Penetration Testing Jobs without Experience

Question

There seems to be a late trend where firms are beginning to hire fresh graduates for security related jobs. This is counter to what I've heard from experienced security professionals (as well as the many other forum community members that say it's usually Help Desk --> Network Administrator --> Security Job). This seems to make sense, since I find that it'd be very difficult to have a deep understanding of computer networks unless you have practical experience in working with them.

But for those who have secured pen testing or security-related jobs before having extensive IT experience, what do you believe that you did that enabled you to get that job? Here are my guesses:

1. Good professional networking
2. Certificates (OSCP, CCNA, A+, Security+, Network+, Systems+, etc.)
3. Personal experience with at-home pen testing lab
4. Published papers

Specific insights as to what you did in any of these four categories, as well as any miscellaneous stuff would be thanked.

Answer 1

I also don't have a first person answer, but I'll share what I know. Your best bet with lack of experience is to show a depth of knowledge, a willingness to work in a team, and excelence in communicating your ideas.

(1) Good professional networking

This may be the the most important, and most difficult. A good referal can beat a good resume in a lot of cases.

(2) Certificates (OSCP, CCNA, A+, Security+, Network+, Systems+, etc.)

Depends on the employer, hiring manager, and the team/group. Some employers will require certificates, so won't care. Some with hiring managers and teams/groups. In my mind certificates are resume points, but not necessarily much more. If you passed the certificate but can't pass the interview questions, it wont matter which certificates you have.

(3) Personal experience with at-home pen testing lab

This is good only to the extent that your learn and grow your experience. This becomes a self-paced self-taught school. And then to the extent to which you can translate it into a paragraph on your resume and answers in an interview.

(4) Published papers

Maybe. Your best shot is to have your papers read by the people who will interview you. The resume sorters won't read them. Most people who interview you won't read them even if they are listed prominently on your resume. Your best bet is be in their network and convince them to read your papers, and really its easier to just them emails (or tweets) with insights and opinions.

Answer 2

I have both my own personal answer, but also a career's worth of answers, since I work in the security industry within a division that is entirely focused on security. I should say, we are not all pen-testers, in fact that's just a part of the things we do for customers. Mileage may vary if your goal is a small but elite company focused specifically on pen testing...

IMO - IT experience is only one way to get into the industry. Certainly it's a good one - a key ingredient to knowing how to secure something is knowing a lot about how it functions, and when it comes to how computer systems and networks function, IT is a very good background for that.

That said, I think a lot of security professionals come into the industry from having worked near it for a long time. For example, we've got a ton of people around here who joined the division to develop software. No security background but strong credentials as software developers. They developed plenty of products with high end security requirements, and bit by bit, they learned more about the problem domain and the world of systems, eventually making the transition into system security. They come from a variety of technical backgrounds (one of my favorites is a PhD in Biology!), but a common path was "make something well" --> "make your something secure" --> "learn enough about security to secure other, similar somethings" --> "learn to secure just about anything".

In these cases, I'd say that none of the 4 things was the overwhelming factor in getting into security. The key ingredient was having a strong competency in some technical area, and becoming interested in the bigger picture. Networking, certifications and papers are a byproduct.

Software is a typical path, but I've also seen this within the realm of EE/hardware design. I even know folks that worked as PMs getting into security policy from the human end, and gradually working their way into social engineering prevention techniques. It doesn't have to be limited to the geeks.

As far as the small, aggressive tiger team style company - I feel the same path applies but with an added requirement - candidates also need to have at least one (preferably more) "sell factors" - either the candidate is already a big name in the industry, so bringing him on is a good way to get PR, or the candidate has a good selling personality. The folks I've met in this genre of security work are not only smart, they are sharp - they present well, they are intellectually aggressive, and they don't hesitate to toot their own horn and broadcast the work of their company. In a small company, that's absolutely critical.

Answer 3

There is no true answer for this as far as I am concerned, it is different for every person that attempts it. If you have motivation, a good personality, and aptitude for the topic, you can pull it off. (i apologize for the TL;DR elaboration)

I guess my situation would somewhat follow this question, but then again I threw going to university into the mix...

---

*I'm a current student at Rochester Institute of Technology. Initially coming to RIT, I was very interested in programming as well as security, so I entered the Software Engineering major.

After a year, I transfered to the Information Security and Forensics major looking for a more hands-on career. I proceeded in taking every security related course I could, which gave me a very good background, though this will be a pain for my last school year (which will be made up of only liberal arts courses).

During my time at RIT, I constantly worked on professional networking (networking with other professionals, though I did end up doing a lot of physical networking too) and experimenting with any technology I could get my hands on along the way.

One thing that I believe give me an advantage was my involvement in clubs. I was an extremely active member of a video gaming club (don't knock it, it is/was the largest club on campus; We would run 200+ person LAN parties), an active member of SPARSA which is a student run security club, and some other music related clubs.

