Penetration Tester Resume:
The Complete 2026 Guide

Just into the field, hold it to one page. Once you have run real client engagements end to end, achieved domain admin on internal engagements, found critical web findings, and led a red-team objective, two pages start earning their keep: the second sheet gets read when the engagement work behind it actually holds up. The blanket one-page rule misses that a senior Penetration Tester career covers a long line of engagements led, critical findings surfaced, and CVEs published worth showing. Save three pages for principal or red-team lead level where that track really fills them.

Comes down to what engagements are actually running with your name on them, not a fixed rule. New to the role: one page covers it. A few years in, with critical findings you surfaced, domain admin compromises you owned, and custom tools you authored, squeezing it all onto a single sheet cuts the very numbers earning the screen. Engagement track beats page count on this resume.

Your current role, by a long way. Roughly 95% of the read sits there, since that is where the recruiter checks whether you have actually run engagements at the technical depth this team needs. The profile summary lands one beat earlier, and the recruiter uses that line as the lens over everything below.

A plain layout: one column, no graphics, no sidebars, no icons. Use the standard labels (Profile Summary, Technical Skills, Work Experience, Education); export PDF, not DOCX. Then run the file through my free ATS parser tool and check that Burp Suite, Metasploit, Nmap, BloodHound, Cobalt Strike, OSCP, OSEP, and the rest of your pen-test stack parse cleanly. If any of those drop out, the layout broke the read, not your keyword list.

For a 2026 Penetration Tester search the must-haves are network testing tools (Nmap, Metasploit, Nessus), Burp Suite Professional for web testing, an Active Directory exploitation kit (BloodHound, Impacket, NetExec, Rubeus), a C2 framework (Cobalt Strike, Sliver, or Mythic), MITRE ATT&CK fluency, and at least one industry methodology (PTES, OWASP WSTG, NIST 800-115). Strong backups: cloud testing tooling (Pacu, ScoutSuite, Prowler), mobile testing (Frida, Objection, MobSF), reporting platforms (PlexTrac, Dradis), and Python or PowerShell for custom tooling. At least one top-tier certification (OSCP, OSEP, CRTO, GPEN, GXPN) is expected past 2 years on the job. The full list, each paired with a sample bullet, sits in the Technical Skills section above.

Lead with both. Engagement count proves you have shipped real client work at scale (30+ engagements a year is a number a hiring manager respects). Critical findings prove you went past report-padding and surfaced things that actually moved a client's risk register (RCEs, domain admin chains, data-exfil paths). A resume with only counts reads as "rotated through scope"; a resume with only findings reads as "cherry-picked the easy ones". The shortlist goes to the candidate who shows both: the volume you delivered plus the depth you found on top of it.

For entry- and mid-level roles, yes, OSCP (or an equivalent: PNPT, eCPPT, CRTP for AD-focused) is the de-facto floor. It is the certification recruiters search for and the one that gets your resume past the first filter. Past 3-4 years on the job, the engagement track outweighs the badge: 38 engagements per year with 14 critical findings and a published CVE beats OSCP on its own. Stack OSCP early; layer OSEP, OSED, CRTO, or GIAC GPEN/GXPN later as you specialize. List what you have, do not stall the job search waiting on more.

Five or six bullets, no more. A heavy paragraph forces slow reading at the moment the recruiter intends to skim, and on a Penetration Tester role what they scan for is the engagement scope, the network and web stack, the AD and post-exploitation kit, the C2 framework, and the certifications you carry. As bullets the recruiter can match you against the role at a glance and decide whether the rest of the page is worth more time.