Job Placement · Cybersecurity · Penetration Tester
BEG recruits penetration testers through direct hire milestone billing, not a percentage of salary. The fee for this seat runs $9,381 to $11,257, priced at Tier II, with an average fill time of 23 to 35 days, and candidates are priced against what the same skill bills out at externally, not the in-house median alone.
See your placement estimate - no call required
See pricing before you talk to anyone. No demo gate, no obligation, and no co-employment.
TL;DR
The firm wants a tester with a public track record in its own environment type at the in-house median wage, while testers with that record are billed out by consultancies at the 75th to 90th percentile, or work for themselves. BEG prices against the real market.
The Hiring Problem
The firm wants a tester with a public track record in its own environment type at the $116,580 median, while testers with that record are billed out by consultancies at the 75th to 90th percentile or work for themselves.
How BEG Fills This Seat
Four steps built around a real testing track record and a market-accurate offer, not a generic security job description.
| Step | What it requires | Where it stalls |
|---|---|---|
| Scope the rules of engagement | The systems in bounds, the exploitation limits and the reporting format defined before sourcing starts | Postings ask for penetration testing without defining scope, so candidates cannot tell what they would actually be doing |
| Source for a real track record | Candidates with public findings, disclosures or competition results in a comparable environment type, not a certification list alone | Most credentialed applicants have never run an engagement against this specific environment type |
| Vet the written finding, not just the exploit | A sample report with severity ratings and remediation guidance, since the deliverable is the report, not the access gained | Strong technical testers write findings a non technical stakeholder cannot act on, and the offer stalls at that gap |
| Close against the consulting rate, not the in-house median | An offer that accounts for what the same skill bills out at externally | An offer at the $116,580 in-house median loses to a consultancy or freelance rate in the $157,500 to $188,470 band |
This search competes with a consulting day rate, not another in-house posting. BEG prices the offer against that external market from the first call.
Milestone Billing Against Contingency
Computer occupations, all other, the code covering this seat, carried a $116,580 median wage in May 2025. Contingency math against that figure runs $23,316 at 20 percent or $29,145 at 25 percent. BEG's flat Tier II milestone, $9,381 to $11,257, comes to 40 to 48 percent of the lower number, before the search even reaches the consulting rate this candidate could otherwise bill. BLS OEWS
What the Math Shows at the Consulting Rate
Priced close to where consultancies actually bill this skill, the gap widens further. At the $157,500 75th percentile, a 20 percent contingency fee is $31,500 and BEG's fee is 30 to 36 percent of it, well under a third of what a percentage of salary model would charge at that band. BLS OEWS
Direct Hire, Contingency, or Staffing
The written finding under signed rules of engagement is the deliverable, which needs a defined scope and legal coverage a loose staffing arrangement rarely provides cleanly.
| Model | Who employs | How you pay | Right when |
|---|---|---|---|
| BEG, direct hire | You, from the tester’s first day | Staged payments totaling $9,381 to $11,257, fixed at the offer regardless of the eventual salary | You need an in-house tester with standing authorization, not a one-off engagement |
| Contingency recruiter | You, the hiring company | A percentage of first year salary, commonly 20 to 25 percent, due at start | Your security team can already validate a tester’s public track record without a specialist search |
| Staffing agency or consultancy | The staffing firm or consultancy, not you | A day rate or hourly bill rate with the firm’s markup built in | You need a single scoped engagement or an annual assessment, not a permanent in-house tester |
A one-off engagement is a legitimate way to buy this skill. A standing in-house tester is a different decision, and it is the one this search is built for. See the rest of the ladder on the cybersecurity hub.
FAQ
The authorized attack: scoping, testing and exploitation within signed rules of engagement, plus the written findings with severity and remediation. Fixing anything or owning the control environment sits with a security engineer.
It helps. Security+ weights threats, vulnerabilities and mitigations at 22 percent of the exam, maps to the DoD 8140 vulnerability analyst role, and sits on ISC2’s approved credential list for a one year CISSP experience waiver.
A fixed Tier II milestone of $9,381 to $11,257, the same tier as a security engineer, agreed before sourcing starts rather than pegged to the accepted offer.
The posting wants a tester with a public track record at the $116,580 in-house median, while testers with that record are billed out by consultancies at the 75th to 90th percentile or work for themselves.
A security engineer builds and defends the controls. This seat attacks them within an authorized, scoped engagement and hands back a written finding, without fixing anything itself.
This seat probes what was actually built for exploitable weaknesses. A security architect sets the design standards before anything is built, and rarely tests the finished system directly.
There is no dedicated BLS code. O*NET lists penetration testers under computer occupations, all other, SOC 15-1299, alongside information security engineers and digital forensics analysts.
The code that covers this role held 471,200 jobs in 2025 and grows 5 percent by 2035, about 24,200 new jobs, a smaller projected pace than information security analysts overall.
Against the $116,580 median, BEG's fee of $9,381 to $11,257 is 40 to 48 percent of a 20 percent contingency fee, and against the $157,500 75th percentile it is 30 to 36 percent.
A single scoped assessment fits a consultancy or a staffing arrangement well. A standing need for ongoing testing and institutional knowledge of your environment fits a direct hire, which is the search BEG runs.
BEG prices this seat at the same milestone tier, Tier II, reflecting comparable search complexity, even though the scope, offensive testing rather than building and running controls, is distinct.
Fixing a discovered vulnerability or owning the control environment afterward sits with a security engineer. This seat delivers the authorized attack and the written finding, not the remediation.
Compare this to a security engineer, who fixes what this seat finds, or a security architect, whose designs this seat tests. All seven cybersecurity tiers are listed on the placement hub.
More cybersecurity placement
Ready?
Answer a few questions, get your placement estimate in about 90 seconds. No call required, no commitment.
See your placement estimate - no call required
