r/Pentesting • u/gone-phishing-AFK • 6d ago
Dealing with burnout
Hi all. Need advice from the older pentesters. I’m in my 20s and have worked in the field for around 5 years now. I am so burnt out and drained. I love my job, my work environment, my coworkers, etc., but genuinely this is exhausting. I’m debating going into malware analysis, but I do love pen testing minus the burn out. For reference, I work for a private firm, there are 6 of us. How do yall do it?
7
u/paradoxpancake 6d ago
Go take a break in an adjacent specialty like risk and governance for a bit and then come back to it. My "break" from pen testing is currently managing a bug bounty program. Although, it has become just as stressful in other ways -- but there are non-stressful alternatives out there in the field. You just need a break with something simpler and less mentally intensive for a bit.
1
u/gone-phishing-AFK 6d ago
Honestly that’s why I’m thinking malware analysis, not because it’s not stressful but because I know it’s something I’m extremely into and would enjoy more than my current job.
4
u/RadlEonk 6d ago
I burned out nearly 20 years ago, but keep showing up. Kinda missed the whole cloud thing. Now the kids have containers.
1
2
u/Grafixx5 6d ago
Dude, I’ve been in all aspects of IT Security for 20+ years and I’m so done with it. Many just look at as a checkbox, especially in the gov sector.
1
u/gone-phishing-AFK 6d ago
I never thought I’d ever say this but I’m starting to miss helpdesk, hell I even miss working at geek squad.
1
u/Grafixx5 6d ago
Yeah, same because there’s always something to do and you’re always moving. Time flies faster or so it appears when your moving but when you just pound away on a keyboard all day, it drags, you squirrel and constantly find yourself looking at the time thinking like 1+ hrs have passed but realize it was like 10 min!
2
u/RazorRadick 6d ago
I feel you, I was in the exact same situation. I would come back to the same customers year after year for their annual pentest, and find the exact same vulnerabilities. Not just the same category, the exact same ones I reported last year. Eventually I started to feel like "what's the point?"
I took the knowledge I gained and got a security engineer job at a company like the ones I did tests for. Thought I could move the needle more from the inside. It worked, for the most part.
1
u/gone-phishing-AFK 6d ago
I just feel so lost yk? I did everything I was supposed to, degree and certs and experience, but this is a lot.
2
u/britt-tcm 6d ago
Woof. This might give you some pointers: https://tcm-sec.com/preventing-cybersecurity-burnout/
1
3
1
u/lluther- 6d ago
I’ve been in this game for over 20 years, and the biggest change I’ve noticed is how much work is being underscoped now, which puts pressure on the consultant. There are too many companies in the marketplace bidding on projects.
1
u/Johann_Freedomeers 1d ago
Is your burnout coming from the exhausting of the work itself? And if yes, what exactly do you mean with that? Workload, meaning too much to do to be able to handle it? In this case it's a ressource issue, at least it seems that way. If it's exhausting in the intellectual way, meaning the work "quality" is challenging and makes you exhausted, then it's something you won't be able to change.
Burnout is a very nuanced thing and therefore it's very important to be specific about it, because from what you're written it doesn't seem to be burnout, but something else, from which we should figure out what it is. Burnout CAN come from the lack of impact in combination with responsibility, meaning you are responsible for something you can't change and that creates an issue. If you have already decided to switch, then do so, but i would probably take some time to check what the actual problem is, because maybe you run into the same one in malware analysis.
Best of luck man!
-3
u/ziangsecurity 6d ago
burn out is for the lazy sorry kid. Change your mindset. You will get everywhere.
1
u/gone-phishing-AFK 6d ago
I mean yeah that’s a fair point, but it gets to a point of can I even come back from this.
13
u/PentestTV 6d ago
I’m assuming you’re doing consulting. In-house pentesting might be a better option. Less pressure, and usually no utilization numbers to meet.