Hello all,
I have read through some of the other pen testing threads (I didn't have to go too far, the first page is literally full of them), and I guess I just wanted to get an idea of what people think in general about pen testing as it relates to the federal government or consulting part time.
Here's what I am thinking. I just recently went to the CNSS 4016-I Risk Analyst course, and a lot of guys there were either full time validators for DoD or they were moving into pen testing. It would seem the appropriate path for me would be to move forward with OSCP for my own good, and also follow the respective branch/organization process for becoming a member of the red team, or other entity to test their networks. You can see my certs on the left...but I will list them below as well. Thank you "zaaa" for the format...I'm using it since I like the way it was laid out.
My Experience:
- 4 years of T1-T2 Helpdesk/Hardware support
- 1 year of imaging and XP->7 migrations for an 8k+ machine environment
- 3 years of Sys Admin experience / primarily Windows with a touch of Linux
- 1 year as a CND Analyst (ArcSight, Sourcefire, Netscout, Wireshark, NetWitness)
- 2 years as an IA policy geek
- 2 years as a Network Admin in a primarily Cisco based environment
My Education:
- B.S. in Information Technology - Security
- A.A.S. in Applied Computer Studies
My Certs:
- Comptia A+
- CompTIA Net+
- CompTIA Sec+
- CompTIA Linux+
- CompTIA Project+
- Cisco CCNA
- Cisco CCNA Security
- LPI LPIC-1
- EC-Council C|EH
- CIW (Web Design Specialist, JavaScript Specialist, Database Design Specialist)
- CNSS 4016-I Risk Analyst
My Cert Plan:
I would say that's pretty much it. At this point, I think it's best to just get my hands on some sort of programming/scripting action...(python etc.), and go from there. That sound about right? I know that I will need a home lab and that's not a problem. I have a good bit of experience with tool suites like BackTrack...but my experience was more like 4-5 years ago when I was hardcore about InfoSec. Then I became a CND Analyst...got burnt out looking at packets all day and went back to IA and Compliance. Which is where I sit now. It's not that I don't like paperwork, because I do like to research and type; it's just that I don't like ONLY doing paperwork. I also want to retain technical skills and knowledge.
Of course, I've been saying I need to figure out where I want to go with my career for 5 years now and I'm still not sure haha.
