Let me give you some advice, from the perspective of someone who runs a successful security firm. Have you worked as a consultant at one of the larger firms, l

Let me give you some advice, from the perspective of someone who runs a successful security firm. Have you worked as a consultant at one of the larger firms, like Optiv, Bishop Fox or NCC Group? What professional experience do you have? Have you found serious vulnerabilities and published them? Any bug bounties? Without a network to draw on it is very difficult to start your own practice. You need referrals, introductions and people to vouch for you. Failing that, you need to be "infosec famous" or very close to it (this is why so many people publish for publicity in the security world). My recommendation is that you join an established firm if you really have the technical skills. If you've already been at a serious firm for two or three years or so then you'll understand the business processes inherent to running a successful consultancy. Without understanding how that works you won't know how to leverage your skills and turn them into a reliable income on your own. Forget certifications. You don't need any to be successful if you can just demonstrate the ability to find vulnerabilities. The CISSP (as an example) can be helpful for a certain subset of clientele, but it's not useful enough to pour your energy into instead of e.g. getting CVEs on your rèsumè and establishing a network. Can you find every single vulnerability outlined in The Web Application Hacker's Handbook? How about the trickier ones that crop up in Black Hat presentations? It's not enough to be able to find CSRF or XSS in a bug bounty, you need to be reliable, consistent and thorough when working as a consultant. This is one of the reasons bug bounty participants are rarely qualified to join consultancies, even if they find vulnerabilities. They often lack the professional maturity to find more than a certain subset of vulnerabilities. Your first few clients will be the most difficult. Here is a rough outline of what you can do to get a pipeline of work: 1. Join a reputable security consultancy and develop your skills. Polish them from "I can find vulnerabilities" to "I can model a large software project for design flaws, implementation vulnerabilities and operational vulnerabilities, then thoroughly find everything" (within reason, given a finite testing timeline). Your track record for finding vulnerabilities must go from "more often than not" to "virtually always" for each application put in front of you. 2. Do independent security research. Subscribe to security alerts from large vendors. When a CVE is issued, check it out, try to reproduce the issue and learn from it. Start finding vulnerabilities just like it in widely used software frameworks and libraries. Build up a track record and a personal brand of security formidibility. 3. If you have done #1 or #2 already, or once you have, then leave and start your own practice. You won't be allowed to solicit your past employer's clients, but you can leverage your network. Talk to past colleagues and coworkers and put yourself out there. Try to subcontract out to various security firms (it's an open secret that most firms will do this if they have a surplus of work). 4. Aggressively pursue referrals for every single client you work with. Master the business side of running a consultancy. Consultants at large firms don't earn as much as successful independent consultants or founders because their margin is spread thinner. Conversely, your own practice will not have salespeople or account managers. It will be you and you alone. You must be able to communicate exceptionally well, maintain deadlines on your own, support a plethora of payment methods from clients (checks in mail, third parties, ACH transfers), survive under uncertain payment timelines (large clients love to languish accounts payable forever) and manage all your clients and sales pipelines on your own. Your technical ability must be exceptional, yet it will only be half of your ability to make a good income. I built what I have now by folllwing my own advice here and reading all of patio11 and tptacek's comments on consulting.