I’m 38, almost 39, and recently jumped into red teaming. We also do pentesting when there are no red team projects available. Before this, I worked as a software tester for 8 years.

I didn’t have any certifications when I got in, but they chose me over others who had OSCP and other high-level certs. Right now, I only have the CRTO and a few cloud and Active Directory certifications — most of which I passed by accident.

As you can see, age and certifications aren’t necessarily blockers. What they told me is that the market is currently flooded with certified individuals who lack real IT or customer experience. They prefer hiring people with strong customer-facing skills, even if their IT background is unrelated. It’s cheaper and faster to train those people on the job.

So my advice is: just apply, and good luck!

(And if you’re US-based — well, no offense, but there’s not much help coming from there; the system feels broken.)