Boolean search strings for penetration testers: web, network, cloud and red team, with OSCP, GIAC and CREST checks
On this page
- Targets, exams and verification tools that change what a pentest search finds
- Ten Boolean strings by kind of offensive work
- What LinkedIn, Dice and Google actually support
- Narrowing by target, delivery model and report writing
- False positives worth excluding with NOT
- A worked example: three passes on an internal network tester search
- What a search cannot verify
- Questions people ask
Penetration testers write their target and their exam more often than their title. A search for "penetration tester" alone misses people titled security consultant, offensive security engineer, red team operator or application security consultant, and the word "penetration" pulls in geotechnical engineers running penetration tests on soil, firestop crews and salespeople describing market penetration. The strings that work pair offensive titles with the target (web applications, internal networks and Active Directory, cloud, mobile) and the hands-on credentials candidates list. As of November 2026, OffSec's OSCP+ expires three years from issuance while the original OSCP does not, GIAC renews on a four-year cycle, and OffSec, GIAC and Hack The Box each run their own verification.
Below are ten strings by kind of offensive work, and what LinkedIn, Dice and Google support as of November 2026. For SOC, GRC and other security specialties, see Boolean search strings for cybersecurity roles; this page goes deeper on the offensive side only.
Targets, exams and verification tools that change what a pentest search finds
| Kind of testing | Terms candidates write | Common titles |
|---|---|---|
| Web application and API | OWASP Top 10, Burp Suite, API testing, authentication, authorization flaws | Application security consultant, web application penetration tester |
| Network and Active Directory | Internal penetration test, Active Directory, Kerberos, BloodHound, lateral movement | Network penetration tester, security consultant |
| Cloud | AWS, Azure, GCP, IAM misconfiguration, cloud penetration testing | Cloud security consultant, cloud penetration tester |
| Red team | Adversary emulation, command and control, C2, MITRE ATT&CK, purple team | Red team operator, offensive security engineer |
| Mobile, IoT and hardware | iOS, Android, Frida, reverse engineering, firmware | Mobile security tester, hardware security researcher |
| Physical and social engineering | Physical penetration testing, social engineering, phishing campaigns, vishing | Physical security consultant, social engineer |
- OffSec. The PEN-200 page describes a 24-hour proctored exam, says the OSCP was previously named the Offensive Security Certified Professional, that OSCP+ expires three years from issuance, and that the original OSCP has no expiration date, as of November 2026. The PEN-300 page says passing its 48-hour proctored exam earns the OffSec Experienced Penetration Tester (OSEP), which is part of the OSCE³ certification.
- GIAC. GIAC's offensive operations focus area lists penetration testing certifications including the GIAC Penetration Tester (GPEN), Web Application Penetration Tester (GWAPT), Exploit Researcher and Advanced Penetration Tester (GXPN), Cloud Penetration Tester (GCPN), Mobile Device Security Analyst (GMOB) and Experienced Penetration Tester (GX-PT). Its renewal page describes collecting 36 credits over four years to keep a certification active.
- CompTIA and EC-Council. CompTIA's PenTest+ page lists exam PT0-003 and recommends three to four years in a penetration tester job role. EC-Council's CPENT page describes a fully practical exam with a report, taken as one 24-hour session or two 12-hour sessions, and says a score above 90% earns its Licensed Penetration Testing (LPT) certification.
- Report-based exams. Hack The Box's CPTS page describes a ten-day exam lab against an Active Directory network plus a commercial-grade report. TCM Security's PNPT page describes five days for the assessment, two more for the report and a live 15-minute debrief with its assessors. Both weigh the report, which is most of a consultant's deliverable.
- CREST. CREST's certifications page lists the CREST Practitioner Security Analyst (CPSA), Registered Penetration Tester (CRT), Certified Tester Infrastructure and Application (CCT INF and CCT APP), and the red team specialist and manager certifications (CCRTS and CCRTM). Expect them on UK and international profiles.
Ten Boolean strings by kind of offensive work
Swap in the target, tooling and metro from your own intake; these are examples. Search on the work and the credentials, never on a term that stands in for age, sex, race, religion, national origin, disability or veteran status.
