How can you gain Information Security experience without a job?

To gain Information Security experience without a job, engage in online courses and certifications like CompTIA Security+, OSCP etc. set up a home lab for hands-on practice, participate in Capture The Flag competitions and hackathons, contribute to open source security projects, and network through information security groups and forums. Volunteering or internships, even if unpaid, can provide practical experience. Stay informed about industry trends through blogs and news, attend workshops and seminars, and undertake personal projects or research in the field.

Gain experience as an entry-level cybersecurity professional by setting up a home lab, participating in CTF(HTB, Proving Grounds, THM) challenges, pursuing certifications (e.g., eJPT v2, PNPT, Security+, CEH Practical, Pentest+), networking at industry events, contributing to open-source projects, and seeking internships or entry-level positions.

Leaning the basics can be achieved in many ways. - Hands-on (most valuable) - Practical videos e.g. YouTube - Books and similar passive activities As a first goal, setting up a small home lab can be helpful. One option is to create a small SOC with a free SIEM like Graylog or ELK, some agents, and a free firewall. With more experience, more and more open-source tools can be added like Security Onion.

For infosec experience without job exposure, start from scratch, mastering basics using online resources. Specialize in web app security, understand web communication, and network fundamentals. Use PortSwigger labs for hands-on experience with vulnerabilities. Transition to bug hunting on platforms like Synack, HackerOne, Bugcrowd, Integrity, Yes We Hack, and Yogosha. Consider offensive security certifications (OSCP, OSWE, OSEP), or become a certified Burp Suite practitioner. Join freelancing pentesting platforms like Cobalt, participate in conferences, CTF competitions, and present research papers to enhance networking and experience. Gain infosec expertise without traditional job exposure.

Self-Study: Utilize online resources, books, and tutorials to learn about security concepts, tools, and best practices. Networking: Engage with the InfoSec community through forums, conferences, and meetups to learn from experienced professionals and stay updated on industry trends. Certifications: Pursue relevant certifications such as CompTIA Security+, or Offensive Security Certified Professional (OSCP) to validate your skills. Stay Informed: Regularly read security blogs, follow industry news, and subscribe to security-related newsletters to stay informed about the latest threats and vulnerabilities. Remember, continuous learning and practical application are key in the field of Information Security

This is a common question I get from new InfoSec folks looking to break into the industry. I would advise seeking out information-specific learning platforms such as Hack The Box and TryHacKMe to practice your skills in safe online testing environment. The great things about these learning platforms is that, most of the time, they have structured learning paths you can take to practice a specific information security technique or tactic. Furthermore, this learning pathways have a certificate of completion for those who complete all of the modules within the learning pathway. This way, you can show an employer that you are doing what you can to gain InfoSec “experience” even if you do not have an actual job in the industry yet.

You can gain Information Security experience without a job through self-directed learning and practical exercises. Here's how to practice your skills: 1. Home Lab Setup:Create a home lab environment using virtual machines to simulate real-world scenarios.Experiment with different operating systems and network configurations. 2. Capture The Flag (CTF) Challenges:Participate in online CTF challenges on platforms like Hack The Box, TryHackMe, or OverTheWire.These platforms offer a variety of realistic scenarios to hone your skills. 3. Open Source Projects:Contribute to open source security projects on platforms like GitHub.Collaborate with others and learn from the codebase.

Collect computer systems from friends, yard sales, estate sales, business fire sales, etc and create a space where you can connect them to power. Obtain a network switch (wifi router is easiest) and set it up to act as a DHCP server. You can maintain the connected systems as desktops or servers. Have a laptop or computer set aside to handle security tools like nmap, metasploit, sqlmap, etc and practice various types of reconnaissance and attacks in a closed environment

I cannot emphasize more about building a network. Your network is your net-worth is a true statement in certain scenarios like Cyber Security industry. If you know everything but don’t know anybody then your knowledge will be sitting like a book on shelf. Use your knowledge to help people, increase & radiate it through different mediums. Visiting conferences & asking product managers about their offerings can help you understand what’s going on & might as-well connect to some good people. Don’t go for pure profits. Provide value & everything will come along.

Talk, chat, talk and chat with as many people as you can. You might win the lottery and find a mentor that can really elevate your path in this field. If you are not a social butterfly, do not panic, you can join many forums and participate (even silently) in many discussions that will provide you real life experiences based on issues that others are living through.

Cybersecurity is a small field with countless options. Having a small network can help to find the right career path or is a huge motivational help. mentors can be found at LinkedIn, but also at cybersecurity related groups like VetSec or SimplyCyber. In most cases, it is good to be prepared and do not ask the easiest question like "How to get into Cybersecurity". Ideally you have a clearer goal to pick the right mentor. Often, mentors are hard to find therefore be willing to invest time into the search, and if you find one work hard to meat the expectations.

Entering the information security (InfoSec) industry, the value of networking and community involvement is immense, particularly for newcomers. The InfoSec community is notably welcoming, fostering a culture of knowledge sharing and openness. Engaging with this community through forums, conferences, and online platforms offers invaluable learning and networking opportunities, facilitating professional growth. More than just gaining technical knowledge, these interactions provide insight into the industry’s culture and help build crucial relationships, leading to mentorship and career opportunities.

Practice cybersecurity basics on platforms like HackTheBox and TryHackMe. For your first internship, use resources like VulHub and digininja's DamnVulnerableWebApp (DVWA) to show off your skills. These platforms give hands-on experience and make a great portfolio for beginners.

Open source projects are the backbone of the modern web. They are also a great training ground for aspiring (and experienced) infosec professionals. Finding vulnerabilities in open source software can be a great way to practice skills such as pentesting and code review, while at the same time helping to make the Internet more secure.

Most Cybersecurity professionals on the defensive side have to watch the news. Every day is a new attack, but if you know about it, you can mitigate many problems. How to get it? There are different ways like reading articles, joining a newsletter, or watching YouTube channels. One idea would be joining SimplyCyber's YouTube channel. Each day, Gerald Auger gives an update about what is happening. There are many more such channels, be sure to pick at least one source. If you are on the offensive side, you may be a bit more relaxed.

While some may insist you run a full security distribution like Kali Linux or Black Arch Linux, it can be a lot easier and more useful to build your own by installing a base distribution of debian or arch linux and making use of Kali or Black Arch repositories. You can customize the tools for your specific interest and not have to worry about having as many difficulties with specific hardware you may obtain to use for your security laptop or desktop