If you aren’t already doing so, I’d recommend lurking on NANAE (news.admin.net-abuse.email), also news.admin.net-abuse.sightings. You’ll probably be able to find a few white-hat folks to network with, perhaps offer to volunteer to help crunch/gather data or maybe offer to monitor a trap mailbox or two.
There’s a lot of good exposure to the “industry” just parsing the headers of your spam and reporting it to all of the various networks implicated in the sending. Using a site like Sam Spade.org, (or the handy hardwired linux commands: host, whois, traceroute, etc) you can start sniffing into the sites that are advertised in your spam, assumedly collecting responses or banner-ad clicks produced by spam. The same approach can be used for combing through your firewall logs, sorting out the logs of network unfriendly traffic, and reporting it all to the network(s) of origin.
Pour over any responses and feedback that you get from your reports. Crawl through whatever sites they recommend or refer you to.
You might find it interesting to volunteer to admin or mod at some of your favorite online haunts. You will inevitably have something messy and “investigatable” drop into your lap. The other important skill you’ll pick up is being able to navigate a conversation with your average woefully ignorant complaining party. They’ll either want to talk your ear off, or chew you a new asshole, and all you really want to get from them is a “brief summary” and perhaps some logs for evidence.
The people I work with come from an endless variety of backgrounds, most of them not from the traditional “IT” or “Security” realms, though certainly some are. The common denominator is a willingness/eagerness to squint through thousands of lines of headers or logs, dig, do research, whatever it takes to understand the motivations of both the perps and the victims of each network unfriendly incident that you come in contact with…always trying to think of ways to lock down the exploits as they’re discovered.
We’re all basically playing chess with the perps, a never ending game of moves and counter-moves.
My background is Zoology. I’ve never taken any sort of IT classes or training. I hold no certifications. Some people who I work with every day have that background, but we all manage to collaborate and feed off of eachother just fine.
