Step 335. Fixing Your Career Direction — Choosing Your Path Among Security’s Branches

Level 4 — Professional | Difficulty ★★★☆☆ | Estimated time: 2 days (half a day of job-posting research + half a day of strength matching + 1 day for the roadmap document)

Prerequisites: Step 334’s consolidated portfolio — this chapter decides not where to submit it but which direction to polish it toward, so the weapon must be finished first. This is a theory-centered concept chapter.

• What you need: access to major job sites, a notes app or document editor, a Python environment (for the gap-analysis script), and Step 334’s portfolio. The gap-analysis script is a measured tool you run with your own self-assessment; job-posting quotations are screen examples.
• Caution: job postings change constantly — the sample postings in this chapter show the typical requirement structure, and filling the table with actual postings from the moment you research is the assignment.
• ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime.

"Information security professional" is not one job. Penetration testing, vulnerability research, bug bounty, incident response, security engineering — each branch has a different daily routine, different required competencies, and different pay and growth paths. Having walked 348 steps together, you now stand at the point where you must choose one of these branches.

But the answer to the choice is not out there. The activity you enjoyed most and did best across this journey is the answer. Today you derive that answer by procedure, not by feel — researching the job market’s demands, matching them against your strengths, setting first and second priorities, and fixing it all in a roadmap document. That is today’s work.

---

1. Learning Objectives

By the end of this chapter, you will be able to:

• Distinguish and explain four or more major security career branches by their daily routines and required competencies
• Collect 10 job postings and structure required skills and preferred qualifications into a table
• Extract your strengths through a completion retrospective and match them against role fit
• Set first/second-priority target roles and verify reality through practitioners’ writings
• Complete a career roadmap document (goal, gap, reinforcement plan, 1-year/3-year goals)

---

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

2-1. The Map of Branches — Same Security, Different Days

Let’s organize security’s major career branches into four. What matters is not the names but the daily routine — a career choice is not a title choice but a choice of the activity you’ll repeat every day.

Beyond this table there are malware analysts, security engineers (building defenses), security monitoring, and more. And branches are not walls — moving within the security industry is common, and one branch’s experience becomes another branch’s asset. This fact is the safety device that lowers today’s decision pressure.

2-2. How to Research — Postings Are a Database of Demand

The career decision’s first material is not imagination but job postings. A posting is a list of competencies a company will actually pay money for — a document that structures the market’s demand.

Three collection rules. ① Collect 10 — one or two carry that company’s special circumstances, and only by overlaying 10 does the "industry-wide common demand" emerge. ② Mix regions and organization types — domestic security firms, finance/IT corporate security teams, and overseas remote. ③ Transcribe only two fields per posting — required skills (qualifications) and preferred qualifications. Preferred is often de facto required, so distinguish the two but record both.

Posting-analysis table format (screen example):
| Posting | Role | Qualifications | Preferred | Distance from my skills |
| Co. A   | Pentester | 2 yrs web/mobile assessment, OSCP preferred | AD environment experience | AD is my gap |
| Co. B   | Vuln research | Fuzzing experience, C/C++ | CVE discovery track record | Fuzzing is my gap |
| ...     | ... | ... | ... | ... |

When 10 rows are filled, the last column’s pattern becomes visible — "the requirement I keep failing" is exactly your reinforcement plan’s list.

2-3. Strength Matching — The Completion Retrospective Produces the Answer

If postings are the market’s demand, the second material is your data. Not an abstract "what do I like," but answers pulled from the records of this journey.

Four retrospective questions. ① Which activity made me lose track of time? ② What did I solve faster than others? ③ What would I gladly do again? ④ On which axis is the evidence thickest in my portfolio (Step 334)? The overlap of these four answers is your strength, and the branch that strength points to is the first-priority candidate.

Here’s a matching example — "the intrusion machines were the most fun (pentesting)," "CVE analysis was enjoyable (research)," "competitions were great (both research and defense possible)," "bug bounty’s freedom was great (independent hunter)." Your journey contains activities matching every one of these sentences — finding which sentence is yours is today’s core work.

