Two collections, one publication. Career Perspectives for the people building careers. Hiring Perspectives for the people trying to fill roles. Each group leads with a verdict. The essays underneath show the working.
28 essays published, 11 in progress.
For a specific route, yes, and it's still one of the best bets going. For most people asking the question, no. Here's the tradeoff nobody selling either route wants to put this cleanly.
Certifications, roles, career change, and where the industry is heading. Written for the person trying to make the next move without burning eighteen months on the wrong one.
It will not get you a security job. It will get you past an HR filter. Those are different problems.
Yes, but only for a specific person at a specific moment. For everyone else it's 12–18 months optimising for the wrong thing.
The six-month silence after passing is the cert doing exactly what it's supposed to, on a slower clock than LinkedIn implies. Here's when 'nothing happened' is normal, and when it's the market telling you something useful.
Exam dumps aren't mainly an ethics problem. They're a signal erosion problem. And that hurts honest candidates too.
Most guides describe the job a SOC analyst wishes they had. Here's the one they actually do.
We're not blocking your project. We're the last function in the room, asked to underwrite promises we were never invited to help shape.
Career changers don't fail because they're too old. They fail because they try to compress a six-year arc into eighteen months, and quit when the compression doesn't hold.
Most career-change content is written for the spreadsheet stage, not the interview. The interview tests two things the advice never names, and that's where the plan tends to fail.
Why technical roles stay open, and what the market actually does behind the polite language of job specs. Same publication, same voice, different audience.
Part 2 of seven. The strongest IAM hires are sitting in platform, infra and identity-adjacent roles whose titles don't contain the word identity. Search by title and you miss them by design.
Part 3 of seven. Filtering for Terraform plus Argo plus Backstage plus a specific service mesh stops being a skills filter and becomes a brand filter. The candidates who pass the brand filter aren't always the ones who can build the platform.
Part 4 of seven. The title says architect. The responsibilities describe a head of function. Senior candidates read the gap from the JD and withdraw by round two, and the brief blames the market.
Part 5 of seven. Asking for three named SIEMs feels like a capability filter. It's actually a platform-tenure filter, and the engineers who think like detectors have gone deep on one platform, not wide across three.
Part 6 of seven. Some DevSecOps roles exist because no one will own the security debt. The hire is being asked to paper over an org-chart problem, and the strongest candidates can smell it in round one.
Part 7 of seven. The JD asks for a manager who's still hands-on at IC depth. Each half of the pool reads itself out, and the search ends up filtering for the candidate who's least sure which job they're doing.
If your current role won't let you touch the work you're trying to move into, stacking certs feels like the only lever. Past the second one, you stop buying progress and start buying the appearance of it.
Not because it's prestigious. Because it installs the operational instincts every later role quietly assumes you already have, and skipping it is what makes year two so painful.
"Cloud engineer" is not the entry-level job the bootcamps pretend. The role advertised under that title in 2026 is a mid-level infra engineer with cloud on top, and the cert-stack candidates aren't being rejected for missing a cert.
It isn't certs and it isn't labs. It's operational time on systems other people depend on. Until you've had that, you're stuck below a ceiling no exam or home lab can lift you over.
Less crowded than cloud or security, hiring at the junior level when most adjacent fields aren't, and the sleeper feeder route for the higher-paid disciplines five years later. Going out of fashion is precisely why it's a good bet.
Mostly judgment under uncertainty, with imperfect tools, on systems you don't fully own, while three people who shouldn't be in the call are in the call. That's the job. The training material describes a different one.
The offensive-first route is presented as a default and behaves like a low-probability bet. The pentesters doing work clients actually pay full rate for came up through defensive and infra. The detour is faster than the direct route.
Most career-change content assumes the move is correct and only argues about route. The assumption is wrong often enough to matter. Four situations where moving into tech in 2026 is the wrong call, three of which are common.
GRC is one of the best mid-to-late-career destinations in security and one of the worst early-career landings. The trap isn't the work. It's that GRC pulled too early severs you from the credibility GRC actually runs on, silently.
Taking an architect title at a firm that doesn't actually run architecture as a discipline is one of the cleanest-looking moves available and one of the hardest to undo. The pay rise is now. The empty CV is year nine.
The certs, the talks, the framework adoption everyone fussed over for six weeks. Most of it went flat. What compounded was operational scars, written documents, and a small number of strong relationships. The boring list.
The cyber or GRC cert changes your position in the hiring system, not your capability inside it. Filter-first, evaluate-later is how the market actually runs, and the candidates who understand that build different things in parallel.
The market that hired junior cloud engineers in 2019 doesn't exist. What replaced it, and the realistic path in.
GRC is one of the calmest, best-paid entries into security. It also quietly closes doors you may not realise you wanted open.
It isn't a rename. The hiring bar, day-to-day, and career ceiling are all different. Most candidates pick the wrong one.
Neither route is the actual differentiator. What matters is the thing both routes leave out.
Not via the cert stack the influencers sell. Five real patterns, ranked by how often they work.