30-Year-Old to Ethical Hacker — Realistic Career Timeline

What the security job market actually looks like
for someone switching at 30:

WHO ACTUALLY GETS HIRED AT 30+
  ✓ Ex-IT ops / sysadmin / network engineers
    moving to security — the most common path
  ✓ Testers moving to application security
  ✓ Developers moving to product security
  ✓ Career-switchers from finance, teaching,
    banking who did real lab work
  ✓ People who did helpdesk and upskilled

WHO STRUGGLES
  ✗ People who only have certificates
  ✗ People who never built a lab
  ✗ People who "studied security" but never
    broke anything
  ✗ People who applied to 500 jobs and gave
    up at 20 interviews

THE HARD TRUTH
  Security interviews are practical. A 22-year-old
  with a strong TryHackMe profile beats a 32-year-old
  with a CEH and no lab work every single time.

  Age is not the variable. Portfolio is.

WHAT THIS MEANS
  If you commit 2 focused hours daily for 12-18
  months and build a real portfolio, your age
  becomes a non-issue.

  If you spend 12-18 months collecting certificates
  and reading books, your age won't be the reason
  you didn't get hired — but you still won't get
  hired.

THE STRUCTURAL ADVANTAGE OF BEING 30
  ✓ You're calmer in interviews
  ✓ You understand business context
  ✓ You can explain a risk to a manager
  ✓ You've worked with people — soft skills are
    real
  ✓ You can commit to a direction (most 22-year-olds
    are still deciding)

What predicts success in a 30+ switch:

1. LAB HOURS
   Not course hours. Actual hours in a VM,
   breaking things, solving CTFs, doing
   TryHackMe / HTB rooms.

   Target: 300-500 hours over 12 months.
   That's ~2 hours daily for 6-8 months,
   plus the reading.

2. A PORTFOLIO OF WRITEUPS
   10-20 TryHackMe / HTB writeups on a blog
   or GitHub.
   Each shows: the box, the approach, the
   thinking, the fix.

   Interviewers don't read them all.
   They look at the first two and decide.

3. A CERTIFICATION THAT MATCHES THE ROLE
   eJPT or CEH for entry-level red team.
   Security+ for broad entry.
   OSCP for serious pentest roles (later).

4. STORY DISCIPLINE
   One sentence on the switch.
   No apology, no backstory.
   "I spent the last 18 months learning
    security through labs and certifications.
    Here's my portfolio."

5. HONEST SALARY EXPECTATIONS
   The first role might pay ₹4-8 LPA —
   less than a senior person might currently
   earn.
   The crossover happens at year 2-3.

What does NOT predict success:
✗ Age
✗ Prior tech experience (helps, not required)
✗ Gender
✗ Degree
✗ Family support (helps, not required)

What predicts it:
  Did you show up for 12-18 months
  and build real evidence?

That's the entire answer.

# recon.py — first proper security script
# Reconnects: networking, Python, OSINT, Nmap
# (works against targets you have permission to test)

import subprocess
import json
from pathlib import Path
import requests

def nmap_scan(target: str) -> dict:
    """Run a basic nmap scan, return parsed output."""
    result = subprocess.run(
        ["nmap", "-sV", "-T4", "-oX", "-", target],
        capture_output=True, text=True, check=True,
    )
    return {"raw_xml": result.stdout}


def whois_lookup(domain: str) -> str:
    """Basic WHOIS via a public API."""
    try:
        r = requests.get(
            f"https://rdap.org/domain/{domain}", timeout=10
        )
        r.raise_for_status()
        return r.json().get("ldhName", domain)
    except requests.RequestException as e:
        return f"lookup failed: {e}"


def main(target: str) -> None:
    out = Path("reports")
    out.mkdir(exist_ok=True)

    print(f"[*] WHOIS {target}")
    print(whois_lookup(target))

    print(f"[*] Nmap {target}")
    scan = nmap_scan(target)

    (out / f"{target}_nmap.xml").write_text(scan["raw_xml"])
    print(f"[+] Saved scan to reports/")


if __name__ == "__main__":
    import sys
    if len(sys.argv) < 2:
        sys.exit("usage: recon.py ")

    # IMPORTANT: only run against targets you own
    # or have written permission to test.
    main(sys.argv[1])

# What this teaches:
# ✓ Running an external tool from Python
# ✓ Parsing and saving output
# ✓ Making an HTTP request for recon
# ✓ Structuring a small tool (main, helpers)

# What it does NOT teach:
# ✗ How to test a real client without
#   written authorisation
# ✗ Scope — that's the legal part below

Legal lab setup — the part that matters more
than any lab:

WHAT YOU NEED TO PRACTISE
  - A Kali Linux VM (host: VirtualBox or VMware)
  - A vulnerable target (Metasploitable 2, DVWA)
  - An isolated network — "host-only" in VirtualBox
  - A notes system for writeups

WHY ISOLATED
  - The VM cannot reach the internet
  - Even if you misconfigure, no one outside
    can be affected
  - Legal, always

PLATFORMS FOR LEGAL PRACTICE
  ✓ TryHackMe — beginner rooms + path
  ✓ HackTheBox — harder, more realistic
  ✓ PortSwigger Web Security Academy — free
  ✓ VulnHub — downloadable VMs
  ✓ PentesterLab — web app exercises
  ✓ OverTheWire — Linux + crypto wargames

THE RULE
  Every platform above provides legal targets.
  Every box there is meant to be broken.
  Nothing you do there is illegal.

  What IS illegal:
  ✗ Scanning a website you don't own
    (even "just checking")
  ✗ Exploiting a bug on a live site
  ✗ Bypassing a login on a real system
  ✗ Testing without a written contract

  "I was just testing" is not a defence.

WHAT "WRITTEN AUTHORISATION" MEANS
  - A signed contract or a scope doc
  - Names of the systems in scope
  - Time window for testing
  - Contact at the company in case of
    incident
  - Agreed reporting format

  Companies hiring pentesters check this
  knowledge in interviews. "Have you tested
  a real client?" is a common question.
  The right answer is "in a legal, scoped
  engagement". The wrong answer is
  "I scanned a site once".

LIFE-LONG HABIT
  Before any test, ask yourself:
  - Do I have written permission for this?
  - Is the target in scope?
  - Am I within the time window?

  If the answer to any is no, don't start.

That's not a legal disclaimer.
That's the job.

# Writeup — TryHackMe / HTB / PortSwigger

Each writeup should have these six sections.
Interviewers read the first two and skim the rest.

1. TARGET
   - Name, source, difficulty
   - OS / services identified
   - Any constraints (no metasploit, etc.)

2. RECON
   - Nmap output, key ports
   - What you noticed (version, headers, tech)
   - What you decided to try next, and why

3. INITIAL ACCESS
   - The vulnerability
   - The exploit or manual approach
   - The exact command / request
   - Why it worked

4. PRIVILEGE ESCALATION
   - What you found (sudo, cron, SUID, token)
   - The method
   - The fix a defender would apply

5. FLAGS / PROOF
   - User flag, root flag (from the platform)
   - Screenshot

6. WHAT I'D DO DIFFERENTLY
   - One paragraph of reflection
   - This is the part interviewers notice

## Why this structure matters

A "writeup" that says "ran exploit, got shell"
teaches nothing and reads like a script.
A writeup with reasoning shows how you think.
The reasoning is what gets you hired.

## Publishing

- Personal blog (GitHub Pages, Hashnode) or
- GitHub repo with a `writeups/` folder
- One index page listing all writeups
- Each writeup: 400-800 words

## Target portfolio size

10-20 writeups is enough for a first job.
That's 3-4 months of consistent practice.

Certification options — honest comparison:

SECURITY+ (CompTIA)
  Level: Entry, broad
  Cost: ~₹35,000 exam
  Prep: 4-8 weeks
  Employers: Very widely recognised
  Best for: "I want to work in security" — opens
            SOC, GRC, entry analyst roles
  Not: deep hands-on pentest

EJPT (INE)
  Level: Entry, hands-on
  Cost: ~₹20,000 exam + training
  Prep: 4-8 weeks
  Employers: Growing recognition
  Best for: Junior pentest / red team
  Hands-on: Yes — practical exam

CEH (EC-Council)
  Level: Mid, theoretical
  Cost: ~₹90,000 exam
  Prep: 2-3 months
  Employers: Widely listed in job postings
  Best for: HR filter pass in Indian market
  Hands-on: Limited

