Ask HN: Starting a career in security at 40?

I made the switch from web development to security a few years ago and initially took a 10-15% pay cut. I didn't get any certs and wouldn't necessarily recommend them. Instead, I joined various bug bounty programs to get practical (and resume-lite) experience.

Having implementation experience (via webdev) in addition to the bug bounty experience was a plus when I was interviewing.

If you're in a tech hub like SF or NYC there is plenty of security work. But, yeah, I would expect some kind of a paycut since you are moving from a (potentially) senior position to an entrylevel position.

I get the sense the biggest obstacle to your career pivot may be the circumstances of a typical 40 year-old. You probably have bills to pay and a lot of responsibilities that consume your non-work time.

The transition to the roles you've mentioned may require a significant period of unpaid, expensive self re-training, and if you want that re-training to end any time soon, you will want to spend a lot of hours on it. Can you handle those two things?

Here's an interesting tale of someone younger than us who took a path into security from zero.[0]

[0] http://blog.mallardlabs.com/zero-to-oscp-in-292-days-or-how-...

You don't give enough information, "security" is meaningless as a solo term. You need to go into specifics at to what exactly you see yourself doing.

If we are talking threat intelligence/analytics then I would say that you're taking on a huge gambit that will most probably not pay off. These jobs will be amongst the first that will go away / automated and do not require deep skills. Certifications are a complete waste of money.

The jobs in security that have a future and pay well are research-related: vulnerability research, reverse-engineering, exploit development, toolset r&d. Certifications are (again) entirely useless. All you gotta do is prove that you have the skills necessary, which take years to acquire and even more years to master.

Personally, I would say don't bother. You are too old and too far behind.

    I have always had an interest in security, especially the red/blue team side of things as well as the forensics area.

I think anyone that understands how computers and networks work can make a good security engineer. The mindset for breaking things can be taught.

It isn't too late to do something that interests you, it may be painful taking lower pay or having to learn something that isn't directly related to your job.

Try it as a hobby first, attend some security related conferences, like most industries the security folks are kind and happy to share knowledge.

I come from a similar background as you and I've done CISSP from (ISC)2. I always thought it would be useless as I thought that I can't learn new stuff because I am sysadmin/SRE/shitty dev.

What I observed from a sysadmin/SRE perspective vs pure security team is that we speak 2 different languages. We often clashed with them and it brought frustrations on both sides.

The material cover in CISSP is very broad and not deep. I've done it on my own and I saved $6K. The book costs 80$ and it takes 3 to 6 months to complete. The exam is a real bitch though! Be sure to be very prepared.

In the end, it's the best moved that I've done in my career and I can now speak with the Security mafia.

In order of appearance of '?', here are my responses

1. Market is pretty hot and you will be get multiple choices to pick from the available offers 2. Certifications have very little to do with the job (Full Disclosure - I am currently maintaining CISSP, CCSP, GWAPT, GMOB certs ) That being said, sometimes HR/recruiter use these for filtering candidates. You can look at security+ certification to get a feel. 3. It will make sense even if its not from SANS because people who have done SANS know that a) SANS is very expensive b) its an open bool exam 3) Does not involve hands-on. For that matter, if you will go after coveted OSCP, then people will understand that you have hands-on skills.

4. You should get equivalent or more pay because the market is hot. Most of the earlier security professionals came from SysAdmin/Dev background. You have a better understanding of how systems/apps, so it will be easier to break them or identify vulnerabilities.

There are several blogs (e.g. https://tisiphone.net/category/security-education/) available to find a learning path for security, so check them out. Self learning is the biggest skill that you will need.

PS - Started my career in Information Security 9 years back, right after coming out of school

First of all: what in particular do you find interesting of the security field? Are you more interesting in the offensive or defensive side?

I guess that given your background, the smoothest transition will be to something like application security engineer/devops security. There is a trend where companies are hiring developers who also know security, to be part of the dev team. So any bug that has an impact in security will be fixed by this role. Also, the new architectural landscape (cloud everything) is really changing the game, and having expertise in these solutions from a security perspective is a very valuable skill.

I don't know of particular certifications for application security or "DevSecOps" that will help you. I know that for example, in your situation; CISSP is not useful. CISSP jobs are mostly boring.

If you're interested in the offensive side, then the OSCP certification is a good bet; it shows that you understand and are able to execute a simple pentest. It is a well regarded certification and It will mostly make up for your lack of professional experience in the subject.

In conclusion, you're making good money right now; unless you're really bored and unchallenged, I'll start getting into security as a hobbie, and see how can you apply what you learn on your current job. Maybe you can even change roles where you're at. But try to use your current experience and give it a security twist, so you can then build on your experience instead of trying to make up for the lack of it with bogus certifications.

Security has a large number of unfilled positions currently:

https://cybersecurityventures.com/jobs/

https://www.forbes.com/sites/jeffkauflin/2017/03/16/the-fast...

https://www.ziprecruiter.com/blog/cybersecurity-jobs-are-sky...

and security jobs tend to be slightly higher paying than other IT positions. With some certifications and a few years of experience you have a good chance to be making a comparable salary to your current one.

SANS tends to be on the high end of cost for certifications. Look into the following organizations for more options:

ISACA

ISC2

EC-Council

A background in IT and Dev is highly valuable for Security jobs. You will find that many of your current skills are applicable.

