I have asked this question on The WorkPlace SE site and did not receive any comprehensive answers over there. I have around 10 years of cybersecurity industry experience and have gained proficiency in using MetaSploit framework for automated penetration testing via vulnerability exploitation.

As a result of a vulnerability I discovered in an application, I wrote an exploit module to automate the manual steps needed for exploitation of vulnerability. Successful exploitation using my method would result in a reverse shell, enabling full control of target system.

I want to include this on my resume to show my experience, dedication and technical expertise for future job hunting, but am unsure how to write in a way that won't scare away potential employers into thinking I am a black hat hacker.

If I include this on my resume, how can I include this experience so as to not cause unease in prospective employers?

  • 1
    Did you engage in responsible disclosure to work with the company on this vulnerability you discovered? I'm concerned that you think what you did was "black hat" activity and not sure how to explain to someone else that it isn't. In other words, why do you think that this activity would cause unease?
    – schroeder
    Commented Apr 30 at 6:51
  • I removed the "should I?" question because that's not a security question but a pure "how to write a resume" question. The answer to that is to only include relevant experience.
    – schroeder
    Commented Apr 30 at 6:52
  • You've also forgotten to include the most relevant information: What kind of job are you applying for? If you'll be doing mostly pentesting, then you're expected to work with tools like Metasploit. It seems bizarre to think this will be seen as suspicous. Of course improper disclosure could be an issue as pointed out by schroeder, but the mere fact that you've already written a Metasploit module is useful experience in an offensive role. If you'll be working in defensive security, this particular experience may not be as relevant, but Metasploit is still a well-known ,legitimate tool.
    – Ja1024
    Commented Apr 30 at 7:35


You must log in to answer this question.

Browse other questions tagged .