[sam0x17]

I'm just saying that from experience, I highly doubt there is an infosec job where you have less free time than the average coder. If you have time for deep thinking about problems, you have the kind of time I'm talking about that is super rare _on average_ in the industry.

[Godel_unicode]

> ...I highly doubt there is an infosec job where...

I understood your point, you're just incorrect. Different people are different, which was my point.

Now that we have that out of the way, I have to ask; are you ok? You seem really invested in this idea that programming is some kind of exhausting, herculean endeavor and that anyone who is a real coder must be exhausted at the end of a day of coding. That is not normal. If you don't enjoy your job I strongly recommend that you look around. Programming is a super valuable skill and I'm sure you can find a job that's more inline with your life.

[sam0x17]

I'm more speaking for the average junior dev -- I part-time as a mentor for a coding bootcamp and get to interview thousands of 1st year junior devs on a yearly basis, and the burnout rate is incredible. Contrast that with my time working in infosec, where I had 20-30 hours a week of free time in which to work on random side projects, play call of duty with my boss (literally), etc., while we wait for X thing to be approved or wait for an incident to occur (which might take a whole quarter). When I did the same for the DoD, things were amusingly both less lax and slower.

Now as a CTO at a YC startup, I've created an environment where devs have good work/life balance, time off is encouraged, engineering has significant say and sway on product decisions, etc., but this is by no means the industry norm.

On the infosec side, the industry norm seems to be infosec is largely consolidating as the industry switches to outsourcing everything to public clouds (read: disappearing), and what remains is pretty relaxed unless you are chasing bounties all day, which is typically a self-driven situation. Penetration tests for example seem to have longer timelines these days even though most of the tools are now automated (our startup just went through SOC-2, and I can tell you from the server logs almost all the checks on our staging server happened in the last 72 hours of the evaluation period). My assumption is for the other 26 days of the evaluation they are indeed playing call of duty, and so it goes for the whole infosec industry.