You are still getting mixed advice here from learn to code to get OSCP.<p>There are two pathd, in the US that is: get an IT job, certs and then entry level security or get a degree and then entry level security.<p>The ideal entry level security job is a SOC analyst where you learn incident handling and a breadth of security knowledge and hopefully get your company to sponsor SANS training or GIAC certs (only because they are expensive). I know people with OSCP who are smart and struggle with incident handling, malware analysis,etc..., I say that because as awesome as OSCP is unless you want to be a pentester only it only gives you bits and pieces of what you need to succeed outside of offensive work. Certs are great at getting you interviews but the rest (knowing your shit) is up to you.<p>If someone tells you to avoid certs, do yourself a favor and disregard everything they say. Certs don't prove anything other than demonstrate you are good enough to make it to a phone screen interview but that part is crucial. As far as training, SANS is the best to get you started, not finished. What I mean is your company (hopefully) pays a lot of money for the training not so you master stuff but so you know what to google for and then master stuff.<p>Usually after your entry level gig, that's when you specialize.<p>Even if you want to be a pentester, work in a SOC first so you understand how defenders work when you try to evade them later on!<p>That aside, outside of typical corporate arena there are other entry jobs where you get really good at coding and do appsec stuff (code review mostly I believe) where prior coding experience plus something like oscp helps.<p>There is also a ton of vendor babysitting (manage tools/appliances) , compliamce,vuln management,etc... but they are usually not entry level unless you have a good degree.<p>Everyone in security needs to know the basics like risk, impact, vulnerability and threat to start with. Moreover, you need to see what threat actors are doing and be familiar with their techniques no matter what you do. That's why I recommend your first gig to require incident handling.<p>Also, find a boring messy company to start with so you can leanrn stuff when they get pwned and probably wear many hats because they are too cheap to hire enough people but that means exposure for you lol.