/ Career Outlook / By

Is Ethical Hacking a Good Career? Pay, Path and Day-to-Day in the UK

Yes, for the right person. In the UK, ethical hacking is a real, paid job, and the job title to search for is "penetration tester", and UK permanent job adverts for that title quoted a median salary of £65,000 in the six months to 10 November 2026 (ITJobsWatch). It suits people who enjoy methodical testing and clear report writing, but it usually follows some industry experience rather than being a first job, and it is only legal because the owner of every system you test has authorised it.

Security professional working at a computer workstation with code on screen in an office

This guide covers what the work looks like day to day, the law that frames it, the UK qualifications and schemes employers recognise, how people get in, and an honest list of pros and cons. If you want the fun side or the ethical debates, we have covered those in The Ethical Hacker’s Playground and Ethics in Hacking, so we will not repeat them here.

Is being a hacker actually a job?

Yes, and the job title to look for is penetration tester: Prospects, the graduate careers service, notes that penetration testers are “sometimes known as ‘pen testers’ or ‘ethical hackers'”. The UK’s National Cyber Security Centre (NCSC) defines penetration testing as “a method for gaining assurance in the security of an IT system by attempting to breach some or all of that system’s security, using the same tools and techniques as an adversary might.” In other words, organisations commission it to gain assurance that their defences work.

According to Prospects, testers more commonly work for a security consultancy or risk management organisation, testing external clients’ systems, than in-house for large companies, and with several years’ experience can move into self-employed or consultancy work.

What a penetration tester does day to day

A typical engagement has three stages, and only one of them is the hacking people picture.

  1. Scoping. Agreeing with the client what is in and out of bounds, which test types to run, the timeframe and any reporting requirements. NCSC guidance says scoping should involve the risk owners, technical staff who know the system and a representative of the test team.
  2. Testing. Working through networks, servers, web or mobile applications or cloud services to find weaknesses and, within the agreed rules, show whether they can be exploited.
  3. Reporting. NCSC says the report should include the security issues found, the testers’ assessment of the risk each one poses, and “a method of resolving each issue found”. In reports under the NCSC’s CHECK scheme, risk must be stated as HIGH, MEDIUM, LOW or INFORMATIONAL.

Prospects lists creating reports and presenting findings to management among the core duties. If you cannot explain a flaw in plain English, the client cannot fix it.

On working environment, the Prospects careers service describes a typical 37 to 40 hour week, says “you may need to work outside your usual 9am to 5pm pattern”, and notes that the work can be done onsite or remotely, with travel to meet clients likely.

The law: the Computer Misuse Act 1990

The line between ethical hacking and crime in the UK is authorisation. The Computer Misuse Act 1990 creates the core offences:

  • Section 1: unauthorised access to computer material. On indictment this carries up to two years’ imprisonment.
  • Section 2: unauthorised access with intent to commit or facilitate further offences.
  • Section 3: unauthorised acts with intent to impair, or recklessness as to impairing, the operation of a computer.
  • Section 3ZA: unauthorised acts causing, or creating risk of, serious damage.
  • Section 3A: making, supplying or obtaining articles for use in an offence under section 1, 3 or 3ZA.

Section 17(8) explains that an act is unauthorised when the person doing it is not entitled to decide whether it may be done and does not have consent from someone who is. In practice, that is why professional testers work to a signed scope and authorisation from the system owner, and never test anything outside it.

Reform status (November 2026): the Act has not yet been changed to protect security researchers. At Report stage of the Cyber Security and Resilience (Network and Information Systems) Bill on 26 October 2026, the government told the House of Lords that the Home Office “proposes to introduce a defence to Section 1 for accredited cyber security researchers”, that it will legislate “as soon as parliamentary time allows”, and that the legislation “is in development”. Until a defence is actually passed and in force, the safe rule is unchanged: no authorisation, no testing.

UK qualifications and schemes employers recognise

There is no single licence to practise, but UK job adverts and government schemes keep returning to the same few names. All details below are taken from the bodies’ own websites.

Qualification or schemeWho runs itWhat the body says about it
CREST Practitioner Security Analyst (CPSA)CRESTAn “entry level exam”; successful candidates are qualified for hands-on pen test roles “indicative of 2 years experience”
CREST Registered Penetration Tester (CRT)CRESTAn “intermediate level examination” (indicative of 3+ years’ experience); a valid CPSA is required first; 2.5-hour exam; recognised by the NCSC for CHECK
CREST Certified Tester, Infrastructure (CCT INF)CRESTIndicative of 5 to 6+ years’ experience
OffSec Certified Professional (OSCP)OffSecLinked to the PEN-200 course; a 24-hour proctored, hands-on exam; the OSCP+ designation expires three years from issue
Professional titles, Security Testing specialismUK Cyber Security CouncilSecurity Testing is one of eight specialisms, “sometimes also known as penetration testing”
CHECKNCSCThe scheme under which NCSC-assured companies test public sector and critical national infrastructure systems

CHECK matters for career planning because it links the qualifications together. Under the NCSC’s Assured CHECK Scheme Standard (v1.1, November 2024), CHECK Team Members must hold a UK Cyber Security Council Security Testing title at Practitioner level and CHECK Team Leaders at Principal level, and both must hold at least SC clearance. If you want to test government systems, expect clearance to be part of the job.

