This is where the role of the Web Application Penetration Tester comes into play, and given the threat level of today’s Cyber security landscape, it is a field that is in high demand. It is important to look at how well this role is compensated, and some of the IT certifications that are available with it.

The Average Web Application Penetration Tester Salary by City

Here is a sampling of salary breakdowns by city: SOURCE: paysa.com Based upon these numbers, the average salary for a Web Applications Pen Tester is $157,400.00. From this data, the highest salaries have an interesting geographic spread. Even more interesting is that Hawaii also has a high salary level as well for Web Application Pen Testers. It appears that a vast majority of these jobs are located in coastal cities. It is not surprising to see California pay out some of the higher salaries. Dallas has a fairly high salary level, but this is not too surprising as Texas is currently in a technological growth mode. It looks like that California and Texas will be the “hot” geographic segments for obtaining a position as a Web Application Pen Tester.

The Average Web Application Penetration Tester Salary by Job Title

The table below shows the Web Application Penetration Tester salary breakdown by job title: SOURCES: Indeed.com and Glassdoor.com From the breakdowns in this table, the average salary for a Web Applications Penetration Tester is $107,054.00. The key takeaway here is that a majority of jobs do not have the exact title of “Web Applications Penetration Tester”. It is important to keep in mind that the technical functionalities of a Web Application go much further than just the actual website itself. Because of the varying functionalities that are involved, one will see different job titles, as illustrated in the table. Therefore, a candidate that is desiring to enter this field must be cognizant of the area in Web Application Pen Testing they want to specialize in, and seek out those titles specifically.

The Certifications Associated with Web Application Penetration Testing

There are three specific certs of which the candidate should be aware of, and these are as follows:

The Web Application Defender (also known as the “GWEB”); The Web Application Penetration Tester (also known as the “GWAPT”); The Certified Web Application Security Tester (also known as the “C-WAST”).

The first two are offered by the SANS Institute, and the third is offered by Udemy. Also, the first two certs are much more technical in nature. For example, the candidate must have knowledge in validation flaws, cross site scripting (XSS), and SQL based injection attacks. The latter cert is considered more of a generalist type, where the candidate will learn about Web portal security, testing, design, and ethical hacking.

Conclusions

The world of Web Application Penetration Testing is guaranteed to be an explosive one, given how much the business world is dependent upon having a website. But, it is also very important for the candidate to narrow down their focus in this broad field. This is especially true when it comes to deciding which cert to get, and the specific job title that he or she wants to pursue. Also, the desired salary level will be dependent partially upon geographic location.

SOURCES

quora.com glassdoor.com udemy.com indeed.com paysa.com csiac.org