I wouldn’t worry about certs to start, especially not OSCP. Since you are in the software/dev space, I would consider security roles in the AppSec or CloudSec space as places to jump first. For that, consider going through PortSwigger’s web security academy (free) training online to learn more about web vulns, their impact, how to mitigate, etc… If you want a cert, consider one from a cloud vendor and apply to jobs that use that vendor. If you can do even basic scripting, understand app-related vulns and use a few appsec tools then you should be an easy hire for a lot of places. (That said, I’ve been hearing the market for infosec is atrocious right now).

Never been in the QA world myself, but as someone who has spent a fair bit of time in AppSec, I’ve encountered Selenium the most. 🤷‍♂️

When you say “transferrable in QA” do you mean, languages useful for QA folks that transfer out? I’d argue any/all of them would be for appsec folks.

Not a bug bounty hunter myself, but it seems like one of those things that you just have to jump into and start trying to do. So many bounties seem to be pretty low-hanging fruit type of stuff. The payouts might be either LOW or non-paid, just recognition type stuff, but seeing an accepted bounty submission come back does a lot for your confidence. It’s like CTFs in a way. Getting into CTFs seems intimidating at first, but then when you go actually do one and you have some level of success, it starts to feel a bit more approachable, you get more XP and you do better the next time.

You could also check this out https://www.bugbountyhunter.com/zseano/ and anything/everything from https://portswigger.net as that team is the best I know in terms of cutting-edge web app research.

🔥

That’s a loaded question 😅. One that can be answered in a few different ways… From a technical perspective, “infosec” is a relatively vast field comprised of a lot of sub-disciplines, so from a tooling and procedural perspective, it varies from job to job. Some would argue a lot of what we do is just theater, and for many orgs and many “pros”, this may very well be true. At the root of it all though, you could say our job is to ensure the Confidentiality, Integrity and Availability (classic CIA triad) of data/systems, keeping in mind the balance/tradeoffs between security needs and business requirements. To do so, we employ a variety of tactics, techniques, tools, methodologies, frameworks, etc… Another way to boil down what security folks do is in the lens of “risk”. Most business and IT decisions in general come down to risk-based decision making and security is no different. Security teams should understand the risk introduced by the threat landscape coupled with the respective data, attack surface, business assets, etc… to help inform the business how to reduce security risk to acceptable levels.

Hopefully this answer isn’t too vague and non-answer-ey!

Titles in the security world are kinda a mess. Generally I just look for “-security engineer” titles. So in this case you would probably find “Cloud Security Engineer” or something. Look for security engineer roles that have anything cloud-related in the job req and you are probably on to something.

Hard to say, especially in this market. But, if you have some coding chops (from DevOps experience) or you have some knowledge of native cloud security tooling (from a Cloud role), then you would definitely have a leg up in getting a security engineer or netsec role (consider that a lot of modern “networks” are largely cloud networks).

Some resources here https://shellsharks.com/online-training#ai and here https://www.databricks.com/blog/introducing-databricks-ai-security-framework-dasf

I’d wager most people do. But you certainly hear about all the people who spend their free time doin more cyberz. I am definitely guilty of this a lot of the time. But I’ve been working harder to disconnect more. Being a parent helps with this as it’s pretty mandatory.

I wrote a bit about the pitfall(s) of “Certification Paths” - https://shellsharks.com/notes/2023/11/14/stop-worrying-about-certification-paths.

This is coming from someone who has A LOT of certs, and I’ve learned over this time that it’s just not the right way to think about progressing career-wise. You can read more though about certs and some thoughts on what you could take here too https://shellsharks.com/training-retrospective#what-certification-or-training-should-i-take.

Never heard of 'em. I’d say most of those things, while not necessarily “scams”, are probably not worth the time you would put into them. That said, if you have free time and they pay, then it is what it is. If you go down that path, make sure to report back!

Greed. Capitalism. AI speculation. Other stuff …

Big consulting firms (e.g. Accenture) and the like. Government jobs too if you’re close to where those are. Outside that, it’s very random which companies have such openings. The bigger the company the more likely it would have a higher diversity of roles and seniority openings.

China. Also, no one is saying FB is fine, but since it’s American then gov pretty much shrugs. It was FB after all feeding the NSA yeah?

I am a pretty heavy “Fediverse user” (Mastodon + Lemmy/Kbin) and my feeds have VERY little Linux talk. There is an incredibly diverse set of folks on the ‘verse but admittedly discoverability is hard. If the only people in your circle are Linux nerds then that’s all that might be boosted into your timeline. Put some effort into finding other folks and unfollow some of the Linux-only voices :-).