Ask HN: Switch from development to security?

[eftel]

Hi HN,

I’ve been working as a software developer for the last 10 years. Fullstack with a strong tendency to Python in the backend.

I’ve never really worked for a company as an employee. All I have done is working as a contractor/freelancer or for my own startups (with one semi successfull exit). Currently I’m working for a multi billion dollar company as a contractor, leading a small team of four people.

I love programming but I was always interested in the security kind of things (the startup was security related). Is there a good way to transition from software development to security? What are my chances on getting an employment in a large-ish organisation without real job expierence in security?

As a contractor, I’m currently making 120k EUR/year from Europe (100% remote). Is it realistic to find a remote position paying equally?

My current contract will probably run out in around 6 months. I’m currently trying to get a CompTIS Security+ certificate. Does that make sense or can I spend my time better doing something else?

[jpgvm]

Unless you want to recant to people the OWASP top 10 and generally be useless don't listen to anyone telling you that certs (especially CISSP) are useful for breaking into (hah) the security field.

Generally security has 2 major schools, offensive (red team) and defensive (blue team). To be good at the latter you first need to understand the former. This means what you should instead be doing is learning the basics of exploitation. OSCP that was mentioned here is excellent but it's also not easy to complete right out of the box, you will want to start with easier stuff and work your way up to it.

One thing worth noting though is that it can be hard to transition from a build to break mindset. Which might mean even after you learn some decent exploitation techniques, binary analysis etc, that you might be better off batting for the blue team. Blue team mostly revolves our mitigations and defense in depth, which is why it's crucial you know red team to start... you can't put walls in right place if you don't know where the enemy is coming from.

Of course this really depends on if you want to be a real security expert and be damn good at what you do or if you just want to get paid for being in "security". If the latter you can ignore everything I said and just get the certs and tell people they need to tick X checkboxes.

[amerkhalid]

> just get the certs and tell people they need to tick X checkboxes.

Sadly, this is the most common variety of security experts. Some of the security experts I have dealt with only know how to run a few tools to generate a pdf and would not even be able to explain things that their reports shows.

Seems like it is a low bar to become security expert but true security experts should be able to get really high salaries.

[MattPalmer1086]

I've heard good things about OSCP, although I haven't done it myself.

[strictnein]

There are some development jobs in security, which would obviously be an ideal position as you could leverage 100% of your skills. That's how I got my role. Some larger companies will have development teams that create tools for their security org.

Also, every security company out there - Mandiant, CrowdStrike, Kaspersky, etc hires developers all over the place. That would be a good spot to get a start.

Past that, there are a couple of possible options.

Larger companies will also have Threat Intel teams and those teams may work on custom solutions and require developers to help them with it. But it may be sort of tough to find a role without any security knowledge.

If you have a good amount of system admin knowledge, you could also look an Analyst role, and work as someone who responds to security alerts for an org. The problem is that you will likely take a pay cut for this type of role. The more senior level roles would probably pay you similar to what you're making now (I think), but that'll be 3-7 years of work.

[MattPalmer1086]

I made the transition from software to security over a decade ago.

I took the academic route, and did a Master's degree in Information Security. I tried to get more security experience in my work.

Wasn't a fast transition for me, but I was fascinated by the subject, and wanted to really study it.

There's other and probably faster routes, but it really depends what interests you. It's a broad subject.

Offensive security can be good to learn, maybe look at doing something like OSCP.

[pyuser583]

Are there any academic programs you recommend?

[gaspard234]

A bunch of great answers.

I've been in offensive security for ~10 years now and am a staff at one of these billion dollar SV tech companies now.

If you want to do pentesting (though i prefer the team offensive security) my advice is to learn the basics of web app security with something like portswigger's course https://portswigger.net/web-security.

Since most tech is really API's and web apps this course would be able to get you productive and probably a jr level skillset. OSCP is also good but I find network hacks are not as applicable today thanks to the cloud, though the thinking process and creative puzzle solving could be worth it.

I would particpate in as many CTF type challenges as possible (http://www.xssgame.com) then apply to jobs. Make it clear you are a junior but good at Burp and web testing.

Good luck!

[weitzj]

I would say that your mindset as a developer is a plus. You could start focusing on how to apply security knowledge on CI/CD pipelines which should be right now your daily business anyways (from a developer’s perspective). So how to make containers safe, dependencies always up to date. These are already hard problems to solve and your developers mindset and skill will help you: how to implement this stuff for yourself and also keeping a developer’s perspective in t CI/CD process.

Shift left on security. Make it a win-win situation for everybody

[jonnycomputer]

Answers might be more helpful if OP was a bit more specific on what they had in mind with "security", which is awfully broad.

[marcinzm]

Yeah. There's a very big difference between pen testing and coming up with SOC compliant processes.

