Everyone talks about how to become a hacker, but it’s quite rare to talk about how to get the job. No bootcamp or 3,000-euro certifications here, just the harsh reality behind getting your first job. It’s going to be a big deal.
The myth vs the reality of the first job
Before you want to get started and find your first job in this field, it is necessary to know the realities on the ground and what they really are rather than following a ready-made idea that you would have made of the job. Many people are starting offensive security and think that the first job is only to attack and from time to time write reports. The reality is quite different. In the first job, yes, there will be many times when phishing, external attacks, active directory, web hacking, or even physical intrusions are practiced. But on the other hand, there are of course the reports to be written, the meetings with the end client, the company’s internal meetings, the corporate culture and most importantly the soft skills.
The false gurus
Several platforms whose names will be kept quiet sell promises to get a job with an executive salary after their paths or certifications in offensive security, it is obviously completely false. No certification or bootcamp directly gives a job, and is ALMOST NEVER enough. This is just a drop in the ocean of things actually requested that we will see in the next point. Consider certifications and skills as pleasant moments to nurture your personal satisfaction and curiosity, as well as necessary for your learning. Not like certifications to be hired. What actually moves the needle is training on real scenarios, building and breaking real infrastructure yourself, not collecting a paper certificate and hoping someone notices. Moreover, some certifications are better than others. We recommend that you question members of the community in the situation where you want to find yourself, they will ask nothing more than to advise you and help you in your search.
What is worth it
Here are the most important points and those that really give the job:
- Consistency: Do not be afraid to apply for several hundred jobs.
- A CLEAN and ADEQUATE RESUME for the requested tasks: The resume you will provide will be judged as the deliverables you will need to send to clients, or as the internal documentation or even the meetings you will conduct. It must also match the image of the company and the skills it requires. Stop with generic resumes.
- Soft skills: You may be the best hacker, but if you run away when you need to demonstrate flaws in a meeting, if you stutter in a presentation, or if you are unable to simply explain what a Refresh Token is to someone who isn’t technical, you won’t be worth a pound. you’re missing 70% of the job.
- The presentation: Make sure you are presentable and well-groomed. If you look tired or underdressed, what will the client think when they see you? He’s not going to tell himself that you’ll take care of his infrastructure or that you have the skills. If you are not even able to take 5 minutes to trim your beard or match two clothes, how can you convince him that you are capable of carrying out a complex attack on the level of a constrained delegation on his environment?
- Real skills: Hacking platforms, online courses, and raw skills. Have you ever done real labs on your own? Did you have the rigor to set up infrastructure before breaking it? Have you ever set up a complete phishing infrastructure with MFA bypass via AITM or Device Code before just following a walkthrough? Do you have the skills described in the job? Are you following a hacking path?
- Relationships: Join communities, find mentors, learn from these people, share your findings, be known and be part of the hacking ecosystem.
Practical advice
Here are the two most important tips in addition to the resume:
- Keep a blog, and document what you learn and find.
- Find CVEs, and make yourself known in the community.
- Having a small specialty to add to the team (Web, Mobile, Malware, Cloud, OT), will allow you to stand out.
Why can’t most people find
Most people can’t find a job because they either GIVE up after several resumes have been sent, or they focus on only 1/5 of what we saw, the technique, and not the other skills. Also, take into account the context: if you are self-taught, it will be 10x harder to find a job so be even more persistent. Finally, salary/income level, don’t hesitate to start low in salary or low in position. Starting at the helpdesk or in the call center can open doors for more. Yes, you have 10 certifications and phenomenal skills, but the employer can’t see it unless you show it to them. Don’t be afraid to put the ego aside and start really low.