2-4. First/Second Priority and Reality Verification — Not a Lifetime Contract

Bring the decision down to two: first and second priority. First is "what overlaps most with who I am now"; second is "an adjacent branch whose competencies overlap the first’s." Why two: market volatility — hiring is a timing industry, so you pre-build a structure where the second priority’s door is open when the first’s is closed.

And before fixing, pass one round of reality verification. Find and read writings, interviews, and talks by practitioners of the target role — check whether that role’s day matches the posting’s wording, and whether the hardships they describe are a kind you can endure. The last filter that keeps "romance" out of your roadmap.

---

3. Follow Along

3-1. Collecting 10 Postings and Building the Table

Collect postings by 2-2’s rules. Search keywords are the branch names verbatim — "penetration tester," "pentest," "vulnerability research," "bug bounty," "incident response," "CERT," "security engineer."

Collection checklist (screen example):
[ ] 3+ postings from domestic security-specialist firms
[ ] 2+ postings from finance/enterprise security teams
[ ] 2+ postings from overseas/remote positions (LinkedIn, etc.)
[ ] 10 total — roles distributed across at least 3 branches
[ ] Each posting's qualifications and preferred items transcribed into the table

Caution: don’t be intimidated by postings’ "N years of experience." In the security industry, experience requirements are often wish lists, and the verifiable portfolio you built in Step 334 offsetting those requirements is this industry’s long-standing practice. Today’s task is not applying — it’s grasping the structure of demand.

3-2. Extracting Strengths — The Retrospective’s Four Questions

While the postings table fills, write answers to 2-3’s four questions. The answers’ material is records, not memory — the completion checklists you have ticked off so far, your blog Write-ups’ field distribution, and competition logs are your data that no company can use for you.

Strength-extraction worksheet (screen example):
Q1. Activity that made me lose track of time: heap-problem bootcamp —
    stayed up all night three times
Q2. What I was faster at than others: patch-diff analysis — always my
    assignment on the team
Q3. What I'd gladly do again: independent CVE analysis (Step 322 was the
    most enjoyable chapter)
Q4. Axis with thickest evidence: 2 analysis reports + 7 related Write-ups

→ Extracted strength sentence: "I enjoy analysis — especially digging
   into the causes of patches and vulnerabilities — the most, and my
   evidence is thickest there too."

The final strength sentence matters. "I like reversing" is a hobby confession; the sentence above is an input value for role selection. Both a verb (digging into) and evidence (thickest) must enter for the sentence to be complete.

3-3. The Gap-Analysis Script — Seeing Fit as Numbers

Pull per-branch common required skills from 3-1’s postings table, self-assess your competencies (0–3) from 3-2’s retrospective, and matching the two becomes simple arithmetic. Save as step335_gap.py — replace the example data with your own research results.

# step335_gap.py — job-posting required skills vs. my skills gap analyzer
# JOBS: required skills per role (fill in the frequency-sorted result of reading 10 postings)
# MINE: my self-assessed skill levels, 0 (no experience) to 3 (multiple real engagements)
JOBS = {
    "Pentesting/Penetration Tester": ["web attacks", "network intrusion", "AD environments", "report writing", "OSCP-grade lab experience"],
    "Vulnerability Researcher":      ["fuzzing", "reversing", "patch analysis", "CVE track record", "exploit writing"],
    "Bug Bounty Hunter":             ["web attacks", "automation scripting", "reproduction reports", "new-asset discovery", "English reporting"],
    "DFIR/Incident Response":        ["forensics", "malware analysis", "log analysis", "breach-scenario knowledge", "report writing"],
}
MINE = {"web attacks": 3, "network intrusion": 2, "AD environments": 1, "report writing": 3,
        "fuzzing": 1, "reversing": 2, "patch analysis": 3, "CVE track record": 2, "exploit writing": 2,
        "automation scripting": 3, "reproduction reports": 3, "new-asset discovery": 1, "English reporting": 1,
        "forensics": 1, "malware analysis": 0, "log analysis": 2, "breach-scenario knowledge": 2}

