3 ms·

Respectfully, none of what you said has been my experience. Remote work is available for competent security engineers and consultants in spades. Entire teams a

by dsacco 10y ago

Respectfully, none of what you said has been my experience. Remote work is available for competent security engineers and consultants in spades. Entire teams at Optiv are distributed across continents (or they were when I worked there, back when it was Accuvant). Delve outside AmaGooBookSoft and you'll find many companies are quite amenable to remote employees for their internal teams, too. Check /r/netsec's hiring posts. As for learning on your own - I'd cautiously disagree here. If your goal is to learn appsec and you're already a competent developer, you can do that by picking up literally one or two textbooks and participating in bug bounties. Job offers will be more or less thrown at you if you have a pulse and have found more than, say, three non-trivial vulnerabilities in recognizable programs. The companies themselves will often try to recruit you. Machine learning is, like a lot of software engineering, easy to pick up and play with over a weekend, yes. But it is more difficult to become competitively competent right now for two reasons: 1) the field is exploding with incoming talent looking to capitalize on the new AI wave and 2) the amount of research you'll want to keep up with to stay informed is much higher than infosec. To be fair though, I still believe someone can pick up machine learning. It's just that (most of) information security is rather more straightforward to ramp up to competency, in terms of resources available.

jwilliams 10y ago
"you can do that by picking up literally one or two textbooks and participating in bug bounties" is a good idea and certainly something I hadn't considered. My main concern was bootstrapping yourself into the area, so that's an interesting approach. I read "cyber security" a bit more broadly. You can certainly be a great appsec-type -- but I still personally believe spending time in and around organizations is really important to be in security. Do take your point there are large domains and specializations where that's less true. Arguably this will be the same in ML at some stage. In actuality I think devops-for-ML or testing-for-ML is a more agreeable place to get started. It's pretty underserviced right now. Ultimately I think best to follow the passion. Give both a try and see what feels best.
- tptacek 10y ago
  There are subfields of infosec where organizational understanding and savvy is important. But if you're a technologist, most of the real action in the field is in appsec and, at it's most specialized, high-status end, vulnerability research. Appsec doesn't much care where you're located, or really even how well you understand the org chart of your target.

by dsacco 10y ago

jwilliams 10y ago

"you can do that by picking up literally one or two textbooks and participating in bug bounties" is a good idea and certainly something I hadn't considered. My main concern was bootstrapping yourself into the area, so that's an interesting approach. I read "cyber security" a bit more broadly. You can certainly be a great appsec-type -- but I still personally believe spending time in and around organizations is really important to be in security. Do take your point there are large domains and specializations where that's less true. Arguably this will be the same in ML at some stage. In actuality I think devops-for-ML or testing-for-ML is a more agreeable place to get started. It's pretty underserviced right now. Ultimately I think best to follow the passion. Give both a try and see what feels best.

tptacek 10y ago
There are subfields of infosec where organizational understanding and savvy is important. But if you're a technologist, most of the real action in the field is in appsec and, at it's most specialized, high-status end, vulnerability research. Appsec doesn't much care where you're located, or really even how well you understand the org chart of your target.