Roles · Penetration Testing Engineer · Junior

What a Junior } should know

13 core skills, 50 in total. Expectations per skill, and what changes at the next level.

This page lists what a Junior } is expected to know and do, skill by skill. Core skills are the ones a manager and peers assess in a review cycle; the rest count only in self-assessment. Main areas: Security.

13core skills
37additional skills
1skill areas
0%at Advanced or Expert
Assess myself as Junior Full role matrix

Core skills for a Junior

Grouped by area. The label on the right is the expected depth: Awareness, Working, Advanced or Expert.

Security · 13

Cloud Security Awareness

Understands basic Cloud Infrastructure Security concepts. Follows security guidelines. Recognizes common vulnerabilities in code.

Dependency Vulnerability Scanning Awareness

Understands basic Dependency Vulnerability Scanning concepts. Follows security guidelines. Recognizes common vulnerabilities in code.

Digital Forensics Basics Awareness

Understands basic Digital Forensics concepts. Follows security guidelines. Recognizes common vulnerabilities in code.

Incident Response Process Awareness

Understands basic Incident Response Process concepts. Follows security guidelines. Recognizes common vulnerabilities in code.

JWT / OAuth2 / OIDC Awareness

Understands JWT/OAuth2 concepts from a security testing perspective: common JWT vulnerabilities (none algorithm, key confusion), OAuth2 redirect URI manipulation, and token leakage vectors. Recognizes insecure token storage and transmission patterns. Follows team guidelines for authentication security assessments.

Kubernetes Security Awareness

Understands basic Kubernetes Security concepts. Follows security guidelines. Recognizes common vulnerabilities in code.

Network Security Awareness

Understands basic network security concepts: TCP/IP model, common ports and protocols, firewall rule logic. Can run Nmap scans, read packet captures in Wireshark, and identify open services on a target host under supervision.

OWASP & Application Security Awareness

Understands basic OWASP and Application Security concepts. Follows security guidelines. Recognizes common vulnerabilities in code.

RBAC / ABAC Authorization Awareness

Understands basic RBAC / ABAC Authorization concepts. Follows security guidelines. Recognizes common vulnerabilities in code.

SAST/DAST Awareness

Understands basic SAST/DAST concepts. Follows security guidelines. Recognizes common vulnerabilities in code.

Secure Coding Practices Awareness

Understands basic secure coding concepts from a penetration testing perspective — recognizes injection, authentication bypass, and insecure deserialization patterns in source code. Follows security guidelines for identifying exploitable code weaknesses and understands how common vulnerabilities manifest in different programming languages.

Threat Modeling Awareness

Understands basic Threat Modeling concepts. Follows security guidelines. Recognizes common vulnerabilities in code.

Vulnerability Management Awareness

Understands basic Vulnerability Management concepts. Follows security guidelines. Recognizes common vulnerabilities in code.

Additional skills

Not assessed by the team, but part of the self-assessment and the development plan.

Algorithms & ComplexityAPI DocumentationAPI TestingAsync ProgrammingAWSChatGPT / ClaudeCode Quality & RefactoringCode ReviewContainer Security ScanningCursor IDEData StructuresDesign PatternsDockerELK StackGit AdvancedGitHub Actions / GitLab CIGitHub CopilotGraphQL DesignIntegration TestingKubernetes CoreMultithreadingNetwork FundamentalsOOP & SOLID PrinciplesOpenTelemetryPostgreSQLPrometheus & GrafanaPrompt Engineering for CodeRate Limiting & ThrottlingRedisREST API DesignRunbook & Playbook WritingSecurity TestingStructured LoggingSystem Design FundamentalsUnit TestingVPN & Network IsolationWebSocket API Design

What changes at Mid-level

50 skills get a higher expectation or become core when moving from Junior to Mid-level. The biggest jumps first.

See the Mid-level page →
Run this with your whole team
Self-assessment plus manager and peer reviews against the same matrix, gap analysis and next-level readiness for every engineer. Team Pro is free for 14 days; individual tools stay free forever.
Start a team trial (14 days free) Send to my manager

} in the open competency matrix: 50 skills across 5 levels. The matrix is free for individuals and stays free.