So far it’s just been a lot of theory (books, man pages, reading PoC code and vulnerability disclosures, dusting off old texts on networking) and practice (CTFs, bug bounty, writing my own exploitable apps then fixing them after, trying out PoCs) since I want to hit a certain level of competence before applying for jobs.

I’ll be talking to contacts in cybersec and HR/recruitment departments in my area since the hiring filter is a bit of a concern. I’m used to going around HR, but not sure how that plays out in this industry. Despite doing front-end and full-stack development for every position I’ve had I do feel I need to groom my experience a bit to downplay my UX/UI contributions. Worst case is I get certs like the OSCP you’re getting to speed things up.