3 ms·

Many physical pentesters have gotten into places where they didn't have requisite deep domain knowledge because they can research particulars or just rely on re

Many physical pentesters have gotten into places where they didn't have requisite deep domain knowledge because they can research particulars or just rely on regular social engineering. If someone is able to breach a prison without the deep domain knowledge, then it's not actually that important. It's good for demonstrating the damage an insider threat could pose. This article doesn't have a comparison engagement with someone lacking domain knowledge though. I don't think the industry is tripping over themselves to get talent in any aspect. It just isn't what I've encountered. None of my prior domain knowledge counted (what little there is). Only certs and recent activity.

jcims 7y ago
Depends on where you’re looking. Companies like the one in the article are not going to be in a position to do a lot of staff development unless they have no other choice..you need to be able to hit the ground running in many cases. Depending on what experience you do have you might find good luck in hiring on at larger firms like insurance, financial, healthcare where they are going to need in-house staff and can make use of other skills that you might bring while they train you up on the security side.
- vsareto 7y ago
  I personally am going back to a dev job. It pays better and there's work to be done (incl. security). I got OSCP and 5 months later eventually landed a security job and ended up sitting on my hands for 3 months doing nothing. It isn't what the industry sold to me as "needing talent". I know there's smart people doing good work, but it could not deliver for me within a reasonable time despite putting in the work, and that was enough to realize most of the call-to-action was bullshit. If anyone asks me for career advice (no one should), I just tell them to learn to code and do code reviews in their spare time. Don't even bother with the pentesting side of it.
  - jcims 7y ago
    I blame it on the security industry because we are terrible at communicating, but your idea of how this works isn't aligned with reality. Think of it as a dumbed down version of the current staffing situation with healthcare. We have a huge talent gap, but that doesn't mean we put fresh grads to work on surgery. Pen tests and red teaming are about both skills and decision making, both of which have very high potential for significant damages if carried out incorrectly. For me personally, getting the OCSP would just tell me you have very basic skills and have demonstrated some interest. I would then have to fold you into the engagement pipeline, which would involve some thumb-warming, as basically a water person until i get feedback from the rest of the team that you are asking the right questions and are making good decisions. You would then get progressively more responsibilities and operate under scrutiny for a couple of years before you would be asked to lead anything. The fact that you did nothing for three months just tells me they were too busy to figure out how to get you started on that ramp...or they were idiots. Who knows. Again, it's a communication issue and your expectations were set too high, but that definitely doesn't mean the industry is secretly flush with talent.
    - vsareto 7y ago
      OSCP has too high of a fail rate to only demonstrate very basic skills, it's a bit more than that (if so, that puts CISSP, CEH, etc. way futher down yet you see those as job requirements all the time). There are plenty of people without it and employed still doing pentesting. This was my reality, I don't know how actually going through that situation qualifies it as anything but reality. This is another thing: people value those certs really differently and it's almost worth not doing them at all, again going back to: just learn to code. And to your point: more communicating badly. There's not a single more valuable qualifier than experience and yet that's the hardest thing to get when it really shouldn't be. Med students assist with surgeries but they aren't put in charge, I don't see why pentesting can't be the same. I think you've taken the rare, good, working parts of the industry and believe that to be a baseline, and I don't think it's realistic.
      - jcims 7y ago
        Thanks for the exchange. Your experience with trying to enter a field that I'm probably all too complacent about at this point has been very informative and I'll definitely incorporate it when I'm encountering those that are trying the same.

jcims 7y ago

Depends on where you’re looking. Companies like the one in the article are not going to be in a position to do a lot of staff development unless they have no other choice..you need to be able to hit the ground running in many cases. Depending on what experience you do have you might find good luck in hiring on at larger firms like insurance, financial, healthcare where they are going to need in-house staff and can make use of other skills that you might bring while they train you up on the security side.

vsareto 7y ago
I personally am going back to a dev job. It pays better and there's work to be done (incl. security). I got OSCP and 5 months later eventually landed a security job and ended up sitting on my hands for 3 months doing nothing. It isn't what the industry sold to me as "needing talent". I know there's smart people doing good work, but it could not deliver for me within a reasonable time despite putting in the work, and that was enough to realize most of the call-to-action was bullshit. If anyone asks me for career advice (no one should), I just tell them to learn to code and do code reviews in their spare time. Don't even bother with the pentesting side of it.
- jcims 7y ago
  I blame it on the security industry because we are terrible at communicating, but your idea of how this works isn't aligned with reality. Think of it as a dumbed down version of the current staffing situation with healthcare. We have a huge talent gap, but that doesn't mean we put fresh grads to work on surgery. Pen tests and red teaming are about both skills and decision making, both of which have very high potential for significant damages if carried out incorrectly. For me personally, getting the OCSP would just tell me you have very basic skills and have demonstrated some interest. I would then have to fold you into the engagement pipeline, which would involve some thumb-warming, as basically a water person until i get feedback from the rest of the team that you are asking the right questions and are making good decisions. You would then get progressively more responsibilities and operate under scrutiny for a couple of years before you would be asked to lead anything. The fact that you did nothing for three months just tells me they were too busy to figure out how to get you started on that ramp...or they were idiots. Who knows. Again, it's a communication issue and your expectations were set too high, but that definitely doesn't mean the industry is secretly flush with talent.
  - vsareto 7y ago
    OSCP has too high of a fail rate to only demonstrate very basic skills, it's a bit more than that (if so, that puts CISSP, CEH, etc. way futher down yet you see those as job requirements all the time). There are plenty of people without it and employed still doing pentesting. This was my reality, I don't know how actually going through that situation qualifies it as anything but reality. This is another thing: people value those certs really differently and it's almost worth not doing them at all, again going back to: just learn to code. And to your point: more communicating badly. There's not a single more valuable qualifier than experience and yet that's the hardest thing to get when it really shouldn't be. Med students assist with surgeries but they aren't put in charge, I don't see why pentesting can't be the same. I think you've taken the rare, good, working parts of the industry and believe that to be a baseline, and I don't think it's realistic.
    - jcims 7y ago
      Thanks for the exchange. Your experience with trying to enter a field that I'm probably all too complacent about at this point has been very informative and I'll definitely incorporate it when I'm encountering those that are trying the same.