I'm tired of these posts. They feel so arbitrary. Either the authors don't work in infosec or have such bubbled exposure it is all "how things are at my job".

I'm tired of these posts. They feel so arbitrary. Either the authors don't work in infosec or have such bubbled exposure it is all "how things are at my job". I can confidently say at least 90% of the people I worked with in infosec over the years did not know what "algorithmic complexity" is. Infosec is a superset of fields not a field of its own. If you work in application security, the things you need to know are vastly different from managing vulnerabilities, red teaming or incident-response. The main common-denominator is being technically proficient enough to know the basic concepts of the tech you work with (so ideally lots of technical college or IT experience). I am struggling to expand it more than that, except maybe a few security 101 classes or certs? Like understand how risk is assesed and what threats are. Ooh... that's a big one for me, keep up with current threats! I have asked people who worked many years in infosec interview questions and they didn't know what a sql injection was or a dns record or a webshell. Which is ok, so long as they know something technical and can articulate it well. The worst in my opinion are people with very strong programming background or technical expertise that just have a strong opinion of everything and trying to show them the right way offends their ego. You can learn a lot on the job, but you do need to bring competency and you have to think practically (college grads struggle with this). What you have to understand is, unlike IT, software development/engineering,networking,etc... infosec's purpose is not to build anything or maintain anything but to prevent and detect bad people (threat actors) and their creations. If you are patching vulns, you need to know how attackers can abuse them so you can prioritize. Writing detection rules? reviewing an apps code? Scouring through forensic artifacts? reversing malware? implementing security appliance? Same thing for all, you need to know how threat actors work and how to prevent or detect these people. In summary: You really can't know enough for infosec but don't let your lack in one area stop you. Conversley, perhaps you can setup gentoo in your sleep, read ARM assembly when you get bored and you are a master of haskell. That just means you can probably do well in application security and vulnerability research and possibly malware reversing. If that's all you know then you can't even begin to respond to a security incident, perform forensic investigation or sit all day inspecting a spam/phishing inbox. If you are interested in infosec and you keep up with threats (in any capacity), and especially if you are on HN, I would bet good money there is a nice place for you in infosec.