Computer related fields are a constantly changing tech stack. People either are constantly growing in their career, or they are falling out of date. That long in the field should either be extremely comfortable, issue with the individual, or lack of drive to be constantly challenged.

The hardest part is the first job. After that should be constant career growth. This observation is only for the US job market.

Let me introduce you to: https://reddthat.com/c/dog_doesnt_eat !dog_doesnt_eat@reddthat.com

There are literally hundreds to thousands. Many of them are horded by governments, APTs, and pen testers. I personally abused a 10 year old CVE for pen tests that was known to be used by non US government entities for a zero click code execution on opening a word doc.

Then there are things that are vulnerabilities but cannot be fixed as they are intensic to how Windows functions. Some can be hardened from the defaults but break compatibility and some cannot be fixed without a complete rewrite of how Windows and AD work. Disa stigs will give you defaults that can be hardened. Requirements for all domain users to see all GPOs, users, groups in order for AD to work is an example of something that cannot be fixed without a complete rewrite. That means an in privileged user can get a list of all users, all domain administrator, names of all computers on the domain, etc. As an attacker, that is invaluable.

Short answer, that list is to big and changes constantly. None that would be comprehensive, but disa stigs is a good place to start.

If you think anything on the Internet can ever be forgotten... Your going to have a bad time. Passwords, one of the most protected data types, are compiled from beaches into huge databases so that hackers can use them to try to log into website. There are literally dozens of not hundreds of those password databases on the public Internet to be downloaded, not to mention private or dark web collections. If passwords are not safe, what makes you think publicly available social media would be any different?

Even if somehow the whole federation agreed to purge all post every year, things like the Internet archive and Google cache of pages would retain the data.

As an offensive security worker.... I can't help but read people listing out their attack surface 😂

Bonuses are discretionary. Stock is questionable, especially if it is not immediately 100 percent vested, 401k tells me they are completely out of money and can't / won't source additional funding.

In tech, you should always be looking at the next job, even if you are comfortable where you are. Loving what you do, who you work with, work life balance can all offset certain amounts of money, but knowledge and experience is either always growing or growing stale. I'm guessing at early 30s, you are not in an exec position and changing companies with lead to faster career growth than sticking around for the company to turn around it's books and promote you.