A pentest (penetration test) is an offensive security audit in which an expert, with written authorization, attacks a target (web application, API, mobile app, network, cloud environment) to find exploitable flaws before an attacker does.
There are three approaches depending on the information provided: black box (no initial access), grey box (limited access, for example a user account) and white box (access to code and documentation). The deliverable is a report that ranks flaws by severity, with proof of exploitation and recommended fixes.
Pentesting complements automated tools (SAST, DAST), bug bounty programs and configuration audits. It is often required by enterprise customers and compliance processes.
Why it matters when hiring
For a pentester, hands-on certifications (OSCP and equivalents) and rankings on training platforms are good first filters, but nothing replaces a report excerpt or a practical exercise. Distinguish the pentester, who tests at a point in time, from the AppSec Engineer, who builds security into day-to-day development.