Wanted to ask a question that I've seen answered in many places, but I could find nothing related to a specific point I got.

Just a bit of background, I work in 3rd level software support for 5+ years and got to a point where my job does not require the skills I acquired over time(don't want to say the word "overqualified").

Over time I developed many "advanced" skills, at least for a support role and those include reverse engineering, programming, scripting, debugging etc which I can't really use with my current role.

Decided to get into security for realizing that there are more oportunities there. My interest is more in webapp pentesting and Im taking several courses(and VM labs for practice) but feel that may be challenging the fact that I don't have any formal experience as a pentester.

So I thought that maybe if I started to bug bounty hunt and use the vulnerabilities I find in my cv as experience, would help me getting closer to the door of the hiring manager but wanted to ask for opinion of people already in the industry... does this make any difference? Does it help? Is there anything else you would suggest?

  • Make any difference for what? What's the goal? Be specific, and the answer might reveal itself in the asking. – schroeder Mar 22 '16 at 17:54
  • Thanks Schroeder. What I meant was: Does it make any difference to the recruiter to have a candidate with no experience working in a company as a pentester but who can prove he can find vulnerabilities in websites – Jacint Mar 22 '16 at 18:06
  • @Jacint Do your calculation and have a plan+backup plan.Try all possibles from your end. You just need to be lucky once. All The Best :) – Sravan Mar 22 '16 at 18:18
  • This is really something to ask a recruiter. Do some informational interviews to get their sense, and use their guidance. – schroeder Mar 22 '16 at 18:39

Anything you do to build your skills will help at this stage. You might want to address some of the basics before trying to collect on bounties, though, or you might get frustrated. Remember, the easy bug bounties have most likely already been collected, meaning you will need very strong skills to find what's left over.

Seek out some of the on-line classes on a wider variety of various pen testing tools, not just Metasploit. Keep practicing on the VMs. Learn about other security measures that might need to be defeated, such as IDP/IDS systems.

Attend local or regional security conferences; they're a great source of information, contacts in the industry, and potential clients.

Honestly assess your communication skills. A pen tester needs to produce a clearly written report describing the vulnerabilities in such a way that the clients can understand and address them. Ask someone else to take a look to ensure you're as clear as you think you are.

A big part of the entry-level pen tester will be their reputation. Hiring a pen tester is a matter of trust. If you have a criminal record or otherwise sketchy background, you may never find customers who want to hire you. Consider getting some certifications, like Certified Ethical Hacker (CEH) and Certified Information Systems Security Professional (CISSP). While some people like to mock certifications, don't let that stop you. They offer something tangible to potential clients that you are at least taking this seriously, and it's those clients that will pay your salary.

Check your local area to see if you need other credentials, such as a private investigator license. A PI license might also be helpful in standing out in a crowd of job applicants.

Consider preparing yourself for other careers in the security field as a path into pen testing. Forensic investigation, application development security, and security architecture are all hot topics these days.

  • Thanks John, I know it's not going to be easy to go out for bounties but just had this curiosity on whether that would be viewed as experience... Currently taking several courses from Pluralsight to Pentesteracademy, and everything in the middle. To be honest, just can't stop learning, feels like I was lost for ages and finally got back to track. This is one of the things why I'm so looking forward but of course as you and @Sravan said, taking a day at a time. Thanks for your invaluable help – Jacint Mar 22 '16 at 18:25
  • You're welcome, and good luck! – John Deters Mar 22 '16 at 18:26
  • In my experience CEH and the like won't help you. On the other hand, hands-on like the OSCP will. – nyxgeek Mar 24 '16 at 6:13

If you are looking into beginning pentesting I would recommend looking at following/joining CTF teams/events. While this may be a more hobby-esque approach it will allow you to jump into the processes of pentesting.
As far as Certs go, CEH is nothing in comparison to CISSP. CEH is for HR distraction.
Another thing I would check is good ole' LinkedIN. Follow prospective companies and check out what their employees list as credentials.


I have recruited pen testers specifically based on bug bounties they have collected. So, to answer your question directly: Yes, I believe a bug bounty track record would help.

Two things to note though about my case:

  1. I recruited on a contract basis only, not as a permanent employee
  2. I was looking to test a specific specialist aspect of an application so I looked for researchers with expertise and a track record in that particular area, not generalists

The other answers from @John Deters and @Ijustpressbuttons contain good advice. It's not an easy route that you are proposing...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.