Web, network and cloud
1. Web application penetration tester — LinkedIn Recruiter, Job titles + Keywords filters
("penetration tester" OR pentester OR "application security consultant" OR "security consultant") AND ("burp suite" OR "owasp top 10" OR "web application" OR "api testing") AND (gwapt OR oscp OR osep OR cpts) NOT (recruiter OR sales)
2. Internal network and Active Directory tester — LinkedIn general search
("penetration tester" OR pentester OR "pen tester" OR "security consultant") AND ("active directory" OR kerberos OR bloodhound OR "lateral movement") AND (oscp OR "oscp+" OR cpts OR pnpt OR gpen) NOT (geotechnical OR soil OR firestop)
3. Cloud penetration tester — Dice resume search
("penetration tester" OR "cloud security consultant" OR "offensive security") AND (aws OR azure OR gcp) AND ("cloud penetration" OR gcpn OR iam)Red team, mobile and senior roles
4. Red team operator — LinkedIn general search
("red team operator" OR "red teamer" OR "red team" OR "adversary emulation") AND ("command and control" OR c2 OR "mitre att&ck" OR "purple team") AND (osep OR gxpn OR ccrts OR oscp)
5. Mobile and IoT tester — LinkedIn general search
("penetration tester" OR "mobile security" OR "security researcher") AND (ios OR android OR firmware) AND (frida OR "reverse engineering" OR gmob)
6. Lead or principal tester — LinkedIn Recruiter, Keywords filter
("principal security consultant" OR "lead penetration tester" OR "offensive security manager" OR "red team lead") AND (scoping OR "rules of engagement" OR "report review") AND (oscp OR gxpn OR "cct inf" OR "cct app")Credentials, clearance and X-ray
7. Credential first, any title — Dice resume search
(oscp OR "oscp+" OR osep OR gpen OR gxpn OR cpts OR pnpt OR "pentest+" OR cpent OR "crest registered penetration tester") AND (pentest OR "penetration testing" OR "offensive security")
8. Cleared penetration tester — LinkedIn general search
("penetration tester" OR "red team" OR "offensive security") AND ("secret clearance" OR "ts/sci" OR "top secret") AND (oscp OR gpen OR "pentest+")
9. CREST-certified tester — LinkedIn general search
("penetration tester" OR "security consultant") AND ("crest registered penetration tester" OR "crest crt" OR "cct inf" OR "cct app" OR cpsa)
10. Public profiles by target and metro — Google X-ray
site:linkedin.com/in "penetration tester" "oscp" "active directory" "denver" -jobs -recruiterOffensive security people often keep their profiles thin, and cleared candidates more so. Expect X-ray results to be smaller than for other technical roles, and treat a public page as a lead, not proof of a current certification or clearance.
What LinkedIn, Dice and Google actually support
As of November 2026, LinkedIn's Boolean help page requires AND, OR and NOT in capitals, supports quotes and parentheses, evaluates quoted phrases first, then parentheses, NOT, AND and OR, and does not support wildcards, so "penetration tester," "pen tester," "pentester" and "pentest" each need writing out. The page does not say how symbols inside quotes are handled, so test "oscp+," "pentest+," "ts/sci" and "att&ck" on your own account. LinkedIn Recruiter's Boolean page lists stop words ignored in search, including "and," which loosens "command and control," so string 4 runs as a general search, and warns that too many facets in one query can cause a search result issue.
Dice's Boolean
guide supports parentheses, quotes, AND, OR and NOT, says to quote keywords with punctuation, fills in
word endings automatically (so the short form "pentest" covers longer forms there), and warns to use NOT
sparingly. Google's search operators
page documents quotes, site:, the minus sign and filetype:, but not OR, so
string 10 uses none.
The exam bodies run the verification tools. GIAC's Certification Holder Directory verifies certified professionals by name or analyst ID. OffSec's help center page on verifying a certification says certificates issued after April 5, 2022 carry a QR code to the holder's digital credential page, and that older ones can be checked by request with the holder's full name and OSID. Hack The Box's CPTS page says a certificate ID can be checked for validity.
Narrowing by target, delivery model and report writing
The target is the must-have. A web application tester, an internal network and Active Directory tester and a red team operator are different hires, and each writes about their own work. Ask the client which targets are in scope, whether the work is compliance-driven testing on a fixed schedule or adversary emulation, and whether the tester will work at a consultancy across many clients or in-house against one environment.
