I think that'd be frighteningly popular. You definitely should!

Do it!

Honestly I don't get overwhelmed by infosec. Though my personality is to take on more projects than I can chew and that can sort of overwhelm my time - I don't get emotionally overwhelmed easily though. Some of that I credit to my personality but I also credit how organized I am, it helps me keep track of everything on my plate and daily prioritization. Inbox Zero, using a task manager, having a personal Wiki (i.e. Obsidian/Simplenote) all help with this.

In the early days of my career I heard that sec people were the "no"-sayers in the group. I have learned over time that we don't need to be. Instead, we become the - "let us find a way to do that securely"-sayers. It's about creating that we're-a-team mentality.

Having a CTF on your resume and being able to speak to that experience is great imo. Early-career is always a bit difficult for resumes since you wanna beef it up but you don't want to fill it with things that don't matter. CTFs, trainings, content you've created (blog, podcast, write-ups, GitHub), etc.. are all great things to put on there imo. If you have any coding projects or cloud experience (easy enough to get) you can put that on there too. Will you be looking to get a job while pursuing your masters?

I think this describes a lot of enterprise cloud security architect roles. I think there is enough delineation between cloud security folks who focus on infrastructure versus those who are more focused on the app/product side. I'd go take a look at the cloud certs from AWS/Azure and see if there is one that looks fun to you. Those certs are typically mapped to common job roles.

Maybe also have a look at devsecops?

I don’t think there’s some minimum XP (in terms of YoE) bar to hit. You just need to be able to demonstrate your practical XP in some manner. Some people get this through work in IT/cyber, others through academics and others still through personal projects and doing things at home. There is a TON of self-teaching options these days through online trainings, CTFs, cons, meet-ups, etc… And lots of ways to document and market your experience and know-how (blogs, social media, podcast, etc…). Personally, I suggest learning a bit of coding, some cloud XP, start a small blog or post about what you’re learning on a micro-blogging platform and network network network.

As for your current place of employment, having a VERY legacy environment can actually be somewhat good for security as it may be “easier” in some respects to find misconfigurations and Vulns. Does your company have any security resources? If not, try to volunteer to help in that area, if they do, introduce yourself and ask to shadow/help/learn from them.

If anything that’s a great learning environment. Offensive security is a lot of reverse engineering, figuring out how stuff works based off (extremely) limited information and understanding how best to attack it.

Moreover, as these are old systems, they’re more likely to be outdated and vulnerable - not that you should try without permission or a clear understanding of what you are doing, particularly on production gear.

At any rate, no company will pay you to learn a completely different job to the one they hired you for. So you’re going to have to spend some of your own time learning about security. Where to start has been repeated ad nauseam online so I won’t attempt it.

I'd be either very broke or have to be very rich to have paid for all of those haha. Fortunately, I worked for a company that had a very generous training allotment. I've also managed to take quite a few entirely free by being part of their vTA (virtual TA) community, whereby I help instructors throughout the week of the course with student questions, lab setup, etc...

I can't go into too much detail on vulns specifically but I've found a number of high impact vulns in public-facing websites for companies I have worked for as well as one vuln in a popular proxy appliance that I should have submitted a CVE for but never did at the time.

Good Q, I'm no AI/ML expert by any means but I do think it's effects on the infosec industry will be muted to some extent, at-least in the 5 year time scale. I can see companies toying with the idea of AI-based capabilities replacing junior staff but from what I've seen from these tools thus far I don't think it would be particularly efficient to do so. Instead, I see AI being a force-multiplier / filling in existing gaps in the security workforce. Beyond 5 years who knows. The tech could progress to a point where it truly is capable of replacing human operators, even for cyber roles. The beauty of infosec though (as opposed to other tech disciplines like software engineering) is that too often we are thinking of ways to circumvent human thinking, and for AI models that were trained on how humans have traditionally thought, they are innately poor at this.

Top 5 SANS courses oh man... I'll give it a shot.

1. SEC503 / GCIA (Intrusion Detection)
2. FOR610 / GREM (Reverse Engineering)
3. SEC564 (Red Team Ops)
4. SEC460 / GEVA (T&VM)
5. SEC450 / GSOC (Sec Ops)

I think 503 is the most valuable SANS course and I had a great instructor during my run. GREM was super technical and really fun. Not something I get to do with my day job. SANS Red Team course was really cool to learn the distinction between Red Teaming and Pen Testing, though it was only a 2-day course at the time. Both 460/450 were actually really amazing curriculums both with top notch instructors/course authors. Can't recommend them enough despite the fact they are 400 level courses.

Roadmaps are such a double-edged sword imo. I'm as guilty of trying to come up with roadmaps as anyone but have often round it get's me too focused on future activities when I really need to focus on the task at hand. It's of course important to have a destination in mind, and often that destination involves having multiple steps to get there (hence the roadmap), but you have to be cautious in biting off more than you can chew (as I have done a lot).

AppSec is, imo, the most interesting security discipline to be in right now. It's sort of all-encompassing and exposes you to a lot of things, coding, cloud, devops, modern frameworks, etc... Given your proximity to devs, learning as much as you can about coding is/will always be super valuable. Plus, if you can code you can automate which is a skill many in infosec don't have which can set you apart. There's so many specific directions to go in in terms of languages to learn, frameworks to master or sub-disciplines to focus on that it's hard to recommend any specific next step or path though. With coding chops, you have a lot of translatable and easily applicable skills for any job though.

Where do your interests lie? Building, breaking or defending?

I guess it depends what skills/experience you've picked up in your time as an SRE. I suspect you have some really transferrable skills though and really just need to get some foundational knowledge for infosec. Sec+ is a good place to start, and if you couple that with some coding, cloud and OS-knowledge, I think you'd be a really appealing candidate for a lot of teams.

My old work place had a relatively progressive training policy and a decently healthy budget. The real beauty of it was that the budget was a departmental pool. The IT department did NOT take a lot of training so those few of us who did want to take advantage of it had access to a huge pool of money. Think, 10 people accessing money meant for 100 people kinda thing…