4

I have my B.Tech in Information Technology with CEHv8 certification. I have 2 years of vulnerability assessment experience and 1.5 years of python automation experience. I am not able to crack any security job interviews.

I mainly look forward for Application security but I had worked only for web application assessment and have experience on XSS, clickjacking, poodle, heartbleed and CSRF. I get rejected in penetration testing interviews because of lack of OSCP or mobile security testing experience.

OSCP certification is bit costly for me and I am not sure how much time I can spent daily for it since I work for python automation right now.

My plan was to get into a security role and then do OSCP, so that, I could spent time on it, I would be able to practice with experience as well as mainly I can reimburse the certification cost in the company.

Are there any suggestions for me on how to achieve or proceed with my career dream? Is certification must or can I go with some other certification or something else? What effort do I need to put? I am well versed in Python.

Improve this question
1
  • It all depends on the hiring managers and their criteria. In some places, you do not need certifications at all. In others, you may be competing with so many certified people, that you need one, too. I'm not sure that we can provide an answer for you because we are all answering from our own perspectives.
    – schroeder ♦
    Commented Mar 14, 2018 at 17:33

2 Answers 2

Reset to default
6

I am a penetration tester; I got my job without an OSCP but I was studying for it. That, however, was not relevant.

I emailed every single CREST (UK) company I could (CREST provides a list, but I only got 1/4 of the way down the list before I got interviews), no generic emails.

I explained my situation, my interests and my goals.

My tips for you:

  1. do as many CTFs as possible; hackthebox is a good CTF. You may have high interest and some background but you need to show and talk about that interest.

  2. email all the small companies, applying for a big company probably will not get you anywhere

  3. make all of those emails personal and attach your C.V. (make sure your C.V. is security focused and clean)

The little guy is always willing to invest in the little guy.

Improve this answer
5
  • Regarding CTFs, I had no idea where to even begin on HTB. I watched a video which went through the process and I was lost. Are there any resources that you'd recommend for bridging this knowledge gap?
    – user171922
    Commented Mar 14, 2018 at 19:19
  • Ya this is a good idea ..I ll try with CTF's. But, is it ok to check the answer of CTF and then do if I am struck
    – lakshmi
    Commented Mar 15, 2018 at 3:26
  • I disagree with point #2. In a small company you will probably have to be THE experienced person, in a large there might be opportunities to do good work as a beginner and train yourself.
    – domen
    Commented Mar 15, 2018 at 8:29
  • @domen it is an easily debatable point :) just my experience through life. I keep trying to go for all kind of jobs but the big firms reject me and the little firms always invest me. which is good because the ladder is smaller and I can climb faster
    – TheHidden
    Commented Mar 15, 2018 at 9:03
  • @lakshmi yes you can, but I would advise perseverance. sometimes looking at the answer, even when stuck, is not a good way to learn. When asked (paraphrased) Thomas Edison said I did not fail, I just found (x) ways not to make a light bulb.
    – TheHidden
    Commented Mar 15, 2018 at 9:07
3

Yes. Many do not have OSCP and I have never paid attention to that while interviewing.

Are you explicitly being told you need OSCP or is this your assumption? I'd be surprised anyone would reject a decent candidate based on this alone. Are you able to decently answer all interview questions?

It could be that your experience is a bit too narrow (even for web assessment only you didn't really list much above).

Improve this answer
2
  • I have answered decently well for the areas which I had experience and also tried to give my best for other areas but how to develop my knowledge in other areas without experience
    – lakshmi
    Commented Mar 15, 2018 at 3:23
  • I'd advise overthewire.org/wargames and similar websites. Although I played these ~5 years before moving into a security job, they made me a better developer and security engineer. There are also vulnerable apps and docker images these days - made just to learn this.
    – domen
    Commented Mar 15, 2018 at 8:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .