Ask HN: Need Career Recommendations

Hey that’s impressive that you’re so young and found so many vulns.

If I was in your place I would chart out a path for myself to be CISO or CIO at a large org. Continue with your graduation and attempt to get ethical hacking certifications (CISSP or CompTia junior or senior year). I would also start a technical blog about your research (once those are patched ofcourse) This will be a boost to your credentials when you apply for jobs. All the best!

Ah this reeks of bs but welcome to hacker news where everyone gets the 350k+ offers. Lol posting the #2 for Epic Games, this totally is very real and very possible for a 10 year old to even do.

If you are 17 and have already being doing sec research for 3 years... well, why do you have trouble choosing between smart contracts and browser security? From my point of view, you could do both.

More seriously, if you haven't already, brush up your math/physics skills to get ready for university, and do either computer science or software engineering. It's only 3 or 4 years but the diploma will last you forever. Since you seem like a smart guy, getting the degree will be very easy for you. You thank me later, when you are 40.

I’d read PG’s essays (someone compiled them in a pdf on github) and learn about startups. Long term you don’t want to sell your soul to corporations.

Continue to learn and try to get some contract work meanwhile. In security this is very common: audits, penetration testing, etc.

Good luck!

I can relate, as I started my career at 16, setting up a small ISP from scratch without any prior knowledge of computer networking and doing the work remotely, part-time since recently when the company was acquired by a larger ISP. They had about 2000 subscribers when they sold it.

Besides that, I've worked full time on Linux administration at a large scale and in the last years on cloud architecture. When starting university, my colleagues were all envious of me because I was working on interesting stuff and because I had a steady income, but I don't know if the sacrifice of not having a life during high-school was worth it.

Some advice to my younger self: - enjoy your young, no-care-in-the-world years and experiment as much as possible outside work and jobs; this will come in handy later on because you will end up working with people - try finding a bachelor and master that can deepen your knowledge on the subject; for various reasons I've picked telecom and now I regret not picking CS for my current day-to-day job. I made the right choice by picking a networking master's - if in or near Europe and if you like traveling, search for Erasmus+ exchanges during high-school and university years - there are lots of certifications that can give you insight on the industry you're on. For example, I've only learned about Cisco certifications years after working in the networking field. Why? One constraint was budget and I initially implemented everything using Linux and cheap switches. - don't get hired full-time early (this I'm glad I didn't do), because there will be plenty of time to climb corporate ladders. A few of the university colleagues are now on a higher corporate level than me, but should I care?

TL;DR enjoy your young years and don't sweat it too much by working during university; you're way ahead of everyone else and will easily land a job when the time will come.

I can't stress enough how important college is. People who can drop out of college and still do extremely well are very rare: When you look at Bill Gates and Mark Zuckerburg (sp?), they had to drop out because their startups' success was a once-in-a-lifetime event. They also had family money to fall back on if their startups failed and they needed to go back to school.

Many of the techies who I've met who dropped out of school had career struggles afterwards: I can't stress just how important it is to do college while you are college age. You can delay it 1-2 years if you like, (and it will really be nice to have spending money when you're in college,) but going to college when you're significantly older than everyone else will really suck.

College isn't just about the book education. That's the easiest part. It's also about the social experience; but it's much harder to apply for jobs without the degree.

There are a few paths forward for you, and a lot hinge upon your skills outside of security (somewhat your morality).

Computer security is a lucrative field, and a broad one.

You could continue the bug bounty approach, which leads into vuln selling (with the attendant morality questions). You could go into systems security research, a long term project but worthwhile intellectually. You could contract (needs networking and business), you could FAANG (needs patience and soft skills), you could government (needs patience and more patience).

My advice: don’t rush. You have at least 50 years of career ahead of you. The decisions you make now will influence your direction for years, but there’s very little you can do to completely derail your future. Try some things, see what resonates and clashes and learn more about you.

