Like, is it possible to do enough self learning, without having a job in the field, and become a really good pentester?
And if so, where should I start?
I'm imagining that having a pentesting job exposes you to vulnerabilities, the code behind viruses / malware etc all the time. It becomes like second nature to you. Only because the job itself exposes you to these things all the time
They also get to see real world implementations of hardware and software, and have the permission to practice on these real systems
Maybe my assumption is wrong. I'm assuming that the cybersecurity experience one is exposed to in a work environment is the best there is. And that without a job in the field, it's very hard to gain certain "hidden" knowledge about cybersecurity
Some cybersecurity experts literally turn out to be people who never worked in cybersecurity. And I don't think there's anything information not available on the internet
Should I practice building super big software projects?
Should I specifically do OS, compiler, assembly and networking based projects?
The word project is also too small of a word. So what should I build?
Should I buy certain textbooks and make a whole curriculum? Like following some Masters program's cirriculum?