Already raised this in other forums but many comments seem to suggest that a recruiter would be the best person to ask.

Just a bit of background, I work in 3rd level software support at the moment and been in the industry for 5+ years. Unfortunately(or fortunately) got to a point where my job does not require the skills I acquired over time anymore.

Over time I developed some "advanced" skills, that are not always necessary, at least not for a software support role and those include reverse engineering, programming, scripting, debugging etc. I really feel that those are the topics I want to focus my career in the coming years and wondered about where they would be mostly useful.

Decided to get into security for realizing that there are more opportunities there. My specific interest is in webapp pentesting and I'm currently working through self-study to fill in the gaps that clearly exist, before I make a move. I'm also taking courses, anything from Pluralsight to Penterster academy, built my own virtual lab for testing etc but feel that may be challenging to get a job as a pentester without any formal experience working ... for instance, in a company.

So I thought that maybe if I started to bug bounty hunt and use the vulnerabilities I find in my cv as experience, would help me getting closer to the door of the hiring manager but wanted to ask for opinion of people already in the industry...would this make any difference? As a recruiter, would it make any difference that someone is listed in the hall of fame of a website as having discovered vulnerabilities?

I would predict that many answers here would start with:"bug bounty is not easy... " or "may be disappointing to try to find bugs..." and believe me, I understand that. I know its going to be a long process... it's just that wanted to have a feel of a recruiter before I engage in this long endeavor

  • 4
    "Already raised this in other forums". That's a sign that you shouldn't post it here. This is a Q&A site, not a forum. As such posts here should be real questions that can have practical answers, not a request for debate or personalised career advice. Unless you identify an answerable question this question will probably be closed.
    – Lilienthal
    Mar 25 '16 at 12:29
  • "if I started to bug bounty hunt and use the vulnerabilities I find in my cv as experience" - If you find bugs in known software and fix them, you probably can list these in a "projects" section on a CV.
    – Brandin
    Mar 25 '16 at 13:48
  • I love questions that take the form "I cured cancer, but it was in my spare time. Do you think that's relevant for an internship at a hospital?"
    – jimm101
    Mar 25 '16 at 14:54

As an employer of pen testers for over 12 years, and previously one myself, I can say that yes, it does give you credibility and could open the door to a small pen testing company, however if you want to be employed by a large company the usual HR gatekeepers are generally less impressed - they will want to see OCSP, SANS, C|EH or other industry certs in this area.

Please check out Security Stack Exchange - we have a fair few pen testers there, and quite a number of questions on professional development etc. This question may not be quite on topic there, but if you look at our site you'll see good examples of what works. Once you get a bit of rep, you'll find our chat room very supportive of this sort of thing.

  • Thanks Rory... I thought about certs as well but wasn't much worried with it because I know that having them only depends on me, my dedication, my time and I can get them as long as I prepare adequately whereas experience is something that depends on other peers ... the gate keepers as you say. This is why trying to wonder about ways to have experience would be valued by the recruiter. Will definitely work on certs
    – Skygge
    Mar 25 '16 at 14:28

I will talk from my personal experience, which comes from a Junior security officer (opposite from @Rory who is a senior and an employer)

If you want to go bug bounty in order to adquire more demonstrable experience that is fine, just in my opinion is the "all-to-one card" option, because you may be an excellent pentester but you will not be the only one.

There are many other experienced pentester that will going for the bug you aim to (I think you know that already), so maybe in another 5 years you won't get that much of experience you would need to fit into a senior category.

So my suggestion is to start from the bottom again, this may not be the best option if you have kids, or someone depending on you (being Junior again will affect your economy,well you know) but you can escalate quicky depending on your skills and that you are already senior on the workplace (opposite young unexperienced juniors)

Either way you pick, if BB or Junior, both are long process, but IMO starting again will guarantee small experience at least (which will grow as the time pass)

Ps: The certificates that Rory mentioned (OCSP, CEH, SANS, ISACA's) if you have them, It will give you a good boost on you CV and probably a better start

  • 1
    That's an excellent second point of view.
    – Rory Alsop
    Mar 25 '16 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .