UK

United Kingdom · Technology and data · Principal/Manager (12-16 years)

Penetration Testing Manager

Here is the whole job, in plain words. What it is, what you decide, how you're judged, how people get here and where they go next. Then the part no course gives you: twelve AI tutors who learn your work.

Start my Penetration Testing Manager plan, free

Free to start: a plan built for this role, and a Future Fluency module to try first. No card.

Keep this job description

Where should we send it?

One email: what AI is changing in this job, and where to start free. With a link back here. Nothing else follows unless you confirm your address.

Upskilling a team in this role? Talk to us

  • Experience bandPrincipal/Manager (12-16 years)
  • Direct reports10-25 reports
  • Reports toDirector of Offensive Security
  • UK framework levelUsually a manager, or the deepest specialist in a team

Also advertised as Head of Offensive Security · Principal Security Consultant (Offensive) · Security Assurance Lead · Offensive Security Team Lead

Built on 43,079 real UK job descriptions we analysed · grounded in qualifications employers recognise

Two short quizzes about you

1From this job to a course

The qualifications matched to this job

OTHM Level 5 Diploma in Cyber Security OTHM Qualifications · Level 5 · covers 3 of 10 standards
OTHM Level 5 Extended Diploma in Cyber Security OTHM Qualifications · Level 5 · covers 3 of 10 standards
ATHE Level 5 Extended Diploma in Computing ATHE Ltd · Level 5 · covers 3 of 10 standards
NCC Education Level 5 Diploma In Computing NCC Education Limited · Level 5 · covers 3 of 10 standards
ATHE Level 7 Extended Diploma in Computing ATHE Ltd · Level 7 · covers 8 of 10 standards
NCFE Level 3 Certificate in Cyber Security Practices NCFE · Level 3 · covers 4 of 10 standards

Matched from the standards this job is measured against: a suggestion, not an official ruling.

The units you would start with

Ethical Hacking OTHM Level 5 Diploma in Cyber Security
Penetration Testing and Ethical Hacking ATHE Level 5 Extended Diploma in Computing
Ethical Hacking and Information Security Assessments NCC Education Level 5 Diploma In Computing
Cyber Security Operations: Threat Analysis, Testing, and Incident Response ATHE Level 7 Extended Diploma in Computing
Cyber security testing, vulnerabilities and controls NCFE Level 3 Certificate in Cyber Security Practices

The future skills this job leans on

AI Fluency working with AI as a thinking partner
Data Fluency turning numbers into a decision
Systems Fluency seeing the whole picture
Trust Fluency keeping the digital world safe
Start my Penetration Testing Manager plan, free
Your Plan Illustration

Built for Penetration Testing Manager

5 units that map to this job, from the qualifications that cover it.

  1. Ethical Hacking OTHM Qualifications · covers 3 of 10 standards Level 5
  2. Penetration Testing and Ethical Hacking ATHE Ltd · covers 3 of 10 standards Level 5
  3. Ethical Hacking and Information Security Assessments NCC Education Limited · covers 3 of 10 standards Level 5
  4. Cyber Security Operations: Threat Analysis, Testing, and Incident Response ATHE Ltd · covers 8 of 10 standards Level 7
  5. Cyber security testing, vulnerabilities and controls NCFE · covers 4 of 10 standards Level 3
These are the real units behind this job, in the order they rank for it. Nothing here is marked done, because this plan has not been started by anyone yet. Yours would fill in as you go.

2AI and this work

Will AI change your work as a Penetration Testing Manager?

Nobody can say exactly how. Here is what this job is being asked for next, and where to start.

The new skills this role is being asked for

  • AI-Driven Security Operations & Threat Emulation
  • Organisational Resilience & Business Continuity Testing
Why each one is rising

The future skills this job leans on

We'll only ever tell you what we can actually back up. No hype, no scare tactics.

What happens when you start

Next, a free account. We build your Penetration Testing Manager plan as you set up, starting with a Future Fluency module on using AI in your job. No card.

Your first Future Fluency module is free. After that, your AI tutor is £70 a month.

Start my Penetration Testing Manager plan, free Ready to pay? Subscribe for £70 a month

3What this role really is

A penetration testing manager runs and shapes a penetration testing function, deciding how systems are attacked, tested and reported on. The role covers the team's output, its development, and making sure offensive security work reduces real risk to the organisation.

4What you'd actually use

The tools this job runs on, and how well you'd need to know each one.

