How to find a penetration tester.

Offensive security is unusual: the good people leave public, permanent, attributable evidence of exactly what they can do. A CVE credit cannot be exaggerated. A bug bounty reputation score reflects findings against real targets. A CTF placing shows problem-solving under time pressure.

Yet most penetration testing searches ignore all of it and screen on certifications instead — often the wrong ones. Requiring CEH as the primary credential signals to experienced testers that the advert was written by someone outside the field, and suppresses applications from precisely the people you want.

Job titles worth searching

Grouped by what the person actually does, because searching all43 at once produces a result set you cannot triage. Decide which group you need first — that decision does more for the search than any string below.

Certifications, ranked by what they prove

The dividing line is practical versus multiple-choice. Exams requiring live exploitation under time pressure cannot be studied around; written ones can, and practitioners weight them accordingly.

Where penetration testers actually are

The public evidence trail is unmatched in any other role. CVE credits are permanent and attributable. Bug bounty platforms publish researcher reputation built against real targets with disclosed report histories. CTFtime carries competition rankings and detailed writeups showing how someone reasons through a problem. Published tooling — a Burp extension, a custom C2 framework — demonstrates depth that running existing tools does not.

BSides conferences are the most accessible discovery channel. They run in most major cities, are affordable, and publish speaker lists, which makes identifying capable local practitioners straightforward. The larger conferences identify the deepest end of the field through tool releases and research presentations.

One caveat worth respecting: a meaningful part of this community deliberately maintains no public footprint, whether for operational security reasons or because their employer restricts disclosure. Absence of a bug bounty profile proves nothing, and this is why referrals carry more weight in offensive security than in almost any other technical field.

Boolean search strings

Written to be pasted as-is. Each one is built around an intent rather than a platform, since the useful question is what you are trying to find, not which site you happen to be on.

site:linkedin.com/in/ ("penetration tester" OR "red team" OR "offensive security") (OSCP OR CREST OR OSEP) "{city}"

("CVE-2024" OR "CVE-2025" OR "CVE-2026") ("discovered by" OR "credited to" OR "reported by") -jobs -database

(site:hackerone.com OR site:bugcrowd.com OR site:intigriti.com) ("hacktivity" OR "reputation" OR "leaderboard") -jobs

("OSEP" OR "OSWE" OR "OSED" OR "OSCE3" OR "CRTO") -jobs -course -training -exam

(site:ctftime.org OR "CTF writeup") ("team" OR "solved" OR "first blood") 2024..2026 -jobs

("speaker" OR "presented" OR "released") ("DEF CON" OR "Black Hat" OR "BSides" OR "Offensive Con") 2024..2026 -jobs

site:github.com ("C2" OR "implant" OR "exploit" OR "recon tool" OR "burp extension") -awesome -tutorial

("CHECK Team Leader" OR "CREST registered" OR "CRT" OR "CCT") ("penetration test" OR "security assessment") "{city}" -jobs

Mistakes that cost the most time

1. Weighting written certifications over practical ones

   CEH is multiple-choice and widely discounted by practitioners; OSCP requires exploiting live machines in a 24-hour exam. Job adverts that list CEH as the primary requirement signal to experienced testers that the advert was written by someone outside the field, which actively suppresses applications from the people you want.

2. Ignoring the public evidence trail

   This is the one security discipline where capability is genuinely provable in public. CVE credits, bug bounty reputation, CTF placings, and published tooling all demonstrate ability that no interview reliably establishes. Screening on CVs and certifications while ignoring this evidence discards the strongest available signal.

3. Confusing penetration testing with red teaming

   A penetration test enumerates vulnerabilities within an agreed scope on a defined timeline. Red teaming simulates a real adversary over weeks, with stealth objectives and detection avoidance as part of the goal. Red teaming requires operational discipline that standard testing does not develop, and the populations only partly overlap.

4. Not accounting for the consultancy and in-house divide

   Consultancy testers move between many clients and technologies, often travel, and work to tight report deadlines. In-house testers know one environment deeply and work alongside the teams they test. People leave consultancies for in-house roles mainly for travel and delivery pressure reasons, so pitching an in-house role on variety misses what they actually want.

5. Underestimating report writing as a requirement

   A penetration test delivers a report, and much of a tester's professional value lies in explaining findings clearly to both engineers and executives. Technically excellent testers who cannot write are a genuine and common problem in this field. Asking for a redacted writing sample is more informative than most technical screening.

6. Assuming everyone in this field is publicly visible

   Part of this community deliberately maintains a minimal public footprint, for reasons ranging from operational security to employer restrictions on disclosure. Absence of a bug bounty profile or conference history is not evidence of weakness, which is why referrals carry unusual weight in offensive security recruitment.

Common questions

What job titles should I search for when hiring a penetration tester?

Search the test discipline rather than the generic title, since these are different specialisations. Web Application Pentester, Network Penetration Tester, Mobile Application Pentester, and Cloud Penetration Tester describe genuinely different skill sets. For adversary simulation, Red Team Operator and Adversary Emulation Engineer. For the deepest technical work, Vulnerability Researcher, Exploit Developer, and Reverse Engineer. Note that 'Ethical Hacker' appears far more often in job adverts than on practitioner CVs, where Security Consultant is more common.

Which penetration testing certifications actually matter?

The practical ones. OSCP is the respected baseline because it requires exploiting live machines in a 24-hour exam that cannot be studied around. The advanced Offensive Security certifications — OSEP, OSWE, OSED, and the combined OSCE3 — are substantially harder and held by a small population. CRTO and CRTP are well regarded for red teaming and Active Directory attack work. In the UK, CREST registration and CHECK status matter more commercially, since they are contractually required for regulated and government testing. CEH is multiple-choice and widely discounted by practitioners.

How can I verify a penetration tester's actual capability?

Uniquely in security, much of it is publicly provable. CVE credits are permanent, attributable, and cannot be exaggerated. Bug bounty platforms such as HackerOne, Bugcrowd, and Intigriti publish researcher reputation and disclosed report histories against real targets. CTFtime publishes competition rankings and writeups that show reasoning in detail. Published tooling on GitHub — particularly Burp extensions or custom C2 frameworks — demonstrates depth beyond running existing tools. One caveat: some practitioners deliberately maintain no public footprint, so absence of this evidence is not evidence of absence.

What is the difference between penetration testing and red teaming?

A penetration test enumerates as many vulnerabilities as possible within an agreed scope and timeline, and the client knows it is happening. Red teaming simulates a genuine adversary pursuing a specific objective over a longer period, where avoiding detection is part of the exercise and often only a few people at the client know. Red teaming requires operational security discipline, patience, and infrastructure management that standard testing does not develop. The populations overlap but not completely, and hiring a strong pentester for a red team role assumes a transition that takes time.

Where can I find penetration testers outside LinkedIn?

The public evidence channels are the strongest: CVE databases for disclosed vulnerabilities, bug bounty platforms for demonstrated capability against live targets, and CTFtime for competition performance. Conference circuits matter too — BSides events run in most major cities, are affordable and accessible, and publish speaker lists that function as regional shortlists of capable practitioners. Tool releases at DEF CON and Black Hat identify the deepest end of the field. Much of this community is also active on Mastodon and invite-based Discord servers rather than mainstream platforms.