Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Can any Security Researchers/Pentesters/Hackers point me in a direction to learn about becoming a Security Researcher and steps to take?

share|improve this question
1  
I would suggest reading all the questions tagged professional-education, and career. They may give you some useful hints. –  Rory Alsop Mar 29 '13 at 9:29
add comment

2 Answers

A security researcher does research, and that's a wide term.

One side of research is academics. Go to a university, study, study more, do a PhD, and voila! you are a researcher. Academic studies are, well, academic, which means that they are not necessarily practical; but knowing how to do research means that you know how to learn, and you can then catch on the practical side of things.

The other way is to start by the field work. Try exploits, learn programmation, spend some time on machines, spend more time, and after having accumulated experience you will have an extensive skill range. You will then be able to rely on that experience to catch on the theory which you initially neglected.

Either way, the two key ingredients are spending time and learning theory, not necessarily in that order.

share|improve this answer
1  
Rook's answer is mostly focused in pentesting. This answer is better since it is more general and covers the two keys as Thomas said: spend time and learn. A researcher (medical, computer, chemical... w/e) need to study and learn, A LOT, and for do it, he/she needs to spend a lot of time in it. –  yzT Mar 23 '13 at 12:03
add comment

To become a security researcher (or any kind of researcher) you choose a security topic and master it. Learn everything about this topic, and if you explore this topic far enough will find something new.

To get a job as a penetration tester you need to prove that you can in fact break software. How I did this was by obtaining CVE numbers and putting that on my resume.... But if you don't know how to break software in the first place you can't do the job and you won't be hired.

In the security industry right now web applications are king, closely followed by mobile applications. Master the owasp top 10, hack DVWA and hunt for bugs in open source web applications. Write exploits for these flaws, report them to the developer and obtain a CVE number.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.