Context: 25 years in computer security in a variety of roles, currently FAANG, currently management. My 17 year old self would likely be somewhat surprised at my circumstances, but hopefully not upset :)

Let me guess, your father just happens to be doing security research himself and as destiny would have it your interests intertwined?

Try getting a fulltime job if you can. You don't need to join college for CS education imo. There is not much benefit of a college degree unless it's from a elite/great college. The best resources to learn CS are online ex. https://teachyourselfcs.com/ is a good resource to self learn. Imo unless you want to go into academia you don't really need a degree atleast for software/security jobs. As far as socializing and learning soft skills is concerned, it can very easily be done in a job as well, you don't need to go to a university for it. Even better get a remote job or go backpacking around the world and you can fast track all those 4 years of socializing skills in a few months as well.

Thoughts and random advice mixed together:

- Before you go to university/college and semi-regularly afterwards do a security/doxx/skip trace/etc. on yourself and your accounts. Even if you later do more impressive work, presenting your earliest work is going to be the only way to prove that you were working pre-18/pre college degree, and you are going to need that proof. The main thing is to make sure that there's nothing connecting to those accounts/handles/usernames that might make you unemployable or people not wanting to work with you. It's a good practice to get into because when you're 28 and handing over proofs of what you did when you were 14, you don't want to lose job offers because 14 year old you named your variables 'buttface' or said something that was acceptable in 2019 that isn't in 2035 or something.

- Consider what you want. Do you want to maximize for money? For free time? For autonomy/freedom? What types of tasks do you enjoy doing?

- Consider majoring/minoring in something completely unrelated to CS. One major benefit those of us with significant programming/tech experience pre college have is that we already have a trade/profession going into college. (I started when I was ~5-6). Keep up with your tech work, but doing coursework in areas like communications or business management or picking a rare domain to acquire knowledge in to combine with your tech skills is going to be very advantageous particularly in the middle or later parts of your career.

- Don't worry a bunch about low-balling yourself. It's really weird to try to get an idea of where you fit in the market if you're an outlier and talented young people get really mixed messages sometimes. I think the main question to ask yourself is do you want to go into smart contract or browser security work? You clearly could.

I've seen a lot of your tweets about those bounties :)

As someone who has done bug bounties and also has certifications, I can suggest a few things.

1. College - Like others said, it helps a lot not just careerwise but socially as well.

2. Try joining big security groups/org - You have a lot of knowledge, especially in RE/PWN fields so maybe try joining organizations that do security research full-time example Google Project Zero or there are loads of other organizations that does that kind of work. This will make life easier in sense of what you wanna do. By joining such groups/organizations you can choose to work on game engine/cheat-anti-cheat hacking or browser/OS security basically choose what you wanna hack.

You might think why would you need a job in any org to do so? Well, simply because a stable income(the reason I stopped doing bug bounties) and association with a good org/group improve your network. Not sure if you know this or not but having a good network of people really helps, professionally.

3. I saw someone mentions that you should think of getting certifications. Believe me, when I say it, certificates do nothing. I got my OSCP because people said it would help me get a job, but it didn't. Certificates are only for people who don't really have anything else to show or beginners in the fields trying to get their foot in the door. You already have an amazing profile showing that you are capable of doing RE/PWN stuff. Go for certifications only if you actually want to have fun and take on the challenge. Don't expect much change in your professional life from those certifications.

**

You already know this but I'd state it again, literally every program lowballs, and no one wants to pay up. So if you get 10k for RCE but expected 100k, just stop reporting to that program. If you like working on their services then maybe try talking to the program managers about it. In the end, if you feel like the program isn't giving back as you expected just move on to a different program.

All the above stuff was what came to mind to help your professional/bug-bounty career. To answer the question

> I've been told many times that I am low-balling myself and should get into smart contract or browser security. Please let me know what you think and feel free to ask any questions.

If you just want big money, yes smart-contract seems to be the big hot thing. If you are looking to make a big name in the security field along with a decent(sometimes really good) amount of money then browser/OS security is definitely a good thing. In the just try them for 1 week/month and stick with something that you enjoy :)

Happy hunting!