I find that talking to folks in the trenches is incredibly useful. If you’re already at a company that has a security team, or even a small company that has folks that deal with infra/app security and/or incidents, you can learn a boatload directly the practitioners on the line. Even better if there’s a chat room that you can be a fly on the wall in.<p>When I worked at Mashery (a SaaS API management company) we were the front end for the APIs of hundreds of companies around the world, handling billions of API calls for the likes of Comcast, Best Buy, Starbucks, Macy’s, etc. During my time there, I learned a god awful amount about ops, scaling, amd security, simply by sticking my head in whenever I detected chaos going down.<p>Some comments mentioned tools like Metasploit, or reading up on the OWASP 10. Yup and yup. Plus, there are other tools to add to your belt that I find indispensable: Charles Proxy (install a MITM to watch web traffic), nmap (discover all the services running on a network)