A person indulged in the negative aspects of information security (social engineering, active information gathering etc.)

  • Should he reference these experiences in his CV
  • And if so, how should he reference it?

The debate about the legality and morality of the mentioned actions will be irrelevant here and out of the scope of the argument.

  • 6
    The debate about legality is quite important when it comes to your CV. Don't put on paper that you did anything illegal. It's bad for you, and bad for the company who wants to hire you.
    – tylerl
    Commented Sep 4, 2013 at 9:24
  • 2
    By themselves, those aren't illegal. Companies often have people or hire consultants to try to break security through means such as those that you have mentioned. Was this your job, or were you using these techniques outside of employment for possibly illegal reasons? Commented Sep 4, 2013 at 11:15
  • 1
    I don't usually forward received resumes to the police, but I also don't have a policy against it.
    – emory
    Commented Sep 4, 2013 at 16:19

2 Answers 2


It somewhat depends on the role, but in general I'd steer clear of any mention of legally dubious activities on a CV.

A lot of large companies like to play it safe with that kind of thing and could drop an otherwise good candidate to avoid potential complications down the line.

Also if it is legally dubious putting it in writing is never a good idea.

I'd say that if the person has expertise that's relevant to the role (so the role includes Social engineering for example) that kind of thing could be expressed verbally in an interview where it can be put in the correct context.

  • 5
    ... if it is legally dubious putting it in writing is never a good idea. YES! Commented Sep 4, 2013 at 13:55
  • 2
    @RoryMcCune - As you point out there is a difference between a reference to a report on an exploit say in Android you have discovered and documented at a security conference ( with references to the white paper for bonus points ) and saying you were the person responsible for the Linken compromise. One isn't illegal as you in theory reported the exploit to Google before you released the paper the other is illegal and anyone who read that on a resume would be without any moral compass not to report it to the proper law enforcement.
    – Donald
    Commented Sep 4, 2013 at 14:16
  • 1
    @Ramhound absolutely, I don't think many employers would have a problem with responsibly disclosed vulnerability research, I was guessing that the question referred to a greyer area than that. Obviously if it was outright criminal putting it in writing would be an amazingly bad plan. Commented Sep 4, 2013 at 15:15

It depends. If you're not applying to a security company, then I would leave them off or reference them in an innocent way - "security consultant" or some highly spun version of the truth.

If you are applying to a security company, it still depends. If you are outside of the statute of limitations or you've been tried for the illegal activity, just list it (with some spin to provide the right tone). People with practical experience breaking security are invaluable to security companies.

If you've done things that people don't know about, and are within the statute of limitations I suggest listing something inbetween. You've done something shady, but unspecific enough to be useless as evidence (by itself).

  • 2
    I would advise ever in any capacity putting on paper that you admited to a crime. The laws can be changed at any time. Working for a security company is legal, their work legal, nobody is harmed by that work. Illegal activity is illegal for a reason, some harm is likely done to somebody, doesn't matter who.
    – Donald
    Commented Sep 4, 2013 at 14:18
  • @Ramhound - Ex Post Facto criminalization is itself prohibited by many countries' constitutions. If you've been tried for the crime, it is public knowledge anyways. Do you want a good job or do you want to chicken out because you backdoored a few machines on your university network?
    – Telastyn
    Commented Sep 4, 2013 at 14:32
  • The constitution can be changed to. If creating a backdoor to an insecure university network gets you a good job, sure admit to it, but don't expect people even in the security industry to accept it.
    – Donald
    Commented Sep 4, 2013 at 14:36
  • @ramhound - in my experience in computer security, nobody worth anything had completely legal experience - quite the opposite. And that came through in how we vetted candidates. Hell, the CTO spent a few months in jail for breaking into a backbone provider (who then promptly hired him).
    – Telastyn
    Commented Sep 4, 2013 at 14:44