I have a few thoughts on why you "don't see a ton of job postings" for security. First of all, would you notice one if you saw it? For example, my posting on th

I have a few thoughts on why you "don't see a ton of job postings" for security. First of all, would you notice one if you saw it? For example, my posting on the "Ask HN: Who is hiring? (January 2018)" thread is this: https://news.ycombinator.com/item?id=16057016 https://news.ycombinator.com/item?id=16057016 Note that I describe the sorts of skills we seek. (you don't need to have them all) The word "security" doesn't appear because that isn't too interesting or useful. Lots of good people come from an embedded RTOS background. Somebody who just runs a port scanner would not have the right skills. Second of all, are you looking in the right places, online or physically? On reddit, try /r/netsec or /r/reverseengineering or similar. Be willing to consider the southeastern states. Making yourself look good to hire is mainly about showing that you have the skills. We hired somebody who had a great story about hacking an overly-fancy parking meter to run code from the tokens. We hired another person who got invited to talk at a conference about hacking a router. Solving some of the DEFCON CTF challenges would look good; they are considered difficult. Contributing to a project like Wine or Qemu or MAME would look good, particularly if you deal with something undocumented.