How people get into ethical hacking

Prospects says: “It’s unlikely you’ll go straight from graduation into a penetration tester role; you will usually need some industry experience.” The common routes are:

  • IT first, then security. Prospects says a first role is likely to be in junior systems administration, IT development or IT support, moving into testing with experience and qualifications.
  • Degree apprenticeships. In England, the Level 6 Cyber security technical professional (integrated degree) apprenticeship (currently being revised, with this version still approved for delivery) typically lasts 48 months and includes ethical reconnaissance and testing work done “in accordance with legal & ethical requirements”.
  • Graduate schemes and trainee roles. Some large organisations run cyber security graduate schemes that include pen testing, and Scotland’s My World of Work service notes you can apply for a paid trainee role where you learn on the job without needing previous experience.
  • Self-directed practice. Legal practice labs and capture the flag (CTF) competitions let you build and show skills without breaking the law. Our guide to the world’s most famous CTF competitions lists beginner-friendly ones.

For example, imagine an IT support technician who spends a year or two learning networking and Linux, practises on legal labs, passes CPSA, and then applies for a junior tester role at a consultancy. That is a hypothetical path, not a guarantee, but it follows the order that Prospects and CREST’s exam levels suggest: foundations, then practice, then a recognised exam.

What does an ethical hacker earn in the UK?

Pay varies with experience, location, clearance and employer, so treat any single figure with care. One transparent public source is ITJobsWatch, which summarises salaries quoted in UK job adverts. For the job title “Penetration Tester”, permanent roles, in the six months to 10 November 2026:

Measure (advertised salaries, UK permanent roles)Value
10th percentile£45,000
Median£65,000
90th percentile£90,000
Median, UK excluding London£55,000
Adverts / adverts quoting a salary202 / 149

Three cautions. First, these are advertised salaries, not what people are actually paid. Second, sample sizes vary: the same six-month period in 2025 had only 37 adverts, of which 19 quoted a salary (median £60,000), so year-to-year changes can swing a lot. Third, the figures only cover adverts using that job title, so trainee and junior roles advertised under other titles are not included.

Pros and cons of an ethical hacking career

Pros

  • Strong advertised pay once qualified: a £65,000 median in the data above.
  • Recognised progression: CREST exams from entry-level CPSA up to CCT, and CHECK roles from Team Member to Team Leader.
  • Varied work: different clients, systems and technologies from one engagement to the next.
  • Visible impact: each report gives an organisation specific fixes for real weaknesses.

Cons

  • A long run-up. CREST’s own exams are pitched at roughly two years’ experience and upwards.
  • Constant relearning. Prospects lists a commitment to continuously updating your technical knowledge as a key skill, and OffSec’s OSCP+ designation expires after three years.
  • Lots of writing. The report is the product the client pays for.
  • Hours outside 9am to 5pm and travel to clients, as Prospects notes.
  • Clearance and legal care. Government work needs SC clearance, and the Computer Misuse Act leaves no room for testing outside your authorisation.

Is it right for you, and where to start

Ethical hacking is a good career if you like taking systems apart to understand them, can stay patient through repetitive checks, and are happy to write up what you found for a non-technical reader. If what attracts you is the idea of “hacking” more than the testing, reporting and rules, a defensive role such as security operations or governance, risk and compliance may suit you better.

Whichever way you lean, the first step is the same: solid foundations in networks, systems and security concepts. LSCS’s CyberForce bootcamp is a 4-week, BCS Tech 10 accredited course for beginners and career switchers covering network, system and cloud security, vulnerability scanning and security testing labs, security operations and career development sessions. It is a foundation, not a penetration testing certification. Contact us for dates.

Frequently asked questions

Is ethical hacking a good career in the UK?

Yes, for people who enjoy methodical testing and report writing. UK permanent job adverts for penetration testers quoted a median of £65,000 in the six months to 10 November 2026 (ITJobsWatch), but you will usually need some IT or security experience first.

Is ethical hacking legal in the UK?

Yes, when the person responsible for the system has authorised the testing. Without that consent, accessing a computer can be an offence under section 1 of the Computer Misuse Act 1990.

Do I need a degree to become a penetration tester?

Not always. Prospects notes it is possible to get a position without a degree if you have significant information security experience and industry certifications, and degree apprenticeships are another route.

Which certification should a beginner aim for?

In the UK, CREST describes its CPSA as an entry level exam and a prerequisite for the CRT. OffSec’s OSCP, earned through a hands-on exam, is another certification Prospects lists. Check current job adverts to see what employers in your target sector ask for.

What is the NCSC CHECK scheme?

CHECK is the NCSC scheme under which assured companies carry out authorised penetration tests of public sector and critical national infrastructure systems. Testers need a UK Cyber Security Council Security Testing title and at least SC clearance.

References

Start Learning With LSCS

Student wearing headphones studying online on a laptop at home
OUR COURSES

RELATED POSTS

ALL POSTS
European Union flags flying outside a glass office building
Across Industry

NIS2, DORA and the UK Cyber Resilience Bill: A Director’s Briefing

November 11, 2026
Professional studying with books and a laptop in a library
Career Outlook

CGRC vs CRISC vs ISO 27001 Lead Auditor: Which GRC Cert to Take?

November 11, 2026
Colleagues reviewing printed charts and a laptop at a meeting table
Across Industry

Cyber Risk Register Template: How to Build One and Actually Use It

November 11, 2026

Stay Ahead With LSCS

Get critical Cybersecurity updates, events invitations, and industry analysis. Our immersive, hands-on training is the most direct path to a high-growth cyber career.

Subscription Form
Scroll to Top