4 ms·

How does one with the requisite skills get a job as a penetration tester? I don’t often see companies hiring for the role.

nikcub 10y ago
They don't advertise the roles as regularly as other sectors of IT because they're hard to hire for. A lot of the hiring is word-of-mouth or promoting a developer internally who has infosec interest into the role, or hiring freelancers / outside companies. It is a sector suited to freelance roles and contracting, or working for a consulting firm in a fulltime capacity. Build up an online profile on your own website. It can take the form of a blog or just a simple web page with a bio and some published articles/papers. Mention on your website that you're available for hire, where you are and what type of work you do. Write some blog posts (anywhere from 2-3 a month or even 2-3 a year if they're a bit longer form), establish specialities that you are good at, produce conference talks and pitch them at CFP's and go and speak at conferences, submit your posts and websites on reddit, here on HN etc. You'll start getting cold approaches (I average around 3 after every blog post) and you'll have somewhere to point the companies you approach to. You'll meet people at conferences who want to hire you. To find companies to approach, find vulnerabilities and send them a note or participate in bug bounty programs. You can also approach companies who have recently been in the news with security issues, or those you find on Twitter where users or other infosec ppl are reporting issues on social networks . A lot of companies hit a wall when they experience a security incident and they're not sure what to do, who to call or who to hire - so they're very open to hiring contractors to organize that or bringing in their first fulltime infosec hire. To get the top-end research roles at the big co's you really need to produce good research and you'll be headhunted. Try to be specific in terms of both specialities and sectors you deal with. If you decide on freelancing, use your first couple of clients as references for potential new clients and ask associated, customers, etc. to refer you other work.
- acdanger 10y ago
  This is helpful. Thank you.

nikcub 10y ago

They don't advertise the roles as regularly as other sectors of IT because they're hard to hire for. A lot of the hiring is word-of-mouth or promoting a developer internally who has infosec interest into the role, or hiring freelancers / outside companies. It is a sector suited to freelance roles and contracting, or working for a consulting firm in a fulltime capacity. Build up an online profile on your own website. It can take the form of a blog or just a simple web page with a bio and some published articles/papers. Mention on your website that you're available for hire, where you are and what type of work you do. Write some blog posts (anywhere from 2-3 a month or even 2-3 a year if they're a bit longer form), establish specialities that you are good at, produce conference talks and pitch them at CFP's and go and speak at conferences, submit your posts and websites on reddit, here on HN etc. You'll start getting cold approaches (I average around 3 after every blog post) and you'll have somewhere to point the companies you approach to. You'll meet people at conferences who want to hire you. To find companies to approach, find vulnerabilities and send them a note or participate in bug bounty programs. You can also approach companies who have recently been in the news with security issues, or those you find on Twitter where users or other infosec ppl are reporting issues on social networks . A lot of companies hit a wall when they experience a security incident and they're not sure what to do, who to call or who to hire - so they're very open to hiring contractors to organize that or bringing in their first fulltime infosec hire. To get the top-end research roles at the big co's you really need to produce good research and you'll be headhunted. Try to be specific in terms of both specialities and sectors you deal with. If you decide on freelancing, use your first couple of clients as references for potential new clients and ask associated, customers, etc. to refer you other work.

acdanger 10y ago
This is helpful. Thank you.