How do I interview and evaluate a penetration tester candidate?

OSCP and CEH are common screening credentials, and each tests something real, but neither substitutes for watching a candidate work. OSCP (Offensive Security Certified Professional) requires passing a 24-hour hands-on exam and is widely respected for its practical rigor; CEH (Certified Ethical Hacker) is broader and more theory-heavy. Both indicate baseline exposure to offensive methodology, but certification pass/fail does not tell you how a candidate approaches an engagement your team actually runs, against your actual technology stack.

Build the assessment around a scoped, realistic exercise. A deliberately vulnerable VM (built in-house or adapted from platforms like HackTheBox or TryHackMe content, used privately and not as a live public box) that mirrors your typical engagement type, web application, internal network, or cloud environment, gives you direct evidence of methodology: does the candidate enumerate systematically before attempting exploits, or jump straight to known CVEs? Do they document findings as they go, or reconstruct everything at the end?

Score the written report as heavily as the technical result. Client-facing penetration testing is as much a communication discipline as a technical one: a report that buries a critical finding on page 40 in dense jargon fails the client regardless of how good the underlying testing was. Ask for a short written summary of the exercise findings, written as if for a non-technical stakeholder, and evaluate clarity and prioritization alongside technical accuracy.

Interview for engagement judgment, not just technique. Ask how the candidate handles a stalled engagement (an application that resists every attempted technique within the time-boxed window), how they scope a test to avoid disrupting production systems, and how they've handled a client who disputed a finding. These scenarios come up in real engagements constantly and separate a technically skilled tester from one who is also safe to put in front of a client.

Watch for over-indexing on tool familiarity. Metasploit, Burp Suite, and Nmap fluency matter, but tools change faster than methodology. A candidate who understands the underlying attack logic adapts to new tools quickly; a candidate who only knows a memorized sequence of commands in one tool struggles the moment the environment differs from their practice setup.

Reference and portfolio checks carry real weight here, more than in most cybersecurity hiring. Ask for a redacted sample report from a past engagement (many testers keep a sanitized portfolio piece for exactly this purpose) and check it against the writing-quality bar above. A candidate with no prior client-facing report to show, for junior hires, is normal; for a senior hire claiming years of consulting experience, its absence is a real flag.

DecipherU for Teams' penetration-tester readiness assessment scores exactly this combination, methodology, technical result, and report quality, on a standardized rubric, so hiring teams get comparable signal across candidates instead of relying on certification lists alone. See the related career entry for penetration-tester and the certification comparison in oscp-vs-ceh-which-is-better for how the two credentials actually differ.