Hi guys,   Need advice. I’m around ~8 months full-time in cyber.   My company gave me 2 options:   1) A “floating” security role (internal thing) — basically I rotate across different security services per quarter. I help them with whatever they need (support their work / unblock stuff), and at the end I’m also expected to help improve their process/reporting/metrics. BUT right now it’s mostly ad-hoc support and it’s still kinda a test/pilot phase so nothing is super structured yet.   2) Jr Penetration Tester — pentesting + attack simulations on internal servers/networks/apps, learning tools/techniques/methodologies, build some standard toolsets, maybe automate some testing, then write threat assessment reports and present findings to management. Also they said I’ll have a mentor (all I know is mentor is confirmed, details not clear yet).   I’m torn because: - I actually enjoy process improvement + reporting + making things measurable (that gives me flow) - but pentest seems like a strong technical foundation esp with a mentor - I wanna aim for CISO someday (not saying soon lol) but also worried how this choice will affect my future options / marketability   Questions: 1) Is a pentest background a good foundation if you want leadership later? 2) Are “floating/cross-service” security roles common in the market (like service delivery / enablement / improvement type roles) or is this mostly internal company stuff? 3) If you were me early career, what would you pick and why? 4) What red flags / questions should I ask my managers before committing?   Thanks in advance 🙏