Ethical Hacking career options for qa professionals

Question

As a test engineer or QA engineer it is very important to have at least one of the Software testing certifications. This will help to broaden the software testing knowledge, also helpful for testing employees to get the promotion in their respective field in large MNC’s.

QAI, ASQ, ISQTB and several other institutes are offering testing specific certifications. These certifications improve the confidence of the clients on the testing professionals. CQTM, PMP are some managerial certifications, which help the testers to scale up in the professional ladder. Certifications on the testing tools offered by vendors like HP increases the technical competency of the individual.

But, I would like to do Certified Ethical Hacker course. Will this course help to boost up my QA career in a security perspective? Can any one give me a proper guidance regarding this?

Answer 1

You have a few options if you want to become a security QA.

• CEH: please bear in mind, CEH council needs you to demonstrate that you have worked in software security industry for a few years otherwise you will have to attend their training course.
• ISTQB security tester certificate.
• Kali Linux certificate.

As a test engineer or QA engineer it is very important to have at least one of the Software testing certifications. This statement is not necessarily true. I have seen testers without any kind of certificates but have demonstrated real industry skills.

• The real reason why people are getting certificates is that nowadays, recruiters use bots to screen candidates from Linkedin (for example). The screening criteria they have configured perhaps include "ISTQB" and/or "CEH", if you do not have them, you do not even make it through the initial screening process.

Security testing is a completely different kind of animal:

• Security testing needs a very different kind of mindset. CEH shows merely the doorway into this industry. It may get you through the initial screening process but during interviews, you will be challenged with real life problems.

Software security has been identified as one of the most promising career paths in 2017, getting a CEH is a good start.

Answer 2

As a test engineer or QA engineer it is very important to have at least one of the Software testing certifications. This will help to broaden the software testing knowledge, also helpful for testing employees to get the promotion in their respective field in large MNC’s.

This is merely a myth. Most certifications out there don't really help you learn testing. They don't give you practical knowledge. Only by practicing testing and improvising and learning new skills will make you a better tester.

About the promotions and good raise, that's may happen sometime, but not always.

Some companies do fancy hiring people with certifications on hand, but it's not really important to be certified to have a good career in Testing and QA. If you actively keep learning and getting better at your work each day you will definitely have a good career.

About Certified Ethical Hacker course helping boost your career, well, that totally depends on you. If you find out shortcuts and cheat-sheets to clear the examination merely to get a piece of paper that says you are Certified Ethical Hacker, I think that won't help you much. You may get a job with that, but it'll be real tough to keep it and even more so to get a promotion. BUT, if you study the course properly, get hands on practice and improve your skills and really get deep into the security analysis stuff, you will definitely have an awesome career in ethical hacking and security analysis.

Answer 3

As someone who was in test for 13 years and has transitioned to information security in the last 2 years, I've thought long and hard about all of this.

First, as others have already said, certifications don't matter that much for most organizations. Some industries will require them because they have little else to use for verification of knowledge/skills. Mainly government and large highly regulated orgs like banks or insurance. Which is the same for test related certs as well. They're only as valuable as the person(s) reviewing your resume.

Second, is showing your own initiative to learn. This carries quite far in infosec. The courses that support the certs will help to show that, but security is very broad and very deep at the same time. There are some sub-genres, but they all intersect to some degree. This means you need to be always learning and always researching.

All that being said, the CEH course work is not regarded terribly highly. Many are drawn to it because it says "hacker" in the title, but depending on where you are in your career it may or may not be worthwhile. Since you are just starting though, it may help you to figure that out and show what you do or don't know and figure out how you want to move forward. Especially if someone else, like your employer, will pay for it :)

Also, there are a lot of great resources to find out how you want to pursue your new career options. Thankfully there are folks out there like @mubix who have been kind enough to compile a lot of those resources in one place. Check out his gist on github here: https://gist.github.com/mubix/5737a066c8845d25721ec4bf3139fd31

Hope this helps! Don't be intimidated by all the data out there, everyone starts somewhere :)