Career Advice, Honestly

About two years ago I started using AI for the technical parts of my work, not just as a chatbot, but in the real work (developing, hacking etc.) itself. I’ve been watching my pattern shift since then.

The most concrete change is that I stopped spending two days finding the right resources before I could begin learning anything new. Now it’s one prompt. I land at the deep end of a topic with the right answer and a pointer to the bits I should actually focus on. The pile of to-learn-skills and topics - VM escapes, kernel exploitation, harder browser internals, deeper reverse engineering - is gone. Not because I learned them. Because the friction of starting is gone.

That should feel good. And it does, on some days. On other days I catch myself thinking: if AI can take me to the deep end of any topic this fast, why do I need to be at the deep end at all? Why learn the niche skill when guiding the AI¹ to use the skill is faster and probably enough? The thing I used to defer, I can pick up in an evening. But the thing I used to be proud of knowing - is that still worth being proud of?

That is where the question I want to write about lives. It is not “is AI changing the work” - obviously it is. It is not “will jobs disappear” - I have no idea, and neither does anyone else who claims to. The question is: if you are a technical person planning to build skills over the next decade or two, what should you actually invest your time in?

What this is not

Before going further, worth saying directly: this is not the version of the post that argues AI is about to kill jobs. Organisations will keep growing. Companies will keep being driven by their business and their customers. They will keep incentivising the best performers the same way they always have - and not everyone is the best performer, which has also always been true.

The narrower question is about what organisations will value differently in the next few years because of AI, and what that means for the technical person trying to choose where to put their time. There is also a counter-scenario worth naming: if AI inference stays too expensive for sustained workloads, organisations may simply hire people back, and the transition becomes a much slower thing than anyone is currently selling. I do not know which scenario will become a reality. For now, both are worth holding.

Specialist or generalist no longer covers it

What people usually reach for is a niche specialist or a generalist. Be the person who knows kernel internals well, or be the person who can hold the whole system in their head without being too deep. AI changes that more than people admit. If AI does the kernel internals better than the specialist, the case for specialising collapses. If AI does the system-level architecture better than the architect, the case for being a generalist collapses too.

The escape hatch people reach for is the managerial or leadership route. Become a vision-holder, a product manager, an executive. But if AI is doing the technical work better than the architects, why would it be worse at the non-technical work? People management, leadership, product management - all of it has the same shape. If AI eats the technical layer, there is no reason to expect it spares the layer that sits on top of it.

So you are left with a question without a clean answer: what survives?

What I am actually focused on, and why

I do not fully know. I am focused on a particular shape of work for the next stretch - using AI well, understanding how AI systems actually work, and on the security side, learning how to break them. AI systems are already the surface that matters and the surface that is worth attacking.

The honest reason I am doing this is not “this is the durable skill of the future.” It is competitive velocity. If you are not using AI fluently and the person sitting next to you is, you lose. That is all. It does not mean AI fluency is a moat. In six months everyone has it. The reason to do it is that the alternative is falling behind, not that the skill itself is a long-term asset.

For the last six months, I am genuinely uncertain. I am reading Yudkowsky and Soares’s If Anyone Builds It, Everyone Dies against Scott Aaronson’s steadier reading of the same moment, and somewhere between the two I think we are heading somewhere none of us can usefully plan for. I cannot pick between that and the slower, less dramatic scenario I named earlier - where a lot of the loud confident calls about which skills matter end up looking silly in retrospect. Most people in the industry cannot pick either - they are just less willing to say so.

The visibility piece

One piece of this touches the corporate end of the security industry directly. In many corporate environments the path to visibility for technical leaders runs through making noise about half-understood problems and shallow work. People who do that get their share of recognition; people who solve problems quietly get told, implicitly or directly, to make more noise if they want to be incentivised the same way. The distinction that matters is between visibility from work that actually solves a problem and visibility for its own sake. They can look identical from outside, but the source is different, and the source is what travels with the person - the way half-knowledge politicians gain followers despite being weak on substance.

What changes with AI is the gap between performing competence and actually having it. If the work is increasingly being done by AI, the substance side becomes common and the performance side has nothing to hide behind. Will the noise-makers still be the right people to guide the AI? Or will they be the people guiding the people who guide it? I do not know. But it is the first time I have seen a real reason to think the entire game might just dissolve on its own.

Where you sit changes what this means

This means different things depending on where you are. Someone working in a large corporate environment reads it differently from someone at a startup or someone working independently. Someone fifteen years into their career, ten years from retirement, may not be bothered by any of it - the horizon is shorter than the transition we are talking about. Someone still in university or in their first year of work, who does not yet know what corner of the field to commit to, may find the same paragraph terrifying.

I expect this post to be perceived in conflicting ways, and that is the point - the conditions we are sitting with do not produce one answer, and the people pretending they do are not paying attention to whose situation they are reading from.

What I tell people when they ask

When someone asks what to learn for a security career - whether they are still in university, just starting their first role, or fifteen years in and trying to figure out what to pursue now to stay relevant - I would say roughly the same thing. Learn AI. Learn how it works. Learn how to use it deliberately, and on the security side, learn how to find vulnerabilities in AI systems while that is still a thing.

Beyond that I would be honest that I do not know, and that anyone telling you with confidence what survives a decade from now is either selling something or pretending. Most of us are pretending. The honest version of the career advice is that there isn’t one.