undefined | Better HN

0 pointsjwilliams9y ago0 comments

"you can do that by picking up literally one or two textbooks and participating in bug bounties" is a good idea and certainly something I hadn't considered. My main concern was bootstrapping yourself into the area, so that's an interesting approach.

I read "cyber security" a bit more broadly. You can certainly be a great appsec-type -- but I still personally believe spending time in and around organizations is really important to be in security. Do take your point there are large domains and specializations where that's less true.

Arguably this will be the same in ML at some stage. In actuality I think devops-for-ML or testing-for-ML is a more agreeable place to get started. It's pretty underserviced right now.

Ultimately I think best to follow the passion. Give both a try and see what feels best.

0 comments

1 comments · 1 top-level

tptacek9y ago

There are subfields of infosec where organizational understanding and savvy is important. But if you're a technologist, most of the real action in the field is in appsec and, at it's most specialized, high-status end, vulnerability research. Appsec doesn't much care where you're located, or really even how well you understand the org chart of your target.

j / k navigate · click thread line to collapse