I was looking around for some stuffs about pentesting and I found an excellent article talking about how to get hired as a pentester.
Being a good (Perfect!) pentester doesn’t mean to just be able to run some tools, exploit some systems, and charge the client, but a good Pentester should have certain criteria and methodology of work and some fluency in communication and listening skills, to explain the problems and recommendations and be understood by the clients.
Master the tools and principles of testing is important, but understanding their approaches and methodologies is paramount, by having perfect knowledge of the OSSTMM (Open Source Security Testing Methodology Manual), the OWASP (Open Web Application Security Project), ISSAF (Information Systems Security Assessment Framework) and the guidelines on Network Security Testing by NIST.
Regarding certifications (CEH, CISM, CISA, MCSE, CCNA, CWNP ...), they are not mandatory but favorable and desirable.
In addition to the technical side, the tester will have to meet clients and interact with them, with all confidence and with a professional strength of marketing and business, and should especially understand the value of the service he provide to the customer and respect the Non-Disclosure Agreements.
As there are many tools that perform the exact same function, the pentester must have its own customized list of tools that he had gathered and tested.
