Penetration Tester (ANZSCO 261317)

On the Core Skills Occupation List

From the official Home Affairs skilled occupation lists, as at 2026-08-12. Lists change at each government update — always confirm on the official page before acting.

Which lists is Penetration Tester on?

CSOL — Core Skills Occupation List. The employer-sponsorship list — occupations on the CSOL can be nominated for the Skills in Demand visa (subclass 482) and the Employer Nomination Scheme 186.

Visas this occupation can access

Being on a list makes the occupation nominatable for these visas — each visa still has its own requirements (points, age, English, a positive skills assessment, and for sponsored visas a willing employer or state).

Skills assessment

A positive skills assessment for Penetration Tester comes from:

What the assessment actually involves

Penetration Tester is assessed by ACS under the standard Migration Skills Assessment pathways (General Skills or RPL) that apply across every ACS-listed code. ACS's family framing groups this code with Cyber Security Engineer and DevOps Engineer as the codes eligible for its Vendor Certification evidence option — ACS states it "now offers applicants the option to submit Vendor Certification evidence across DevOps and Cyber Security ANZSCO codes," naming ISC2 credentials including CISSP and CSSLP among the accepted certifications an applicant can upload as supporting evidence within the standard application.

Where these applications come unstuck

As with DevOps Engineer, no ACS-published lead definition or duty description specific to this code was found in the material reachable here, so a job title cannot be checked against ACS's own wording the way it can for the fully documented support-and-test cluster. Applicants should not treat naming a vendor certification as a way to skip the underlying General Skills years-of-experience matrix or RPL work-experience requirement — ACS's own material treats certifications as supporting evidence within the application, not a substitute for it.

An honest read on this pathway

This code carries CSOL only, reaching solely the 186 and 482 employer-sponsored visas — no 189, 190, 491, 494, 407 or 485. That is identical, narrow reach to DevOps Engineer in the same unit group, and both sit apart from the broader six-visa menu the ICT support-and-test cluster carries. The employer-sponsored door is real and can draw on named security certifications as evidence, but the points-tested and regional pathways are not available under this code regardless of preparation.

Assembling an ACS application? ACS wants employment evidence that lines up exactly with the dates and duties you claim elsewhere. The Skilled Visa EOI Organiser keeps your claims consistent across the skills assessment, EOI and Form 80 — inconsistencies between them are a common cause of delay.

Talk it through with a registered agent

Whether nominating Penetration Tester is your best route depends on your points, experience evidence and timing — exactly what a MARA-registered agent works through in an initial consultation. Describe your situation once through Migratio and compare real consultation quotes from registered agents, free.

Compare registered agents — free

Related occupations

All skilled occupations · Points calculator · Skilled visa agents