Ask HN: Starting a career in security at 40? • Hacker News Board

Re: Ask HN: Starting a career in security at 40?

#111

Post by wglb » Tue, Nov 20, 2018, 4:37 PM UTC

arkadiyt wrote: post #66

runjake wrote: post #61

Allow me to disagree with tptacek a little: The OffSec Penetration Testing with Kali Linux (OSCP certification) is excellent and outstanding and cheap. https://www.offensive-security.com/information-security-trai... While the course itself is $800, you'll most assuredly need another 60 days of lab time for the certification. I think all-in-all it cost me $1,500 for everything. The course material is excellent and wid…

I'm just one data point but I'm a hiring security manager and if someone had OCSP it would mean nothing to me.

Second this point. One hire that I had a voice in getting hired showed up with no current job, no security experience, but had written a compiler at home, just for fun. Has what most folks would consider a spectacular career since then.

Re: Ask HN: Starting a career in security at 40?

#112

Post by devsecguy » Tue, Nov 20, 2018, 5:34 PM UTC

tptacek wrote: post #109

devsecguy wrote: post #105

Earlier quoted context omitted.

In the UK at least there has been a strong drive to regulate security companies through organisations like CREST and CHECK. The problem is that its an industry with a massive amount of hidden information. If somebody does a pen test on an corporate network and says "we didn't find any vulnerabilities" how does a company know if they have actually done a thorough check or if the network is genuinely secure? Yes in an…

I don't know what part of "there are no certificates required to do this kind of work" I'm failing to communicate. My last company was acquired by NCC Group, a UK public company, and I haven't met anyone from the UK side who was certified either.

I never once said that certifications are required to do this work though did I?

Re: Ask HN: Starting a career in security at 40?

#113

Post by devsecguy » Tue, Nov 20, 2018, 6:19 PM UTC

elteto wrote: post #11

insertcredit wrote: post #5

You don't give enough information, "security" is meaningless as a solo term. You need to go into specifics at to what exactly you see yourself doing. If we are talking threat intelligence/analytics then I would say that you're taking on a huge gambit that will most probably not pay off. These jobs will be amongst the first that will go away / automated and do not require deep skills. Certifications are a complete was…

He did say what he was interested in: I have always had an interest in security, especially the red/blue team side of things as well as the forensics area. You should try replying to the actual post, not the one you constructed in your head.

He also said "With regards to what do I find interesting, honestly I would put offensive at the top of the list".

Re: Ask HN: Starting a career in security at 40?

#114

Post by disposable42 » Wed, Nov 21, 2018, 8:09 PM UTC

Jumping in the thread since there are a lot of very helpful advices here, I would like to know if my career change seems stupid or not?

Here is my background:

I am a SRE for a FAANG for a couple of years, sharing my time between system development and operational work. I am almost 40, EU based, been doing that for more than a decade.

I am more and more considering a switch to a security position, because I start being tired of operational tasks and oncall duty.

I have a fairly good knowledge of operating system/linux internals, the underlying mechanisms (memory layout, subsystems, io, kernel/user space, ...) how programs work down to the cpu level (registers, stack/heap, assembly, cpu rings, syscalls, stackframe, ...).

Some minors contributions to the Linux thanks to the Eudyptula challenge (eudyptula-challenge.org) I've completed a few years ago, also minor patchs for the FreeBSD kernel.

Security wise, a few years ago I was very interested in reverse engineering (Softice, windasm, ida, understanding exe packers, debuggers detection) and lately managed to participate in a few CTFs and done some Linux reverseme (thanks radare2!)

Security is a very wide world, but reverse engineering/exploiting binaries would be the thing I like the most (familiar with stack smashing, rop, format string attack, everything low-level)

I am also starting to write an toy interpreter/compiler from scratch.

I have been talking to some security engineers from another FAANG company, and realized that what they were doing (security audits, CVEs impact analysis, lot of paperwork/emails/document writing) is something I am not interested in, I like low-level technical stuff.

Hence my question: am I dreaming? Is that possible with this background to find a security position where low-level/reverse-engineering is the main part of the job?

What would be the best thing to start with? Find some security issues in opensource software? reverseme write-ups?

Thanks a lot!