COMPUTING, DATA AND AI

Ethical Hacker / Penetration Tester

Legally breaks into company systems to find security gaps and report how to fix them.

Maths helpful; computers helpful After Class 12 Private sector

Facts checked 29/10/2026

Is this for me?

People in this work enjoy

Puzzle-solving and thinking the way an attacker would
Learning new tools and techniques almost every month
Doing work that protects people, banks and public services

It may not suit you if you dislike

Long study hours, and certification exams that many people fail the first time
High pressure: one careless step in a client's system can cause real damage
Lots of report writing, and the need to keep learning every year to stay current

Class 11–12 subjects: Class 12 with Maths is the usual base. Computer Science or IT helps, but a school may not offer it. The common route after that is a degree in IT or Computer Science.
First degree: BCA, B.Sc in CS or IT, or B.Tech/B.E. in CS or IT, usually 3–4 years. Some people come from other degrees and add skills and certificates later.
Entrance exams: No single national exam for this career. Entry to B.Tech or BCA depends on each college's test or Class 12 marks. The well-known industry certificates are CEH (EC-Council) and OSCP (OffSec).
Licence or registration: None needed to start working.

Subjects that keep this door openClass 11–12: Physics + Mathematics.Maths helpful; computers helpful.Way back: You can add the missing subject later as an extra subject (for example through NIOS) and still apply, but check the exam's and college's rules. A longer road, but open.Check your subjects against every career

What the work is like

Testing networks, websites, apps and cloud set-ups for weak points, with written permission. Running tools and doing manual checks. Writing reports that explain each weakness and how to fix it. Briefing developers and managers.

A day in the work
Your day often starts with a short call to agree the scope of a client's test and the rules you must follow. In the morning you scan a web application and note each weakness you can prove. After lunch you try to get into a test server, and you record every step so someone else can repeat it. The afternoon goes into a clear report, with fixes that developers can actually apply.

The path, step by step

Step 1 · Class 9–12Take Maths and, if your school offers it, Computer Science. Learn how networks, IP addresses and websites work. Get comfortable with the command line early.
Step 2 · Class 12Choose a degree in IT or Computer Science: B.Tech/B.E. in CS or IT, BCA, or B.Sc in CS. Entrance tests and admission rules differ by college and state.
Step 3 · Degree yearsBuild hands-on skills: Linux, basic Python or Bash scripting, and networking. Practise only on lab platforms or systems you own or are allowed to test. Never test someone else's system without permission.
Step 4 · 1–2 years in ITWork in IT support, network administration or a security operations role. CEH asks for about two years of security experience unless you take official training instead.
Step 5 · After 1–2 yearsEarn a recognised certificate. CEH has a 4-hour, 125-question multiple-choice exam. OSCP is a hands-on exam scored out of 100, followed by a written report; third-party guides describe the lab time as about 24 hours. (reported — check with the official body)
Step 6 · First security jobLook for roles in a company security team or with a CERT-In empanelled auditing firm. CERT-In publishes its list of empanelled auditing organisations, so you can check a firm before applying.

Time and money

Stage	Time	Government college or body	Private college	Help available
Class 12 degree choice: B.Tech/B.E. in CS or IT, BCA, or B.Sc in CS (entrance test or Class 12 marks)	3–4 years	Check the college's fee page	Check the college's fee page	Not stated on page
Degree years: hands-on Linux, scripting, networking (lab practice)	Included in degree	Check the college's fee page	Check the college's fee page	—
Optional: NPTEL Ethical Hacking course (enrolment)	Self-paced	Free to enrol; optional certificate exam Rs 1,000 (per course, general category)	Free to enrol; optional certificate exam Rs 1,000 (per course, general category)	Course enrolment is free
Industry certificate: CEH (4-hour, 125-question exam) or OSCP (hands-on exam)	1 day exam (CEH); OSCP lab about 24 hours (reported)	Privately paid, priced in US dollars; check each provider's page	Privately paid, priced in US dollars; check each provider's page	Not government-paid; no provider fee figures on page

Total timeAbout 4–6 years after Class 12 (degree, 1–2 years in IT, then certificate)

Total costDepends mostly on the college you choose — compare fee pages.

Good to knowRs 1,250 applies to NPTEL exams on programming courses; CEH and OSCP training is privately paid, not government-paid.

Fees from: NPTEL: Ethical Hacking course page (certificate fee on an earlier run) · EC-Council: Certified Ethical Hacker (CEH) page · Uttarakhand Open University - NPTEL Local Chapter (certification fees). Fees change every year — check the college's own fee page before you pay.

What people earn

Pay depends a lot on experience, city and employer. Entry roles pay modestly, while people with years of testing work and well-known certificates earn more, especially in banks, consulting firms and large product companies.

Myth and fact

Myth: ~~You must be a criminal hacker or a coding genius to do this job.~~

Fact: Ethical hacking is legal and done only with written permission and a defined scope. You need solid networking and Linux basics, and your coding skills grow with the work.

Try it now

Class 7–9Turn on two-factor login for one of your own accounts and explain to a family member why strong passwords matter. Ask your computer teacher about a coding or cyber-safety club.
Class 10–12Read the free NPTEL Ethical Hacking syllabus and see whether the networking and Linux topics interest you.Open link ↗
College or afterFind the next run of NPTEL's Cyber Security and Privacy course and enrol when it opens. Finish the weekly assignments before you go deeper into labs.Open link ↗

Good to know

No licence is needed by law. CEH and OSCP are private certificates, so employers judge you on your work and what you can show.
Testing a system without written permission is illegal under Indian law, even if your intent is to help. Permission and a clear scope come first.
Under CERT-In rules as summarised by a consultancy, empanelled firms should not send freshers on audit assignments, so early jobs are often in support or testing-assistant roles.
If you are weak in Maths or do not want a degree, a BCA or IT diploma route plus certificates still works for many people in support roles first.

Sources: EC-Council: Certified Ethical Hacker (CEH) page · OffSec: OSCP+ Exam Guide · CERT-In: Empanelled Information Security Auditing Organisations list · NPTEL (IIT Kharagpur): Ethical Hacking course page · NPTEL: course list with Jul–Oct 2026 runs · US Army COOL: CEH credential page (renewal rules) · TCSA: what a CERT-In empanelled auditor may and may not do (consultancy summary, reported)