I worked as a pen tester a couple years ago. Some may not agree, but go for one of the Big 4 accounting firms or their sister companies. The company name is huge on resumes, you learn lots of business stuff. Knowing how to properly document, follow procedures, create repeatable tests is extremely important. You can learn this in both sides, either audit or implementation.
I started in implementation. Knowing how to build something makes it much easier to take apart (pen testing). You learn how the technology is implemented and what mistakes are normally made. I went from there to auditing and pen testing. I was immediately the top "tech" star (which was sad), but I didn't know how to properly document. Audit firms are masters of documentation. From there you can jump into full on pen testing. People that don't have a rounded background are not good pen testers IMO.
If you are in DC area, you have many options. Audit has sox and fisma, fiscam and a boat load of others.
Slashdot Mirror
I worked as a pen tester a couple years ago. Some may not agree, but go for one of the Big 4 accounting firms or their sister companies. The company name is huge on resumes, you learn lots of business stuff. Knowing how to properly document, follow procedures, create repeatable tests is extremely important. You can learn this in both sides, either audit or implementation. I started in implementation. Knowing how to build something makes it much easier to take apart (pen testing). You learn how the technology is implemented and what mistakes are normally made. I went from there to auditing and pen testing. I was immediately the top "tech" star (which was sad), but I didn't know how to properly document. Audit firms are masters of documentation. From there you can jump into full on pen testing. People that don't have a rounded background are not good pen testers IMO. If you are in DC area, you have many options. Audit has sox and fisma, fiscam and a boat load of others.