▸ Hiring playbook · 2026
How to hire a Penetration Tester
Hire penetration testers who find what attackers would. This is the same 5-step playbook our customers run for every hire - start to offer in ~21 days.
14–21d
Time to hire
kickoff to signed offer
2–3
Interview rounds
incl. final
92%
Offer acceptance
vs ~60% industry
~5:1
Shortlist-to-hire
typical ratio
Blueprint
The 5-step process
Each step has a clear owner, a typical duration and a deliverable. Run it like a sprint.
- 01
Define the role and must-have skills
Day 0 · 1 hrAgree the 3–5 non-negotiable skills before sourcing. For a penetration tester, that's typically Burp Suite, Metasploit, Web AppSec, Cloud Pentest plus demonstrable experience shipping production systems.
- 02
Decide on level, comp, and working pattern
Day 0 · 30 minMid-level penetration testers earn around £65k–£90k; senior hires reach £95k–£135k. Confirm hybrid/remote expectations upfront - it's the single biggest deal-breaker on offers.
- 03
Source vetted candidates
Day 1Skip cold sourcing. Haystack matches you with pre-vetted penetration testers actively interviewing, with skills, salary and notice period verified upfront.
- 04
Run a focused 2–3 stage process
Day 2–10Keep it tight: 30-min intro, technical deep-dive, and a final round with team and leadership. Avoid take-homes longer than 2 hours - top candidates won't engage.
- 05
Reference, offer, and onboard
Day 10–14Move fast on offer once a decision is made. Senior penetration testers often have multiple processes running; a 24–48 hour offer window is the new normal.
£65k–£90k
Mid-level base
Anchor your comp band around the mid-level number. A senior penetration tester reaches £95k–£135k; juniors start near £45k–£60k. Add ~10–15% for London and Berlin, and 25–40% for SF and NYC, where total comp dominates base.
Must-have vs nice-to-have skills
4 core · 4 nice to have
Core stack
Nice to have
Python
BashWatch-outs
Common mistakes that kill penetration tester hires
Vague job description
Skills like "Burp Suite" need years of experience and context. Specify it.
Too many interview rounds
Top candidates drop after the 3rd. Cap at 3, including final.
Lowballing on offer
Internal salaries go stale fast. Benchmark every 6 months - not yearly.
Skipping references
Live-coding catches what dialogue won't. Always do at least one paired session.
Slow offer turnaround
48 hours after final round is the upper bound. Faster wins the candidate.
No defined scorecard
Hiring 'gut feel' alone leads to inconsistent decisions across panels.
What a great penetration tester owns
Use this as your interview scorecard. Score each candidate 1–5 per item; calibrate as a panel.
- Run black-box and grey-box pentests
- Write actionable, prioritised reports
- Partner with engineering on remediation guidance
- Drive purple-team exercises with detection teams
Deep dive
The penetration tester hiring playbook
Penetration Tester specialist or generalist - which should you hire?
The honest answer depends on the half-life of your penetration tester surface area. If you expect to keep investing in Burp Suite and Metasploit work over the next 18-24 months, a specialist penetration tester will out-deliver a generalist on day-30 throughput and stakeholder confidence.
If your team is under ten people, or penetration tester responsibilities are spread across two or three roles already, hire a strong generalist who has shipped this work in anger at least twice. The cross-disciplinary pattern recognition will pay for itself the first time priorities collide.
On Haystack we surface both - filtered by whether the candidate self-identifies as a penetration tester specialist and verified against their last two roles. Expect to pay around £65k–£90k for a mid-level UK hire, scaling toward £95k–£135k for senior.
What strong penetration testers actually bring
A great penetration tester is not the one with the longest CV - it is the one who has owned a hard Burp Suite call and changed how they work because of how it landed. Across the engineering hires we have placed in 2025-2026, the same patterns keep showing up.
- Active mentorship of at least one other penetration tester or adjacent role - usually a junior - within the first quarter.
- Versioned, observable penetration tester work - measurable outputs, structured logs of decisions, and a clear rollback path on every change.
- Documented trade-off notes on the calls they made, including the option they rejected and why.
- An opinion on what NOT to do with Burp Suite, backed by an example where adding it would have hurt the team.
Red flags when interviewing penetration testers
Every discipline has its own pattern of plausible-sounding answers that fall apart in production. For penetration testers, these are the patterns that most often correlate with a six-month regret hire on the employer side.
- Cannot name a single penetration tester project where they removed scope rather than added it.
- Defines "senior penetration tester" purely by years of experience, not by the scope of decisions they own.
- Lists Burp Suite on the CV but cannot describe a single trade-off they hit in production - all framework, no friction.
- Treats the penetration tester role as a job title rather than a problem to solve - no opinion on what they would change about how the discipline is typically practised.
What to expect in the first 30 days from a Haystack penetration tester hire
By week one, the new penetration tester should have shipped a small, low-risk artefact to production or a stakeholder - a docs fix, a small process change, a first review on someone else's work. The goal is to validate the loop, not to ship anything heroic.
By week two, the penetration tester is shadowing the active workstreams, attending standups in observe-mode, and asking pointed questions about why specific decisions were made. If they are not asking those questions, the hire is going to plateau.
By day 30, they own one cleanly-scoped slice of the penetration tester surface area, have published a public ramp-up doc, and are the named point of contact for stakeholders inside that slice. Every Haystack employer gets a structured onboarding template, so you are not reinventing the playbook each hire.
Keep exploring
Keep going
Ready to hire a penetration tester?
Start matching with vetted, interview-ready candidates today.