Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can any Security Researchers/Pentesters/Hackers point me in a direction to learn about becoming a Security Researcher and steps to take?

share|improve this question

closed as too broad by tim, Stephane, Steve, Xander, schroeder Jun 19 '15 at 20:46

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

I would suggest reading all the questions tagged professional-education, and career. They may give you some useful hints. – Rory Alsop Mar 29 '13 at 9:29

A security researcher does research, and that's a wide term.

One side of research is academics. Go to a university, study, study more, do a PhD, and voila! you are a researcher. Academic studies are, well, academic, which means that they are not necessarily practical; but knowing how to do research means that you know how to learn, and you can then catch on the practical side of things.

The other way is to start by the field work. Try exploits, learn programmation, spend some time on machines, spend more time, and after having accumulated experience you will have an extensive skill range. You will then be able to rely on that experience to catch on the theory which you initially neglected.

Either way, the two key ingredients are spending time and learning theory, not necessarily in that order.

share|improve this answer
Rook's answer is mostly focused in pentesting. This answer is better since it is more general and covers the two keys as Thomas said: spend time and learn. A researcher (medical, computer, chemical... w/e) need to study and learn, A LOT, and for do it, he/she needs to spend a lot of time in it. – Ayozint Mar 23 '13 at 12:03

To become a security researcher (or any kind of researcher) you choose a security topic and master it. Learn everything about this topic, and if you explore this topic far enough will find something new.

To get a job as a penetration tester you need to prove that you can in fact break software. How I did this was by obtaining CVE numbers and putting that on my resume.... But if you don't know how to break software in the first place you can't do the job and you won't be hired.

In the security industry right now web applications are king, closely followed by mobile applications. Master the owasp top 10, hack DVWA and hunt for bugs in open source web applications. Write exploits for these flaws, report them to the developer and obtain a CVE number.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.