lainchan / sec

A rant about pentesting and request for career advice

Acid Burn · 2024-03-08 17:20
Hi folks! I feel like I am burned out and dont want to work as a pentester anymore. After some time it just so mundane and monotonous. And I dont even feel like my skills are developing anymore, as I am mostly doing engagements against some ancient internal apps used by 5 people at most at some corporation I dont care about. Also, I have lots of hobbies and work is just taking my time, especially that I earn more than twice as much as I need monthly and the only thing I could be saving right now - a flat, is so expensive that it would take like 10 years to buy it. So the question is: How do I earn money if I quit my job, preferably without being employed full time? Currently I earn about 4500USD monthly (after taxes), but I would need about 1800USD monthly to be able to pay rent, food etc I have about 25k USD of savings so I can take some risks. I thought about trying bug bounty, I never really gave it a try as all my experiences (a very limited amount of them) was being scammed with duplicates or not being paid for no reason, but I think that 1800USD monthly should be possible for someone with my experience. Just for the reference: I have almost 5 years of professional experience as a pentester, about 10CVEs in my CV and used to play lots of CTFs. I also worked as a programmer for 2 years prior to that. I know that bug bounties sound monotonous as well, but at least I will be facing real-world problems and constantly sharpen my skills. Some of you might say about getting a part-time job, but for some unknown reason I havent seen any half-time offers in the cybersec market. But to be honest I would love to work 20h weekly, just to earn enough money to not starve. Also, there is also this huge layoffs thing going on, so I am afraid that if I quit my job it might be hard to find another one. What do you think? Also, do you have any other ideas on how to make money with my skills without sacrificing my time to profit of others (my employer). Just FYI: I am not interested in going black hat.
The Fin · 2024-03-20 19:42
Know this is probably a soykaf idea, but... I'm actually considering becoming a pentester as a career (field I've been interested in for the longest) but have no idea where to begin, or if I even should. What did you do to get involved in the field, and do you think the job opportunities/outlook is good (i.e., I can get hired as someone with no experience)?
Ivan Petrov · 2024-03-21 11:31
>>23629 Basically, I did a few years of CTFs in highschool and college, then worked 1.5 year as a programmer while still in college and then I found an entry-level penetration tester job and had to accept 50% salary cut. And thats something that you will have to get accustomed to, as imo pentesting roles pay less than software engineering demanding the same level of skill. Here is a cool article about the downsides of pentesting: https://assume-breach.medium.com/im-not-a-pentester-and-you-might-not-want-to-be-one-either-8b5701808dfc One other thing to consider is that it is very hard to find remote jobs as a pentester. Especially to USA because they only hire USA citizens for security reasons. There are certain advantages to be a pentester, but franky speaking I think that finding a decent paying dev parttime job and spending the rest of the time doing bug bounties and/or security research will benefit you more Btw, great picreal xd