I’ve worked in computer security for over 15 years as an engineer. In my case I often work closely with threat researches building infrastructure or things to

I’ve worked in computer security for over 15 years as an engineer. In my case I often work closely with threat researches building infrastructure or things to make their lives easier (eg automate or detect the “easier” attacks so they can focus on the novel). I’ve had the same Internal career debate recently, in my case going back to roots. I enjoy CTFs and working with our threat researchers. With this skill set I figure out how to scale them. If I know more, can I help more? Probably. Beyond general security it sounds more like you’re interested in the blue team side (defense). To that I’d look into things like https://cyberdefenders.org/ https://cyberdefenders.org/ hack the box and other CTF work first. OSCP is nice and maybe even mandatory for pen testing (Hr) but hands on is key. From there you can figure out if certain are worth it to you. The ejpt is a cheaper starter as well. In practice you need both technical skills and report writing skills. You have to tell a security story to technical and non technical people. The better you are at both, the further you can go. As a counterpoint, we still have a hard time finding solid security minded engineers. You can be a triple threat :)