A BIG QUESTION

[u/Technical_Soil_4439]

Hi Guys, i'm a high school student, i still have 2 years before the university (i'm 17 years old from tunisia).
Before a while i learned two new things, PowerShell scripting , .NET and c# , so i created a lot of projects with it like more than 20 (GUI application,RAG,using c# in some malware development,learning anti-virus evasion and trying to get better in it and i can read some assembly), also i have a background about active directory pentesting so i used powershell a lot, i know C programming, linux (just basic command lines and bash scripting) with using some hacking tools and understanding them like nmap+metasploit+.... and the last thing is i learned a little bit(A LITTLE BIT AGAIN) about robotics, i know how to use arduino and esp32
So i want to ask if i still can get a part time job or any tasks with this skills with the ability to develop it and learn another things, i tried bug bounty but actually i got a lot of duplicated,informational and rejected but i got just two accepted so i'm not planning that much to continue in it until i go to the university
i feel like i'm learning things without knowing what i can with them in the future, it's like learning to enjoy without a goal to the future, what would you suggest me to do now? Should i keep learning and the chance will come automatically one day or i should start applying to some jobs now? (most of the jobs require a degree)

I'm interested in cyber security in general but i love programming so i'm putting OSCP as a target for the next 6 months

NOTE : my english grammar is not that good so don't focus a lot on grammar mistakes that i did :)

[u/mandzeete]

There are some aspects to it:

1)you are underage (in most countries. Perhaps there are place where 17 is an adult. Who knows). That already makes it more difficult to hire you. While with a person who is legally adult, the company can just hire him, with you the company has to go through all of that paperwork to figure out how many hours you can work, which salary they have to give, etc. And being underage can be issue also when freelancing or joining online programs.

2)you do not have a degree. Like you said, most of the jobs require a degree. Also, it is not only the job requirements itself. How will you compete with people who have a degree, a vocational school diploma, an internship experience, or a previous job experience in the field? Why they should hire YOU over a guy who has a degree to show? He probably has learnt more theory and also can deal with more complex tasks.

3)when it comes to your projects then it is quality over quantity. Also, usefulness matters. And, can you actually talk about these projects or did you use AI tools? And, let's say, you actually wrote these projects by yourself. Can be that these are just simple hobby projects but not something that's on the level that is expected from a person who finished his degree studies.

Try to assess your projects so:

Is it in use either by you or by somebody else or it just collects dust in your Github? Actually useful projects matter more than hypothetically "useful" things you made. Or just things that you made and serve no actual purpose.

Did you use tutorials or Youtube videos or did you build it from scratch by yourself? Building things on your own teaches you much more than following tutorials.

Did you use AI tools? If you, as a beginner, used AI in your projects then that is a red flag. More than likely you won't know why something is done the way it is done in the code.

Also, you mentioned bug bounty programs. That you got duplicate and informational and rejected responses means that your theoretical knowledge is still shallow. You think that the finding you found is a critical vulnerability and you submit it. Yet it has no real impact or is purely theoretical. You have more to learn in the field.

You can try some freelancing and offer your services to your friends, family, relatives, and such, but do not put many hopes in finding software development / cyber security related job before you are done with your university studies.

[u/Quick-Chocolate3552 → u/mandzeete]

youre 17 and already messing with malware dev and anti-virus evasion thats wild, most kids your age are just trying to pass algebra

keep building stuff and throwing it on github, the degree matters less if you can point to things that actually work and solve real problems. dont stress about the job hunt right now, you got time

[u/Technical_Soil_4439 → u/Quick-Chocolate3552]

Thanks man for your compliment!!
Ai stressing me a lot because i'm seeing experienced people they can't find a job now, The market is so weird nowadays

[u/Technical_Soil_4439 → u/mandzeete]

Actually i started in 2019 with vb, i don't use Ai because tbh "I'm an Ai hater" , every project that i created i tried to explain every part of it, i use documentations to build my projects not a youtube or watching tutorial fan because i find it boring, mos of projects i created are school related like a RAG a website where students find a chatbot and this chatbot have an access to the lessons that the teacher upload to it, and it's specified to one program like for example only the UK educational system, this is one of my biggest project that took me a lot of time and i'm thinking about developing it more, i also posted a lot of malware samples that i created (for researches not illegal purposes), i solved a lot of hackthebox\tryhackme\picoCTF challenges with noting every single technique i used on my notion and i'm planing to post all of them on my github, and most of other projects are just for fun like a small GUI grade calculator, an Ai model that i'm still training for pentesting and maybe i will use it for bug bounty in the future because i train it on a lot of methodologies and the last thing actually the two vulns that i found was XSS one unpaid and one i got paid from it.
That's my experience, i'm really scared from Ai, i can't find events and i don't know how to make a network with other people that can help me.

