0

Wanted to ask a question that I've seen answered in many places, but I could find nothing related to a specific point I got.

Just a bit of background, I work in 3rd level software support for 5+ years and got to a point where my job does not require the skills I acquired over time(don't want to say the word "overqualified").

Over time I developed many "advanced" skills, at least for a support role and those include reverse engineering, programming, scripting, debugging etc which I can't really use with my current role.

Decided to get into security for realizing that there are more oportunities there. My interest is more in webapp pentesting and Im taking several courses(and VM labs for practice) but feel that may be challenging the fact that I don't have any formal experience as a pentester.

So I thought that maybe if I started to bug bounty hunt and use the vulnerabilities I find in my cv as experience, would help me getting closer to the door of the hiring manager but wanted to ask for opinion of people already in the industry... does this make any difference? Does it help? Is there anything else you would suggest?

  • Make any difference for what? What's the goal? Be specific, and the answer might reveal itself in the asking. – schroeder Mar 22 '16 at 17:54
  • Thanks Schroeder. What I meant was: Does it make any difference to the recruiter to have a candidate with no experience working in a company as a pentester but who can prove he can find vulnerabilities in websites – Jacint Mar 22 '16 at 18:06
  • @Jacint Do your calculation and have a plan+backup plan.Try all possibles from your end. You just need to be lucky once. All The Best :) – Sravan Mar 22 '16 at 18:18
  • This is really something to ask a recruiter. Do some informational interviews to get their sense, and use their guidance. – schroeder Mar 22 '16 at 18:39
2

Anything you do to build your skills will help at this stage. You might want to address some of the basics before trying to collect on bounties, though, or you might get frustrated. Remember, the easy bug bounties have most likely already been collected, meaning you will need very strong skills to find what's left over.

Seek out some of the on-line classes on a wider variety of various pen testing tools, not just Metasploit. Keep practicing on the VMs. Learn about other security measures that might need to be defeated, such as IDP/IDS systems.

Attend local or regional security conferences; they're a great source of information, contacts in the industry, and potential clients.

Honestly assess your communication skills. A pen tester needs to produce a clearly written report describing the vulnerabilities in such a way that the clients can understand and address them. Ask someone else to take a look to ensure you're as clear as you think you are.

A big part of the entry-level pen tester will be their reputation. Hiring a pen tester is a matter of trust. If you have a criminal record or otherwise sketchy background, you may never find customers who want to hire you. Consider getting some certifications, like Certified Ethical Hacker (CEH) and Certified Information Systems Security Professional (CISSP). While some people like to mock certifications, don't let that stop you. They offer something tangible to potential clients that you are at least taking this seriously, and it's those clients that will pay your salary.

Check your local area to see if you need other credentials, such as a private investigator license. A PI license might also be helpful in standing out in a crowd of job applicants.

Consider preparing yourself for other careers in the security field as a path into pen testing. Forensic investigation, application development security, and security architecture are all hot topics these days.

| improve this answer | |
  • Thanks John, I know it's not going to be easy to go out for bounties but just had this curiosity on whether that would be viewed as experience... Currently taking several courses from Pluralsight to Pentesteracademy, and everything in the middle. To be honest, just can't stop learning, feels like I was lost for ages and finally got back to track. This is one of the things why I'm so looking forward but of course as you and @Sravan said, taking a day at a time. Thanks for your invaluable help – Jacint Mar 22 '16 at 18:25
  • You're welcome, and good luck! – John Deters Mar 22 '16 at 18:26
  • In my experience CEH and the like won't help you. On the other hand, hands-on like the OSCP will. – nyxgeek Mar 24 '16 at 6:13
  • Second especially the "visit conferences" part. Don't just go to the presentations, hang out in the hallways and actively network at the buffet. There are great contacts to be made and you won't spot them at first glance, you have to talk to people. – Tom Jun 18 at 6:44
1

If you are looking into beginning pentesting I would recommend looking at following/joining CTF teams/events. While this may be a more hobby-esque approach it will allow you to jump into the processes of pentesting.
As far as Certs go, CEH is nothing in comparison to CISSP. CEH is for HR distraction.
Another thing I would check is good ole' LinkedIN. Follow prospective companies and check out what their employees list as credentials.

| improve this answer | |
  • Weird timing... arstechnica.com/security/2016/03/… – Ijustpressbuttons Mar 24 '16 at 23:06
  • My personal opinion (and I do occasionally vet candidates): I consider CEH to be ridiculous. I might even count it against you if I have a bad day. CISSP is in the "ok, you can do something that takes effort and rote learning" class. I hold a CISM and don't really give it much value, but clients occasionally like it. All of these things don't actually test any actual technical skills, and while they get you through the HR filter, they are unlikely to count much with the head of pentesting. – Tom Jun 18 at 6:47
0

I have recruited pen testers specifically based on bug bounties they have collected. So, to answer your question directly: Yes, I believe a bug bounty track record would help.

Two things to note though about my case:

  1. I recruited on a contract basis only, not as a permanent employee
  2. I was looking to test a specific specialist aspect of an application so I looked for researchers with expertise and a track record in that particular area, not generalists

The other answers from @John Deters and @Ijustpressbuttons contain good advice. It's not an easy route that you are proposing...

| improve this answer | |
0

Go job hunting.

These skills are in high demand right now and if you are honest with your skill level and realistic with your salary expectations, you should easily be able to get an entry-level position and then learn on the job.

Some of my friends are pentesters of some reknown. They are all self-taught and one of them hold an international reputation but zero papers from anywhere, no university degree, no certifications, nothing. Granted, his name alone opens doors nothing else could, but the point is that everyone who seriously works in this field knows how little papers mean and how many people entered the field from somewhere else and they still have the skills.

There are some things that won't happen if you can't list X years and Y papers on your CV, these are largely related to bigger projects that are procured by tender. I'm working on one right now and when you're looking for 20+ security people, and that's a small part of the whole, you don't estimate each individual skillset, you ask for the paperwork.

But I know of several companies who are actively looking for skilled people in this area and would consider someone self-taught without credentials - as long as you have something that can convince them in an interview. Ask yourself how you'd convince someone who's done pentesting for years in an interview that you are qualified to join his team. If you have a good answer for that, start writing applications.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.