4

I have my B.Tech in Information Technology with CEHv8 certification. I have 2 years of vulnerability assessment experience and 1.5 years of python automation experience. I am not able to crack any security job interviews.

I mainly look forward for Application security but I had worked only for web application assessment and have experience on XSS, clickjacking, poodle, heartbleed and CSRF. I get rejected in penetration testing interviews because of lack of OSCP or mobile security testing experience.

OSCP certification is bit costly for me and I am not sure how much time I can spent daily for it since I work for python automation right now.

My plan was to get into a security role and then do OSCP, so that, I could spent time on it, I would be able to practice with experience as well as mainly I can reimburse the certification cost in the company.

Are there any suggestions for me on how to achieve or proceed with my career dream? Is certification must or can I go with some other certification or something else? What effort do I need to put? I am well versed in Python.

  • It all depends on the hiring managers and their criteria. In some places, you do not need certifications at all. In others, you may be competing with so many certified people, that you need one, too. I'm not sure that we can provide an answer for you because we are all answering from our own perspectives. – schroeder Mar 14 '18 at 17:33
4

I am a penetration tester; I got my job without an OSCP but I was studying for it. That, however, was not relevant.

I emailed every single CREST (UK) company I could (CREST provides a list, but I only got 1/4 of the way down the list before I got interviews), no generic emails.

I explained my situation, my interests and my goals.

My tips for you:

  1. do as many CTFs as possible; hackthebox is a good CTF. You may have high interest and some background but you need to show and talk about that interest.

  2. email all the small companies, applying for a big company probably will not get you anywhere

  3. make all of those emails personal and attach your C.V. (make sure your C.V. is security focused and clean)

The little guy is always willing to invest in the little guy.

  • Regarding CTFs, I had no idea where to even begin on HTB. I watched a video which went through the process and I was lost. Are there any resources that you'd recommend for bridging this knowledge gap? – user171922 Mar 14 '18 at 19:19
  • Ya this is a good idea ..I ll try with CTF's. But, is it ok to check the answer of CTF and then do if I am struck – lakshmi Mar 15 '18 at 3:26
  • I disagree with point #2. In a small company you will probably have to be THE experienced person, in a large there might be opportunities to do good work as a beginner and train yourself. – domen Mar 15 '18 at 8:29
  • @domen it is an easily debatable point :) just my experience through life. I keep trying to go for all kind of jobs but the big firms reject me and the little firms always invest me. which is good because the ladder is smaller and I can climb faster – TheHidden Mar 15 '18 at 9:03
  • @lakshmi yes you can, but I would advise perseverance. sometimes looking at the answer, even when stuck, is not a good way to learn. When asked (paraphrased) Thomas Edison said I did not fail, I just found (x) ways not to make a light bulb. – TheHidden Mar 15 '18 at 9:07
3

Yes. Many do not have OSCP and I have never paid attention to that while interviewing.

Are you explicitly being told you need OSCP or is this your assumption? I'd be surprised anyone would reject a decent candidate based on this alone. Are you able to decently answer all interview questions?

It could be that your experience is a bit too narrow (even for web assessment only you didn't really list much above).

  • I have answered decently well for the areas which I had experience and also tried to give my best for other areas but how to develop my knowledge in other areas without experience – lakshmi Mar 15 '18 at 3:23
  • I'd advise overthewire.org/wargames and similar websites. Although I played these ~5 years before moving into a security job, they made me a better developer and security engineer. There are also vulnerable apps and docker images these days - made just to learn this. – domen Mar 15 '18 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.