From CTF to first job: how freshers break into VAPT in India

There are more people who want to work in security than there are entry-level jobs, and yet good junior testers are genuinely hard to hire. The gap is not talent; it is evidence. Employers cannot tell, from a CV that lists the same certifications as everyone else's, who can actually do the work. This article is a practical roadmap for closing that gap and landing your first VAPT role in India, written from the hiring side of the table.

Start with capture the flag, but use it correctly

Capture the flag (CTF) competitions and practice platforms are the best on-ramp into security, because they let you build real skill legally and measurably. The ones worth your time:

• TryHackMe — the gentlest start, with guided paths that teach as you go. Best for your first few months.
• Hack The Box — less hand-holding, closer to real systems. The natural step up once TryHackMe feels easy.
• PortSwigger Web Security Academy — free, and the best structured resource specifically for web application testing.
• PentesterLab and VulnHub — focused exercises and downloadable vulnerable machines for offline practice.

The mistake freshers make is treating CTFs as a score to farm. Employers do not care about your rank. They care about what you understood. So use CTFs as material: for every meaningful challenge you solve, write up what the vulnerability was, why it existed, how you approached it, and how you would fix it. That write-up is worth more to your career than the points.

Turn practice into a portfolio

A portfolio is what separates you from the hundred other applicants with the same certificate. It does not need to be elaborate. It needs to show that you can find, understand and explain security issues. Build it from:

• Lab and CTF write-ups, published on a simple blog or GitHub. Focus on your reasoning and your remediation advice, not just the solution.
• A home lab, described and documented. Showing that you built and broke your own environment demonstrates initiative. Start with our lab setup guide for freshers.
• Contributions, however small: a documentation fix to an open-source security tool, a helpful answer in a community forum, a talk at a local chapter meet.

Hiring managers read portfolios far more carefully than CVs, because a portfolio is hard to fake.

Bug bounties and responsible disclosure, done right

Bug bounty programs let you test real systems legally, but only within the rules the program sets. This is where ethics and law are not optional.

• Only test targets that have an explicit program and stay strictly inside its defined scope. Testing a company that has not invited it is illegal, regardless of your intentions.
• Follow responsible disclosure. If you find a genuine issue, report it privately through the proper channel and give the organisation time to fix it before it is discussed publicly. In India, CERT-In operates a responsible vulnerability disclosure and coordination process, and many Indian companies now run their own programs or use platforms that mediate disclosure.
• Never test government or third-party systems without authorisation. Under the IT Act, unauthorised access is an offence. A single reckless test can end a career before it starts.

Even one well-handled disclosure, reported responsibly and resolved, is a strong signal to an employer that you understand the professional and legal side of the job, not just the technical side.

Certifications: useful, but not a substitute

Certifications help you get past CV screening and give structure to your learning. Weigh them honestly:

• eJPT (INE) — a good, affordable first practical certification. A sensible starting point.
• PNPT (TCM Security) — practical and report-focused, which mirrors real consulting work well.
• OSCP (OffSec) — demanding and well respected; strong signal, but not where a fresher should start.
• CEH (EC-Council) — widely recognised by HR and sometimes required in job listings, though more theoretical.

A certification opens the door; the portfolio and the interview get you the job. Do not spend two years collecting certificates instead of building evidence.

What the interview actually tests

Security interviews for junior roles usually probe three things:

1. Fundamentals. Networking, how HTTP works, the OWASP Top 10, and the ability to explain why a vulnerability is dangerous, not just name it.
2. Reasoning. You may be given a scenario and asked how you would approach it. They are watching your method, not waiting for a memorised answer.
3. Communication and ethics. Can you explain a finding to a developer? Do you understand scope and authorisation? A candidate who is casual about permission is a liability, and interviewers screen hard for it.

Prepare by being able to explain, out loud and simply, how one vulnerability class works end to end, from why it exists to how you would fix it.

The first 90 days of a junior VAPT role

It helps to know what you are actually walking into. At a firm like VA2PT, a new junior tester's first three months usually look like this:

• Weeks 1–4: shadowing senior testers, learning the firm's methodology and reporting standard, and working through internal labs. You are learning how the team works before you touch client scope.
• Weeks 5–8: taking on parts of real engagements under supervision, usually starting with mapping and the more mechanical testing, and writing findings that a senior reviews before they reach the client.
• Weeks 9–12: owning sections of a test end to end, from testing through to a report that stands up to review, and joining the re-test that confirms the client actually fixed what you found.

The pattern is clear: the technical skill gets you in the door, and the ability to work to a methodology and write a clear, fixable report is what earns you responsibility.

What to do this week

• Pick one platform (TryHackMe if you are new) and commit to a regular schedule rather than occasional binges.
• Publish your first write-up, however modest, focusing on your reasoning and your fix.
• Read the rules of two bug bounty programs closely, so you understand what "in scope" really means before you ever test.
• Practise explaining one vulnerability out loud until you can do it in two minutes, cause to fix.

Breaking into VAPT is not about a secret trick. It is about building visible, legal, well-explained evidence that you can do the work, and being someone a team can trust with a client's systems.