print("=== Career Gap Analysis (self-assessment 0–3, threshold 2+ = 'met') ===n")
results = []
for job, skills in JOBS.items():
    met = [s for s in skills if MINE.get(s, 0) >= 2]
    gap = [s for s in skills if MINE.get(s, 0) < 2]
    score = sum(MINE.get(s, 0) for s in skills) / (3 * len(skills)) * 100
    results.append((job, score, met, gap))
    print(f"[{job}] fit {score:.0f}%")
    print(f"   met: {', '.join(met) if met else '-'}")
    print(f"   gap: {', '.join(gap) if gap else '-'}")
    print()

best = max(results, key=lambda r: r[1])
second = sorted(results, key=lambda r: -r[1])[1]
print(f"First-priority candidate: {best[0]} ({best[1]:.0f}%) — {len(best[3])} gaps")
print(f"Second-priority candidate: {second[0]} ({second[1]:.0f}%) — {len(second[3])} gaps")
print("nNote: the score is a conversation starter for the beginning."
      " The final call is made by 'which activity was enjoyable.'")

Here’s the measured output from running it with the example data:

=== Career Gap Analysis (self-assessment 0–3, threshold 2+ = 'met') ===

[Pentesting/Penetration Tester] fit 60%
   met: web attacks, network intrusion, report writing
   gap: AD environments, OSCP-grade lab experience

[Vulnerability Researcher] fit 67%
   met: reversing, patch analysis, CVE track record, exploit writing
   gap: fuzzing

[Bug Bounty Hunter] fit 73%
   met: web attacks, automation scripting, reproduction reports
   gap: new-asset discovery, English reporting

[DFIR/Incident Response] fit 53%
   met: log analysis, breach-scenario knowledge, report writing
   gap: forensics, malware analysis

First-priority candidate: Bug Bounty Hunter (73%) — 2 gaps
Second-priority candidate: Vulnerability Researcher (67%) — 1 gap

Note: the score is a conversation starter for the beginning. The final call is made by 'which activity was enjoyable.'

How to read it: don’t take this output literally — the script’s last line is that warning. ① Fit is "current readiness," not preference. In the example, bug bounty ranks first at 73%, but if 3-2’s strength sentence is "analysis is fun," vulnerability researcher (67%, 1 gap) may be the better first priority — the score narrows the candidates; the retrospective chooses among them. ② The "gap" list is the roadmap’s material. The vulnerability researcher’s gap is just "fuzzing" — the moment the reinforcement plan lands on one concrete word. ③ DFIR at 53% is not "don’t do it" but "starting now means a large reinforcement load." Keep it as a later transition candidate.

3-4. Reality Verification — Reading Practitioners’ Writings

Once first and second candidates are set, find and read at least two writings each by practitioners of those roles. Where to look: security-conference talk videos, corporate tech blogs, practitioners’ personal blogs.

Three checkpoints while reading. ① The day’s composition — is their ordinary day the same as the role you imagined. ② The kind of hardship — overtime, on-call, report stress, research’s long dry spells — is that hardship a kind you can endure. ③ The entry path — is the actual route by which they got there copyable into your roadmap. The third is most practical — postings speak of "demands," but a practitioner’s path tells you about "passing."

3-5. The Career Roadmap Document — The Form of Fixing It

Fix the research, retrospective, and verification into a one-page document. The format has five fields.

■ Career roadmap (screen example)

Target role: 1st — vulnerability researcher / 2nd — pentesting
Grounds: strength sentence (joy of analysis + report evidence) +
gap analysis (researcher gap: 1)
Requirements match: met — reversing, patch analysis, CVE record /
gap — fuzzing
Reinforcement plan: intro fuzzing, 8 weeks (AFL++ tutorial → campaign on
open-source software → crash triage)
1-year goal: first CVE via fuzzing, apply to research positions
3-year goal: research-organization membership, 1 international-conference talk
Reality verification: summaries of 2 practitioner writings — (what I read
and learned)

The document’s completion criterion is not "no blank fields" but "is the reinforcement plan in a form that goes straight onto the calendar." "Study fuzzing" is not a plan; "8 weeks, tool names, deliverables" written down is a plan. This document runs in parallel with the next chapter’s competition preparation — career and competition are not rivals but two exits of the same skill.

