Joined every CTF I could find. Built a Raspberry Pi honeypot in the hostel as a final-year project. Spent more time on TryHackMe than on classes.

College syllabus on security was a decade out of date. Self-study took over.

Curiosity beats certification. A persistent CTF habit will teach you more than a brand-name internship.

Networking, Linux, OS internals, basic crypto, ethical hacking labs, CTF teams

First job was a 24x7 security operations centre rotation. Most shifts were boring; the few that were not, I will remember forever.

Sleep schedule destroyed for a year. Senior analysts gatekept knowledge until you proved you cared.

Pattern recognition is muscle memory. Most alerts are noise; the one that matters does not announce itself.

Caught a credential-stuffing campaign that the dashboard had missed. Trust earned, transferred to threat hunting.

SIEM (Splunk, QRadar), incident triage, log analysis, MITRE ATT&CK, night shifts

Moved from reactive SOC into proactive hunting. Half the role was technical, half was writing reports executives would actually read.

Convincing leadership that "no incident this week" was the product, not the absence of work.

Adversaries do not care about your org chart. Defenders should not either.

EDR tools, scripting in Python and PowerShell, threat intelligence, report writing

Switched from a services firm to a product company. Less ticket work, more design. Now I help engineering teams ship safely instead of cleaning up after them.

Earning credibility with developers who saw security as a blocker. Learned to be a partner before being a gate.

The best security work is invisible. If the team did not feel us this sprint, we did the job well.

Built a paved-road platform that cut critical findings by 60% within a year.

Get one cert that opens doors (Security+, OSCP) and then stop collecting them. Build instead.

Cloud security (AWS, Azure), IAM, threat modelling, secure SDLC, leadership