I want to be a security researcher, but I can't find a fixed set of syllabus or sets of skills you need to know before hand in order to be called a security researcher.
It's very unambiguous, Is it that you have to a very good coder so you can write very complex algorithms or is it that you need to know a good amount of Assembly language or you need to know how to debug a kernel ?
If you want to become an Independent Security Researcher, you can. You can start now. Don't get hung up on whether or not you have the skills for it, just DO IT! The best time to plant a tree was 20 years ago. The second best time is now.
You have plenty of time to learn, and you will learn a lot in your journey.
I want to be a security researcher, but I can't find a fixed set of syllabus or sets of skills you need to know before hand in order to be called a security researcher.
Like Schroeder says, once you've found something, you can start calling yourself an Independent Security Researcher. I'll take that a step further: once you get started, you are one. Whether or not you'd be successful, and whether or not you get paid for it, are both entirely different subjects.
It's very unambiguous, Is it that you have to a very good coder so you can write very complex algorithms or is it that you need to know a good amount of Assembly language or you need to know how to debug a kernel ?
Did you know a lot of Information Security experts are non-technical? No, really. This field is huge. You don't need to be overly technical, depending on what you want to work with.
Privacy & compliance is a huge field which doesn't require you to be technical. Even though people in this area aren't generally technical, I have tremendous respect for the individuals that I've worked with in this sub-specialty.
If you're a good coder, Application Security would be a good fit, as would creating security-based programs. There's a lot of other things you can do as well. This is one area of the field with many sub-specialties.
If you want to reverse engineer programs, do malware analysis, or search for vulnerabilities and then create PoCs, then assembly is very useful (as is any language you want to create the exploit in). This is one area with many sub-specialties.
Schroeder is right about there not being a "Full Stack Security Engineer." I say this despite dabbling in over 20 different sub-specialties in the Cyber Security "field."
I've got a lot of experience, but there's so much I don't know, and so much I'm lacking. There's no way in hell I'd try to sell myself as a Full Stack Security Engineer.
