Cyber, Risk & Internal Audit
Offensive Security / Red Team
The archetype with the most competition per posting and the clearest way to stand out: public, verifiable work.
Offensive security is the most oversubscribed security specialism, because it is the one people want to do. That makes the hiring signal unusually simple: public, verifiable evidence of finding real things beats every certification and every claim of interest.
| Time | What you are actually doing |
|---|---|
| 09:00 | Scoping a test. What is in scope, what is explicitly out, what the rules of engagement are, and who to call if you find something that cannot wait for the report. |
| 10:30 | Testing. Long stretches of nothing punctuated by a chain that works. Most of the time is reading and mapping, not exploiting. |
| 14:00 | Writing. The report is the deliverable and it is judged on whether a developer can reproduce and fix from it. A finding nobody can act on has no value regardless of how clever it was. |
| 16:00 | A readout. Explaining severity to people who will push back, and separating what you proved from what you suspect. |
The decisive round
“Walk me through your best finding.”
Interviewer: “Tell me about the most interesting vulnerability you have found.”
A weak answer. “I found a stored XSS on a client's admin panel that could have let an attacker take over an administrator account. It was rated high and they fixed it.” Common bug, no chain, no reasoning about how it was found, and nothing about impact beyond the label. This is the answer everyone gives.
A strong answer. “The one I would pick is not the most technically exotic — it is the one where the chain mattered.
Individually there were three low-severity findings: an endpoint that leaked internal hostnames in an error message, a redirect that did not validate its target, and an internal service that trusted requests originating from the application tier. Every one of those had been reported before and closed as informational.
Chained, they were critical. The hostname disclosure told me what internal services existed. The open redirect gave me server-side request forgery from a component that could reach them. And the internal service's trust model meant that once a request arrived from the right network position, it was authorised. I used it to read data from a service that was never intended to be reachable from the internet.
What I would highlight is the method rather than the exploit. I found it because I read the error messages carefully instead of running a scanner, and because I went back through previously-closed low findings looking for combinations. Most organisations triage findings individually, which means chains are systematically invisible to them — that is a process finding as much as a technical one, and it went in the report as one.
I also wrote the remediation as one change rather than three, because fixing the trust model closed the chain regardless of the other two.”
A chain rather than a single bug, the method that found it, and a process observation the client can act on. It also demonstrates the thing that actually distinguishes good testers: patience with boring output.
- Public evidence is the whole game. A CVE credited to you, a bug bounty profile, a well-written writeup, or a tool people use. One of these outweighs any certification.
- OSCP still opens doors in this archetype specifically, unlike most of security where certifications matter less than the industry thinks.
- Write one excellent report and bring it, redacted. Reporting is half the job and almost nobody demonstrates it.
- Build something offensive — a small tool that automates a tedious part of testing. It shows you can code, which separates testers from operators of other people's tools.
Compensation
| Market | Band | Notes |
|---|---|---|
| United States | $130k – $230k base | Specialised research (hardware, kernel, mobile) sits above |
| India | ₹12L – ₹40L total | Consultancy pays less than product-company red teams by a wide margin |
| Both | — | Most competitive archetype in the atlas. Public artefacts are how you get read at all |
The book for this field
Security Engineering & Tooling
What each category of security tool structurally cannot see, what the evidence actually supports, how the market consolidated, and what the 5,197 postings say the job is.
Also read for this role
Identity & Access
Authentication versus authorisation, federation, the joiner-mover-leaver lifecycle, entitlements, privileged access, secrets, and machine identity.
Cross-cutting
Skills every archetype tests
These are shared across every field on this site — the same question asked in different vocabulary — so preparation here compounds rather than being spent once. The book above is specific to your field.
Practice the 12 Security questions → · Back to Cyber, Risk & Internal Audit →