Kali Linux Strategic

Setting standards for team environments, evaluating new distributions/tools for inclusion, and understanding the OS's role in the broader security ecosystem. You'll guide your team on optimal use, not necessarily be hands-on daily.

Burp Suite Professional Architect

Defining web application testing methodology for the team, integrating Burp with CI/CD pipelines, and training others on advanced techniques. You'll ensure your team is getting the most out of it.

Metasploit Framework Strategic

Integrating Metasploit into larger Red Team campaign orchestration. Evaluating commercial alternatives like Cobalt Strike for team-wide adoption and managing licensing.

Nmap Architect

Designing enterprise-wide discovery and scanning strategies. Correlating Nmap output with other data sources for comprehensive asset intelligence and reporting.

Python (with Scapy/Requests) Strategic

Architecting automation frameworks for the entire testing lifecycle. Championing 'offense-as-code' initiatives within the team and guiding custom tool development efforts.

Nessus / Tenable.io Strategic

Managing the enterprise vulnerability management programme. Using trend data from Tenable to inform strategic security investments and report risk to the board. Overseeing scanner deployment and policy.

Hashcat Strategic

Designing and maintaining the team's password cracking rig and methodologies. Advising on enterprise password policy based on cracking metrics and industry best practices.

5What you get to decide, and how that grows

Power in a job isn't your title. It's what you're allowed to decide. Here's how it grows as you move up.

The choiceComing in Where you are nowThe step above
Team Hiring & Structure No authority; recommends candidates to hiring manager. No authority; participates in interviews, provides feedback. Recommends hires; input on team structure; final say on junior roles within project budget.
Methodology & Tooling Selection Follows established methodologies; uses approved tools. Chooses appropriate tools/methods for routine tests; proposes improvements. Designs methodologies for complex engagements; evaluates new tools for team adoption (with lead input).
Budget Allocation (Functional) No budget authority; requests resources via supervisor. No budget authority. Manages small project budgets (up to £5K) for specific engagements; requests larger spend.
Risk Acceptance & Prioritisation Identifies risks; escalates to supervisor for prioritisation. Assesses severity; recommends prioritisation to manager. Proposes risk acceptance/remediation strategies for project-level findings.

6How you'll be judged

The scoreboard, and what is not on it. The hard targets, how often each is actually looked at, and the quiet signals that never reach a dashboard.

Vulnerability Remediation Rate (Critical/High)
The percentage of critical and high-severity vulnerabilities identified by your team that are actually fixed within their agreed-upon Service Level Agreements (SLAs).
Target · Increase from current 60% to 85% year-over-year

If your team finds 100 critical/high issues in Q1, and 85 of them are closed within the SLA by Q2, you're hitting the 85% target. This shows we're not just finding issues, but getting them fixed.

Team Utilisation & Engagement Rate
The percentage of time your team members spend on billable engagements or high-value internal security assessments, balanced with their professional development and research time.
Target · Maintain >85% utilisation for billable roles; >70% for internal roles, including 10% R&D time.

If you have a team of 10, and 8 of them are consistently working on client engagements or internal tests, while the other 2 are doing training or tool development, you're managing resources effectively. We don't want 'scanner monkeys', but we also need to deliver.

Programme Coverage & Scope Expansion
How effectively your team's testing programme covers our critical assets and how often we expand our testing scope to new technologies or business units.
Target · Achieve 100% coverage of critical applications annually; expand testing to 2 new technology areas (e.g., IoT, specific cloud services) per year.

This year, we've tested all our customer-facing web apps and our core banking systems. Next year, you'll need to add our new mobile payment platform and our internal Kubernetes clusters to the regular testing schedule.

Budget Adherence & Cost Efficiency
How well you manage the penetration testing team's budget, ensuring we get maximum value from our tools, training, and external services.
Target · Stay within ±5% of allocated budget; identify and implement 1-2 cost-saving initiatives per year.

You've been allocated £1.2M for the year. Coming in at £1.18M while still hitting all your targets, or finding a way to consolidate two expensive tools into one, shows smart financial management.

