I have been honest on this blog about almost everything, so here is one more. I am not chasing security as a career anymore. Not because I fell out of love with it. The opposite, really. I am moving the paycheck somewhere else and letting security go back to being the thing I do because I want to, not because I need it to make rent.
Let me back up. Most of what I have written here is offensive security. Labs nobody can see, a port scanner I wrote to feel something, the haunted house of Active Directory, a chmod hook in NVIDIA’s toolkit that I read until it looked wrong. I meant every word of it and I still do. The problem was never the work. The problem was the gap between how much I love the work and how the job market actually pays for it.
The bug bounty math has not been kind. My last real find, that symlink issue in NVIDIA’s container toolkit, came back a duplicate. Real bug, confirmed by triage, zero dollars. That is the game and I am fine with it, but you cannot pay rent in confirmed-but-second.
So I made a call. I have been spending my mornings on something different lately: systems engineering in Rust, and most of it pointed at Web3. Not the coin flipping, get rich part. The protocol part. Smart contracts on the EVM, programs on Solana, the on chain code that holds other people’s money and cannot afford a single off by one. Under that, the layer it all rides on: memory you account for by hand, consensus algorithms, storage engines, the things that have to not fall over while everyone is watching. It is hard in a quiet way, and there is a real job market on the other side of it that does not ask me to win a lottery to get paid.
Here is the part I want to be clear about. This is not a breakup with security. Security comes with me, and Web3 is where it pays the most rent. Every habit I built, reading code until it looks wrong, distrusting input, assuming the attacker controls the thing you forgot about, all of that makes me a better protocol engineer, not a worse one. A reentrancy bug, a missing signer check, an integer that overflows right where the money sits, those are the same bugs I already hunt for fun, just wearing a different hat. The people who ship this code lose sleep over exactly the things I taught myself to find. Security is not the thing I am leaving. It is the edge I am bringing.
What changes is the label. Security stops being the career I am trying to force a door open on and goes back to being the hobby it was when I started. I will still read source on weekends. I will still file the bug when I find it. The next NVIDIA shaped thing that catches my eye, I will chase it and write it up here, and if it pays it pays, and if it is a dup that is fine, because I was not counting on it for groceries.
I think a lot of people in this field carry a quiet guilt about wanting a stable job, like wanting to get paid reliably means you were never serious about the craft. I do not buy that anymore. The craft is the hobby. The job is the job. Letting them be two different things is the most honest I have been with myself in a while.
So the blog shifts a little from here. Less “here is the exploit,” more “here is the system I am learning to build, and here is the security brain I cannot switch off while I build it.” Same person, reading the same kind of code, sitting down at the desk for a different reason.
On to the next thing. This one pays.