With this degree it is required that you have at least 3 quarters (3 x 11 week blocks) of co-op (paid internships). My first co-op was as a system administrator at RIT. Because of my schooling and my contacts, i was able to land my second co-op (6 month contract position) with the company I am working for now. I work in two different security departments and it gives me the opportunity to take part in their penetration testing practices as well as may other aspects of of the security industry.*

---

Many of the articles and books I have read regarding professional penetration testing seem to agree that a proper pen test team member is a security professional with 15+ years experience in the IT field. I would love to say that I fit that bill, but i definitely do not. I'm simply an undergrad student with no certifications, but I'm working on the same team as those very experienced professionals.

If you are a security enthusiast and do not necessarily have the professional experience to get your foot in the door, I'll tell you what I believe helps (or at least what has helped me).

First, There's no reason not to apply to any security jobs if you're interested. Don't let the thought that a lack experience or skill sets may hold you back. What's the worst that will happen? they turn down your application?

Second, Constantly network. Get involved with the security crowd, or even the general IT crowd. Something as simple as being in a video game club that runs LAN parties may inadvertently help you out. Additionally, every job interview is another chance to network. Make a good impression, even if you don't fit the bill at that time, it's always a good thing to have people recognize you (even better if it's at a security convention or something to that effect).

Third, Do research and show that you are a current contributer to the field. Working with opensource projects and going to conventions are things that one can do without being a current security professional that are also great topics to discuss in an interview. Things as simple as being involved in a security forum (or hey, maybe this stack exchange) will give you discussion topics. When it comes to penetration testing, remember that knowing how to pop a box isn't the only hurdle. Demonstrate that you have an understanding of the whole picture (legal issue, reconnaissance, risk/threat evaluation, vulnerability management, technical writing, etc).

Forth, emphasize a willingness to learn. If you don't have the experience, make sure that you convey that you are looking to gain that experience.

So, those are just some thoughts I had while reading this question. This situation has to have a lot of aspects perfectly align. The personality and position of the interviewer/perspective employer (if the interviews are conducted by an HR person who has a list of reqs in front of him/her then you're out of luck) and the heiring climate at the company also have a lot to do with the situation as well.

Certifications help, but are not always needed. Some companies give them a lot of weight, while others will put much less merit in them.

As for published papers, if you're able to publish papers, then i would assume that either you're scholar or already a professional. Either way, you should already have a foot in the door.

I would like to end with one final comment, i have seen a growing trend in companies heiring fresh recruits so they can build the employee into someone that suits their environment and their needs. Why bring in a person that the company needs to break of their old ways when you can being in a newbie who you can mold from scratch? Granted that this is much harder to apply to the security field, but it is definitely applicable to most other fields and i'm sure that it has some bearing in security.

I would have liked to better formulated this response, it feels very scatter brained. Also, i apologize for any spelling or grammar errors. I'm happy to clarify my comments, answer any questions, or take any berating if anyone is so inclined. :-)

Answer 4

I don't have a first-person answer, as I was in IT for a long time before bouncing into security, however I have selected individuals for hire into information and IT security, some of whom had little to no direct experience in the field, so the answers on this question and this one about what to look for in a prospective candidate for a security role might be of some use to you.

In addition, check out this question on entry level skills - It is a major issue and many organisations are putting in place initiatives to try and help fix the problem.

Answer 5

Something else to add here - if you are really looking to get into penetration testing, don't focus on the networking/infrastructure side. Learn web application security, as (in my experience), most of the penetration testing work now is web app focused.

Research - practice in your home lab, learn on vulnerable systems (Metasploitable, Damn Vulnerable Web App, WebGoat...), pull apart open source applications.

Certifications are the punchline to a number of jokes in the penetration testing industry, I wouldn't bother.

Some companies now get prospective testers to assess a real environment (in a lab) as part of the interview process. Think about what sort of skills you would need to get through that sort of assessment.

Answer 6

I'm not a professional or "experienced" but I am a student studying a masters in ethical hacking. In my opinion getting a job without experience anywhere is difficult however there are some things I am doing to improve my chances. One of which is testing open source applications posted on sites like github and sourceforge.

Recently found this blog post which was cool: http://trillworks.com/nick/2011/07/04/finding-0-day-vulnerabilities-in-the-ghetto/

I think this would look good on my CV and is also good practise, and hopefully something employers will like.

However I do live in Scotland so that dose put me at a huge disadvantage as nearly all pen testing jobs are in london/england so relocating is a bastard!

Answer 7

I suppose one of the creative ways around getting hired into security without following the conventional protocol is to start your own security firm specializing in and helping clients achieve compliance with a myriad of security requirements.