I'm 17 and from Tunisia, with about two years before university. I've been learning PowerShell, C#, .NET, C, Linux basics, Bash scripting, Active Directory security testing, and tools such as Nmap and Metasploit. I've also experimented with malware development and antivirus evasion in controlled research environments, can read some assembly, and have beginner experience with Arduino and ESP32 robotics.
I've built more than 20 projects, including GUI applications and a retrieval-augmented chatbot that lets students search lessons uploaded by teachers. I've also completed many Hack The Box, TryHackMe, and picoCTF challenges while documenting the techniques I used. In bug bounty programs, I have received many duplicate, informational, or rejected results, but two XSS reports were accepted, including one paid report.
I usually build projects from documentation rather than tutorials and avoid relying on AI-generated code. However, I feel like I'm learning many different things without a clear direction. Since I'm interested in cybersecurity but also enjoy programming, I'm considering aiming for the OSCP within the next six months.
Should I start applying for part-time or freelance work now, even though I'm underage and many jobs require a degree? Or should I focus on improving my skills and portfolio until university? What would be the best way to find mentors, events, or other people in the field?
3 Answers
Two accepted bug bounty reports at 17 are a positive result, not something to dismiss. Bug bounty programs generate lots of duplicates and low-impact findings even for experienced researchers, so use the feedback to improve your understanding of impact and report quality rather than treating every rejection as failure.
You don't necessarily need to wait until university to apply for opportunities. Try smaller, clearly defined work involving programming, testing, documentation, or automation rather than aiming only for penetration-testing jobs. Contributing to open-source projects, joining legitimate security competitions, attending online talks, and participating in student or local technology groups can help you meet people and get references.
OSCP can be a useful long-term target, but six months may be an aggressive schedule if your fundamentals are still developing. Make sure you understand networking, Linux, Windows administration, scripting, web security, and report writing before treating the certification as the main goal. A strong portfolio and fundamentals will help you more than rushing toward a credential.
You can start networking without waiting for a formal job. Look for university technology clubs, maker spaces, cybersecurity competitions, developer meetups, and educational events in your area or online. Ask specific technical questions, share a small project, and offer to help with documentation or testing. That is usually more effective than simply asking people to find you a job.
Keep your public portfolio professional: include a short overview, screenshots or demonstrations, setup instructions, lessons learned, and links to code where appropriate. Separate harmless educational experiments from anything involving malware, and never test systems without written permission. Even if you don't get paid right away, this process can produce experience, references, and a clearer direction.
Being under 18 and not having a degree will make formal employment harder, especially because companies may have extra rules around working hours, contracts, and security-related access. That doesn't mean your work has no value, but you will be competing with people who may already have degrees, internships, or professional experience.
Focus on quality rather than the number of projects. Choose two or three strong projects, make them reliable, document the design and limitations, and explain what you personally implemented. A useful project that someone can actually run is much more convincing than a large collection of unfinished experiments. Your education chatbot sounds like a good candidate if you continue improving it and can demonstrate it safely.
For cybersecurity, keep malware and evasion work strictly inside isolated labs and present it as defensive research. Build a clear portfolio with write-ups, scripts, lab notes, and responsible vulnerability reports. You can also look for small programming or automation tasks through people you already know, local businesses, school contacts, or supervised internships. Don't depend on a job appearing automatically, but don't feel pressured to obtain a security job immediately either. University, networking, and consistent projects will make the process easier.
I build my projects from documentation and try to understand every part instead of copying code. Most of my work is either school-related or research in controlled environments. I'm planning to publish my challenge notes and improve the education chatbot, but I haven't found many local events or people to connect with yet.
My main concern is that I haven't found a part-time opportunity or even a volunteer role where I can show what I know. I have documented many lab challenges and want to publish them, but I also need a way to meet people who can give useful feedback.