Average Web Application Penetration Testing Salary [Updated 2021]

Introduction

For businesses and corporations, it is crucial to secure web based applications. After all, it is not just their bottom line at stake, but their brand, reputation, and most importantly their customers that are at grave risk as well. Thus, it is important on a regular schedule, to penetration test these web based applications to make sure that all known and unknown vulnerabilities are fixed and sealed.

This is where the role of the Web Application Penetration Tester comes into play, and given the threat level of today’s Cyber security landscape, it is a field that is in high demand. It is important to look at how well this role is compensated, and some of the IT certifications that are available with it.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

The Average Web Application Penetration Tester Salary by City

Here is a sampling of salary breakdowns by city:

City and State Salary

Fort Belvoir, VA $134,000

Atlanta, GA $132,000

El Segundo, CA $129,000

Huntsville, AL $122,000

Martinsburg, WV $220,000

Chula Vista, CA $182,000

O'Hau, HI $177,000

Dallas, TX $162,000

Baltimore, MD $159,000

Albuquerque, NM $157,000

SOURCE: paysa.com

Based upon these numbers, the average salary for a Web Applications Pen Tester is $157,400.00. From this data, the highest salaries have an interesting geographic spread.

Even more interesting is that Hawaii also has a high salary level as well for Web Application Pen Testers. It appears that a vast majority of these jobs are located in coastal cities. It is not surprising to see California pay out some of the higher salaries.

Dallas has a fairly high salary level, but this is not too surprising as Texas is currently in a technological growth mode. It looks like that California and Texas will be the “hot” geographic segments for obtaining a position as a Web Application Pen Tester.

The Average Web Application Penetration Tester Salary by Job Title

The table below shows the Web Application Penetration Tester salary breakdown by job title:

Job Title Salary

Penetration Tester $120,921

Penetration Tester - Cyber Security Tester $125,000

Senior/Principal Security Engineer - Penetration Tester $155,000

Software Security Architect $131,000

Network Penetration Tester $84,000

Penetration Tester - Application Security $103,000

Information Security Engineer - Automated Dynamic Application Security Tester $90,000

Application Penetration Test Engineer Expert $75,500

Application Vulnerability Risk Management Consultant $71,500

Senior IT Security Analyst $91,500

Software Security Engineer $157,500

SOURCES: Indeed.com and Glassdoor.com

From the breakdowns in this table, the average salary for a Web Applications Penetration Tester is $107,054.00. The key takeaway here is that a majority of jobs do not have the exact title of “Web Applications Penetration Tester”.

It is important to keep in mind that the technical functionalities of a Web Application go much further than just the actual website itself.

Because of the varying functionalities that are involved, one will see different job titles, as illustrated in the table.

Therefore, a candidate that is desiring to enter this field must be cognizant of the area in Web Application Pen Testing they want to specialize in, and seek out those titles specifically.

The Certifications Associated with Web Application Penetration Testing

There are three specific certs of which the candidate should be aware of, and these are as follows:

• The Web Application Defender (also known as the “GWEB”);
• The Web Application Penetration Tester (also known as the “GWAPT”);
• The Certified Web Application Security Tester (also known as the “C-WAST”).

The first two are offered by the SANS Institute, and the third is offered by Udemy. Also, the first two certs are much more technical in nature. For example, the candidate must have knowledge in validation flaws, cross site scripting (XSS), and SQL based injection attacks.

The latter cert is considered more of a generalist type, where the candidate will learn about Web portal security, testing, design, and ethical hacking.

Conclusions

The world of Web Application Penetration Testing is guaranteed to be an explosive one, given how much the business world is dependent upon having a website. But, it is also very important for the candidate to narrow down their focus in this broad field.

This is especially true when it comes to deciding which cert to get, and the specific job title that he or she wants to pursue. Also, the desired salary level will be dependent partially upon geographic location.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

SOURCES

• quora.com
• glassdoor.com
• udemy.com
• indeed.com
• paysa.com
• csiac.org