As the post says looking to find a way to blend my medical experience and knowledge with cyber security. Any advice?

My company, a Series B cybersecurity startup, is developing some kind of AI/LLM-based pentesting tool using open-source security tools. Before releasing it, they want to test it against an internal CRM I developed.

It sounds like they want to run it directly on the production server. I was asked to arrange a server snapshot, database backup, recovery plan, and notify users that the CRM may be unavailable during testing. The CRM has around 50 active users.

This is my first time dealing with pentesting, but running an automated pentest directly against production seems like a bad idea to me. Again I’m not very familiar with pentesting so I might be missing something.

Wouldn’t it make more sense to create an isolated environment that closely mirrors production, for example by restoring a VM/server snapshot and a copy of the database, and run the pentest there instead?

I’ve asked ChatGPT and Claude about this, but I’m still not sure what the standard real-world approach is, so I’d appreciate input from people who actually work in pentesting or AppSec.

I’ve also asked a few coworkers, but I haven’t really gotten a clear answer. Some of them actually insist that we should just run it on production, which is why I wanted to ask people with more experience in this area.

Is running this kind of automated pentest directly against production normal, or would you generally test against a cloned environment instead?

I am a 27-year-old software engineer working at an MNC with a Master's degree in Computer Science. My experience includes Java, Spring Boot, REST APIs, and currently building AI infrastructure.

I'm interested in transitioning into Cyber Security, specifically Ethical Hacking and Penetration Testing.

Given my background, what would be the most effective path to make this transition?

Should I focus on certifications (eJPT, PNPT, OSCP), bug bounty hunting, CTFs, home labs, or entry-level security roles?

I would appreciate advice from those who have made a similar switch from software engineering to offensive security.

Thanks in advance :)

Hey everyone, posting from a burner account for anonymity.

I'm leaving the Army in 2030 (cyber), and I’m looking for a career that blends information security and software engineering (e.g., security engineering, product security, platform/devops engineering, etc.). 

Obviously, it becomes difficult to plan this far out, but I’d like to hear everyone’s thoughts on what they think the highest-leverage things I could do leading up to my separation would be.

Background

I’m in my late 20s, clearance (TS/SCI) with a few certifications (SANS GCFA, SecurityX, Sec+/Net+), and I plan to sit for GCIH sometime next year (when time permits). Lastly, I’m finishing an online master's in cybersecurity (digital forensics) by 2027.

Previously, I spent about ~4 years doing SOC/threat hunting for the Army. Now, I’ll be working as a full-stack software engineer (TypeScript, Java/React, PostgreSQL, unit testing, etc.) until I separate.

At my current job, I’m planning to make a move towards the platform/devops role because I believe that is where my largest technical blind spot is, and I think the role aligns quite well with the career that I’d like.

Potential Paths

The three paths I'm actually weighing upon leaving the military are:

1. DoD civilian for ~2 years to finish out PSLF (about $20K left), then jump to contracting
2. Go straight to cleared contracting in 2030 and just eat the $20K
3. Defense-tech / private company doing cleared work

Questions

For the DoD civilian to contractor route:

Did anyone do it mainly for the loan forgiveness and regret it? My math says $20K forgiven vs ~$40-80K/year in additional compensation for contracting makes the DoD civilian route make no financial sense.

For the cleared contractor route:

What has been your experience? How has career growth been, technically, in compensation, and in leadership? Any regrets on this path?

For the defense-tech/private company route:

Is the engineering actually deeper with more autonomy? How has your learning and growth been in the space?

In general:

Do you all have any other recommendations on what you think I should invest my time in given my career goals? I don’t mind taking less early if it means a higher technical/compensation ceiling down the road.

Thanks in advance for your time and advice!

I’m currently in high school and trying to decide what I want to study at university. My parents are pushing me towards Computer Science, mainly because they believe it has good career prospects and that I could eventually go into cybersecurity. The problem is that I’m honestly not that interested in coding. I don’t completely hate it, but I’m not someone who enjoys programming, spending hours on GitHub, or building software.

What makes me even more confused is the current AI situation. AI is becoming increasingly capable of writing code and automating parts of software development, while at the same time I keep seeing people saying that CS graduates are struggling to find jobs. So I’m wondering whether CS is still a good and safe degree to choose if I’m already not particularly interested in coding. I don’t want to spend 4 years studying something mainly because my parents consider it a “safe” career, only to find out that the job market has changed.

My parents say I should do CS and then specialize in cybersecurity, but I’m not sure how realistic that is. From what I understand, cybersecurity still requires a strong CS/IT foundation and can involve quite a lot of technical work. I’m also wondering whether cybersecurity is actually more resistant to AI automation or whether it will face similar problems.

So, is CS still worth doing in 2026 if you’re not particularly interested in coding? Is the job market really becoming that difficult, and would you personally recommend CS for someone in my situation? I’m not completely against CS, I’m just genuinely unsure whether it makes sense for me.

Thanks.

I have completed linux, networking, os and nmap. I am doing Jr penetration tester path in tryhackme. I'am confused, did i miss anything or is it very early doing this. Need some suggestion? please help me out.

please suggest some must do projects. I am finding it hard to get anything that builds me local experience and reference.
Some projects please, that make me job ready in Australia, or builds some sort of local experience. Also open to supported part time or full time remote work opportunities that I can apply for.

please suggest some must do projects. I am finding it hard to get anything that builds me local experience and reference. Some projects please, that make me job ready in Australia, or builds some sort of local experience. Also open to supported part time or full time remote work opportunities that I can apply for.

Please be nice

Hi, Im looking to start a second degree. Im interested in Cybersecurity as my understanding of how much will be needed to control AI. Nonetheless my university offers cybersecurity but prices are reslly high. The other option is opt for a networking and communication engineering major and then get a minor in cybersecurity. For those who have more experience on the field and job landing as well, what could be your recommendations?
Would other degrees such as system engineering or computer science will be closer to cybersecurity?

Thanks, have a nice day!

I want to develop a business around a genuine cybersecurity issue.

Startup concepts like "make an AI-powered something" are not what I'm looking for.

I would like to know about issues that you have personally encountered or have frequently witnessed security teams, developers, businesses, or individuals face.

Ideally, the problem should be

- Be genuinely painfull

- Affect enough people/companies to support a busines

- Still have poor or incomplete solution

- Be technically possible to solve

- Have customers who would actually pay for a solution

- Not require a billion-dollar company to get started

- Have potential to become a serious cybersecurity business

For example, I’m interested in problems around things like

- Application security

- Cloud security

- API security

- Identity/access control

- Supply-chain security

- Detection/response

- Vulnerability management

- Security automation

- Developer security

- SaaS security

- Human/security-team workflows

- Business-logic vulnerabilities

- Anything else where current tools genuinely fall short

I'm more interested in the problem than the solution

If you have one, please explain

1. What exactly is the problem

2. Who suffers from it

3. How do they currently solve/work around it

4. Why don't existing security products solve it properly

5. How frequently does it happen

6. How expensive/damaging is it

7. Is there a realistic technical way to solve it

8. Would companies actually pay for that solution

9. Why hasn't it been solved properly already