[Music] what's going on everyone in this video
I'm going to talk about the slightly taboo topic in any industry and this is
salaries of a penetration tester in the UK it's not too hard to know where you
should be sat on the salary scale depending on if you are a junior
penetration tester or if you're a more senior penetration tester or red teamer
so the UK is very exam driven we have a body called cheque and these are the
people that really set the standards of penetration testing in the UK and then
there's exam providers who follow these specifications such as crest or Tiger
scheme or there's a few others as well but they're the main ones and they set
the exams out that you need to pass to become a cheque team member or cheque
team leader this is kind of what you aim for as a pen tester in the UK if you
just come out of university or if you maybe just hold the osep or you know
you've got kind of very basic knowledge in pen testing that's your first level
in as a penetration testing job most likely of course you need to remember
that these salary scales are going to be very dependent on you as a person and
how much value you actually might give to a business as many factors on this so
don't take this as this is a definite but these are the kind of ranges that
you should be looking at so for an OSC P basic knowledge type person you should
be looking at something around twenty-five thousand a year once you
gain a bit more knowledge you've passed the Academy you're probably going to be
taking the CRT exam which is the crest registered tester if you're going for a
crest once you take this exam which is a written multiple-choice and also a
practical kind of salt course where you hack boxes and try and pass it that way
once you've got this exam you should be looking at around thirty five to fifty
five thousand a year your next move on from this is check
team leader at this point you're probably doing quite intense government
type jobs known as IT health checks they're
not fun they're not easy and they do require
quite a lot of management and knowledge so not only do you need to be quite
experienced in the field and take this exam there's a lot of managerial kind of
work that goes along with this and with the czech team leader there's two
different crest exams to do this the first one is infrastructure and the
second one is applications so depending on what your specialty is personally if
you're better infrastructure off your bear and web apps and compiled
applications and things like that you take either one of these once you've
passed one of them you should be looking at around sixty to seventy-five thousand
pounds a year then you want to try and go for your double CTO your double check
team leader so that's if you've taken a nap you're gonna go for imp if you're
taken in if you're gonna go for app that will make you a double check team leader
at this point you're looking at about eighty to ninety thousand pounds a year
then your next step and probably your final step in the kind of check team
world is to take see sass or C Sam so this is when you start becoming a red
teamer this is actually picking a scenario and with the client and working
with them to try and properly hack them and simulate a real-world attack so this
is very specialist work and that's why it's paying so highly so the C sass is
the kind of practical work and the C Sam is more of a managerial penetration
testing qualification so once you have one of these or both of them you're
easily looking around a hundred thousand plus a year again these are all
subjective to the company you're working for and obviously yourself as well so
it's the value you bring to the company so if you're someone that has a lot of
blogs and you're getting a lot of reach with that if you've got quite a lot of
influence in the industry you know you've got a big network of people that
you know and this can potentially bring clients to the company and basically you
need to make yourself an asset to the company you won't be paid these kind of
top-end salaries unless you're bringing good value to the
company of course and of course it's also to do with your accomplishments so
if you're already working for a company and you've done a lot for the company
you might have made a few tools that the company hosts on their internal github
or and really help out the team these give you more value and make you more an
asset to the company so you would probably be looking at the top end of
this scale rather than the bottom end and this brings me to my next point is
you need to negotiate so if you get offered a certain amount and you don't
think that's fair because you've done all of these accomplishments and you've
done loads of blogs and you know you're really bringing traffic and revenue to
the company you need to negotiate that or else you're just gonna say yes and
not beyond what you deserve to be on and there's other factors as well so some
companies will expect you to travel a lot and these companies you would
typically want the higher end anyway because other companies you might be 100
percent remote working in your underpants at home so you know you've
got to think about these things as well so if your remote you're probably
looking at more of the lower end scale because you don't have to travel on a
Sunday for example and use your own time so these tend to be lower paying jobs
anyway and then there's other benefits that come with some companies so some
companies might fly you out to conferences such as DEFCON you you might
get training days and they you know this might be a few exams might be free and
quite often you might get research days and kind of you know just have these
little benefits that are worth more than having a high salary so there's a lot
that comes with being a penetration tester and depending on what salary you
get but these as I say these are the the rough scales of what you should be
looking at they're by no means the absolute definite what you should be
getting but this is a bit of a video to make you understand kind of what you
should be aiming towards and a kind of pathway through your career as well and
of course I'm from CSIS and see Sam you might want to move into more a
managerial role where you're managing a team of red teamers or team of
penetration testers and this kind of goes out the realm of being a
penetration tester or a red team so higher salaries will come with that but
if your focus purely on being a penetration tester / red teamer
here's your scale and yeah try and work towards that it's kind of all I've got
to say so thanks for watching guys give the video a like give the channel a
subscribe I really appreciate it thank you