4 ms·

The industry gets a bad rap, because it's full of ego maniacs, but the reality is that there are tons of interesting opportunities that fall outside conventiona

by twox2 5y ago

The industry gets a bad rap, because it's full of ego maniacs, but the reality is that there are tons of interesting opportunities that fall outside conventional compliance/pen-testing roles. Research is actually a huge sector, because you can apply security research to so many emerging and existing industries. You can specialize is specific things as well. Take for example blockchain. !0 years ago there were no cryptocurrencies, today it's a multi-billion (trillion?) dollar industry. People with skills to audit smart contracts are in huge demand. What about all of the other emerging technologies? Criminals are always quick to exploit and abuse emerging tech and emerging markets, so there are always opportunities presenting themselves for technical & security minded folks. The world of cybersecurity goes beyond just pen testing or sitting in a SOC as an analyst.

the_only_law 5y ago
Security research fascinated me after reading a number of papers on really cool exploits, but it was quickly evident it wasn't something I'd ever be cut out for. Anyways, do you typically have to be highly credentialed to do it? How many people are getting hired as security researchers without prior [academic] research?
- twox2 5y ago
  Honestly, it's something that you can just "do". I know not everyone has much appetite for speculative, unpaid work, but that's the lowest rung of the ladder you can start. Bug bounties for example... if you go deep into enough into a single category of bug class that you can find a new way to approach it, that's demonstrated security research and can start you off on a track record that makes you employable. Not all security research is low-level stack smashing. I also think there are highly overlooked opportunities in emerging sectors. Off the top of my head, VR is taking off, but it's still so niche. It's an opportunity to go deep into something and make some discoveries that might have meaningful impact. So I guess as a long winded answer to your question, I don't think there's a typical path, because not all security research is academic by default in my opinion.

by twox2 5y ago

the_only_law 5y ago

Security research fascinated me after reading a number of papers on really cool exploits, but it was quickly evident it wasn't something I'd ever be cut out for. Anyways, do you typically have to be highly credentialed to do it? How many people are getting hired as security researchers without prior [academic] research?

twox2 5y ago
Honestly, it's something that you can just "do". I know not everyone has much appetite for speculative, unpaid work, but that's the lowest rung of the ladder you can start. Bug bounties for example... if you go deep into enough into a single category of bug class that you can find a new way to approach it, that's demonstrated security research and can start you off on a track record that makes you employable. Not all security research is low-level stack smashing. I also think there are highly overlooked opportunities in emerging sectors. Off the top of my head, VR is taking off, but it's still so niche. It's an opportunity to go deep into something and make some discoveries that might have meaningful impact. So I guess as a long winded answer to your question, I don't think there's a typical path, because not all security research is academic by default in my opinion.