Career Advice: Navigating Low-Level Security vs. Market Realities
Hello! I am a second-year computer engineering student with two years left until graduation, and I feel quite lost and frustrated about my situation.
I started out in penetration testing and web security and spent some time doing bug bounty hunting (which I wasn't very good at). Along the way, I fell in love with binary exploitation, reverse engineering, and low-level programming. I've completed about 80% of the Yellow Belt on pwn.college.
However, whenever I work on pwn.college or study low-level concepts, I am reminded that the local market in my country has virtually no pure Vulnerability Research (VR) jobs—mostly just pentesting and a few red teaming roles. This makes me frustrated, as I feel like I might be wasting time on a domain that won't give me a quick return.
I'm considering pivoting back to pentesting to focus on Active Directory (AD) and web application security, but I really don't want to abandon a field I genuinely enjoy.
If you have experienced a similar dilemma, I would appreciate your advice on how to balance these interests over my remaining two years of university. Also, if there is a hybrid field that connects these two areas, please let me know!