I'm an amateur hacker with a solid experience in full stack and programming. I recently decided to chase after my dream job and transitioned to the Cyber industry.

I applied to a few companies and every interview I had was a success. I applied for junior cyber security positions and got amazing offers. Now i need to choose between the following junior positions, and I feel that making the right decision is crucial to my advancement. The positions are:

  1. Junior Penetration Tester
  2. Junior Security Researcher
  3. Junior Web Application Security Engineer

How I want my day to day to be:

  1. As much freedom as possible
  2. Ability to take time to learn new concepts and figure out ways to exploit them, around 20%
  3. A good amount of coding and scripting, writing tools and writing exploits POC. Around 30%
  4. Advancing my career in a vector that would allow me to make new discoveries, zero days, CVEs, attend conferences and teach. 25%
  5. Writing reports, and office related stuff around 25%

I'm attracted to the following subjects:

  1. Reverse engineering low level code, where the real magic happens.
  2. Web application security, i love manipulating and finding web exploits. I have a pretty good understanding of the infrastructure components and systems, as well as new technologies
  3. malware engineering, this seems the most exciting but doesn't feel legitimately profitable.
  4. Pentesting, absolutely love knocking on doors.

How can I determine which of my available career paths are the most suitable to my professional goals?


What those terms mean to me:

Junior Penetration Tester

Using other peoples tools to do penetration testing.

Junior Security Researcher

Researching and building those tools.

Junior Web Application Security Engineer

Securing a potential target against threats.

So it seems what you described would be the Security Researcher.

However, please be aware that job titles are not fixed. They can be created on the fly, given to whoever wants them and do not have to mean what they normally mean. Make sure that in the company you apply to, those titles actually mean what you think they do. For example, a good interview question from you to the technical person at the table might be "Can you describe the tasks you normally do in this position? What would my typical day look like?"

Not the answer you're looking for? Browse other questions tagged .