Penetration tester

What does a penetration tester do?

A penetration tester attacks an organisation's own systems, with written permission, to find weaknesses before real attackers do.

The targets include web and mobile applications, networks, cloud setups and sometimes staff. The tester then reports what was found and how to fix it.

In Singapore, you find this role in bank and insurer security teams, government agencies and their vendors, and cyber security consultancies. Some software and tech firms also hire testers in-house. Consultancies send testers to many clients, while in-house testers focus on one organisation.

You work with developers, system and network engineers, security analysts and risk or audit teams. You also deal with project owners who decide when and how fixes happen. Clear writing matters as much as technical skill.

What the work involves

• Read the scope of a test and agree the rules, targets and time window with the system owner.
• Scan and probe applications, servers and networks to find weak points, using tools such as Burp Suite, Nmap and Metasploit.
• Try to exploit the weaknesses safely, to show what an attacker could actually reach.
• Write test scripts in Python or shell to repeat checks and cover large sets of hosts.
• Write a report that ranks each finding by risk and gives clear steps to fix it.
• Meet developers and system owners to explain findings, then retest after fixes.

Pay in Singapore

Back to top

Skills a penetration tester needs

Back to top

Penetration tester job description

A penetration tester finds weaknesses in applications, networks and cloud systems before attackers do.

You plan authorised tests, run them and report the results. The role sits in an in-house security team or a consultancy that tests for clients.

Responsibilities

• Turn client or business requirements into a test plan with clear scope, methods and limits.
• Run vulnerability assessments and penetration tests on web, mobile, network and cloud systems.
• Test against common weakness lists such as the OWASP Top 10.
• Exploit weaknesses in a controlled way to show real impact, without harming live services.
• Write scripts and tools to automate repeated checks.
• Prepare reports that rank findings by risk and give fixes that developers can follow.
• Present results to technical teams and managers, and answer their questions.
• Retest systems after fixes to confirm the weakness is closed.
• Give input on security policies, standards and secure design for new software.
• Keep up with new attack methods, including attacks on AI systems, and share what you learn with the team.

Requirements

• Diploma or degree in information technology, computer science, computer engineering or cyber security, or equivalent hands-on experience.
• Typically 1 to 3 years in security testing, security operations or development for junior to mid roles, and more for senior roles.
• Working knowledge of networking, Linux and at least one scripting language, usually Python.
• Hands-on use of Burp Suite, Metasploit, Nmap and similar tools.
• Certifications such as CompTIA Security+ or OSCP are often listed, and CISSP is more common for senior roles.
• Clear report writing and the ability to explain risk to non-technical readers.

Back to top

Penetration tester career path

Most penetration testers start in IT, development or security operations, then move into testing and later into senior, lead or offensive security management roles.

1. Junior penetration tester

   Entry

   Runs scans and tests under guidance, repeats known checks and drafts parts of reports.

2. Vulnerability assessment and penetration testing analyst

   Mid · SkillsFuture title

   Writes test plans and scripts, runs tests across infrastructure and applications, and prepares reports on the results.

3. Senior penetration tester

   Senior

   Leads complex tests, handles harder targets such as cloud and Active Directory, and coaches junior testers.

4. Red team lead or security testing lead

   Lead

   Plans attack simulations, manages the test team and agrees scope and risk with senior stakeholders.

5. Head of offensive security

   Head

   Sets the testing strategy for the organisation, owns the budget and reports risk to senior management.

Steps marked "SkillsFuture title" follow the career pathway in the SkillsFuture Skills Framework. The others are titles commonly used in Singapore.

Related jobs and their pay

Back to top

Penetration tester interview questions

We wrote these questions from the skills this job needs. They are not an official question bank.

1. Walk me through how you would test a login page for SQL injection using Burp Suite.

   What a good answer covers

   • Maps the request in Burp Proxy and sends it to Repeater
   • Tests inputs with single quotes and boolean or time-based payloads
   • Compares response size, content and timing to spot differences
   • Explains how to confirm the flaw without dumping live customer data
   • Recommends parameterised queries as the fix

2. Pick three items from the OWASP Top 10 and explain how you would test for each.

   What a good answer covers

   • Names real items such as broken access control, injection and security misconfiguration
   • Gives a concrete test for each, such as changing object IDs between users
   • Describes what evidence proves the weakness
   • Links each item to a practical fix for developers

3. Explain the TCP three-way handshake and how a SYN scan in Nmap uses it.

   What a good answer covers

   • Describes SYN, SYN-ACK and ACK in order
   • Explains that a SYN scan sends SYN and reads the reply without completing the connection
   • Says how open, closed and filtered ports respond differently
   • Notes that firewalls and intrusion detection may flag the scan

