This is the weekly thread for career and education questions and advice. There are no stupid questions; so, what do you want to know about certs/degrees, job requirements, and any other general cybersecurity career questions? Ask away!

Interested in what other people are asking, or think your question has been asked before? Have a look through prior weeks of content - though we're working on making this more easily searchable for the future.

Independent researchers are reverse-engineering the bugs using AI.

I'm planning a full Cybersecurity Awareness Month 2026 program that I'll be presenting to our CISO for approval.

The challenge is:

• We currently have no dedicated security awareness/training platform
• Little to no budget for this initiative
• It's an older organization, while our cybersecurity department is relatively new
• Many employees are fairly old-school and unlikely to voluntarily participate in games, scavenger hunts, quizzes, etc.

I've found some great ideas around gamification, CTFs, scavenger hunts, phishing activities, and cybersecurity games, but I'm struggling to create a realistic mix that will actually work in this environment.

I don't want to spend the entire month just sending awareness emails.

If you were designing this campaign, what activities would you include?

Especially interested in ideas that are:

• Free or very low cost
• Practical without an awareness platform
• Suitable for non-technical employees
• Effective even with low voluntary participation
• A mix of passive awareness and interactive activities

Would love to hear what has actually worked in your organizations.

I feel like I see software engineering jobs everywhere. Almost every company needs software engineers, and there seem to be plenty of junior and entry-level opportunities.
Cybersecurity feels completely different. There seem to be fewer entry-level jobs, and whenever one gets posted, I sometimes see hundreds or even 1,000+ applicants. Employers also seem extremely picky, even for junior positions.
Do you think switching to software engineering would give me better chances of finding a job, or should I stick with cybersecurity?

We’re starting to see AI move from internal experimentation into workflows that can access knowledge bases, tickets, code, and sometimes production-adjacent systems. For teams in larger enterprises, what are you actually using for AI security beyond standard IAM, DLP, and vendor questionnaires?

Interested in how people are handling model access, prompt injection, agent permissions, audit trails, and testing before new AI tools are approved. Is this owned by the security architecture team, the AI platform team, or shared across both?

I'm exploring an idea and want to validate whether there's actually a need for it before building it further.

Imagine having a small Azure environment that behaves somewhat like a real organization:

• Multiple identities with different roles
• Normal day-to-day activity
• Resource access and changes
• Administrative activity
• Deployments and configuration changes
• Authentication activity
• Background "noise"

And on top of that, specific security scenarios or attack activity is triggered at different times, hidden in the noise.

The goal would be to have an environment that is active and changing, rather than a static cloud-security lab where you perform one exercise and tear everything down.

Potential uses could include:

• Detection engineering
• Testing Sentinel/SIEM detections
• KQL development
• Threat hunting
• SOC investigation practice
• Cloud-security training
• Testing security products
• Practicing cloud incident response

I'm trying to figure out whether this is actually something people want.

If this existed, would you be interested in using it?

If yes:

What would you use it for?

And what would you expect it to do for you to consider it worth using?

If no:

What would you use instead, and why would this not be useful?

I'm not promoting a product or asking anyone to sign up for anything. I'm simply trying to determine whether this is a problem worth building a solution for.

Are big companies still hiring penetration testers?
I feel like penetration testing jobs barely exist at big companies anymore. Most of the openings I see seem to be at small startups or small security firms started by a few people working together.
Meanwhile, I see software engineering positions at almost every big company, but rarely penetration testing roles.
It’s honestly making me wonder if I should switch my career path to software engineering instead.

I've been studying cybersecurity through TryHackMe, and I've been wondering about the best way to retain what I learn.

When I study a new Room, I usually understand and remember the topic pretty well while I'm working through it. However, once I move on to another Room and start learning something completely different, I gradually forget parts of the previous topic.

This makes me wonder whether I'm approaching learning the wrong way.

Should I try to memorize everything before moving on to the next Room, or is it normal to forget some of what I learned and come back to it later?

My current thinking is that I might actually retain a topic much better when I eventually need to use it in a practical situation. For example, if I learn a technique today and then encounter a situation weeks later where I need it, I would review it, use it in practice, and probably remember it much better afterward.

At the same time, I'm wondering if I should have some kind of regular review system to prevent myself from forgetting too much.

For those of you who have been studying cybersecurity for a while:

Do you try to memorize everything before moving forward, or do you keep progressing and review topics when you actually need them?

I'd also be interested in hearing how you organize your revision/review process while using TryHackMe, HTB, or similar platforms.

I'm a mid level appsec engineer looking to upskill. I work in Microsoft and have heard it is really good to get this cert. Does anyone know much about it? I do know it's a very hard cert, 48 hours long

Hi everyone,

​Looking for some advice on my career transition. Here is my context: I worked as a Backend Developer for 7 years. I recently moved to a new country and I'm currently working outside the tech industry while I look for my next IT role.

​To be honest, I've lost interest in pure software development. Over the last few months, I've been exploring different areas, and Cybersecurity has always been the one that appeals to me most. However, I'm not really interested in SOC operations or Pentesting. Back when I was a developer, I was always drawn to DevOps, so shifting toward DevSecOps felt like the most logical path.

​Here is what I’ve done so far:

​Theory & Fundamentals: Spent the last two months studying the CompTIA Network+ and Security+ material to get solid grounding in networking and security context.

​Hands-on practice: I've been building end-to-end CI/CD pipelines (from Git to deployment) and I'm currently integrating static/dynamic code analysis (SAST/DAST) and pre-commit/pre-push hooks.

​I’ve already checked out roadmap.sh/devsecops, but I'm looking for real-world insights and more specific advice. A few questions for the community:

​What core technical skills or practical portfolio projects should I have under my belt before applying for roles?

​Is it worth actually taking the exam for Security+ (or another certification) for a DevSecOps path?

​What tools or practices do you consider absolute "must-haves" for someone making this transition?

​Any advice, reality checks, or suggestions on my roadmap would be greatly appreciated. Thanks in advance!

Running agents on our infra and the logging is fine at the command level. Every command is there. But when I go back to work out what it was actually doing, I'm stitching commands together across a few hosts and guessing at the intent.

How are you handling this? Grouping by session ID, tagging the run with a task up front, feeding the logs to something that summarizes them? Looking for what actually works, not what's supposed to.

CrowdStrike SafeMind, the first agentic system for defenders, built with NVIDIA Nemotron, protects more and costs less than generic frontier models.