How to land a Penetration Testing Job

Penetration testing — also called pen testing or ethical hacking — is the practice of testing a computer system, network, or web application to find security vulnerabilities that an attacker could exploit. Pentesting is a career that will test your limits on a daily basis. Penetration testing can be automated with software applications or performed manually. Penetration tests are also called white hat attacks because, in a pen test, the good guys are attempting to break-in.

In order to find and test weaknesses, a pen tester must have a well documented, step-by-step guides, with detailed explanations. This is a very specialized role that you need to learn how to navigate.

According to PayScale data from August 2020, the average penetration tester salary in the U.S. sits at $84,690 per year. However, many factors affect a professional’s salary, such as experience.

Top Penetration Testing Certifications

Penetration Testing Steps

Information Gathering
Reconnaissance
Discovery and Scanning
Vulnerability Assessment
Exploitation
Final Analysis and Review
Utilize the Testing Results

Skills for Penetration Testers

Desire to learn
A Teamwork Orientation
Strong Verbal Communication
Report Writing
Deep Knowledge of Exploits and Vulnerabilities
Scripting and/or Coding
Complete Command of Operating Systems
Strong Working Knowledge of Networking and Network Protocols.

Penetration Tester Responsibilities

Plan and Design Penetration Test
Carry Out Test and Other Simulations
Creating Reports and Recommendations
Advise Management on Security Improvements
Work with Other Employees to Improve Organizational Cybersecurity

What you should be looking for in a pentesting job. At your job interview be sure to ask the following:

Who are the members of the team you will be working with?
If you can find a job where you can work with a knowledgeable team it will be very beneficial to you regardless of your skill level or experience. When you have access to people with a high skills level it can help move you to the next level of your career. Ask about the people you work with and it will also help you look like a team player.
What does the company do?
Make sure the company you want to work for is in an industry you find interesting or exciting. This will help motivate and keep you interested.
What is the job description and responsibilities?
Find out as much information as you can about the role. Find out what the key responsibilities are going to be. Be sure you are comfortable with the position’s core functions and responsibilities. Be sure that you are honest and realistic in the interview.
What are the hours and after-hour support requirements?
Be sure to get some honest feedback about this so you are not disappointed after you take the job.
Brush up on your theory
Make sure you are ready to answer general vetting questions like “what port number is X associated with?”

How to set up your Pentester Resume to land a job

List all relevant pentesting experience with skills relating to the field.
Don’t just list the Pentesting tools but instead list your pen-testing capabilities like wireless traffic testing, packet inspection, and web testing. This lets the employer know what you can do for them in the role of pentester.
List all certifications that relate to pentesting or cybersecurity. This will highlight your dedication to learning and help show your skills. Many employers will be looking for specific certs.
List any pentesting/security tools that you have built on your own.
Be sure to have projects on Github that your potential employer could review
Create a website or blog and be active on it. This will show a potential employer that you have an interest and would be a good fit with their company.

What is the Interview Process Like?

Every company is different, but the basic interview process usually takes place over two or three interviews. The first interview usually consists of a series of questions to help the interview gauge your level of knowledge and understanding of the pentesting role you are applying for.

Question: What is penetration testing?

Answer: Penetration — refers to entering or making your way through something. It’s also a deep insight.

“Penetration testing is a type of security testing used to test the vulnerabilities of an application. It is conducted to find the security flaws which might be present in the system.”

Question: What is a security Exploit?

Answer: An exploit is the next step in a hacker’s playbook after finding a vulnerability.

Question: Difference between authentication vs authorization?

Answer: Authorization means checking permission. Authentication means checking credentials.

Question: What tools are used for analyzing traffic on a network?

Answer: Packet sniffing utilities such as Wireshark are used for packet-level analysis of network traffic.

Question: What are three basic precautions that protect against brute force attacks?

Answer: Automatic account lockout after a set number of login attempts, IP blocking via a script that detects a certain amount of failed login attempts and Firewall IP filtering to allow only trusted remote logins.

Question: What is the difference between a /23 and a /24 network?

Answer: A /23 network supports a maximum of 510 hosts and uses a subnet mask of 255.255.254.0, while a /24 network supports a maximum of 254 hosts and uses a subnet mask of 255.255.255.0. The /n refers to the number of network bits, and the number of subnets varies depending on the network class (A, B or C).

Be ready for a Practical Assessment to prove your skills.

Did you hear that CompTIA PenTest+ is Approved for DoD 8140/8570.01-M?

Understanding Threat Actors 101

Here is the 101 on the Purple Team

How to land a Penetration Testing Job