Strategic Impact on Security Architecture
The extent to which your team's findings and recommendations directly influence significant improvements in our overall security architecture and design principles.
  • Your team's input is regularly sought during design reviews for new systems. At least one major security architecture change per year is directly attributable to a pattern of findings from your team. You're presenting to the Architecture Review Board with actionable insights, not just a list of bugs.
Team Morale & Development
The health, engagement, and professional growth of your penetration testing team.
  • High retention rates for your team members (below 15% annual attrition). Positive feedback in internal engagement surveys. Your team members are actively pursuing new certifications or internal training, and you're seeing junior testers progress to senior roles. People actually want to work on your team.
Stakeholder Trust & Collaboration
How effectively your team collaborates with development, product, and other security teams, building trust and fostering a 'security-as-a-partner' culture.
  • Development teams are proactively reaching out to your team for advice before a test. You're regularly invited to sprint planning or architectural design meetings. Feedback from other departments consistently highlights your team's helpfulness and clarity, not just their ability to break things.
Quality of Reporting & Communication
The clarity, accuracy, and business relevance of your team's penetration test reports and presentations.
  • Reports are consistently delivered on time and require minimal edits from senior leadership. Non-technical stakeholders (e.g., product managers, legal) can easily understand the business impact of findings. Your team's PoCs are clear, repeatable, and help developers fix issues efficiently.

7Would you like it

Both sides. What people enjoy, and what grinds them down.

What people enjoy
Building & Empowering a High-Performing Team

You'll spend time mentoring junior staff, designing training programmes, and celebrating team successes. Seeing your team members grow in skill and confidence, and knowing you've helped them achieve their potential, will be a huge driver.

Watching a tester you mentored lead their first complex engagement successfully, or seeing the team collectively solve a tricky exploitation problem that you helped frame.

Driving Strategic Security Improvements

You'll be constantly looking for ways to improve our overall security posture, not just find individual bugs. This means defining new testing methodologies, influencing architectural decisions, and seeing your team's work lead to tangible reductions in risk.

Implementing a new continuous penetration testing programme that catches critical flaws earlier in the development lifecycle, or seeing a pattern of findings lead to a fundamental change in how we secure our cloud environments.

Solving Complex Organisational & Technical Challenges

You'll be tackling problems like 'how do we test this new IoT platform at scale?' or 'how do we get engineering to prioritise security fixes faster?' These are messy, multi-faceted problems that require both technical savvy and strong people skills.

Successfully rolling out a new secure development lifecycle (SDLC) integration for penetration testing, or navigating organisational politics to get a critical security initiative funded and resourced.

What frustrates people
  • The constant battle for resources and budget to keep the team equipped and trained.
  • Dealing with the 'finding vs. fixing' gap, where your team identifies critical issues but remediation is slow or deprioritised.
  • Managing team members who are brilliant technically but struggle with communication or teamwork.
  • The sheer volume of administrative tasks, reporting, and scheduling that comes with leading a team.
  • Having to justify the value of offensive security to non-technical senior leaders who just see it as a cost.
What this role does not give you
  • Extensive hands-on, individual penetration testing (you'll still do some, but it's not your primary focus).
  • A quiet, heads-down environment; expect constant interruptions and people-related challenges.
  • Instant gratification from every vulnerability found; organisational change takes time and persistence.
  • A clear-cut, purely technical problem-solving role; you'll be solving people and process problems just as much.

8Who you work with

You'll directly influence the organisation's security risk posture by ensuring a robust, proactive offensive security programme. Your team's findings will drive remediation efforts, inform security architecture decisions, and help shape developer security training. Get this right, and we avoid major breaches; get it wrong, and we're exposed to significant financial and reputational damage.

Inside the business
  • Director of Offensive Security
  • CISO and Security Leadership Team
  • Heads of Engineering and Product Development
  • Internal Audit and Risk Management
  • Legal and Compliance Teams
Outside the business
  • External Audit firms
  • Security Vendors and Tool Providers
  • Industry Peer Groups and Forums
  • Potential Clients (for pre-sales discussions)

9What you need before you start

Not a wish list. The things you would be expected to already have.

  • Extensive hands-on experience (at least 8-10 years) as a Senior or Lead Penetration Tester, with a proven track record of finding and exploiting complex vulnerabilities across diverse environments.
  • Demonstrable experience in leading small teams or mentoring junior security professionals, with a clear passion for developing others.
  • A deep, practical understanding of offensive security methodologies, tools, and techniques, including web, network, cloud, and API testing.
  • Proven ability to communicate complex technical risks and remediation strategies effectively to both technical and non-technical audiences, including senior leadership.
  • Experience in programme management, including planning, scheduling, and delivering multiple security testing engagements concurrently.
  • A strong ethical compass and a commitment to responsible disclosure and professional conduct in all offensive security activities.

10What to practise next

Where the job is going, and what to do about it starting this week.

Advanced Cloud Native Exploitation & Security

Cloud environments are constantly evolving, with new services and architectures emerging regularly. Your team will need to master exploiting these, and you'll need to understand the underlying principles to set the strategy for testing containerisation, serverless, and complex microservices architectures.

Kubernetes & Container Security · Serverless Function Exploitation · Cloud Identity & Access Management (IAM) · Cloud Security Posture Management (CSPM) Bypass

  • This quarter: Ensure your team has access to dedicated cloud security training and labs (e.g., CloudGoat, Pacu).
  • Next 6 months: Develop a comprehensive cloud penetration testing methodology for your team, covering all major services we use.
  • Next 9 months: Engage with our cloud architecture team to understand upcoming deployments and proactively identify testing needs.
  • Next 12 months: Evaluate and integrate new cloud-specific offensive security tools into your team's toolkit.

Quick win: Encourage your team to complete a cloud security certification (e.g., AWS Security Specialty, Azure Security Engineer) and share their learnings.

Purple Teaming & Threat Hunting Integration

The most effective security programmes involve Red and Blue Teams working together ('Purple Teaming'). You'll need to drive this collaboration, ensuring your team's offensive insights directly enhance the Blue Team's detection and response capabilities, and vice-versa.

MITRE ATT&CK for Purple Teaming · Threat Hunting Methodologies · Detection Engineering · Post-Exploitation Forensics

  • This quarter: Schedule regular joint sessions between your team and the Blue Team to share recent findings and TTPs.
  • Next 6 months: Implement a formal 'Purple Team' exercise where your team executes specific attacks while the Blue Team attempts to detect and respond.
  • Next 9 months: Establish a feedback loop where Blue Team detection gaps directly inform your team's future testing priorities.
  • Next 12 months: Develop a shared knowledge base of attack techniques and corresponding detection strategies.

Quick win: Start by having your team document not just how they exploited something, but what logs/artefacts they left behind, to help the Blue Team.

11Staying current once you are in

What people here do to keep up
  • Actively participate in security conferences (e.g., Black Hat, DEF CON, BSides) and industry forums to stay current with emerging threats and network with peers.
  • Contribute to open-source security projects or publish research on new attack techniques or defensive strategies.
  • Mentor junior security professionals, either formally within the team or informally through community initiatives.
  • Pursue advanced certifications in areas like cloud security, red teaming, or exploit development to maintain technical edge.
  • Engage in public speaking or presenting on offensive security topics to build thought leadership and influence.

12The rising capability

The rising capability

Zavmo analysis

What's rising in its place

This is where the work is heading, and the higher pay with it. Get fluent here and the shift stops being a threat and starts being your edge.

AI-Driven Security Operations & Threat Emulation

AI is rapidly changing how both attackers and defenders operate. Attackers will use AI to generate more sophisticated exploits and evade detection, while defenders will use it for faster analysis. As a manager, you'll need to understand how to integrate AI into your team's offensive toolkit and how to test AI-driven defences.

  • AI for Exploit Generation
  • AI-Powered Reconnaissance
  • Testing AI/ML Systems
  • AI in Blue Team Operations

Organisational Resilience & Business Continuity Testing

Beyond just finding technical vulnerabilities, businesses are increasingly focused on their overall resilience. Your role will expand to ensure your team's findings directly feed into and test the organisation's ability to withstand and recover from significant cyber incidents, not just prevent them.

  • Cyber Resilience Frameworks
  • Tabletop Exercises & Simulation
  • Supply Chain Security Testing
  • Operational Technology (OT) & IoT Security

13What you’ll use

What you’ll use

Skills this role draws on

Technical

  • Advanced Offensive Security Methodologies
  • Enterprise Vulnerability Management
  • Cloud Security (AWS/Azure/GCP)
  • Application Security (OWASP ASVS & API Security)
  • Red Teaming & Adversary Simulation

14The pathway

The pathway

How you actually get there, here

How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.

  1. 1

    Lead Penetration Tester / Staff Security Researcher

    3-5 years in this role

    Skills to master

    • Deep specialisation in a technical domain (e.g., cloud, AD, exploit dev), ability to architect complex testing strategies, strong mentorship of junior staff, and influencing technical direction.

