This reads a bit like a troll from my perspective, but I could be wrong. First of all, it's 2018. Don't pay for a cert unless you are trying to get into an ind

This reads a bit like a troll from my perspective, but I could be wrong. First of all, it's 2018. Don't pay for a cert unless you are trying to get into an industry you know nothing about really fast, in which case you will be hired by idiots or abusive exploitative companies (or governments). Studying certs is a good way to identify the processes/requirements of infosec, but paying for one is like paying for a certificate that says you learned how to cook. If someone talks to you about cooking they can tell if you have ever actually done it. Second, forget working your way up, IT, tic tac toe. There's so much more to know that this really doesn't begin to explain. You want to know how technology is managed in a business, which is IT, but then there's the software dev and product dev and project management and admin, etc. Then you'll want to actually know how to not only develop software, but how to do it so it's secure. And then you'll want to know how to find software that isn't secure, and exploit it. And then you'll want to know how to prevent it. That is a metric shit ton of information. Experience and talking to people who know can help speed this up, and you can skip a lot of it for specific positions, but this certainly is more demanding than becoming a DBA. Third, 2600 meetings are a great way to waste your time. I should know. I started one when I was 16. Conferences are great ways to network and find people hiring, and cheap if you can get a ticket to a "real" con and not a trade show for people expensing their trip to Vegas. But stay away from unprofessional egotists full of the lore of the elite hacker. And generally just stay off of IRC. There's so many snobby douchebags still holding on to their little cliques, it's generally a soul crushing waste of time to court them. Talk to people who work on teams at real companies, or know people who do. Infosec is one of those jobs where you basically just have to learn what the processes are and have a firm grasp of all the concepts, and know the latest tools and trends, and you can get a job. (Come to think of it, that's every tech job...) So besides knowing the ins and outs of how businesses interact with technology (regulations, standards & practices) you also need to know how security firms do business (procedures, positions, services, etc). But, yeah, don't go this route if you want a real career. Learn it from the bottom up by studying it like it was a job maintaining nuclear reactors, but keeping in mind it's basically just monkeys running tools and generating reports.