While freelance software developers can show their work to potential clients by building personal projects or by showing their previous client's project how can a pentester do the same?
A pentester can't provide audit reports of previous clients as they are confidential and if he is new he may work for free for few clients and show his work but again, how would he show his work to potential clients without showing the actual reports?
What you are talking about is "work product" (the pentest reports). There are lots of industries where someone cannot show their work product to another person to show their expertise. A cashier cannot show another employer their work product, because there is nothing to show.
What you are trying to figure out is what to show instead of your work product. That's actually quite easy.
You want to show, not your main work product, but your skills in adjacent areas that reflect your skill and expertise in your main work.
The easy way to do this? Get more public with your technical work (CVEs, competitions, CTFs, etc.) and create materials to help potential clients, whether they hire you or not. Books, a blog, anything to reach out to customers to help them but not sell to them. If you can help as a hired pentester, then you can help as a provider of general advice. Do that, and you develop trust. When you reach out to prospective clients, you can give them your free material, whether they hire you or not.
When you can't show work product, you need to have trust and reputation.
A pentester can't provide audit reports of previous clients as they are confidential
I don't truly agree with this. Reports can be edited, sanitized and anonymized. For example if you just replaced or blacked out the IP addresses - it's already much harder to identify the client. Just omit the info that is too revealing.
Actually as a customer I would love to see report samples, because some security testers/auditors have a box-ticking attitude and do little more than follow a template and copy-paste. The reports actually tell it all about your skills and it's the most important deliverable.
It's not just your technical prowess on display but also your ability to convey complicated geeky stuff in simple terms to a non-technical audience.
When you think of it, plenty of employees are in a similar situation, they cannot easily prove how much money their brought it while working at some company, because obviously the financials are confidential too, but they can nonetheless explain their work process and should be able to provide testimonials. After all there is no reason why not a single one of your customers would decline to provide references.