[raesene9]

So it is possible to make the switch (IMO) but, in Europe, I think you may struggle to find a matching salary when starting out in security.

To give you some idea https://twitter.com/tazwake/status/1451702586348818435?s=20 is actually (IME) pretty close to UK Infosec salary ranges.

Past that, if you're still interested, I'd say you want to focus a bit on what sort of security work you want to do, there's a massive range, and the qualifications and experience vary.

With a dev. background, something like Appsec work is likely to be the closest, or maybe DevSecOps. The advantage of both those paths is that they kind of sit between development and security, so you can leverage your existing development experience, when looking at roles.

[ferdowsi]

Are there any possibilities for you to first work at a company doing full stack dev in a way that allows you to interact with security teams? Stuff like implementing the OWASP top ten? That was how I built up a skill set and knowledge base in security.

As with any lateral change you should consider if you'd really enjoy the change. Security is a very interesting landscape but it turned out I really enjoy having a more direct impact on product development so I haven't totally made the switch. But security experience has definitely made job searches easier, recruiters specifically target folks with product/security experience and there a lot of opportunities in the space.

[eftel]

That’s a good idea! Did you actively plan to change your path or was that something that just happened because it was interesting to you?

[mettamage]

Handy cert for pentesters is OSCP.

Train via hackthebox.eu

[WelcomeShorty]

Most comments seem to focus on active security testing. My experience is that this is just 20% of what companies call Security.

80% of the effort is compliance, regulations and getting "holes plugged".

For one to be successful in corporate security, you better be good at PowerPoint and selling ideas / wishes.

Currently my role is managing a bug bounty program for a largish company. Getting a service on-boarded (explaining the benefits and expectations) is 40% of the work, agreeing with the service owner on the CVSS scoring 10%, getting a service fix a finding about 20% and the rest of the work is the cool stuff (validating findings, communicating with the hackers & setting a bounty).

So my "advice" to you would be, figure out what exactly you want to do "in Security". If you like to get your feet wet in the technical space, sign up to a Bug Bounty program and start searching. If you want to be administratively involved, by all means apply for any of the "looking for security officer / manager" job offerings.

[mooreds]

My suggestion would be to move to something security adjacent that still uses your software skills.

Options:

   * devops (mentioned in other comments)
   * auth (lots of needs for crypto and other security knowledge)
   * cloud security (gobs and gobs of need for this)

You could do this by trying to transition internally, but that will be difficult because of your position as a contractor. You could try to get hired as a FTE by your current company.

Another option would be to seek out a security company that has dev needs. You could do this with a smaller company (like r2c), a medium size company (like snyk) or a large company with security needs (like github). At each of these companies, they'll probably want you full time.

I don't know about certs as a means for getting hired, but they certainly have helped me dive deeper into a topic (a forcing function, if you will). If you were into the cloud security option, for example, I'd probably get the AWS arch cert and then the security specialization.

HTH.

[keeeeeeeem]

I moved from fullstack development to pen testing. I don't have any certs, but I'm working towards one purely because clients prefer it.

Previously I had worked for a startup in the finance space and had increasingly been more involved in the security aspects of our development process. I was impelled to make the jump to security because I wanted to dive deep into the topic and I knew I wouldn't get the depth of knowledge from my SWE job.

The majority of people in security I come across have a surface level knowledge of many topics and depth in perhaps one topic, which will give you an advantage in your previous domain (i.e. web applications).

In my country, the pay for pentesters is lower than for developers by 10-15%. In my experience day rates for testers ranges from 800-1400 EUR.

[bawolff]

The easiest way to transition is to transfer internally in a company you already work for. However that doesn't seem like something available to you.

Try maybe looking for roles labelled "software security engineer" - those might be more likely to take a pure software background.

> I’m currently trying to get a CompTIS Security+ certificate.

Certs are not respected in the security industry, especially the easier ones like security+, to the point wherr its almost considered negative signal on a resume. Some of the harder ones like cssip are controversial in that it depends where you're applying whether or not its worth anything.

As a general rule, i would not bother with certs, but they can be useful as a general study guide sometimes, if you're not sure where to start.

[CodeGlitch]

> Certs are not respected in the security industry, especially the easier ones like security+

I'm a software engineer, but have no certs myself however I'm familiar with the security-related certs. I find it bizarre that an industry would find the certs useless, as certs at least give a baseline. You can give someone a bunch of tests at interview, but there's no way you can check someone's knowledge in just a few hours - unless your tests look something like the questions you'd be asked to gain a cert! I'm trying to get a Network+ cert, but it's taking me awhile due to the massive amount of stuff you have to learn...and Security+ is seen as the next cert after that. I've learnt a massive amount already, so cannot see why it would be useless or seen as a negative. It's almost like saying "nah we won't use this standard baseline, we'll be the judge!"

