I am a software developer (mostly .NET and Python about 2-3 years exp.) looking to break into the Computer Security field. I have a GWAPT cert and will have both GSSP-NET and Network+ certs by the end of july. I am a member of OWASP and ISSA in order to network and keep up to date on various issues in the field (I attend the meetings and try to get involved). What can I do to help me get a job in the computer security field as a pen tester or security researcher or really anything that will get me started in that field?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
This is the career path I've just taken (or am in the middle of, really). As Guillaume says, the best start is to focus on security in your current work. This could mean at your current job, or it could mean taking a similar dev post where you have the chance to concentrate on security. What do I mean by 'concentrating' on security? If your dev team already follows a security development lifecycle, take on responsibility for some of the tasks as part of that SDL. If it doesn't, start introducing those tasks and leading adoption of an SDL. Where Guillaume and I differ is at step 2: I didn't get and still don't have a CISSP or any other industry cert, though I do have a postgraduate software engineering qualification that includes security content. That wasn't necessary to getting into software security though: the route I took was to go out and find developers and talk to them about security. This means conference talks, podcasts, blog posts...I even wrote a book. Pretty soon you get recognised as "the security guy" in your chosen field, and the work comes to you. I also disagree that you lose the ability to code. A lot of what I do now is programming: either implementing security controls for client products, writing tests to research platform security features or sample code to demonstrate security issues to fellow-developers. |
|||
|
|
I made the move about 6 years ago. In short :
I started to tackle all security related assignements in my development projects (I was team lead back then). I passed my CISSP certification and waited a few months. There was an opportunity where a security team needed someone with strong technical expertise, to balance a team where there were mostly networking experts or security policy experts. I went back to development for a whole year and let me warn you : it is a one way street. You will learn lost of new stuff, but you'll loose the ability to write code blind folded ;) |
|||||
|
|
My background was in IT - long term system and network administrator and I sort of fell into security through it taking more and more of my day job...but you can't count on that happening to you; I would add to @Guillaume's points with this: Networking - in the people sense - is key. Find your local chapter of OWASP, ISACA, ISSA, ISF depending on what your focus is, and join the mailing list, go to meetings...better yet, volunteer to host, sit on the committee, even present a talk (even as a newbie in the industry you will have your perspective on your areas of expertise) Get known - this will give you more opportunities. It's always a simple fact - you might be right for a role, but if people don't know you, you'll never know... As for certs, CISSP is useful, as is CISM - they both score very highly among recruiters (in fact you should have a look at this question on professional certifications) |
|||
|