OSCP (Offensive Security)
  Level: Senior, hands-on
  Cost: ~₹1,20,000
  Prep: 3-6 months
  Employers: Gold standard for pentest
  Best for: After 1-2 years of experience
  Not: beginner-friendly

PNPT (TCM Security)
  Level: Mid, hands-on
  Cost: ~₹35,000
  Prep: 2-3 months
  Employers: Growing
  Best for: Practical, cheaper OSCP alternative

THE HONEST ADVICE FOR 2026
  - Security+ if you're unsure and want to enter
    broadly
  - eJPT if you want hands-on pentest focus
  - CEH only if job postings you're targeting
    explicitly list it
  - OSCP after 1-2 years, when you have a job
    and can afford it

What certifications do NOT replace:
  ✗ A portfolio of writeups
  ✗ Hands-on lab time
  ✗ The ability to explain a finding to a
    non-technical person

The most common mistake at 30:
  Spending ₹1L on OSCP before being ready,
  failing, and quitting.
  Do eJPT first. Build confidence. Then OSCP.

What's legal in security work:

LEGAL
✓ Testing your own VMs
✓ TryHackMe, HackTheBox, PortSwigger
✓ VulnHub, OverTheWire
✓ Bug bounty programs (within their rules)
✓ Testing a client system with a signed
  contract and defined scope
✓ Reporting a vulnerability responsibly
  to the vendor

ILLEGAL (in India, under IT Act 2000 and
amendments, and similar laws elsewhere)
✗ Scanning a website you don't own
  (even "just nmap")
✗ Using default credentials on a live system
✗ Accessing data you're not authorised for
✗ Bypassing authentication on a real system
✗ "Testing" a company's login page without
  permission
✗ Sharing exploit code for someone else's
  live system
✗ Any testing outside a signed scope

THE PHRASE THAT KILLS CAREERS
  "I was just testing my skills."
  No prosecutor or hiring manager accepts it.
  It's the same as "I was just checking if
  the door was unlocked."

WHAT RESPONSIBLE DISCLOSURE MEANS
  1. Find the vulnerability on a system you
     have permission to test (bug bounty or
     your own)
  2. Report privately to the vendor
  3. Give them a reasonable window (90 days
     is common) to fix
  4. Do not publish exploit details before
     the fix
  5. Do not sell the finding to anyone else

BUG BOUNTY IS THE SAFE PATH
  HackerOne, Bugcrowd, YesWeHack all define
  scope explicitly. Testing within scope is
  legal and pays.

  Start there if you want real-world practice
  before a job.

THE SIGNAL THIS SENDS IN INTERVIEWS
  If a candidate says "I tested a random site
  once" they're not hired.
  If they say "I did bug bounty within scope
  and reported responsibly", they're hired.

  The technical skill is the same.
  The judgment is what differs.

Client engagement basics — what to
understand before you're on a real project:

DOCUMENTS
  - Scope document: exact systems, IPs,
    domains in scope
  - Rules of engagement: allowed techniques,
    forbidden techniques (e.g. no DoS)
  - Time window: when testing is allowed
  - Contact list: who to call if something
    breaks
  - Reporting format: template and deadline

WHAT TO ASK BEFORE TESTING
  - Is this asset actually in scope?
  - Are third-party services excluded?
  - Is the data production or staging?
  - What's the escalation path if I find a
    critical issue?
  - Who else knows about this engagement?

WHAT NOT TO DO
  - Do not test outside the window
  - Do not test assets not in scope
  - Do not screenshot customer data
  - Do not take a copy of the database
  - Do not "improve" the exploit to see how
    far you can go

REPORTING
  Good reports have:
  1. Executive summary (one paragraph)
  2. Findings with severity (CVSS or a
     simple critical/high/medium/low)
  3. Reproduction steps (for the finding)
  4. Business impact
  5. Recommended fix
  6. Evidence (screenshots, request/response)

WHAT INTERVIEWERS ASK ABOUT THIS
  "How do you handle a critical finding on
   day one of a two-week engagement?"
  Wrong answer: "I keep testing to find
   more."
  Right answer: "I report it immediately
   via the agreed escalation path, and
   continue within scope."

  That answer gets you the job.
  The first answer gets you escorted out.