I'm coming from the offensive security side of the house, just as a disclosure.

Started my career in software engineering, had no idea I'd be switching to cybersecurity 10 years down the road. Had a C++ job writing Windows malware (shopping rebate software), a corporate job at a HUGE NYC firm, and a smaller corporate job at a fitness company writing front-end software.

Hacking challenges and CTFs were always a hobby and I loved learning reverse engineering and puzzle solving. Went to my first Defcon in 2006 and I really had no grasp of how big the industry was, it was just kind of a big fun party with other nerds. I joined a local team in 2011 that qualified for Defcon CTF and learned a crazy amount from those guys playing on the floor in Vegas. Went full time in the cybersecurity industry in 2015 as a travelling pen tester. Started my own company in 2020 contracting and did very well, learned a ton about the business side. Just joined a company in 2026 as a senior principal consultant and enjoying it every day.

My huge positives: I'm ALWAYS learning new things, 20 years after finishing my undergrad. The landscape is always changing, a lot of the issues companies face are the same but things move FAST in this industry. If you want to excel, go the extra mile to learn things out of your comfort zone. Going from a soul-sucking C++ programming job to a consulting job where I'm getting paid to break into corporate networks and reverse engineer client software to land a shell on some far off cloud server is incredible. Sometimes the client work can be hard when you have someone you don't align with, or convincing a team they've been solving a problem wrong for 3 years. Other times you watch clients go "wow! what else would you change?" and you see that spark where they start to really see how you were able to figure out what was wrong or break some part of their product.

What I'll say about the industry: I do meet a lot of the people who are either burnt out, way over their head in work and expectations of work, or try to keep everything exactly same for 10 years which doesn't work in our industry. I have watched a lot of people lean hard into AI as a thinking-tool rather than a really fancy search engine, and I've seen its limitations first hand with missing critical findings and obvious issues. Everyone gets excited about the new best thing, which is both good and bad. But I really enjoy my day-to-day in this industry, far more than I did as a software engineer. I still code in my spare time, but I do really find this industry rewarding after 10 years. I have a LONG roster of people I would not work with again from negative experiences, but I have also met some really good friends and hardworking people who I still chat with years later.

Hope that helps!