"you can do that by picking up literally one or two textbooks and participating in bug bounties" is a good idea and certainly something I hadn't considered. My

"you can do that by picking up literally one or two textbooks and participating in bug bounties" is a good idea and certainly something I hadn't considered. My main concern was bootstrapping yourself into the area, so that's an interesting approach. I read "cyber security" a bit more broadly. You can certainly be a great appsec-type -- but I still personally believe spending time in and around organizations is really important to be in security. Do take your point there are large domains and specializations where that's less true. Arguably this will be the same in ML at some stage. In actuality I think devops-for-ML or testing-for-ML is a more agreeable place to get started. It's pretty underserviced right now. Ultimately I think best to follow the passion. Give both a try and see what feels best.