Not all companies require a penetration test to successfully evaluate their security posture.  Regular vulnerability scans are often an alternative.  An engineer performs vulnerability scanning to search systems for known vulnerabilities without exploitation attempts with an end goal of providing a remediation report prioritized on risk.