Penetration Testing Experience and How to Get It

The speaker, a longtime security professional and trainer, opens by noting that many people doubt they can move into penetration testing without prior hacking experience. He traces his own route from a non-technical job through system administration and application security, landing a pen testing role despite lacking hacking skills. His point is that persistence and passion can outweigh a missing credential, and that a hiring manager may take a chance on adjacent experience.

He recommends building hands-on skills through online labs and capture-the-flag platforms, plus free tools such as Nmap, Metasploit, Burp Suite Community and deliberately vulnerable virtual machines. Basic networking, Linux and Windows administration knowledge and some scripting are useful foundations. Web application testing and bug bounty programs offer realistic entry points, and crowdsourced platforms can provide short paid engagements. Publishing write-ups, CVE findings, scripts on GitHub and talks at meetups helps show employers what someone can do.

For landing a job, he stresses networking, mentors and referrals, noting that most positions are filled through connections, and maintaining relationships over time. He suggests asking contacts to forward a résumé to get past HR screening. In the audience Q&A he also touched on purple teaming and on how someone from QA could move toward application security by learning the OWASP Top 10 and retesting fixed issues.