Penetration Testing contract jobs: rates and IR35
UK Penetration Testing contract jobs are how clients buy this skill without opening a permanent seat. The work is authorised testing of a system the client owns, reported in a way an engineering team can fix. This page is the market around that skill: who hires, what the day rate looks like, how IR35 tends to fall, and the live contracts on IR35 Jobs.
Updated 1 November 20264 min read
What a Penetration Testing contract is
UK Penetration Testing contract jobs are how clients buy this skill without opening a permanent seat. Clients hire for authorised testing of a system the client owns, reported in a way an engineering team can fix. The contract is usually three to six months with an extension if the work continues, and the advert should say whether it is outside IR35, inside IR35, or silent. Silent is common, and it is not the same thing as outside.
You are not an employee of the client. Even on an inside IR35 contract the legal shape is still a contract, paid by an umbrella or by agency PAYE. On an outside contract you invoice through your own company. The IR35 calculator shows the take-home difference on any day rate you are offered.
Who is hiring
Regulated firms, government, and any board that has just had a finding it cannot leave until next year are the clients behind most Penetration Testing adverts. Agencies still post the majority of contract roles in the UK, so the name on the row is often the recruiter, not the end client. The skill and the IR35 line tell you more than the agency brand.
Demand moves with programmes, not with the calendar. A quiet week on Penetration Testing is not a dead market. New contracts are added every hour, and the ones from the last 48 hours are visible to members first because that is when they get filled.
Penetration Testing day rates
Advertised Penetration Testing day rates commonly sit between £500 and £900. That is the headline number, before tax, umbrella margin or the costs of a limited company. Work clusters in London, Manchester, Cheltenham-adjacent remote roles, Bristol and Edinburgh. The rate on a specific advert is on the board when the recruiter published one. Where they wrote "competitive" instead, the role is harder to compare and usually not in a hurry to tell you.
A higher inside IR35 rate can be worth less than a lower outside one. Run both numbers before you negotiate, and read the Penetration Testing day rate guide for how to compare them. Benchmarks across skills are on UK contractor day rates.
IR35 on these contracts
Penetration Testing contracts are genuinely mixed. Product companies and smaller clients more often advertise outside IR35. Large programmes, and anything with a body-shop agency in the chain, more often advertise inside. Treat "outside" as a claim to check, not as a promise, and price an inside offer against take-home rather than against the headline.
Penetration Testing outside IR35 jobs collects the point in one place. The live filter is outside IR35 jobs across every skill, and inside IR35 jobs for the other column. We report the status the advert states. We do not decide it, and neither does a keyword.
Where the work is
Penetration Testing contracts turn up most often in London, Manchester, Cheltenham-adjacent remote roles, Bristol and Edinburgh. A city on the advert is not always a daily commute. Hybrid is the default pitch, and a role marked remote should say so rather than implying it.
Use the board's location and radius filters once you are a member. Free browsing shows the delayed board. The link through to the original advert, on every Penetration Testing job, is part of membership and the 14-day pass.
Live roles on the board
These Penetration Testing contracts are on the board now. The day rate and IR35 status are public. The link to the original advert is for members.
- Cyber Security Consultant / Penetration Tester — Maidenhead
- Junior Penetration Tester — Fareham
- Penetration Tester — UK, £500-£501/day Inside
- Penetration Tester - Cyber Security Global Firm — England
- PENETRATION TESTER - SC cleared - Fully Remote £700 a day - CTL — Remote , UK, £650-£700/day Outside
- URGENT REQUIREMENT - REMOTE - PENETRATION TESTER - CTL — Remote , UK, £650-£700/day Outside
- PENETRATION TESTER - SC cleared - Fully Remote £700 a day - CTL — United Kingdom, £650-£700/day Outside
- Penetration Tester — Belfast
See live Penetration Testing contracts · Membership unlocks apply links and the first 48 hours