Pentesting; Failing Upwards

I was given instructions to start an office. Find candidates, filter through them, and then pick a number of them. A lot of trust and I wholeheartedly thank my employers for giving me the rope to do this.

I have never really seen becoming a manager as a career ambition. I always have, and most likely always will, call this “failing upwards”. Why? Put simply being a Pentester for me is the greatest job on the planet. Any step away from doing that *every*day* must simply be called “failing” right?

Over the years I have assisted many in the industry by offering; advice, training, but most importantly (so I am told) is TIME.

During my decade or so I have seen those I helped go from entirely green to campaign hardened professionals. Thinking back to them being straight out of university and unable to sort out their “multiple simultaneous logins” from their “session hijacking” (more common than you might expect that confusion!). They now are doing exceptional things themselves.

Usually the committed people will get there on their own and it is not necessarily my influence. In some small way I hope they do even one thing better as a result though!

Currently, I still get to do a decent number of testing days which is good. However, I see the time for that coming to an end relatively soon. The in-take for the inaugural year seems set and now we just have to focus on starting them off correctly.

Guess I will have to live vicariously by assisting my new troop during their projects. To support all of this I have been making training and coming up with little speeches in my head.

Today I am really excited to start the newest member of the team off on the route of how to be professional, and get the job done. There are a lot of myths about the industry that seem to build up. Universities seem adept at teaching some things but not in making “consultants”.  Part of the programme will be to sort those out!

The goal is not to make people ready for passing some certification like CREST. It is to make them engaged with their job, confident in doing it, aware of where to get information, and to deliver things that are useful to customers.

Remember these few points:

• the report is the “product”. Not how amazing your technical acrobatics is.
• recommendations are what the customer pays for.
• talk to the customer. Not all of them are the same, some might have a preferred risk system etc.

Take ownership of your deliverables, care about your name being on it, and TALK to the customer. These things will set you up the right way.