Then ask about the report. Consultancies sell the report, so they need testers who write clear findings, severity ratings and executive summaries, and the report-based exams above test exactly that. For seniority, look for "scoping," "rules of engagement," "led engagements," "report QA" and "mentored junior testers," against "assisted" and "participated." LinkedIn's premium search filters page lists Years of Experience and Seniority Level only in Recruiter and Sales Navigator.
False positives worth excluding with NOT
- Soil and construction. Geotechnical engineers write "standard penetration test" and "cone penetration test," and construction crews seal "firestop penetrations." Exclude geotechnical, soil and firestop when you search the bare word penetration.
- Market penetration. Sales and marketing profiles write it constantly. Exclude sales and marketing, or require a target word in every string.
- Vulnerability scanning roles. Analysts who run scanners write "vulnerability assessment" and tool names without manual exploitation. They can be the hire for a junior role; for a tester role, require Active Directory, web application or exploit words.
- Students and training labs. "Student," "capture the flag," "home lab" and "aspiring" profiles hold the same exam names in progress. Exclude them for experienced hires, include them for apprentice roles.
- Instructors and course sellers. Trainers and course authors list every certification. Exclude "instructor" and "course author" when they crowd the results.
- Security sales and recruiters. Exclude "account executive," "sales engineer" and "recruiter," as in the cybersecurity roles guide.
A worked example: three passes on an internal network tester search
An invented search, shown as it actually gets narrowed.
Intake: A security consultancy needs a mid-level tester for internal network and Active Directory engagements who writes client reports without heavy editing. Not looking for scanner operators or students.
Pass 1: "penetration tester": testers mixed with students, application
security engineers, geotechnical profiles that mention penetration tests and recruiters.
Pass 2: ("penetration tester" OR pentester OR "security consultant") AND ("active
directory" OR "internal network") AND (oscp OR cpts OR pnpt OR gpen) NOT (student OR geotechnical OR
recruiter): network testers with hands-on exams, many of them at consultancies.
Pass 3: add AND ("report writing" OR "client reports" OR "executive summary" OR
"rules of engagement"). Those words tend to come from testers who run engagements end to end. The
list is short enough to call, and the screen asks them to walk through their last internal engagement from
scoping to readout.
The target and exam blocks removed the noise; the report block found the testers who deliver. Add it once the target block has done its work.
What a search cannot verify
A string can find someone who lists the right targets and exams. It cannot confirm the certification is current, show whether they found the issues in a report or ran a scanner someone else configured, or tell you whether their writing is clear. Verify credentials through the issuers above, and ask for a sanitized sample report only if they are allowed to share one; never ask for client material they are not permitted to disclose. Then use the cybersecurity analyst screening questions for hands-on depth, the interview guide for cybersecurity roles for the later rounds, and the cybersecurity job description template to pin down targets and must-have exams with the client before you search.
Questions people ask
Does the OSCP certification expire?
The original OSCP does not. As of November 2026, OffSec's PEN-200 page says the OSCP has no expiration date, while the OSCP+ designation expires three years from issuance unless the holder passes a recertification exam, passes another qualifying OffSec exam or completes OffSec's continuing education program. Profiles often write OSCP for both, so check which one the credential page shows.
How do I verify a penetration tester's certification?
Use the issuer's own tool. OffSec says certificates issued after April 5, 2022 carry a QR code that opens the holder's digital credential page, and older ones can be verified by request with the holder's full name and OSID. GIAC's Certification Holder Directory verifies by name or analyst ID, and Hack The Box checks a CPTS certificate by its ID.
Why does a penetration tester search return geotechnical engineers?
Because geotechnical engineers run standard penetration tests and cone penetration tests on soil, and construction crews seal firestop penetrations. Search penetration tester, pentester and pentest as titles or exact phrases, require a target word such as Active Directory or web application, and exclude geotechnical, soil and firestop with NOT.
What is the difference between a penetration tester and a red team operator in a search?
A penetration tester usually tests a defined scope, such as one application or network, and reports every finding; a red team operator emulates an adversary against the whole organization to test detection and response. Red team profiles write adversary emulation, command and control, MITRE ATT&CK and purple team; pentest profiles write scoping, OWASP and the targets they test.