---

4. Missions & Exercises

Mission — Complete the Career Roadmap Document

1. Collect 10 job postings by 3-1’s rules and complete the analysis table — roles must span at least 3 branches.
2. Write your strength sentence with 3-2’s four questions — in a form containing both verb and evidence.
3. Fill step335_gap.py‘s JOBS with the postings table’s common required skills, assess MINE from the retrospective, and run it.
4. Set first and second priorities and pass each through reality verification with 2 practitioner writings — if score and retrospective conflict, write the reason in a sentence.
5. Complete the roadmap document in 3-5’s five-field format — the reinforcement plan in a form with duration, tools, and deliverables.

Exercises

Exercise 1. Explain why the reason for collecting 10 job postings is "to extract industry-wide common demand" rather than "to choose companies to apply to," connecting it to small-sample distortion.

Exercise 2. Among strength extraction’s four questions, why must answers come from "records," not "memory"? Give one example of self-perception distortion.

Exercise 3. When the gap-analysis script’s top-fit role differs from the activity most enjoyed in the retrospective, by what criterion should the final first priority be set?

Exercise 4. Explain together the principle by which "career choice is not a lifetime contract" lowers decision pressure, and why first/second priorities must nevertheless be fixed now.

---

Answers & completion criteria · expand/collapse

5. Model Answers & Completion Criteria

Mission Model Answer

Check against these verification criteria.

1. Representativeness of the postings table: do the 10 span 3+ branches and 3+ organization types — no single-company bias.
2. Strength sentence form: does it contain both a verb (what you do) and evidence (thickness in the records) — a sentence ending in "I like it" is incomplete.
3. Gap-analysis connection: was the script’s JOBS actually extracted from the postings table, and does the output’s "gap" list continue into the roadmap’s reinforcement plan.
4. Existence of reality verification: are "the day’s composition" and "hardships" summarized from practitioner writings — a roadmap that copies only posting wording is unverified.
5. Reinforcement plan feasibility: does it have the three elements — duration, tools, deliverables — so it goes straight onto the calendar.

Exercise Answers

Answer 1. One or two postings reflect that company’s special circumstances — an urgent project, a team lead’s preference, the chance of a vacancy. A requirement like "Rust experience required" may be that team’s circumstance, not the industry’s demand. Overlaying 10 cancels this noise, leaving only requirements that recur across organizations — that is the industry-wide common demand, and the reinforcement plan’s targets must be exactly those recurring items. Planning from a small sample creates the error of mistaking someone else’s circumstances for your roadmap.

Answer 2. Because self-perception distorts with recency and emotion. The most common distortion is "remembering the hardest-fought activity as the most-loved activity" — an all-night problem is intense, so it’s easy to mistake it for loved, but records may refute it: that field’s retry count is low, meaning you were actually avoiding it. Records, by contrast — the checkbox distribution, the per-field Write-up counts, the competition logs’ role assignments — are emotion-free sums of accumulated behavior. What you love is proven not by declaration but by repetition, so the retrospective’s input values must be records.

Answer 3. The final criterion is the retrospective — "which activity was enjoyable." The fit score measures current readiness; readiness can be changed by a reinforcement plan, but preference cannot. The cost of choosing a lower-scoring role is a few months of reinforcement training; the cost of choosing an unenjoyable role is every day’s motivation — the former is recoverable, the latter is not. Still, the score has its job — selecting the second priority and estimating the reinforcement load. The retrospective sets the first priority; the score sets the second priority and the plan’s scale. That division of labor is this script’s correct use.

Answer 4. Movement within the security industry is common, and one branch’s competencies become another branch’s assets — a pentester’s experience serves a researcher and DFIR alike. So the first choice is setting a direction, not fixing a life, and this fact dissolves the paralysis of "what if I’m wrong?" Yet it must be fixed now because of the portfolio’s language — Step 334’s weapon becomes an application document only when polished in the target role’s language, and a reinforcement plan enters the calendar only with a goal. Diligence without direction scatters; diligence with direction compounds. Fixing it is a device for focus, not for permanence.

