Awesome-Red-Teaming VS awesome-appsec

Red Teaming

Red Teaming / pen testing -- set up a home lab. Find a resource on the internet about how to learn red teaming and dig in. Example: https://github.com/yeyintminthuhtut/Awesome-Red-Teaming

For software, pretty much everything you might need to start out is available as open source. Besides the actual testing stuff, don't forget to look at tools to facilitate collaboration + reporting (highly recommend looking at https://github.com/GhostManager/Ghostwriter). Also checkout: https://github.com/yeyintminthuhtut/Awesome-Red-Teaming

Pentesting is a tiny fraction of roles out of 10s of thousands and you're not likely to get an entry level gig on a red team but if you are interested in pen-testing check out https://jhalon.github.io/becoming-a-pentester/ and https://github.com/yeyintminthuhtut/Awesome-Red-Teaming

For resources : https://github.com/paragonie/awesome-appsec

AppSec

Here is a repo of some resources. You are going to need to learn to walk before you run so that at a concrete level you can articulate what secure vs insecure code is and why it matters, then dive into appsec. No disrespect intended but from the way this is written my suggestion would be to focus on computer science foundational concepts as well as spending significant time writing and reading code. This will likely be a several year journey if you are a total beginner but the best time to start is now :)

Come over to /r/devsecops to get more information about the field. Also, there are lots of good sources, you can get some from my blog, or Awesome AppSec, or Security Prince and other places.