"Security Generalist" is gone. How do you focus long-term training?

Sheiko37

"Ok, you're a pen tester, now where do you see yourself in five years?"


It's easier to make education and training choices when you're starting in information security, but I've been a penetration tester for nearly two years now (not long) and I'm feeling lost again, though I do love my job, this is not endgame.


The training out there tends to cap at mid-level complexity, and all the "advanced" courses are either not that advanced or exploit development, and the latter isn't that marketable. You're basically on your own.


There's "learning", and "specialising". You can learn everything all the time, but you can't really specialise in mobile, web, wireless, application, network, coding, forensics, etc. all at the same time, or ever, so what do you do? I've started to narrow my options by process of elimination, crossing out domains I know I don't want a committed future in, what's your method? How do you plan what's next after you've already "made it"?

LordQarlyn

The Security Generalist is dead, long live the Security Generalist!

Honestly, I never thought there were much of a demand for generalists in IT in the first place. Outside of small organizations where the IT individual could be expected to have skills in broad areas of IT, including security, most of the positions are for a specific area.

Then it just goes that you need to find your passions and try to align them with market trends. There's something out there for everyone, and if you happen to be a specialist in a niche field, then be damn good at it. Start looking for jobs in those areas and concentrate your training there. That's where I start myself. I've found where I am passionate about and started focusing my training and certification along that route. It doesn't mean I can't learn about other areas. I haven't stopped learning about hard sciences just because I am focusing my career in information security.