About a week ago I had a chance to observe the workflow and talk with team of incredibly talented and young hackers, they were pentesting our system and dug up 4 security holes within a day. What I saw was nothing less than awe-instilling, their skillset was extremely broad and varied, it included reverse engeneering, packet analysis and what not. I was greatly inspired to set up myself to change my career, however there is one big problem, I already am in my mid 20s, and they were no older than 21 with youngest member being 19. At my age is it still possible to make such a dramatic career jump or I should just stick to safer path ? What will be long term development and consequences ?

  • 1
    " however there is one big problem, I already am in my mid 20s" Why is this a problem? If you are still capable of learning and doing hard work then you should have no issue transitioning to something that you presumably enjoy.
    – sf02
    Aug 25 '20 at 20:44
  • 2
    There is the middle ground of application security, i.e. where you help build secure applications. Perhaps that might be of interest to you? Aug 25 '20 at 20:48

I would suggest to plan this out throughly. While mid 20s are not old, you are old enough that your career decisions are slowly setting in stone. You will spend a lot of time on training for new stuff and do you really want to spend your precious time on preparing to start from zero instead of furthering your existing career ? By the time you retrain and start getting experience you will also have age playing against you. It may look cool from side (grass is greener i guess) but is fiddling with wireshark sustainable say at 35 ? Pentesting is field with clear experience ceiling, how different is 5 and 10 year experience ? There are diminishing returns at play. Stuff like this is young mans game and if I was you I would leave it like that. This is my honest, objective view. As for infosec, I lean towards Mathews comment, go for middle ground, infosec has larger overlap with coding so you won't be starting from zero.

  • There is nothing objective about this. If he wants to learn the basics he can do so on the side in his free time. There are plenty of online ressources to learn and its not that big of an investment to get the basics.
    – Al rl
    Aug 25 '20 at 21:24
  • 20's isn't even close to old nor set in stone. I engaged in a career change at 31 with no ill effects, and I have known a good number of people who have done the same in other careers. All it takes is dedication, perseverance and an eagerness to learn. Aug 25 '20 at 21:27
  • 3
    You can learn anything online, but what are chances that you make use of it ? I can learn about laws but will I be lawyer in 5 years ? Is it cost effective to tank my current career/achivements for risky switch ? OP is already too specialized for good or bad. Aug 25 '20 at 21:33
  • @Joel Etherton you just risked and got lucky. Aug 25 '20 at 21:42
  • 2
    I was really afraid of answer like this. Aug 26 '20 at 14:52

It is entirely possible. That's not to say it's easy. It will take a considerable amount of dedication to pull it off, and depending on your personal circumstances will be easier for some than others. A 30 year old with 2 kids and a spouse, a heavy mortgage and debt is possibly going to find the transition harder than a single person who can tighten the wallet a little bit.

What you have to figure about yourself is: Are you ready to put in the work to make it happen? You will be taking on an entirely new skillset, and your ramp-up time will (be necessity) be much shorter than someone expected to be more junior. It is an in-demand skillset, and it's a challenging field to break into. It can also be very rewarding. Your age and current skillset is not in your way.

  • 2
    Pretty much this. Career switch needs dedication, and dedication needs time, the most expensive resource that we run out of as we age. It boils down to question is it worth my time to chase dream ? If I achieve it then how long will I spend living it ? Most truthful answers also happen to be the most bitter ones. Sad. Aug 26 '20 at 9:07

You do not mention in detail the skills you already have, so it is a bit hard to guess what you would need.

Nonetheless, and as you noted, the skills of hackers vary greatly. Some people have only have a knowledge of unix systems, other are hardcore .NET Windows programmers, some of them may not even know how to program properly. Some are good doing reverse engineering, others would not do that at all (or maybe could, but would prefer not to).

Yes, you could do such move. You are not old at all to do that. Your software developer experience would probably help there, and if you have some Comp Science studies that could be useful, too (even though there are also people in that industry without degrees).

I would say that the main characteristic is being curious, and investigating how things work, which could then lead to results like those (or not, they might not have found any hole, too).

I would recommend you to get some infosec course, such as one from SANS. Even if you didn't end up completely changing your career, it should be somewhat useful, it wouldn't be a complete wasteful effort.

Also note, there are all kinds of people on this industry. Those you met were awe-instilling, some other people/companies have quite-limited skills (although they may sell themselves as semi-gods). Similarly for the courses. I have seen infosec courses with many people, and the expectation that they would be complete hackers as they finished. Which wouldn't be the case. Some people showed a lack of the required skills at the end, even if they passed the different subjects. You can teach packet analysis (in fact, I would expect it as part of Networking 101), but that's quite different than getting people to understand what is being done, or how it can be useful in a more complex setup in the future...

Not the answer you're looking for? Browse other questions tagged .