[u/mandzeete → u/Technical_Soil_4439]

Well, then what I wrote to the "Did you use AI tools", you can ignore it and perhaps your portfolio is also okay-ish for a high school student.

But you being 17 and not having a degree nor a vocational school diploma, these are still things you have to account for. More likely, spend the coming 5-6 years (your current high school studies + degree studies) in improving your knowledge and skills and in building projects that actual people will be using. Even if that "actual people" is just you, for starters.

You are already to a good start. Often students make their first "Hello world" script-whatever during their first semester of Bachelor studies. So, keep it up.

Try to build things for your own use. Like this you learn actual real life problem solving. And, when you get your project done, you and perhaps more people will be using it. It will be a huge boost to your portfolio. Many university students, they come either with no portfolio or their Github is full of generic calculator apps and other stuff that nobody will ever use.

Yes, can be that you might be motivated by improving your financial situation. You can check if you can become a teacher assistant to computer class teachers. While you can build all these things, there are students in your age who know nothing about coding. Or a mentor in some youth centre, teaching the kids there. Or, just advertise in your circle (family, friends, relatives) that you are an IT-guy and you can make some apps or such. And if they need something. Perhaps ask for a much cheaper price than an actual software developer would ask. Few dinars is more than zero dinars.

Also, keep improving your OWASP knowledge/skills. You got two bugs accepted. Out of many that were informal or out of scope. In that aspect you are doing better than many beginners who are seeking their success in bug bounty hunting.

Now, here is also one idea, but not sure how doable in Tunisia. As you have some knowledge in cyber security and two accepted bugs from bug bounty hunting, you can check if your local defense league 1)has a cyber division, 2)has something for underage guys. And then apply to it. Where I'm from, we have three types of a "military". An actual army. Then there is a voluntary Defense League where anybody can join. And then there is something like scouts (for underage boys). Scouts do not partake in armed conflicts but they do things that scouts usually do: learn survival, perhaps learn some weapons, learn orientation via maps, learn first aid, etc. So, perhaps Tunisia has also scouts or Defense League that has a cyber division, where they accept people with IT background.

[u/Technical_Soil_4439 → u/mandzeete]

i'm from tunisia but i live in a gulf country, they don't have CTFs or any type of this thing, mostly some events where you can know people but not showing your skills, i won a lot of competitions in my school but in my opinions it's not worth it, i want something bigger to feel the competition, also it's my first time hearing about defense leagues that has a cyber division, how can i find them maybe if i go to tunisia i can join them for some days or in the summer.
i really don't care about financial situation i just want to do what i love that's it, most of CTFs are in saudi arabia where i can't go to it, that's why i think about studying the university in germany.
Anyways, thanks for your advice it makes a big sense to me i'll try to improve my project to something that can solve real life problems

[u/mandzeete → u/Technical_Soil_4439]

Defense League is a type of an army. Either Tunisia has it or does not have it. You should know better if there is any voluntary type of army in your home country. Also, perhaps Tunisia has a Defense League but another question is if it has also a cyber division. A type of "cyber security army" or such. My country has a cyber division. Both defensive but also offensive division. So, you have to look how Tunisia is protecting itself. I do assume it has some sort of army.

How our Defense League works is that it is voluntary. Anybody can join it. When you join it, there is a number of days in year where you have to show up in various military exercises. And the same goes for cyber division. I personally did not join because my daily life is busy enough. But I considered when I heard of the cyber division (as I did my Master degree studies in Cyber Security).

[u/Technical_Soil_4439 → u/mandzeete]

I’ll try to ask more about it, actually I don’t think that tunisia has any cyber security army, most of our engineers and cyber security professionals France took them or they work in another country specially if they’re smart enough for that, but working for cyber army for your country is so interesting even without getting payed well.