    You're ready to move on when

    • Successfully led multiple complex, multi-week engagements end-to-end.
    • Consistently developed and contributed custom tools or methodologies to the team.
    • Mentored at least 2-3 junior/mid-level testers to a point of significant independent contribution.
    • Demonstrated ability to present technical findings clearly to senior engineering leadership.
    • Proactively identified and addressed systemic security issues, not just individual bugs.
  2. 2

    Security Architect (with Offensive Specialisation)

    4-6 years in this role

    Skills to master

    • Designing secure systems from the ground up, understanding enterprise architecture, translating offensive findings into preventative controls, and influencing design decisions across the organisation.

    You're ready to move on when

    • Regularly consulted by engineering teams during the design phase of new products.
    • Successfully influenced major architectural changes based on security principles.
    • Deep understanding of secure coding practices and defensive controls.
    • Ability to bridge the gap between offensive insights and practical, scalable defensive solutions.
  3. 3

    Security Operations Lead (with Offensive Background)

    5-7 years in this role

    Skills to master

    • Managing a Security Operations Centre (SOC), incident response leadership, threat hunting, and integrating offensive intelligence to improve detection capabilities.

    You're ready to move on when

    • Strong understanding of SIEM, EDR, and other defensive security tools.
    • Experience in leading incident response efforts and post-incident analysis.
    • Demonstrated ability to use offensive insights to improve defensive playbooks and detection rules.
    • Proven leadership skills in a fast-paced, high-pressure operational environment.

15Where this role leads

The long view: This role can lead to CISO, to specialising further as an external consultant, or to a broader engineering leadership role. The ability to understand, test and secure complex systems carries into all of them.

The ten Future Fluencies

Zavmo analysis

The credential is what you can do today. These are what keep you valuable.

A qualification proves you can do the job as it's defined today. These ten are what decide whether you're still the obvious person for it in five years. They're the capabilities employers are now writing into senior roles faster than people are learning them. Zavmo weaves them through whatever you study, so you come out with both: the credential and the fluency.

The highlighted ones are the Fluencies your role leans on hardest, from how Penetration Testing Manager is actually changing.

Where it leads

Roles this leads to

Also named as a next step, with no page in the catalogue yet:

  • Principal Security Consultant (External)

How you would learn this

One to one, on the work you already do

A tutor sets the task against your own job and marks the reasoning, at your pace. There is no cohort to fall behind.

A lesson from Ethical Hacking, worked against Penetration Testing Manager.

Ethical Hacking Level 5

Applied to your work in Penetration Testing Manager

This unit aims to equip learners with the knowledge and skills to perform ethical hacking and penetration testing to enhance cyber security. Learners will learn to identify and exploit security vulnerabilities in a controlled environment, while adhering to legal and ethical considerations.

How the thinking builds
  1. 1 Remember
  2. 2 Understand
  3. 3 Apply
  4. 4 Analyse
  5. 5 Evaluate
  6. 6 Create
An illustration of a Zavmo lesson, built from this role’s own route. The unit, its objective and every criterion above are the awarding body’s own words, not an example.

It is £70 a month, billed monthly. Your free first module is Future Fluency, and you can cancel any time.

Start my Penetration Testing Manager plan, free
See Your Progress Grow Illustration
Penetration Testing Manager
  • Advanced Offensive Security Methodologies
  • Enterprise Vulnerability Management
  • Cloud Security (AWS/Azure/GCP)
  • Application Security (OWASP ASVS & API Security)
  • Red Teaming & Adversary Simulation
This is your Mind Palace on learn.zavmo.ai. Every skill above comes from this role's own record, not an example borrowed from another job. A node lights up when you evidence it, and what you build stays yours between jobs. That is the part a course cannot do.

16The detail, folded away

Everything else the record holds

The career branches in full, how AI is already showing up in the day-to-day, and the questions people ask about this job. Here when you want them, out of the way while you decide.

Where it leads next, rung by rung

Where it leads

The career path, and where it branches

Penetration Testing Manager is a start, not a ceiling. Each step below asks for new skills and hands back more autonomy.

