Hi all, I am sure this question goes around a lot (I’ve seen it myself a couple times) but I was curious what people in the field have to say about this topic.

Currently I’m a Systems Engineer, we deal with network / Server administration (Firewalls, Wifi configuration, Cloud infrastructure, AD, File Servers, some web servers, etc.). I have a friend who’s a security engineer at Apple who thinks it makes the most sense to transition into whatever you have the most background in, which for me would obviously be either network or cloud.

Having read through this reddit as well as other Pentesting adjacent places, almost everyone says to go for web apps first. I am not sure whether I want to do full on pentesting in the future, my main goal is to transition into security. I absolutely love the act of pen testing, I think the one thing that makes me hesitant to want to do it is how hard it is to initially get into. My plan at this moment is to transition into some type of security role, and then determine whether I want to go for pentesting or another more senior security role after.

But my main purpose of this post was to get people’s opinions on whether I should focus on web apps first or net pentesting to start out with. I’ve read that its best to specialize in one area first and try to stand out from the rest of the crowd for the best chance at transitioning into the security field. Any opinions or suggestions are appreciated. Thanks for reading. !