From Building to Breaking – The Road to Becoming a Hacker

I started writing software when I was in high school about 20 years ago. I didn’t program computers, I actually started on the Texas Instruments TI-83+ Graphing Calculator. Remember those?

Since then, through my university and professional career, I’ve written a lot of code. I’ve also gotten some experience managing teams who write code, and doing some product work as well.

Through much of that time, there’s been a nagging little thought in the back of my head: I want to be a hacker.

I’ve always felt drawn to cybersecurity. Although much of my career was focused on improving my programming, management, and product skills, I tended to take opportunities to work on security, in some form, whenever I could. I would fix security bugs that came up in software, investigate security incidents when possible, and take part in CTF (Capture The Flag) competitions regularly.

After my 3-month sabbatical in the Fall of 2022, I came back to work feeling like I needed a change. In January of 2023, I finally made the switch from being a software developer to being a security researcher. Instead of focusing on creating code, my focus was on security vulnerabilities and malware. I was lucky to be part of a great team of skilled hackers who helped me to learn and improve every day. Our job was to find security vulnerabilities before the “bad guys” did, and also to analyze malware infections when they occurred, with the goal of improving our security products to better prevent and detect compromises.

After about a year, I was drawn back into a management position. I was still on the same team, and still focused on security, but I wasn’t quite as hands-on as before. Although this was rewarding in many ways, I don’t feel that my own hacking skills improved as much in this period, compared to the previous year. But I still gained valuable experience in the area of security.

And now, another year or so later, I find myself at a crossroads in my career. And although I’m thankful that I’m in a position where I don’t need to rush into anything, I do have a sense of the “ticking clock” as I ponder what comes next. There is a tension between the part of me that wants to stop, wait, and listen, vs the part of me that wants to think about what’s next and figure it all out.

My mind keeps coming back around to hacking. I’m talking about ethical hacking, of course. The legal kind 🙂

I feel like I have a good background for building my skills significantly, and could eventually get into things like bug bounty hunting, penetration testing, and maybe even consulting work. I’m not really sure why it calls to me, but it’s work that I find interesting and fun (and also incredibly frustrating at times!).

I’m also drawn to the idea of building a small business of my own. I admire content creators, and people who have created a sort of “lifestyle business”, allowing them to do what they love, and make a living in a way that allows for freedom, fun, and fulfillment. I started a chess Youtube channel a while back, and I’ve tried some similar things in the past. I could see cybersecurity being another area for content creation: sharing my journey and helping people along who are just a few steps behind where I am.

I love learning and growing new skills. And although it tends to be hard work, I also enjoy sharing and teaching. I like helping people to learn what I’ve learned, and to improve themselves in ways that I have. It could be that as I continue to grow in my cybersecurity skills, I could share that in a way that is valuable for people. Maybe this could lead to creating courses and/or software tools to help others in the industry.

Honestly, I don’t really know what’s next. But for now, I’m working on becoming a better hacker. I’m doing some training, working toward some certifications, making some connections, and trying to navigate the vast security industry.

I don’t know where it will lead. Perhaps it will lead to a content creation business. Or maybe it will help me to get a job later on. Or perhaps I’ll find that cybersecurity isn’t for me, and all of this will simply be a stepping stone toward the next “thing”, whatever that might be.

I don’t know, but as my coach once told me: “you can’t steer a parked car”. So I’m going to start down this road for now, and see which way it goes.