2

I work in the cybersecurity field as a security analyst. As a part of my work I have gained decent experience with white hat penetration testing tools such as Snort, Burp Suite, MetaSploit etc. I also maintain a portfolio of projects such virtual pen testing simulations i have completed on the site of vulnhub.com

My past work experience have all been in highly regulated industries such as banking or insurance. My main concern with future employers is potential insider threat, especially if you are knowledgeable in how to use black hat tools.

What level of details of my experience can I safely put on my resume or say in future interviews? I dont want to seem like a risky hire in terms of security.

Improve this question
6
  • 1
    Perhaps this is naive, but are these skills not standard/expected for somebody in your field? That is, would you actually want to work for a company that doesn't respect the need for their security analysts to be fluent in these tools and techniques?
    – user81330
    Commented Feb 25, 2020 at 13:01
  • 1
    @tymoteusz , it's not my site. I just practice using it. Will remove link
    – Anthony
    Commented Feb 25, 2020 at 13:06
  • @bilkokuta, its expected, yes, but can it also cause worry in potential employers? Financial industry is heavily regulated and many attacks do stem from insiders. Is my concern here reasonable?
    – Anthony
    Commented Feb 25, 2020 at 13:08
  • On the actual questions, the tools you mention are not black hat tools. Something to orchestrate a botnet could maybe classify as one, but this stuff is just security 101.
    – Aida Paul
    Commented Feb 25, 2020 at 13:10
  • @Anthony If the security analyst you are hiring doesn't know how to use the basic day one hacker tools you've listed then they aren't a security analyst. Your concern is completely unreasonable. It would be like being afraid to hire a locksmith to fix your locks because you are worried they know how to break locks. Its a basic day 0 requirement for the jobs you are looking for.
    – TheBatman
    Commented Feb 25, 2020 at 14:13

1 Answer 1

Reset to default
7

Penetration tester here. Put it all in. These are standard tools and techniques for your field. You'd basically have to admit to doing illegal things (using these tools on systems where you have permission to, such as CTF sites or VulnHub VMs, is legal pretty much everywhere) for an employer to get cold feet in this industry.

No sane employer is going to jump from 'knowledge of tools' to 'potential insider threat' in a single bound in the cybersecurity industry. Things like background checks and interviews exist to fill in those blanks.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .