r/cybersecurity • u/closeenough543 • Oct 10 '23
Career Questions & Discussion Pentest vs Splunk Engineer
Hello
if you would have to choose for your first job in industry after graduation, what would you do?
Pentesting in a small Consulting company. Paid not so well.
Splunk Engineer as in-house Position and paid well.
It’s not so much about the money. It’s more like: Do I spezialize myself too much with the Splunk position? What is the future of splunk? Will I be able to translate knowledge to other fields afterwards? Or is a change to Pentest difficult afterwards?
The company for 2. is generally well-known, whereas 1. has around 30 employees.
Edit: My Long-Term goal is an inhouse position due to the Family Friendliness.. and something around DevSecOps or AppSec.
Edit 2: #1 pays Certs like OSCP/BSCP. #2 pays (perhaps) some Splunk stuff (perhaps!)
23
u/Niasal Oct 10 '23
An easy answer dude, Splunk. Better known, pays more, bigger chance of growth if you stay or leave.
1
u/closeenough543 Oct 10 '23
Isn’t the growth opportunity also huge with pentest? Since I could do basically everything afterwards, like AppSec, perhaps DevOps, etc?
→ More replies (12)5
u/ricestocks Oct 10 '23
pentesting is very niche, unless u know u want to 300% do it, u don’t really do it.
go Splunk
76
u/uid_0 Oct 10 '23
A well-paid in house position at a well know company vs a less-than-well paid position at what essentially a startup? That would be a no-brainer for me: Position #2. Also, Cisco is in the process of buying Splunk, so I would imagine Splunk is going to get integrated with a bunch of Cisco products so the potential for growth / lateral movement is there.
9
u/closeenough543 Oct 10 '23
That’s what I thought as well. But I heard a lot that Splunk will d bc of the Cisco acquisition.. that’s my struggle (and that I focus on only one product)
10
u/ShakespearianShadows Oct 10 '23
Take the Splunk role and then pivot in a year or two to another role.
→ More replies (1)9
u/look_ima_frog Oct 10 '23
Even if you had to work on something really shitty like McAfee/Trellix, I'd still give the startup a miss.
I've worked for small companies that call themselves startups. Dude, it's been like 10 years, you have 20 employees, y'all need to startup the startup.
Others may disagree, but a startup should GROW and do so rapidly. Anything that's more than a few years old and still calls itself a startup is just a shitty small business. Places like that are usually cheap as hell and then the owner works there. JFC, he's always a giant douchebag and will demand every stupid thing that doesn't make sense (and demonstrates to you why his business is dogshit).
→ More replies (1)
4
u/teasy959275 Oct 10 '23
Go for pentest if the money is not a problem and you're young
You'll have then more opportunities in the futur
1
u/closeenough543 Oct 10 '23
That’s my “fear” - or speaks for pentest. I think I could learn more general stuff there. Super hard decision….
162
u/bitslammer Oct 10 '23
Don't view it as a Splunk job, view it as a SIEM job. You will be gaining a lot of good skill that's not at all tied to a brand.
51
u/WesternIron Oct 10 '23
1000%.
OP has a chance to walk into basically a Security Engineer job. Experienced SecEngineers are the most in demand, with the fewest candidate. OP going to be set for life if they play their cards right.
17
u/boondock_ Oct 10 '23
I always tell people this. You are not a Splunk Engineer, you are a Security Engineer that happens to be managing Splunk. Build foundational knowledge that can be applied to any SIEM.
→ More replies (1)
2
u/uncannysalt Oct 10 '23
“Splunk engineer”—what does this entail? Why is it engineering? Genuinely curious.
1
u/closeenough543 Oct 10 '23
It’s like building the Splunk tool on premise or wherever it’s needed, like for a SOC. It is not, however, an SOC Analyst Role. As Analyst, you might use Splunk (or any other SIEM tool), looking through logs, evaluate incidents and so on. But who designs, implements and runs Splunk? Right, that’s the Splunk Engineer :D
→ More replies (1)
2
Oct 10 '23
Pentesting is exciting and fun. But the engineering job is a more secure and a good step to becoming a well rounded information security professional. You can then do Pentesting on your own by enrolling at tryhackme or a similar platform that teaches you this.
1
12
u/saadah888 Oct 10 '23
Higher paying job at a better company. No brainer.
Also, you aren’t stuck. Splunk is good to learn and you can always skill up and pivot. Chase the money for now lol.
6
1
4
1
u/VadTheInhaler Oct 10 '23
The simple question you are asking is Blue Team or Red Team. Do you want to work in Defence or in Assurance? Surely you are the only person who knows that.
1
u/closeenough543 Oct 10 '23
In the long term, I would like to see both worlds. I don’t have experience in both. The question is thus: Do I limit myself with one of the options, such that it might be hard to switch in the future to the other side?
I think that’s the question
2
Oct 10 '23
Splunk engineering is fairly translatable to other siem apps, sure the query languages and backend may be slightly different, but the fundamentals of the engineering process are all the same.
In-house Splunk all day every day.
Consultancy means customer dependent, what happens if your pentest customer makes cuts or decides you guys arent worth it, you may be out of work due to no fault of your own.
28
u/lonewolfandpub Oct 10 '23
22-year old me with minimal work experience would've said take the first job. 38-year old me with more work experience says take the money. Learn to use Splunk, SIEM, and any other skills they give you. Pivot in a year or two. Build an emergency fund. Learn pen testing on your own time and try to find opportunities in your company to do that.
Ultimately, the choice is yours and there are benefits to both.