I'm 17, from Tunisia, and have about two years before starting university. I've been learning PowerShell, .NET, C#, C, basic Linux and Bash, Active Directory security testing, and some Arduino and ESP32 development. I've built more than 20 projects, including GUI applications, a retrieval-augmented chatbot for school lessons, and research projects involving malware analysis and defensive evasion concepts in controlled environments. I can also read some assembly and have practiced with authorized cybersecurity training platforms and challenge labs.
I've tried bug bounty programs and received many duplicate, informational, or rejected reports, although two vulnerabilities were accepted, including one paid XSS report. I'm interested in cybersecurity generally but especially enjoy programming, and I'm considering preparing for the OSCP over the next six months.
I'm worried that I'm learning many different topics without a clear direction. Since I'm under 18 and most jobs ask for a degree, should I keep building projects until opportunities appear, or start applying now for part-time work, internships, freelance tasks, or volunteer experience? How can I improve my portfolio and meet people in the field when I don't have many local events or professional connections?
2 Answers
Being underage and lacking a degree can make formal employment harder, mostly because of legal paperwork and competition with candidates who already have diplomas or experience. That doesn’t mean your work has no value, but quantity alone won’t convince employers. Choose a few strong projects and document what problem they solve, how they work, what tradeoffs you made, and what you learned.
A useful project that people actually use is usually more impressive than a large collection of small experiments. Your education chatbot sounds like a good candidate for a polished portfolio piece: explain its architecture, include a safe demo, document limitations, and show how you handled authentication, data protection, testing, and deployment. For security work, focus on authorized labs, write-ups, defensive tools, and clear methodology rather than publishing anything that could be misused.
You can start applying, but target realistic opportunities: local software shops, school or community technology projects, junior development tasks, open-source contributions, internships, and small freelance work for people you know. Also consider contacting university clubs, attending online talks, joining capture-the-flag events, and contributing thoughtful technical write-ups. Keep learning, but give yourself a direction for the next year instead of trying to master every area at once. A strong programming foundation plus security knowledge will serve you better than rushing toward a certification without enough practical experience.
Two accepted bug bounty reports at 17 are genuinely a good start, even if many submissions were duplicates or rejected. Those outcomes are normal and can teach you how to judge impact and write clearer reports. Don’t measure your progress only by whether a company pays you.
For now, build a public portfolio that is easy to evaluate: a short résumé, three or four finished projects, screenshots or a safe demo, concise technical documentation, and write-ups showing your reasoning. You can also offer practical programming help to trusted local organizations or classmates, contribute to open-source projects, and look for supervised internships or volunteer technology work. If you pursue the OSCP, treat it as a long-term learning goal rather than the only route into the field. Keep your security research strictly authorized and focus on developing software, testing, and communication skills alongside it.
That helps. I sometimes feel invisible because I haven’t found part-time work yet, but I’ll focus on presenting a few useful projects well instead of treating every rejection as proof that I’m not ready.
I build most projects from documentation rather than tutorials and don’t use AI to write my code. I’m planning to improve the education chatbot and publish more detailed write-ups for my lab work and challenges. My main difficulty is finding events and meeting people who can give useful feedback.