"...you're a solid software developer..." I think that's the area it's hard to break if you're already engulfed into security. I've been in architecture, resea

"...you're a solid software developer..." I think that's the area it's hard to break if you're already engulfed into security. I've been in architecture, research and pentesting across a lot of shops but I've always felt like minimum viable exploitation was all most places were after. Fast forward years and you end up in something you don't feel like you've transitioned into something deeper. Sure, you can go there on your own but it has limited viability unless you're path forward is Pwn2Own or bounties in general. I'd love to work for the Matasanos of the world but feel like I may be locked out based on the initial hurdle of being more proficient in code as a first class skill vs having a more honed skilkset in finding flaws on the systems as a whole. Also tracking the relevant things within the security landscape is a skill in and of itself and since most orgs don't understand how to find and cultivate that talent it open the doors foe the Risk.IO of the world. Sure, I've done some reverse engineering, lots of (easy) pentesting and am proficient in Python. I've designed many F100 systems as it pertains to the security construct, yet I can't see a path forward to digging in deeper with those like Matasano. So @tptacek, any advice? The money is excellent on this side of the fence, but the real challenges are, seemingly, few and far between. Edit: I need to stop writing posts from phone/tablet (spelling).