4. You have a low-privilege shell on a Linux server. How do you look for a way to gain root?

   What a good answer covers

   • Checks the kernel version, sudo rights and the current user's groups
   • Looks for SUID files, writable cron jobs and weak file permissions
   • Searches for stored credentials in config files and history
   • Uses enumeration scripts and can explain what they check
   • Stays within scope and records each step

5. What is the difference between a vulnerability assessment and a penetration test?

   What a good answer covers

   • Describes an assessment as broad discovery, often tool-driven
   • Describes a test as manual exploitation that proves impact
   • Explains that tests need more time and skill
   • Says when a client needs each, for example routine scanning versus a pre-launch test

6. How would you use Python to check a list of 500 hosts for open web ports and missing security headers?

   What a good answer covers

   • Reads hosts from a file and uses threads or async requests
   • Handles timeouts, redirects and certificate errors
   • Checks headers such as Content-Security-Policy and Strict-Transport-Security
   • Writes results to a CSV file for the report
   • Keeps the request rate low so services are not disrupted

7. In a Windows domain, how could an attacker with a normal user account move towards domain admin?

   What a good answer covers

   • Starts with enumeration of users, groups and service accounts
   • Explains an attack such as Kerberoasting or abuse of weak permissions
   • Mentions credential reuse and misconfigured delegation
   • Describes how defenders can detect or prevent each step

8. How would you test a customer-facing chatbot built on a large language model for prompt injection?

   What a good answer covers

   • Defines what the bot should never do, such as reveal system prompts or other users' data
   • Tries direct and indirect injection, including text hidden in documents or web pages
   • Tests whether connected tools or APIs can be misused
   • Records prompts and outputs as evidence
   • Suggests fixes such as limiting permissions and filtering outputs

1. During a test you find a database holding real customer records, open to anyone on the internal network. What do you do?

   What a good answer covers

   • Stops further access beyond what proves the issue
   • Tells the client contact straight away using the agreed channel
   • Leaves the data uncopied and keeps only minimal evidence
   • Records time, steps and what was seen
   • Recommends access controls and a check for earlier misuse

2. A product owner says your high-risk finding can wait because the system is only used internally. How do you respond?

   What a good answer covers

   • Listens and asks how the system is reached and who can reach it
   • Shows a realistic attack path, such as a phished staff laptop
   • Explains impact in business terms as well as technical terms
   • Offers options, such as a short-term control if a full fix takes time
   • Documents the agreed decision

3. Your scope covers one web application, but you discover it connects to a payment system run by a third-party vendor. What do you do?

   What a good answer covers

   • Treats the vendor system as out of scope unless written permission says otherwise
   • Reports the connection to the client contact
   • Asks the client to get approval from the vendor if testing is needed
   • Keeps testing the in-scope parts
   • Notes the finding and the boundary in the report

1. Tell me about a time you were stuck on a target or lab machine for hours. What did you do?

   What a good answer covers

   • Describes a real example with detail
   • Shows a method, such as re-checking enumeration notes and trying a different angle
   • Mentions asking for help or reading write-ups for ideas instead of copying them
   • Explains what was learned and how notes were improved

2. Describe a time you explained a technical security problem to someone with no technical background.

   What a good answer covers

   • Picks a specific audience, such as a manager or business owner
   • Uses plain words and a simple comparison
   • Focuses on risk and what to do next
   • Checks that the listener understood
   • Says what the outcome was

1. What do you need in place before you start testing a client's systems in Singapore, and why does the Computer Misuse Act matter?

   What a good answer covers

   • Written authorisation from someone with the right to approve it
   • A signed scope covering targets, methods, time windows and contacts
   • Understands that unauthorised access to computer systems can be a criminal offence in Singapore
   • Confirms that third-party or cloud-hosted systems also need approval
   • Keeps the authorisation letter with the test records

2. You are testing a Singapore bank's app and find files with customer personal data. How do the Personal Data Protection Act (PDPA) and Monetary Authority of Singapore (MAS) expectations affect how you handle it?

   What a good answer covers

   • Limits access to personal data and avoids copying it
   • Stores evidence securely and deletes it as the contract requires
   • Reports the exposure promptly to the client's security contact
   • Knows that MAS sets technology risk and security expectations for financial institutions
   • Says the client decides whether a data breach notification is needed, and that you would check the current rules

Common questions about a penetration tester job

Sources