I wish the software dev industry would embrace certs a bit more. Hiring is basically a massive gamble. Recent example: chap I worked with who had been a programmer for decades...didn't know what Base64 was, and used globals a lot. This is basic stuff.

[chias]

We (Workiva) currently have an open rec looking specifically for people like you: engineers who are interested in pivoting into security. You're more experienced than the baseline that rec is designed for, but that's where negotiation comes into play :)

I hope you check us out: https://workiva.wd1.myworkdayjobs.com/en-US/careers/job/Ames...

If not with us us, then I have no doubt you'll find other companies looking for something similar. People in your shoes are in high demand.

[eftel]

That sounds super interesting! I’m still on a contract for at least 4 months. Is there a way to reach you? Mail?

[batch12]

There is a lot of talent missing in security. You are ahead of those that have no operational experience with your programming background. Check out the certs others mentioned. Also decide what you want to do (or start with) in security? Risk management, vulnerability management, incident response, pentester/red-teamer, social engineer, SOC, etc. Also realize that you may have to start at an entry level. Tier I/II SOC work, for example, would give you some experience to leverage for other roles.

[baby]

Recommended reading: https://securityhandbook.io/

[eb0la]

Since you know Python... what about Threat Hunting?

I work with a Data Scientist turned Threat Hunter (which means you model and find stuff using data gathered for security).

Warning: like most data science-related jobs this can be a "lonely" position. I mean, very little people will understand you and your job but will buy the results.

[samstave]

CISSP.

A buddy of mine is KILLING it in security - and he got a 30% raise and a $100,000 sign on bonus from his new gig plus a $40K sales bonus less than six months after joining.

But you have to actually need to be interested in security to succeed.

[akerl_]

Any company that values certs in InfoSec is not a company you want to work for. There are specific government roles that require certs, and thus there exist good companies that make a token nod to paying for their folks to get certified, but the CISSP isn’t going to teach useful skills and any company that says otherwise is a huge red flag.

Best route depends on what band of security you want to get into. Pentesting? Building systems? Incident response? It’s a big field. But essentially, would recommend getting your hands dirty, go poke at some bug bounty programs to get your feet wet. That’ll help you narrow down what you want to do and get a sense of what attacks look like in the modern era, which are the 2 really useful outcomes.

[giantg2]

I second the cissp cert. Seems to be more prevalent or sought after than security+. I think GSEC is another cert, or group of certs, that I hear about more than security+ too.

I don't know about the money part. The $120k EUR salary already sounds high to me, and this $100k bonus stuff sounds very high to me also. Maybe these are outliers. The median for an infosec analyst seems to be $103k vs $110k for devs in the US.

https://www.bls.gov/ooh/computer-and-information-technology/...

It's also possible that I'm a jaded pessimist since I'll never make that sort of big money.

[eftel]

Reading about CISSP, this is listed as a requirement: - Possess a minimum of five years of direct full-time security work experience in two or more of the (ISC)² information security domains (CBK).

Looks more like an intermediate/senior level kind of certificate?

[strictnein]

You'll also learn about fencing requirements and where fire extinguishers should go.

CISSP is not a cert to get as an entry point into the field.

[raesene9]

CISSP shouldn't be an entry level cert. Something like SSCP or CSSLP might fit better here.

[MattPalmer1086]

You need 4 or 5 years experience in a few CISSP domains before you can get it.

So not a great one to pursue at first.

[nemexis]

how do you even make 120k per year? what kind of software are you developing? what country are you based in exactly? how did you find your clients? sorry for asking so many questions, but I found it difficult to charge such a rate.

[eftel]

I’m based in Germany. Currently building a webservice with lots of different integrations, mostly Python. We basically build the whole thing, choosing our own stack. On my day-to-day I work on developing the platform but also on integration and lots of management to bring multiple parties on the same page.

I’m charging 100 EUR per hour which seems in line with what others with the same amount of expierence are charging. The client I’m currently working for contacted me through a freelancer platform here in Germany.

With me, there are three other devs working on the platform. I was their “first hire”, leading the team. Other team members charge a bit less at around 75 EUR per hour.

[sshine]

This is a bit of a tangent, and salary is often discussed on HN.

Companies whose software is important enough will gladly pay that.

There are two ways to get to a significantly higher salary; one is finding out what people who earn more do better than you, and do that, and the other is boldly asking for more. You can do either one or both. I've always felt better having some reason why I should have more. (Also, I always earned $93k-105k. I once had the option to earn $144k doing Drupal, and another time $122k at close to zero tax doing Blockchain, but my biggest career mistake so far was taking a job just for the pay raise.)