My Journey to Pentesting

I am currently living out my dream on an offensive red team!

This was one of the goals I wanted to achieve in life ever since I was a teenager. However, it was a long road to get here and this is how I did it. Towards the end of the article, I also give my two cents on how to get into the field. Its opinionated as we all start from different steps in life however, what I say is my own viewpoint from the things I have personally seen.

College

I graduated with a Bachelors of Science in ITAM - Cyber Security. I honestly struggled the first years of college since nothing peaked my interest. Biology was eh, statistics were not fun, and the list goes on. It wasn't until I joined my major until things took off. I realized I had a passion for cyber security and learned everything I could. I took a bunch of classes in cyber security methodologies, digital forensics, web development, offensive security w/ Kali, and more. My interest peaked and so did my grades. That was when I knew I wanted to work in the cyber security industry.

Internships

I currently was working for a company that created an internship just for me. It was an information technology internship that helped me gain some experience in the IT world. I mastered and deployed phishing tests using a software back in the day called Proofpoint. I taught and tested our employees with all different kinds of phishing attacks including ACH scams, social engineering, etc. I also helped write up a company policy on the physical security of the office. (Cameras, alarm systems, you name it.) This led to a second internship working in the cloud, specifically O365/Azure. A third party vendor recognized my efforts and offered me an internship with them after my first one has finished. Within that internship, I helped create an apps through Microsoft Power Apps automating a few processes regarding timecards / checking out equipment. I helped research/test/implement backup recovery management software that integrated with O365. Towards the end of the internship, I helped gather security data from Microsoft Secure score and implemented security policies through Azure. This lead to a O365 custom risk assessment that I created and submitted helping assess our security within our cloud infrastructure.

Engineering + Certs

While finishing school and completing an internship, I also studied on the side with what little time I had left for the CompTIA Net +. I ended up completing the internship, graduating college, and securing the Net + all within two weeks. While scrolling on LinkedIn for jobs, I saw that one of my old friends shared an IT engineering apprenticeship. I decided to reach out and apply, and after 3 interviews, secured the position! Within this apprenticeship I gained my SSCA, A+, and CCNA. I went through multiple classes as well with troubleshooting networking gear, PowerShell, python, active directory, and cabling. During this apprenticeship I learned a valuable amount of information about how a network works, how nodes can talk to each other, and the power of active directory. I graduated the apprenticeship and became a Network Security Engineer on our Cisco Implementation team. This position was crucial to my road to pentesting. I worked one on one with customers building their infrastructure from the ground up as well as working with other team members. Whether it was building a new firewall, implementing cisco security solutions, or even installing switches... we did it all. My focus was NGFW FTDs/FMCs, Duo (MFA), Umbrella, Secure Endpoint AV, Secure-X, Snort, cisco switches, routers, etc. The technologies / soft skills I learned from the position was priceless. I had excellent senior engineers that would help me when I hit a wall, a great boss that would listen to my struggles and help re-align my focuses, as well as great team members that no matter what time of the day it was would always come to each other's aid. Little did I know, working with customers day in and day out, building out their infrastructure in a screen share would increase my consulting skills as well. During this time, I also passed my CCNP Security. I took the core test first, then passed the firewall specialization test to secure the CCNP-S title. I also completed my CMNA and eJPT while in this position. (Reviews of certifications can be found under "Certification Reviews" within this site) I knew I wanted to transition into the offensive security world after being on the "blue team" for a while. I was active in a bunch of cyber security discords and actually met a person who recently had joined a company as a pentester. We talked for a bit and I told him my dream of getting to do offensive security. He linked me an application and told me to apply to the company he was working for. After a few rounds of interviews, I successfully managed to secure a position as a penetration tester / red team operator.

Ending Advice

My road to pentesting took years to get to but I didn't give up.

My biggest piece of advice is to start small. Apply for an entry level positions! Go after that helpdesk job, become an IT technician, get any IT experience you can and you WILL move up. It may take some time, it might be a pay cut, it will be grinding for certs after hours, but it is worth it. That isn't the one and only route either... I have met several people that all had different paths; College, job experience, certifications, self-study, side projects, you name it!

I always thought of it this way. Cyber Security is all about securing a network, web app, or whatever. How are you supposed to know how to secure "<Enter technology here>" when you don't even know the technology itself? How am I supposed to pivot to another network if I don't know the fundamentals of routing? How am I supposed to exploit a vulnerability within Active Directory when I don't even know what Active Directory is? It is important to learn these fundamentals to help gain an understanding of the basics before you can go to more advance topics.

Thanks for reading and good luck on your own journey!