Most security practitioners assume contributing to open source security projects requires being a recognized expert first. It does not. These communities need practitioners doing real work, and the path from first-time contributor to named contributor is far more accessible than most people believe.

This talk is a practical, beginner-friendly guide to making your first open source security contribution, drawn from the speaker's own path from zero contribution history to contributing across OWASP projects, the CycloneDX ecosystem, and a CISA federal publication within about 18 months.

It covers how to find a project that matches your actual expertise, what a good first contribution looks like (and what gets ignored), how the contribution ladder works from lurker to reviewer to named contributor, and how showing up consistently translates into real community standing. Attendees leave knowing the specific first step they can take this week.