Chapter 58 — Specialisations, certifications, and staying current

The main specialisations

   APPLICATION SECURITY / PRODUCT SECURITY
     secure SDLC, code review, threat modeling, SAST/DAST/SCA, paved-road
     tooling, working alongside dev teams. (This guide points here.)

   OFFENSIVE / PENETRATION TESTING / RED TEAM
     web/network/cloud/mobile pentest, red-team ops, adversary emulation.
     Report-writing and scoping are half the job.

   DETECTION & RESPONSE (BLUE TEAM) / SOC / DFIR
     detection engineering, threat hunting, incident response, forensics,
     threat intel.

   CLOUD / INFRASTRUCTURE / PLATFORM SECURITY
     IAM, network architecture, Kubernetes, IaC scanning, secrets, CSPM,
     guardrails at scale.

   SECURITY ENGINEERING / DevSecOps
     build the security tooling and pipelines; automation-first.

   CRYPTOGRAPHY / SECURITY RESEARCH
     protocol design, implementation, vuln research, exploit dev. Deep,
     specialised, often research-degree adjacent.

   GRC / SECURITY MANAGEMENT / PRIVACY
     risk, compliance (SOC2/ISO/PCI), policy, audits, programme leadership,
     privacy engineering.

   PRODUCT/SPECIFIC: OT/ICS, automotive, medical device, hardware, AI/ML
     security, blockchain.

Most careers move fluidly between these. A strong foundation (this guide) plus one deep track plus general breadth is the durable shape.

Certifications — what they're actually for

They're signalling and structured study, not proof of skill. Useful when job-hunting or when an employer pays. Roughly by track:

   ENTRY / FOUNDATION
     CompTIA Security+           broad baseline; common HR filter
     ISC2 CC (Certified in
       Cybersecurity)            free-ish, foundational
     Google Cybersecurity Cert   beginner, blue-leaning

   OFFENSIVE / PENTEST
     PNPT (TCM)                  practical, affordable, report-based
     OSCP (OffSec)               the well-known hands-on bar; hard; network-
                                 focused. OSWE = code-centric web; OSEP =
                                 evasion/AD.
     HTB CPTS / CBBH             practical, modern, cheaper than OSCP
     PortSwigger BSCP            web-specific, practical, well-regarded

   DEFENSE / DFIR / DETECTION
     BTL1 / BTL2 (Blue Team
       Labs)                     practical blue-team
     GIAC GCIH, GCIA, GCFA,
       GNFA, GREM                SANS courses; excellent, expensive
     Elastic / Splunk certs      tool-specific

   CLOUD
     the cloud provider's
       security specialty        (AWS Security Specialty, Google PCA-
                                 Security, AZ-500)
     GIAC GCSA (cloud sec
       automation)

   MANAGEMENT / GRC / GENERAL
     CISSP (ISC2)                broad, management-leaning; the classic
                                 "senior" HR checkbox; needs experience
     CISM / CISA (ISACA)         management / audit
     ISO 27001 Lead Implementer/
       Auditor

   CRYPTO / RESEARCH
     mostly no certs -- portfolio, CVEs, CTF results, publications,
     conference talks are the currency.

Advice: if you're job-hunting entry-level, Security+ or CC clears filters; then one practical cert in your chosen track (PNPT/OSCP/BSCP/BTL/cloud specialty). Skip collecting certs for their own sake. A public portfolio — the projects from Part 12, blog posts, CTF profiles, OSS contributions — often outweighs another acronym.

Staying current (signal, not noise)

   FOUNDATIONS DON'T CHANGE FAST. The Top 10 classes, crypto primitives,
   TLS/SSH, auth, network attacks -- stable for years. Don't chase every
   headline.

   WORTH FOLLOWING:
     - Your dependencies' security advisories + a CVE feed scoped to your
       stack (GitHub Advisory DB, OSV, distro security lists).
     - 2-4 high-signal blogs: Project Zero, Trail of Bits, PortSwigger
       Research, tl;dr sec (newsletter), Google/Cloudflare/AWS security
       blogs, Krebs (industry), Schneier (policy/broad).
     - One newsletter: "tl;dr sec" or "Risky Business" (podcast).
     - Primary sources when something big lands: the actual advisory,
       RFC, or NIST doc -- not the third-hand summary.
     - One conference's talks per year (real-world track): DEF CON,
       Black Hat, OWASP Global AppSec, USENIX Security/Enigma, fwd:cloudsec,
       BSides (local + free).
     - Standards you touch: watch the relevant IETF WG, NIST project, or
       CA/Browser Forum for changes (e.g. cert lifetime shrinking, PQC).

   CADENCE: ~30 min/week skimming feeds; deep-dive only what affects you
   or genuinely interests you. Quarterly, re-read one chapter of this
   guide's further-reading list.

A closing note

You started at "what is a byte" and finished by threat-modeling a system, running a PKI, hardening a host, breaking and fixing an app, and planning a post-quantum migration. That's the real job: not memorising attacks, but being able to reason from fundamentals — where is the trust boundary, what crosses it, what happens when this fails — and to build, test, and explain the controls.

Keep a lab. Read primary sources. Break your own things before someone else does. Write down what you learn. And use it to defend, and to help others — the whole point of Chapter 0.6.