4 ms·

Allow me to disagree with tptacek a little: The OffSec Penetration Testing with Kali Linux (OSCP certification) is excellent and outstanding and cheap. https:

Allow me to disagree with tptacek a little: The OffSec Penetration Testing with Kali Linux (OSCP certification) is excellent and outstanding and cheap. https://www.offensive-security.com/information-security-training/penetration-testing-training-kali-linux/ https://www.offensive-security.com/information-security-trai... While the course itself is $800, you'll most assuredly need another 60 days of lab time for the certification. I think all-in-all it cost me $1,500 for everything. The course material is excellent and wide-ranging and very hands-on. If you have a family, it's a serious investment of time. It put a serious dent into my night time hours for a couple months. The OCSP certification is widely-respected and not just a "paper certification" like some of the others (c|eh). Lots of practical skills. Great stuff.

arkadiyt 8y ago
I'm just one data point but I'm a hiring security manager and if someone had OCSP it would mean nothing to me.
- runjake 8y ago
  ... why nothing to you?
- temperfidelis2x 8y ago
  You are probably looking for advanced people (or you might just be a shitty recruiter...). As a second data point I can tell that having OSCP can help you significantly in the beginning of your career (and for a reason, most entry-level certs are just complete bs and it's nice to have something to show off when you are lacking actual experience).
- debatem1 8y ago
  Same. To some extent the presence of certs is a lacks-clue indicator to me. That's not fatal (lots of great hires really understand security but know nothing about the industry) but it starts my evaluation of you off at 'greenhorn'.
- tptacek 8y ago
  ~Same. I expect in the most charitable case it means about as much to infosec hiring managers as bootcamps do to developer hiring managers.
  - PeterisP 8y ago
    What are you looking for in that case? I mean, in the absence of previous experience doing the same thing. The way I look at it, people come into technical security either from operations or development backgrounds, but it's hard to distinguish someone who has the required skills from their years in dev or ops from those who have managed to do their core work so without going into the relevant details; their CVs are going to look pretty much the same. A hobbyist might have practiced on some CTFs or vulnerable machine challenges, but unless they haven't e.g. won some bug bounties or gotten some CVE disclosures, then that won't be really visible on a job application. If certifications aren't considered relevant by security hiring managers, what is?
    - tptacek 8y ago
      We hire resume-blind, based on work-sample challenges. https://latacora.com/careers/ https://latacora.com/careers/
    - souprock 8y ago
      Things that would count: You wrote a compiler, kernel, emulator, firmware, or boot loader. You wrote a small demo, such as 4096-byte or 512-byte. Like this: https://en.wikipedia.org/wiki/Demoscene https://en.wikipedia.org/wiki/Demoscene You have hand-optimized code via assembly language. You have debugged software with a JTAG device or a digital logic analyser.
      - pvg 8y ago
        Why would those things count more or less than other things? It seems more like a list of things you think are neat but trying to guess what a resume-reader might think is neat seems like a game with very poor returns.
- wglb 8y ago
  Second this point. One hire that I had a voice in getting hired showed up with no current job, no security experience, but had written a compiler at home, just for fun. Has what most folks would consider a spectacular career since then.

arkadiyt 8y ago

I'm just one data point but I'm a hiring security manager and if someone had OCSP it would mean nothing to me.

runjake 8y ago
... why nothing to you?
temperfidelis2x 8y ago
You are probably looking for advanced people (or you might just be a shitty recruiter...). As a second data point I can tell that having OSCP can help you significantly in the beginning of your career (and for a reason, most entry-level certs are just complete bs and it's nice to have something to show off when you are lacking actual experience).
debatem1 8y ago
Same. To some extent the presence of certs is a lacks-clue indicator to me. That's not fatal (lots of great hires really understand security but know nothing about the industry) but it starts my evaluation of you off at 'greenhorn'.
tptacek 8y ago
~Same. I expect in the most charitable case it means about as much to infosec hiring managers as bootcamps do to developer hiring managers.
- PeterisP 8y ago
  What are you looking for in that case? I mean, in the absence of previous experience doing the same thing. The way I look at it, people come into technical security either from operations or development backgrounds, but it's hard to distinguish someone who has the required skills from their years in dev or ops from those who have managed to do their core work so without going into the relevant details; their CVs are going to look pretty much the same. A hobbyist might have practiced on some CTFs or vulnerable machine challenges, but unless they haven't e.g. won some bug bounties or gotten some CVE disclosures, then that won't be really visible on a job application. If certifications aren't considered relevant by security hiring managers, what is?
  - tptacek 8y ago
    We hire resume-blind, based on work-sample challenges. https://latacora.com/careers/ https://latacora.com/careers/
  - souprock 8y ago
    Things that would count: You wrote a compiler, kernel, emulator, firmware, or boot loader. You wrote a small demo, such as 4096-byte or 512-byte. Like this: https://en.wikipedia.org/wiki/Demoscene https://en.wikipedia.org/wiki/Demoscene You have hand-optimized code via assembly language. You have debugged software with a JTAG device or a digital logic analyser.
    - pvg 8y ago
      Why would those things count more or less than other things? It seems more like a list of things you think are neat but trying to guess what a resume-reader might think is neat seems like a game with very poor returns.
wglb 8y ago
Second this point. One hire that I had a voice in getting hired showed up with no current job, no security experience, but had written a compiler at home, just for fun. Has what most folks would consider a spectacular career since then.