Building An Effective Application Penetration Testing Team
summary
Covers concrete practices and results for building a pen‑test team: hiring shifts from CTFs to a report‑review exercise for seniors, cohort training with a recorded library and 400 modules, and a required graduation attempt against Juice Shop that proves too large and fails to finish. Shows tooling and systems: Burp capture ideas, Excel‑macro driven dynamic checklists, a technical review survey that yields actionable metrics. Describes what works (cohort training, review forms, surveys) and what doesn’t (findings archive, Juice Shop graduation), plus a proposed OSATS‑style assessment.
AI-written summary · about
chapters (16)
- 0:00Introduction and background
- 1:39Lessons from other fields
- 3:07Career and management philosophy
- 4:54Principles of team management
- 8:56The gap in security resources
- 9:24Market dynamics of consultancies
- 15:11Professionalization of surgery
- 16:34Skills assessment frameworks
- 21:51System-level safeguards
- 31:55Practical hiring strategies
- 32:24Training and curriculum design
- 37:41Managing feedback loops
- 39:06Checklists and templates
- 40:57Failed and successful projects
- 42:19Future work and initiatives
- 47:18Q&A and closing remarks
related talks
52mApplication Penetration Testing – DOs and DON‘Ts
34mPurple Team Strategies for Application Security
20mMaking Penetration Tests Actually Useful
37mDeploying Security Testing Practice in Your Team and Company
19mPenetration Testing
33mWorking with penetration testers as a developer
33mThe Practicalities Of Pentesting At Scale
17mManual versus automated penetration testing on AWS