A side question, for Canadians, which gigs offer "teach on the job" as
MSFT_Edging mentioned in his comment? Maybe government too?
Ask HN: How can I get into cyber security research?
41–47 of 47 posts
Re: Ask HN: How can I get into cyber security research?
#42Earlier quoted context omitted.
I work in this niche (finding/exploiting C/C++ bugs in operating systems and browsers). Here's the companies I know about: Raytheon, Mitre, L3Harris, Grayshift, Vigilant. Also NSA and CIA will train you if you don't already have the skills, but there's downsides: clearance required, no remote work, DC area only, low pay.
If you find the right contractor or aim for a smaller subcontractor, the pay can be fairly lucrative if you haven't been poisoned by FAANG salaries. Typically the game in the industry is work for a contractor, quit with a few of your best buds, open an LLC and sub back to the same customer/contractor with your billing rate doubled. Since you lack the overhead of a larger company, you can be a little entrepreneur with…
Agreed! I just meant that working directly for NSA/CIA is low pay. Like ~100k, which certainly isn't poverty wages. Working for a contractor, I think about 250k is normal (but I have very few data points). And I don't know anyone who has started their own LLC, but I'm sure the sky's the limit with that route.
Re: Ask HN: How can I get into cyber security research?
#43I work for the Adversary Simulation arm at IBM X-Force Red. Prior to that, I worked at Mandiant and left as a technical manager for the proactive (offensive security) consulting branch. I’d be happy to chat with you and answer any questions. I have interviewed and hired candidates for these positions many times, and have also been the one in the interview chair. My Twitter handle is in my profile. In case you’re wond…
I've followed you there, but I think I can't send a DM if you don't follow me
Re: Ask HN: How can I get into cyber security research?
#44landing a cyber job isn't too hard but getting a "research" based position is going to be extremely difficult even if you already have a decade+ of cyber experience. "Research" may be a better home/fun activity. If you want a security-based job, first figure out what niches you enjoy the most: mobile, vulnerability writing, mobile, reversing, web apps, forensics, etc.
Re: Ask HN: How can I get into cyber security research?
#45please add contact info to your profile or reply here. i work for a team you would be interested in, and we're looking for people exactly like you.
Hey, I am currently a application pentester and also interested in looking for something more focused on security research.
Re: Ask HN: How can I get into cyber security research?
#46please add contact info to your profile or reply here. i work for a team you would be interested in, and we're looking for people exactly like you.
I would also be interested in hearing from you, thanks. (see my profile)
Re: Ask HN: How can I get into cyber security research?
#47Assuming vulnerability research, you need to be able to recognize bug patterns (buffer overflows, use-after-frees and such), be familiar with fuzzing, code audits, debugging. Of course understanding the code usually in C/C++ and assembly. Assuming you have the technical skills there are companies that hire for such positions ranging at varying degrees in the "ethical" scale. See Google Project Zero and Zerodium for i…
There is no formal way to acquire this knowledge? I know lots of stuff, but don't know if it's enough or if it's what is needed.
There are certs like OSCP, but I feel that these companies only care about it when it's about pentest