  1. Director of Offensive Security

    3-5 years as Penetration Testing Manager

    Level 6 (Director/VP)

    • Owning the entire offensive security programme (Red Team, Pentesting, Vuln Management)
    • Integrating offensive findings into overall security strategy and risk posture
    • Managing relationships with C-Suite, board, and external regulators
    • Driving cultural change around security across the enterprise

  2. Principal Security Consultant (External)

    3-5 years as Penetration Testing Manager

    Level 5/6 (Individual Contributor path)

    • Leading complex, multi-disciplinary security engagements for external clients
    • Designing and implementing bespoke security testing programmes for unique client needs
    • Providing expert advice on security strategy, architecture, and risk management to client executives
    • Mentoring and guiding junior consultants on client projects
Working with AI on the job

Working with AI

Where AI is starting to help

As a Penetration Testing Manager, your time is precious. You're balancing team leadership, strategic planning, and stakeholder engagement. Imagine if your team could deliver higher quality, more comprehensive tests in less time, freeing you up to focus on the bigger picture. That's where AI comes in.

We're embedding AI tools directly into our offensive security workflows to automate the tedious, repetitive tasks that eat up your team's valuable time. This isn't about replacing human expertise; it's about augmenting it, allowing your testers to focus on the truly creative, high-impact exploitation work. For you, it means a more efficient, effective, and engaged team.

Automated Recon & Enumeration

Your team can use AI-powered tools to continuously scan public assets (think GitHub, S3 buckets, subdomains) and intelligently chain reconnaissance steps. This means they get a prioritised list of potential targets and attack vectors delivered to them, often before the manual test even officially begins. Less grunt work, more focused attack planning.

Exploit Path Analysis & Correlation

Imagine feeding all the raw outputs from Nmap, Nessus, and Burp Suite into an AI model. It then correlates findings across the entire technology stack, identifying complex, multi-step attack paths that a human might easily miss. This could be a public web flaw leading to an internal pivot to an unpatched database. Your team finds the 'golden tickets' faster.

CVE & Exploit Research Assistant

When a new CVE drops, or your team needs to understand common misconfigurations for a specific tech (e.g., 'AWS RDS running PostgreSQL 14.1'), an LLM can rapidly summarise new CVEs, translate technical advisories into plain English, and even generate boilerplate code for Proof-of-Concept exploits. It's like having a lightning-fast research assistant for every tester.

Intelligent Report Generation & Quality Control

The 'reporting treadmill' is a huge pain point. AI can transform your team's raw technical notes and tool outputs into well-structured report sections. It can draft executive summaries by translating technical risk into business impact, write standardised remediation advice, and ensure consistent formatting. This frees up your testers to focus on finding, not writing, and ensures higher quality, more consistent reports for you to review.

Common questions

Common questions

How do you become a Penetration Testing Manager?

Common routes in include Lead Penetration Tester / Staff Security Researcher (3-5 years in this role), Security Architect (with Offensive Specialisation) (4-6 years in this role) and Security Operations Lead (with Offensive Background) (5-7 years in this role). Times vary with prior experience.

Where can a Penetration Testing Manager progress to?

This role can lead on to Director of Offensive Security (3-5 years as Penetration Testing Manager) and Principal Security Consultant (External) (3-5 years as Penetration Testing Manager), depending on the skills you build.

What new skills matter most for a Penetration Testing Manager?

Increasingly, AI-Driven Security Operations & Threat Emulation and Organisational Resilience & Business Continuity Testing. These are the skills our record of this role lists as growing.

Free tools

Want a read on where you stand?

Three free tools, no account needed. Each one ends with a role, a level and a way in.

Read the Zavmo manifesto to understand how you will be taught Meet your tutors

Or try another one

17Where to go from here

Other roles at Level 5

Same depth of qualification, different job. Useful if the work appeals but this particular role does not.

 More jobs in technology and data

Stay in the field you know and move sideways rather than up.
If you leave this industry

Skills built as a penetration testing manager carry across most industries, including finance, tech, government and healthcare. Every organisation needs offensive security leadership. This can lead to work at a security vendor, a large enterprise, or a specialist consulting firm.

This role profile is © 2026 Growth Engineering Technologies Ltd. Built from UK occupational standards and regulated qualification data, and written for Zavmo.

You're not behind. You're right on time. The shift is only just beginning. Your role won't look the same in two years. Be the one who leads the change, not the one it happens to. Start my Penetration Testing Manager plan, free What happens next: a free account, then we build your plan as you set up. No card. Build your plan, see your roadmap and meet the twelve tutors matched to you. All free. When you're ready to start learning, it's £70 a month, billed monthly. Cancel any time and billing stops.