3 ms·

Of the two I'd get more involved in machine learning. For a couple of reasons: 1. Ultimately I think it'll be easier to get a remote job. ML is in high demand

Of the two I'd get more involved in machine learning. For a couple of reasons: 1. Ultimately I think it'll be easier to get a remote job. ML is in high demand and requires dedicated, focused hacking time. This means remote is more do-able. Generalizing -- Cyber security interfaces significantly with people and process across the whole of an organization, so tends to require more face time. 2. It's easier to experiment and learn ML on your own. Grab a project, come up with some ideas and then get them up on Github. That's much hard to do in the security realm. If I were you, I'd see if you can carve out some time for a passion project. Pick up a ML framework and see what you can do. Put it up on Github, write some blogs. You'll see how passionate about the space you are, plus build out the start of a CV.

gdfer 9y ago
Definitely like the idea of carving out time for a passion project and going from there. I'll probably start out with a couple of MOOCS or something in each field and give some thought to what that passion project will be.
dsacco 9y ago
Respectfully, none of what you said has been my experience. Remote work is available for competent security engineers and consultants in spades. Entire teams at Optiv are distributed across continents (or they were when I worked there, back when it was Accuvant). Delve outside AmaGooBookSoft and you'll find many companies are quite amenable to remote employees for their internal teams, too. Check /r/netsec's hiring posts. As for learning on your own - I'd cautiously disagree here. If your goal is to learn appsec and you're already a competent developer, you can do that by picking up literally one or two textbooks and participating in bug bounties. Job offers will be more or less thrown at you if you have a pulse and have found more than, say, three non-trivial vulnerabilities in recognizable programs. The companies themselves will often try to recruit you. Machine learning is, like a lot of software engineering, easy to pick up and play with over a weekend, yes. But it is more difficult to become competitively competent right now for two reasons: 1) the field is exploding with incoming talent looking to capitalize on the new AI wave and 2) the amount of research you'll want to keep up with to stay informed is much higher than infosec. To be fair though, I still believe someone can pick up machine learning. It's just that (most of) information security is rather more straightforward to ramp up to competency, in terms of resources available.
- jwilliams 9y ago
  "you can do that by picking up literally one or two textbooks and participating in bug bounties" is a good idea and certainly something I hadn't considered. My main concern was bootstrapping yourself into the area, so that's an interesting approach. I read "cyber security" a bit more broadly. You can certainly be a great appsec-type -- but I still personally believe spending time in and around organizations is really important to be in security. Do take your point there are large domains and specializations where that's less true. Arguably this will be the same in ML at some stage. In actuality I think devops-for-ML or testing-for-ML is a more agreeable place to get started. It's pretty underserviced right now. Ultimately I think best to follow the passion. Give both a try and see what feels best.
  - tptacek 9y ago
    There are subfields of infosec where organizational understanding and savvy is important. But if you're a technologist, most of the real action in the field is in appsec and, at it's most specialized, high-status end, vulnerability research. Appsec doesn't much care where you're located, or really even how well you understand the org chart of your target.

gdfer 9y ago

Definitely like the idea of carving out time for a passion project and going from there. I'll probably start out with a couple of MOOCS or something in each field and give some thought to what that passion project will be.

dsacco 9y ago

Respectfully, none of what you said has been my experience. Remote work is available for competent security engineers and consultants in spades. Entire teams at Optiv are distributed across continents (or they were when I worked there, back when it was Accuvant). Delve outside AmaGooBookSoft and you'll find many companies are quite amenable to remote employees for their internal teams, too. Check /r/netsec's hiring posts. As for learning on your own - I'd cautiously disagree here. If your goal is to learn appsec and you're already a competent developer, you can do that by picking up literally one or two textbooks and participating in bug bounties. Job offers will be more or less thrown at you if you have a pulse and have found more than, say, three non-trivial vulnerabilities in recognizable programs. The companies themselves will often try to recruit you. Machine learning is, like a lot of software engineering, easy to pick up and play with over a weekend, yes. But it is more difficult to become competitively competent right now for two reasons: 1) the field is exploding with incoming talent looking to capitalize on the new AI wave and 2) the amount of research you'll want to keep up with to stay informed is much higher than infosec. To be fair though, I still believe someone can pick up machine learning. It's just that (most of) information security is rather more straightforward to ramp up to competency, in terms of resources available.

jwilliams 9y ago
"you can do that by picking up literally one or two textbooks and participating in bug bounties" is a good idea and certainly something I hadn't considered. My main concern was bootstrapping yourself into the area, so that's an interesting approach. I read "cyber security" a bit more broadly. You can certainly be a great appsec-type -- but I still personally believe spending time in and around organizations is really important to be in security. Do take your point there are large domains and specializations where that's less true. Arguably this will be the same in ML at some stage. In actuality I think devops-for-ML or testing-for-ML is a more agreeable place to get started. It's pretty underserviced right now. Ultimately I think best to follow the passion. Give both a try and see what feels best.
- tptacek 9y ago
  There are subfields of infosec where organizational understanding and savvy is important. But if you're a technologist, most of the real action in the field is in appsec and, at it's most specialized, high-status end, vulnerability research. Appsec doesn't much care where you're located, or really even how well you understand the org chart of your target.