EH-Net

I see a lot of requests about shooting for certain entry level certs and was curious if there are people out there looking for practical experience as well to go in conjunction with the certs? Just interested to hear if anyone is exploring options out there and what type of luck they're having.

I suppose I've done both.  I've been lucky though.  I've put myself out there to jobs and asked for internships.  Some been succesful, some have not.  Same goes with certs.  I've paid for everyone one of my certs and I've passed some, failed some. Live and learn and study harder.

Hopefully my hard worked has paid off with this recent job offer.

Joshsevo, you're lucky like you said.  I haven't been able to find any pentesting jobs that require less than 3 years experience, let alone an internship.  How to get that first job without the 3 years...

If you can get a internship then awesome. but I think you find them hard to come by as most companies don't want train people they want skilled professional who they can make money from.

when I was breaking into the industry I offered to work for free and no one would take me on. So I ended up doing certificated to get some expierence.

The key is to demonstrate your passion for the industry. This can bypass experience sometimes. You have to do things on your own time to demonstrate that you're obsessed with this stuff, get certs, write articles, find exploits......whatever it is, do it and keep doing it. You've got to go into interviews professional, but energized. For example, I had a network admin/engineer background (12 years) and was hired as a senior pen testing consultant because I convinced them I knew what I was talking about. It can be tricky but it can be done. A good company will recognize passion and know that the upside for someone with passion is far superior to someone who is just luke warm.

Most of the interviews I've had they've explicitly told me "I can tell you're very passionate" or "you're doing the right things (in order to try to get the experience)", but they still say we're looking for someone with more experience.  Guess I just haven't found the right company yet.


I am doing unpaid work for a startup, I'm not getting a lot of experience, but it's better than nothing.

"Bypass" might have been a strong word. You obviously have to have some experience. I had a plan to get into the industry for years so I tried to do everything I could at my old job in the security space, and tried to leverage that experience in the interview. What are you currently doing?

I don't know.  I had a resume that showed my little experience and my certs and I had some passion in there as well.  They could see that.

I just had in interview for a Jr. Pen Tester yesterday while shopping at Target.  So these jobs are out there.  They found me online and contacted me for the interview.

That's interesting conversation. I just get the impression from a lot of the posts I see that certifications seem to be valued more than experience and was curious what specific issues people have encountered. It's pretty painful offering services for free, but indeed some times it is the only route. What about working penetration into your current positions, has anyone attempted that?

I cant agree with cd1zz that how I got my job I had lot interview who told me the same that they could see my passion but want senior staff just don't give up. and carry on doing certs and applying for junior roles.

Are you based in the USA or UK Seen ?

US