The DefCamp 2026 speaker and OFFENSAI Director of R&D shares how to start in cybersecurity, get unstuck, and keep a life outside the keyboard.
Cybersecurity is a field defined by constant change. Learning never truly stops, and new challenges appear almost every day. As technology evolves, so do the tools and methods attackers use, which forces professionals to stay one step ahead at all times.
From the outside, the field can look like a string of visible wins and fast career growth. The reality behind becoming a cyber expert is more nuanced. It takes patience, continuous effort and the ability to adapt in a fast-paced, demanding environment.
At events like DefCamp, where security professionals share research and real-world experience, one thing becomes clear: building a career in cybersecurity is as much about mindset as it is about skills. The talks on stage show the results. The years of curiosity, persistence and trial and error behind them usually stay out of view.
That hidden side is what we wanted to explore with Eduard Agavriloae, who is no stranger to the DefCamp stage. A returning speaker, he presented on Track 1 last year to a nearly full room, and this year he comes back with one of the most technical sessions on the agenda.
Today, Eduard is Director of R&D at OFFENSAI, where he focuses on offensive cloud security research, especially in AWS. He has spoken at DEF CON, trains other security professionals and, according to his speaker bio, is a proud cat owner. His path started in 2017, when he was learning cybersecurity while working as a web developer, studying for a master’s degree and spending weekends on CTFs. He later joined KPMG Romania, and from there moved into original research and public speaking.
At DefCamp 2026, he will present “Paying the CAP Price: AuthN/AuthZ in the World’s Most Distributed Systems”, an expert-level session showing that deleting a cloud identity doesn’t revoke its access right away. On AWS, that window is about four seconds, which is long enough for an attacker to recreate the identity that was just deleted. Before he takes the stage, we wanted to meet the person behind the research and find out what it really takes to become a cyber expert, and how to keep a sustainable work-life balance in a field where no two days are the same.
If you could go back to 2017, when you were just starting to learn cybersecurity, what advice would you give your younger self?
Don't neglect life outside the computer. Doing a master's degree in cybersecurity while working as a web developer and playing CTFs on weekends left little room for a personal life. The hard work paid off in the end, but I'm sure I could have ended up in the same place doing less. Touch some grass, and maintain the personal relationships that matter.
For someone aged 16 to 20 who wants to get into cybersecurity but doesn’t know where to start, what path would you recommend?
Start with two or three "zero-to-hero" courses on platforms like Udemy, then learn by doing: CTFs, reading write-ups and completing rooms on TryHackMe. Anyone in cybersecurity should have a solid understanding of networking, basic security concepts like password management, basic web and network exploitation, and some idea of how to investigate an attack. Knowing both offense and defense makes a cybersecurity engineer stronger.
After that, pick a niche you like and go deep. In the beginning, my two areas were web and network exploitation, and that foundation helped me shift to other areas later.
How do you handle a problem that looks simple but ends up blocking you for days? What keeps you from giving up?
I take a break for a few days. Most of the time, being blocked means my approach isn't working. To see the problem from a new angle, I first need to move away from the original approach, and to do that I need to stop working on it.
Has a DefCamp speaker, workshop or piece of research influenced your career or changed the direction of your work?
Even before I became a penetration tester, I dreamed of doing research and presenting at conferences. Daniel Tomescu, a recurring DefCamp speaker and my former manager at KPMG Romania, inspired me to take the step and apply to speak at DefCamp. Watching recordings of him on stage sharing his insights was the biggest push to start my career as a researcher and public speaker. I'll always be grateful I got to work in his team.
You’ve attended DefCamp as a participant and now return as a speaker. How does your perspective change when you go from the audience to the stage?
It makes you respect both the participants and the speakers more. When you understand that people chose your talk out of three or four parallel tracks, you want to make sure you give them something worth their time.
Similarly, when you understand that research that took months to finish is presented by someone in a time slot of 30 minutes, you appreciate the effort behind it regardless of anything else. Being a speaker might mean different things to different people. I remember presenting on Track 1 last year with the room almost full and my wife and friends in the front rows. It's a form of appreciation for your work, and it's a wonderful feeling to get recognition for your efforts. For me, it's humbling and comes with responsibility.
Eduard’s tips for making it in cyber, in short:
- Don’t neglect life outside the computer. Protect the relationships that matter.
- Start with two or three beginner courses, then learn by doing: CTFs, write-ups, TryHackMe.
- Build the fundamentals: networking, security basics, web and network exploitation, and investigating attacks.
- Learn both offense and defense.
- Pick a niche you enjoy and go deep.
- When you’re stuck, step away for a few days and come back with a new approach.
- Find people whose work inspires you, and let them push you forward.
Eduard’s path shows that becoming a cyber expert is neither a straight line nor a sprint. It is built on solid fundamentals, curiosity, people who inspire you, and knowing when to step away from the keyboard.
The research he brings to DefCamp 2026 is the visible result. The habits behind it are something anyone can start building today.
See Eduard’s research live, meet the people behind the talks, and find the mentors and peers who might shape your own path. Whether you’re just starting out or already deep in the field, DefCamp is where the security community of Central and Eastern Europe meets in Bucharest.
Meet the interview author:
Mihai Șcheaua is a 19-year-old first-year student at the Faculty of Mathematics and Computer Science in Bucharest, originally from Slobozia, a small town in Romania. He loves volunteering, running, skydiving and, above all, traveling. Determined to take every chance life offers him, he lives by a simple motto: it may be hard, but diamonds are only made under pressure.