Understand the principles of corporate network design and firewall operation.
Be able to work with different operating systems.
Be familiar with Active Directory–based infrastructures and be able to find and exploit vulnerabilities and misconfigurations.
Have skills in conducting web attacks and exploiting threats from the
OWASP Top 10 list.
Understand the basics of penetration testing (reconnaissance, scanning, exploitation, persistence, and privilege escalation).
Have offensive security certifications such as OSCP or OSWE.
Participate in public offensive security research (presentations, blog articles, and CVEs).
Be active on specialized platforms such as Bugcrowd, HackerOne, Hack The Box, Root Me, Standoff 365, or TryHackMe.
Make sure your team members have versatile skills covering the key areas: web testing, infrastructure, reverse engineering, and threat intelligence.
Understand the principles of corporate network design and firewall operation.
Be able to use network traffic analyzers, such as Microsoft Network Monitor or Wireshark.
Be able to work with different operating systems.
Understand the main web attack vectors and how attackers exploit threats from the
OWASP Top 10 list, as well as SQL injections, XSS, and Path Traversal.
Understand the key attack vectors and stages (reconnaissance, gaining access to the target, malicious code execution, lateral movement), along with persistence techniques and privilege escalation techniques.
Be able to use the MITRE ATT&CK matrix and the Cyber Kill Chain model.