Disclaimer: my account is a biased one. With that said, I hope the following comment helps. Not working there but have a friend that does and looked around a b

Disclaimer: my account is a biased one. With that said, I hope the following comment helps. Not working there but have a friend that does and looked around a bit myself. My experience: - 3 university courses from VUSec (e.g. how to do Rowhammer via JavaScript? How to analyze a binary? How to do a XSRF, XSS or SQLi? <-- is stuff I learned there) - Hack The Box full-time for 2 months, most difficult machine I pwned was PlayerTwo (making a working heap exploit by poisoning the t-cache). My friend also did OSCP after that and he rated it between easy to medium level compared to Hack The Box. However, you did need to be faster at finding the easy to medium exploits compared to Hack The Box (since OSCP is time-based and Hack The Box isn't). The levels of Hack The Box are: easy, medium, hard and insane. IMO, this is a false characterization, since the levels are more like: Easy: metasploit vulnerability Medium: some payload vulnerability Hard: harder to find the vulnerabilities, but most vulnerabilties are of level "medium", mixed in with some binary stuff that's quite easy to do (if you know binary, because if you don't, you're gonna cry with how hard it is. I suspect most people don't know how to do it, but VUSec prepped me well for that) Insane: medium web level vulnerabilities (same as hard), but the binary stuff becomes a lot harder, also mixed in with C vulnerabilities (e.g. heap exploit). That's it for the education side, now for the work side. ----- My insight is, there are two types of companies: - Tech companies (they don't care about things like OSCP) - Traditional companies (they care a lot about things like OSCP) The job ads that I saw for tech companies, or tech-related companies (e.g. Airbus [1]) were quite deep. Most of them require deep C/C++ skills with binary stuff and less on the web side. The job ads that I saw for traditional companies were more web-based, had no clue about binary/low level stuff and terms like OSCP were mentioned quite often but not always. My friend now works at a traditional company. He noticed a few things that the article doesn't touch (I skimmed it, I might be wrong). - The level that he needs is at most medium hack the box level (technically) - The level of social skills that he needs is quite high, because you're always telling some IT team that they didn't secure their shit properly - The level of political skills that he needs is quite high as well, because not only do you deal with the IT team, you also deal with all the managers relevant to it So yea, that's what I know. So the resources that this article gave were quite good for getting a job at a traditional company as a pentester, because it's more or less what my friend did. However, if you want to work at Google or something, I think another path is required that probably starts at VUSec. FYI, VUSec is the systems security department at the Vrije Universiteit Amsterdam. Btw, I'm for hire as a junior pentester or junior reverse engineer.