Entrepreneurship + security contracting

r3mo

Hello,

I'm hoping to get some advice on my somewhat complex career situation.

I've spent the last few years working in a startup business which has not got off the ground (lots of progress, lots of work, but with a business partnership which does didn't work out, it didn't make it).
The startup was to commercialise a computer security technology - I invented it, developed a proof of concept and now a product demonstration, which involved lots of hands on cryptography and security development completely on my own. I started this business after quitting university in my final year (it was too good an opportunity to put off). I should be able to spin this to make it look very good on a CV.

I'm looking at getting into penetration testing. I've good knowledge in some areas (others I'll brush up on) and I'm planning to take the Offensive Security Penetration Testing with Backtrack (OSCP) course which should hopefully prove that I have good, practical penetration testing skills.

The problem is, however, that I live in a small country where there is very little pen-testing work/companies.

I plan to get proven pen-testing experience - as a worst case scenario, I'd do a short term contract for a very cheap rate simply to get it on the CV.

Once I've got experience and the OCSP, I plan to do short term security contracting (max 1 month) almost anywhere (I'm happy to travel, but I'm somewhat tied down to my home so I can't move away). I'm not really wanting to get a full time job (and there aren't really any available here).


My questions are:

Am I being unrealistic in my desire to do contract work without lots (e.g. 5 years) of formal experience?

Am I being unrealistic about being able to reliably find security contracting work - enough to make a decent living? Thanks to my entrepreneurship, I'm good at selling myself and networking with other professionals.


Any advice would be truly appreciated - I'm rather muddled over the whole situation!

Thanks in advance!
r3mo

JDMurray

r3mo wrote: »

The problem is, however, that I live in a small country where there is very little pen-testing work/companies.

Maybe try expanding your marketing to include potential customers from all over the entire planet.

he nice thing about network pen testing over the Internet is that your physical location rarely matters (unless you are trapped behind a very restrictive ISP), so your customers don't need to be in the same country. The bad thing is that you face competition from all other pen testers on the Internet. So you need to be verifiabiliy good (customer references) and come at a good price.

r3mo

Hi JDMurray

Thanks for the response

You talk about network pen-testing over the internet - is this something that is commonly done? My understanding is that clients would want face to face contact and for the contractor to come on site.

Thanks in advance,
r3mo