I am currently a programmer with 4 years of experience. In the past I have done tech support for a few years and was an instructor at an IT trade school for a few years. I have a good balance of IT knowledge and would like to enter the world of security particularly doing penetration tests as an external auditor.

I'm really looking for help figuring out how to make myself more marketable as a penetration tester and what is the best way to find a pentesting job?


Well I'd advise searching through the existing questions as I'm fairly sure that similar questions have been answered before.

That said with your background some suggestions

  • Web application testing or code review would likely be the areas that you'll find it easiest to get into as programming knowledge is needed for both and also they're relatively good areas at the moment in terms of demand.
  • In terms of learning the trade there's a load of good online resources and courses, both free and paid for. Something like pentesterlab which is free or Coliseum which is pay for could help you learn the concepts.
  • Read and understand the Web App Hackers Handbook.
  • Participating in the community, online (like here!) or offline, at conferences and things like OWASP chapter meetings is a good way to meet people and get an idea of who's hiring.
  • contributions to open source projects are another good way to get to know people in the industry
  • Depending on where you are, once you've got some training under your belt it could be worth approaching security testing companies directly. In the UK anyway some will hire people with IT backgrounds and a limited amount of direct security exposure.
| improve this answer | |
  • On the last bullet: - are these called "security audit script kiddies"? – Deer Hunter Jun 29 '13 at 11:18
  • 1
    @DeerHunter well to an extent a lot of security testers come into the industry from IT or development. So it's a chicken-and-egg of how do you get a first job in testing . Some companies solve this by hiring for IT/dev experience and training on the testing aspects... – Rory McCune Jun 29 '13 at 15:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.