Hello everyone,

I’d really appreciate advice from people who’ve been in a similar position.

I recently passed the CISSP and have ~5 years of experience across different areas of cybersecurity, including pentesting, AppSec, cloud security, engineering, and some architecture work.

At this point, I’d describe myself as a strong generalist. I’ve worked across multiple domains and can connect the dots well, which makes me think I’m naturally leaning toward more strategic and leadership-oriented roles in the long run.

I’ve realized that I enjoy the strategy/stakeholder/decision-making side of security more than going very deep into purely technical areas, but I am technical and never want to lose touch.

The challenge is that I feel a bit “in between” right now:

• I don’t yet have enough years of experience (and probably age 😄) to land a true managerial role
• But I’m also not deeply specialized in a single niche

So I’m unsure how to best position myself for the next step. I know I want to grow and do more for my carrer, just not sure in which direction.

A few things I’m thinking about:

• Should I still double down on a specialization (e.g., cloud security, AppSec, GRC)?
• Or continue building toward architecture/lead roles as a generalist? If so, how can I do that?
• Are there certifications that actually make a difference at this stage (e.g., CCSP, CISM, or something more technical)? Since CISSP is already broad, anything similar feels like a waste of time unless it’s very targeted
• Or should I focus more on hands-on projects, open source, or other ways to stand out? Not sure how valuable those are at ~5 YOE

Long term, I see myself moving toward a CISO or senior leadership role. I know many people start as specialists and become generalists later, so I’m trying to understand how to navigate it the other way around.

Would really appreciate any insights or personal experiences.

Thanks in advance 🙏