The team at BugCrowd, a platform for bug bounty programs, has posted a series to help people interested in getting into the field. I would have to say, bug bounty is pretty lucrative when it comes to cybersecurity.
For example, if you find simple bugs in web applications you could be rewarded in the hundreds to thousands of dollars (depending on the type of vulnerability you found). You can even reach tens of thousands if you get RCEs (remote code execution).
The big $$$ are however when you find critical flaws and bugs in operating systems (someone said Microsoft?). If you're able to directly report the bug (to the OS providers), you could get hundreds of thousands and (yes) millions of dollars for kernel vulnerabilities).
Okay, but like anything else that pays big, it's actually quite complex and difficult to be good at this. It's not impossible, but it's difficult and it requires tremendous effort in code auditing, testing, pentesting, and all the related assessments.
Plus, if you're talking about system vulnerabilities you might need to be literate in more than one domains of security (including programming). No matter how hard it is or it may get, to me this is extremely attractive and engaging.
And what's even better is that today we have platforms like BugCrowd for bug bounties that create a legal and safe bridge for security researchers and pentesters to do their work. The video below is an example methodology that Jason Haddix suggests.
To stay in touch with me, follow @cristi
Cristi Vlad Self-Experimenter and Author