify supervised scope, careful validation and a measurable contribution.

Keep most bullets to one or two lines. If several clauses obscure the result, split the point or remove incidental detail. A reader should be able to identify the scope, your action and the outcome in one pass.

List education in reverse-chronological order with the institution, exact awarded qualification, field and completion year. Do not turn a broad eligibility phrase into the title of a degree, and never present unfinished study as an awarded qualification. A recent graduate can add relevant modules, a final project or a carefully defined lab result. An experienced candidate can usually reduce older education to one line unless it remains closely connected to the vacancy.

The available role evidence does not establish a universal degree, GCSE profile, apprenticeship, licence or certificate for entry into penetration testing. Present your actual route without implying that every applicant needs the same one. Use the official title shown on the award, name the institution or issuer and distinguish completed study from training in progress. When space is tight, retain material that supports the vacancy and remove unrelated short courses.

Relevant penetration-testing certifications can have a separate section, especially when the job description asks for them. A credential records an assessment or learning route; practical evidence should appear elsewhere. Link the entry indirectly to experience or project bullets showing authorised engagement scope, validated findings, a defined test objective or a tool you wrote. This lets the reader see what you can do as well as what you studied. Never estimate engagement totals or outcomes.

Within the UK CHECK qualification assessment route, CESG's IT Health Check Service includes CHECK Team Member. It also includes CHECK Team Leader, with infrastructure and web-application routes. These details describe that particular route; they do not mean either qualification applies to every penetration tester vacancy. If you hold one, reproduce the credential and applicable route as they appear on your records, for example CHECK Team Leader with the infrastructure route rather than an ambiguous generic level.

A compact entry normally needs the qualification, issuer and year. Label an unfinished credential as "in progress" and add an expected completion date only when you have a firm date. Logos, copied syllabus text and unexplained strings of post-nominals take space away from useful evidence.