Completion Criteria Checklist

• [ ] I collected 10 job postings and completed the analysis table (qualifications, preferred, distance)
• [ ] I wrote a strength sentence (verb + evidence) through the four-question retrospective
• [ ] I ran step335_gap.py with my data and confirmed fit scores and gap lists
• [ ] I set first/second priorities and explained the score-vs-retrospective relationship in a sentence
• [ ] I read 2 practitioner writings per candidate and left reality-verification memos
• [ ] I completed the roadmap document’s five fields (goal, grounds, match, reinforcement, 1yr/3yr)
• [ ] The reinforcement plan is in an executable form with duration, tools, and deliverables

---

6. Common Pitfalls & Fixes

Wall 1. Every branch looks attractive and I can’t decide

Symptom: the more postings you read, the more attractive they all get, and the gap analysis comes out ambiguously similar.

Cause: a common and precise trap — the problem is usually not the options’ attractiveness but decision avoidance. Deciding creates things you give up, so not deciding is immediately comfortable.

Fix: use two devices. ① Recall that it’s not a lifetime contract — the first role is "what overlaps most with who you are now," and movement within the industry is common. ② Set a deadline — set the roadmap document’s writing deadline at 48 hours from now. An imperfect decision can be revised, but a postponed decision produces nothing. The cost of "I’ll decide later" is every day scattering without direction.

Wall 2. My self-assessment is all generous or all harsh

Symptom: MINE‘s scores are all 3s or all 1s, so no difference emerges between roles.

Cause: the self-assessment has no baseline — the definition of "can do" wobbles per item.

Fix: fix the baseline — 2 means "can reproduce alone and has evidence." Attachable Write-up/report/repo links mean 2 or more; having only read or followed along means 1. Step 334’s portfolio is exactly this baseline’s physical evidence — the single rule "no evidence means 1 or below" corrects generous assessment.

Wall 3. Every posting says "3+ years of experience" — there’s no door for newcomers

Symptom: required experience is all practitioner-level, so no posting looks applicable.

Cause: postings’ experience requirements are often wish lists, and a large share of entry-level hiring happens through rolling, referral, and internship routes rather than postings — reading only postings shows half the market.

Fix: widen the research scope — beyond postings, internship recruitment, whether companies run security seminars or bug bounty programs (a signal of whether the organization builds touchpoints with outside talent), and rolling-hiring information through the community connections made in Steps 331 and 333. Remember today’s task is not a posting to apply to right now but grasping the demand structure — where the door is, is a roadmap problem, not a premise of the analysis.

Wall 4. The practitioner writings contradict the postings — what do I trust?

Symptom: the posting said "research the latest techniques," but the practitioner’s day is reports and meetings.

Cause: both are true — postings write the ideal; practitioners write the everyday. This gap itself is precious information.

Fix: judge by the everyday. A job is not the ideal days but the repetition of an ordinary Tuesday. Is the ordinary day the practitioner describes endurable — that is reality verification’s only question. The bigger a role’s gap, the more practitioner writings to find for cross-checking, and record the gap’s content in the roadmap’s "reality verification" field — post-hiring shock mostly visits people whose this field was empty.

Wall 5. Family and people around me recommend "a stable path" — I’m wavering

Symptom: others’ worries about paths like bug bounty or research positions shake your decision.

Cause: a career decision has real life constraints (income stability, location, time) as actual variables — ignoring them is an error, and so is letting them be everything.

Fix: don’t hide constraints — write them into the roadmap: next to the "1-year goal" field, write "minimum living conditions." If bug bounty’s variable income falls short of the conditions, design first priority as a salaried research position with bug bounty as a parallel axis. Writing constraints into the document stops constraints from deciding in your place — choosing the best within conditions is different from letting conditions push you into choosing nothing.

---

7. Summary

Today’s Concepts

Today’s Tools & Commands

The Core Instinct

Career choice’s essence is not prophecy but design. Nobody knows which branch will be hot in 10 years — trying to guess the unknowable paralyzes the decision. Design is different: set the best direction from current data (postings and retrospective), put the reinforcement plan on the calendar, and pre-build a structure that pivots to the second priority when the market shifts. Today’s roadmap document is that structure.

And one more thing. This decision makes Step 334’s portfolio, for the first time, a weapon with direction. Until now it said "I am this kind of person"; from tomorrow it gets polished into "I am this prepared for this role." With direction fixed, we now move to the final stage that proves that direction — the championship challenge.

---

Once every box is checked, Step 335 is complete.