Hacker News Reader

Comment by SecConsult | Hacker News Reader

People might not like your comment and have different opinions, but as person who did exactly what you said and now making around 420k/yr for cyber security consulting, I have to say, you are 100% right.

View on HN

How did you establish your reputation to the point that companies know it's worth it to pay you that much?

I found critical flaws in systems 4 previous pen test companies didn't find. I found bugs in a security camera DVR platform for a big company, I found critical flaw on numerous custom web portals, I found all these bugs after they went through at least one pentest by another vendor. I usually don't miss bugs in pentest and/or source code analysis. When I analyze malwares, I usually do it quick and I analyze them extensively and write good and detailed reports. I'm 28 but I built my reputation over sometime with quality work. (very sorry if my post have bragging tone, I don't mean to, I just wanted to share)

It's clear that you do have value, and it's easy for you to prove it. But how did you get your foot in the door to even have the chance to prove it?

Were you invited to pen test? Did you offer your initial service for "free" to prove your worth?

First you need to work for established infosec companies. They get pentest projects every day, easily. You can't be like them day 1. So when you work through those companies and do pentest for a client, show yourself. In our team, maybe 10 people were working with me on pentest projects, but if you ask clients now after years, they probably ONLY remember my name, because they know and understand who did what. So after years and years of good reputation, it's super easy to expand your client base, do for yourself, ask for top $, reject offers might be a dream salary for some. But just like everything else, you start slowly and gradually "level-up"

Hours/week for you on average and billing please?

I have around 70-80hrs a week. ~40 hrs for each of my clients. It doesn't have to be exact 40, as long as I do what I'm supposed to do, it's fine. It's not like 9-5 job

are you working for yourself or another company is compensating that?

I have long term contract with two companies, for one of them I do application security review, I analyze source codes and point out vulnerabilities. For the second one, I do penetration testing, forensics, malware analysis, and... One is paying 230k the other one is paying 190k. I have other contacts and other offers too, but these two jobs are taking all my time. I can switch and work with a new client anytime.

thanks for sharing -- I work in network security but I have not had opportunities to work direct with applications and forensics. clearly have some research to do and how to get in.

I am already getting downvoted for putting the truth out there. These fools like the idea that their web development job can turn into a 300k a year salaried job but its a pipedream. I am not saying those jobs don't exist. But they usually are anomalies or due to other things like a PhD.

I would say even with a PhD you can't make 300k/yr for web or any other development. Top notch developer's salary won't exceed 220k/yr

I am really happy that you make 420k but I guarantee you that there are plenty of developers who make more than 220k. (I make more than that and in my know plenty of folks personally who make that amount) One easy to way more money than this is to work in finance space in NYC.

I guess working at an hedge fund, HFT, or doing some C++/ASM may be the only way to earn such salary.

Indeed, I am 24 year old programmer, 2 years out of a top CS program and I am making $280k (100% cash) slinging C++ for a small quant hedge fund.

Silly question. If you are making that much in NYC, how much are you paying for rent?

You're being downvoted because it isn't true. I have seen Staff SWE offers for >$300k with my own eyes—and not just in SF/NY.

Reply on news.ycombinator.com