Practical security learning: Participation in CTFs, security research, open-source contributions, or labs such as PortSwigger Web Security Academy, picoCTF, or Hack The Box. Own a scoped security engineering project, from understanding the problem and exploring approaches to building, testing, and documenting the solution, with guidance from a senior engineer.