According to the most recent ISC2 cybersecurity workforce study, around 4.8 million cybersecurity roles remain unfilled. Many of these roles span the numerous fields within cybersecurity (e.g. SOC analyst, forensic analyst, etc.), though focusing on the offensive side, discussions in this space almost exclusively cover the ‘how’ of becoming a hacker, the technical skills required, with little to no mention of how to actually land a job as one. Go ahead and Google ‘how to become a hacker’ right now, and most results will be organisations upselling their courses. Technical skills do indeed matter (and sorry to break it to you, but no role in cybersecurity gets by on AI prompts alone), but the thing is, your technical capabilities are only half of what the job is about. Fortunately for you, this blog covers the other half, and how you can improve it.
So put away the bootcamps and €3,000 certifications, because we are going to explore the harsh realities behind the façade.
It’s not all hacking and glory
Having taken many offensive security courses myself, one common pattern I noticed is that they share a familiar structure, often starting with some technical content and finishing with a report. Granted, it’s a reasonable introduction, but frankly, and this is coming from someone currently in a red teaming role, it paints an incomplete picture of what the job actually looks like. For many beginners and intermediates alike, that gap is exactly why they struggle to land their first role.
The biggest assumption among beginner operators is that their first offensive security gig is purely about attacking systems and writing reports. Whilst there is some truth to that, and yes, phishing, external attacks, Active Directory, web hacking, and even physical intrusions will all feature, there is also:
- Client meetings and report presentations
- Internal debriefs, collaboration, and knowledge sharing
- Adaptation to corporate culture, policies, and compliance requirements
- Verbal and written communication, stakeholder management, and professional conduct
You can probably see a common pattern here. Offensive security is not purely about being the best technically. It’s about communicating findings effectively, cooperating with teams, and doing so professionally. Regardless of how much you know in your field, your character, the way you speak, the way you present yourself, and your ability to explain a complex topic in layman’s terms will always go a lot further than the certifications you hold. In fact, assessments may sometimes fall short of scope or not go to plan. The ability to clearly explain what happened and why is something every employer values, because anything less risks not only losing a client, but potentially your career as well. No technical certification helps in this regard.
Snake oil and certifications
Based on our own research, offensive security takes the largest market share of online courses and certifications. However, several platforms and ‘influencers’, whose names shall be kept quiet, sell promises of landing a job with a six figure salary once their paths or certifications are completed. This is completely false.
No course, certification, or bootcamp directly secures a position, and on its own, is almost never enough. I have known operators with impressive certification portfolios who were laid off for nothing more than a lack of soft skills. These accomplishments, whilst valuable, are merely a drop in the ocean of what employers actually look for, and should never be mistaken for a guaranteed ticket to employment.
That said, not all certifications are created equal. Seek out to some members of the community already working in the role you’re after, and take their guidance over any marketing material.
What actually matters
It’s hard. Spending many hours in front of a screen learning technical skills is one thing, but learning to carry yourself as a professional is an entirely different challenge, and for many in this field who lean towards introversion, it can feel like the harder of the two. With the right mindset, however, it is entirely achievable.
Here are some of the most important considerations:
- Consistency, and the willingness to apply for several hundred jobs without giving up
- A clean and adequate resume for the requested tasks; think of it as a deliverable, because your employer will
- The practical application of soft skills; can you present confidently? Can you break down a complex subject for someone with no technical background?
- Professional presentation and hygiene; if you cannot take five minutes to present yourself well, it becomes difficult to convince an employer you are capable of carrying out a complex attack path
This introduces the foundation, but the point still stands. Offensive security is not purely about being able to compromise a system. It’s about doing so with the professionalism, communication, and conduct that the role demands.
Why many fail
Most people fail to land a job in offensive security for one of two reasons:
- Giving up after sending only a handful of applications
- Focusing exclusively on technical skills whilst neglecting everything else
Context matters too. If you are self taught, the road will likely be harder, and persistence becomes even more important. Keep going where others stop.
Lastly, don’t hesitate to start on a low salary or in a junior position. Experience is worth far more than any certification you hold, and some of the best operators started at the bottom. Put the ego aside, take the opportunity, and grow from there.
Practical advice
To wrap up, here are three of our most important tips, in addition to the resume:
- Keep a blog and document what you learn; writing about what you know is one of the best ways to demonstrate your knowledge and your ability to communicate it
- Find CVEs and make yourself known in the community
- Develop a small specialty to bring to the team (e.g. mobile, malware, cloud, OT, etc.) and use it to stand out
If you have any questions or want some practical advice, feel free to get in touch.
