Journey to Becoming a Top Security Researcher

Ziga's journey from a novice to a top security researcher showcases the importance of self-assessment and continuous improvement.

### From Novice to Expert: Ziga's Journey in Security Research
* 👨 ‍💻 Ziga, currently ranked **number two** on Kan's leaderboard, shares his transformation from a beginner in cybersecurity to a **proficient security researcher** at Spearit.
* 📈 He recounts his early struggles, revealing that he initially performed poorly in competitions, such as earning **only $5 in his first contest** and ranking **over 100th**.
* 🔍 After acknowledging his shortcomings, Ziga developed a structured approach to improve his skills, focusing on **understanding the goals of protocols** and **visualizing their workflows**.
* 🛠 He highlights the significance of maintaining **good energy and focus**, advocating for proper **sleep, nutrition, and regular breaks** to enhance productivity during intense work sessions.
* 💡 Ziga emphasizes the importance of manual code reviews, encouraging participants to **explore unfamiliar code areas**, as they often contain **hidden vulnerabilities**.
* 📚 He created a knowledge base to document vulnerabilities and lessons learned from each competition, ensuring he **extracts maximum value from his experiences**.
* 🚀 By applying his new methodology, Ziga achieved **impressive rankings** in subsequent contests, including a **sixth and fifth place** in early 2024, demonstrating the **effectiveness of his approach**.
* 🌟 Ultimately, he advises aspiring security researchers to **enjoy their journey and find personal fulfillment in their work**, as **passion is crucial for long-term success** in the field.

The Security Researcher Journey with Zigtur | Cantina

Cantina

Ziga's Journey to Becoming a Security Researcher

Ziga, currently a security researcher at Spearit and an instructor at R Skills, shares his rapid rise to the number two spot on Kan's leaderboard.

His journey began with a non-technical cybersecurity education and an apprenticeship in securing embedded systems.

A pivotal project on post-quantum blockchain led him to the Solidity boot camp, where he gained the technical skills needed to excel in security research.

The Falcon algorithm, using lattices for cryptography, aims to secure transactions against quantum computers, but its larger signature size makes it impractical for production use.

The speaker's web3 security audit journey began with a $5 win in a competition, leading to a turning point after ranking 21st in a later contest.

Identifying reasons for their initial struggles, the speaker emphasizes the importance of understanding protocol goals, visualizing workflows, and identifying potential vulnerabilities for future success.

Key Workflows and Focus Strategies in Codebase Management

Identifying the five most important workflows in a codebase is crucial, as they often determine potential issues.

Maintaining good energy through sleep, diet, and physical activity enhances focus and productivity.

Deep work slots, note-taking, and tackling difficult code areas are essential strategies for finding bugs and improving understanding of the codebase.

The Importance of Manual Review in Bug Hunting

Manual review is crucial for identifying difficult bugs that can impact rankings, and it provides valuable knowledge about the code base.

The process involves a feedback loop, where documenting missed vulnerabilities and using a checklist can help reinforce learning and improve future audits.

Gaining experience from competitions is important, but understanding the root cause of missed issues and modifying work processes is key to extracting maximum value from that experience.

Gaining experience is crucial for auditing success, and developing a personal methodology is key.

Visualizing the code base helps identify potential issues, while deep focus is essential for finding bugs.

The approach to reviews differs from competitions, as collaboration with the team can provide clarification and support.

Integrating Drawing and Coding with VS Code

The speaker uses a VS Code extension to split the screen, allowing them to view drawings and code simultaneously.

They find competitions more appealing than reviews due to the transparent ranking system.

The speaker believes that while programming experience is helpful, anyone can learn to understand and break down code logic with enough focus and practice.

Creating your own process is key to personal growth and happiness, rather than relying on external factors.

Experience in Rust can be helpful, but Solana's unique data handling can be challenging.

Instead of reading solo reports, focusing on a contest and analyzing the results can provide valuable context and help identify missed issues.

The Importance of Intuition in Bug Hunting

Developing an attacker mindset and intuition is crucial for identifying potential vulnerabilities in protocols.

Performing multiple audits in parallel can be effective, as deep focus time is essential for finding bugs.

Enjoying the journey and finding passion in the work is important for long-term success in security research.