This is a question more about how the market is for a software engineer with a focus on application and information security, mainly development and software engineering, either of secure practices while developing apps/systems, or of actual security software development (either tools or cryptographic implementations). I've spent some time in this field for the past couple of years, and was wondering about how my future would look like, in it.
One concern of mine is that most of the time spent working in this field seems to be focused on properly using secure libraries/apis and managing/configuring systems, and very little time spent on actual developing custom security protocols using security primitives (crypto libraries/implementation, etc). Most of the time developing custom flows is heavily discouraged, for very good reasons. Unless you're experienced enough, and even then it's a matter of not having enough eyes on your implementations. And I'm not even going to mention implementing crypto libraries which is a huge other can of worms.
But ultimately I see that in order to be fully invested in this field (as an implementer, and not a simple consumer of implementations) you need to be very experienced, but everywhere you hear don't get experience in production systems as it's too risky (as I said, for very good and understandable reasons). So, I'm considering what paths of activity are there in this field. It is really that most of the activity comes down to keeping up to date with best practices and making sure to use proper implementations/configurations)
And the only chance to work as an actual implementer is either in academic circles, and maybe your work will get enough recognition and be reviewed enough that it starts to get acceptation. Or working for really big software companies that truly invest in researching security design and implementations.
So, after this long pre-amble, my question: is it true that most of the time spent in software development with a focus on security comes down to consuming security libraries/implementations, and configuring the use of those. With far less focus on implementing security flows or security primitives? And if you want to focus on actual development, your best chances are either in academia or large companies that are actually invested in research and development.