Look at job postings in Indeed, LinkedIn, etc. job sites for roles that interest you and look at the certifications and experience they ask for. That will help guide your investigation into what you need to qualify.

(I have been working in the security industry for the past 10 years in various capacities, caveat emptor etc.)

It's a great time to be in security, definitely a job seeker's market. I've been in security for ~8 years now and don't have any certs and don't see a whole lot of value in them unless your employer/clients require them (some consultant or government shops do). I place a much higher value on knowing your stuff and being able to earn the respect of other engineering teams when helping them understand more secure ways to build what they're trying to build.

Some of the best security engineers I've known came from a network engineer or sysadmin background. So don't worry if you don't have a "masters in security". I'd spend some time thinking about the last large system you built. How would someone attack it? How would you detect those attacks? What would you do if they were successful? How could you have architected around those weaknesses? If doing that seems like fun, my team is hiring in Seattle, feel free to drop us a message at prodsec-recruiting@tableau.com

You're not likely to have much luck jumping straight into the R/B team pentesting or forensics world without either some practical experience or certification. With a firm tech background I can imagine you can re-train into a slightly lower position on the security totem pole pretty easily though. Certs can be a mixed bag - pretty much everyone knows they don't actually mean a whole hell of a lot other than a basic grasp of the concepts, but some places will still use them as HR filters. SANS exams can be helpful and are not particularly difficult, but as you said, are very expensive. I'm not really sure about current pay rates for sysadmin type work are, but I wouldn't expect that significant of a pay cut, if you encounter one at all.

Security as a field in general is definitely hiring, though. You'll almost certainly be able to get a job pretty much anywhere in a large variety of companies. For example, here in the Midwest there's a lot of health providers, insurance companies, and banks that have plenty of positions available at locally competitive rates (though bear in mind this exists outside the SV wage bubble) and they generally do not have any qualms about hiring older folks.

I was 36 when I got into security and have never looked back. The fastest, most lucrative route to security is through a role at a vendor. Start to get involved with security at your current job. Get to know the security team. Work on a project with them. Get to know the sales person from an up and coming vendor. Ask him/her abut an SE role. You can easily clear six figures.

My career arch is much like yours but at the same time I grew up wearing a greyhat much like how my beard is becoming: black then with time white was added. Most employers value security and actively encourage any efforts in increasing their security posture. Are there not efforts in your current career to "scratch the itch" so to speak? I would agree with many that certs are worthless unless you intend to work as a third party auditor but being able to "talk the talk and walk the walk" matters more.

The security market is insanely hot right now and will continue to thrive. From my perspective, we are reaching a point where security is seen as a commodity, not some optional process––everyone needs to know about security, even if they aren't working in the field. From a job perspective, schools are not able to keep up with the demand and even then, those leaving academics are not showing strong practical skills they can apply.

SysAdmin/SRE/Dev is the perfect sort of person to transition to security. You are going to think about how the system functions, what is running on top of it and how to ensure it stays online. When I interview candidates, I like see an alternative background as it means that person is going to bring a new perspective. "Security" as a job doesn't really make as much sense to me––you specialize in a given area (i.e. network background folks may maintain appliances, rule sets, detection signatures, etc.) and apply security to that area. I see your area as a means to solve a lot of security problems. Configurations, deployments, etc. can be checked in and accounted for with code instead of relying on people; there's massive power in that.

When it comes to certifications, I think there's two schools of thought. There's folks who look at the paperwork and make sure you can check the box, giving way too much value to certifications. For those who have been around a bit, they see the certification as practical, though no substitution for real-world experience. If you are being cost conscious, check out some of the free resources online for Network+[1] and Security+[2]. The important take away in those materials are not that you _need_ a certificate, but that you should understand the content and be confident in speaking out it.

If the red/blue side is more your style, I can't recommend enough to check out the Offense Security courses [3]. The tool set is free, the course is reasonably priced, it's a lot of fun and will give you real-world experience that is far more favorable than the standard certificates. Skip the whole CEH program as it has a poor reputation.

You mention six figures, but don't provide a scale, so it's hard to know how much a pay-cut you would potentially take. That said, security pays well and it's not uncommon to see salaries in the ranges of $100-200K even with less experience. All salaries are relative, but in general, a lot of my peers are not exceeding 200K on the base, though clear a lot more when factoring in other incentives like stock, or bonus.

Background: Been in security my whole career (started in networking and morphed into security) totaling close to 15 years. Like you, I have a set of skills outside of security (sys admin, networking, dev) and it's played in my favor a lot. Reach out to me direct if you have more questions!

[1] https://www.cybrary.it/course/comptia-network-plus/ [2] https://www.cybrary.it/course/comptia-security-plus/ [3] https://www.offensive-security.com/

The certification discussion usually raises hackles among security people. I've been in infosec for over 20 years, so take from this what you will.

Question is what kind of work you plan to do. If you are contracting, most public sector contracts are awarded on a points scoring system that gives points for certifications. Given the value of a given contract (e.g. say, ~$200k for a year) paying for a $5k-$10k option on all of them is a sound bet. Other things could tip a points scale, but this is the advantage is what you pay for.

From an economics standpoint, demonstrating differentiated skill is hard. In the jargon, it means signalling costs for competence in security are very high. Many people use papers, blogs, conference speaking, exploits, open source contributions, and media hits to differentiate themselves, and the work that goes into this is more than most normal people put into their careers. A certification doesn't get you the same thing, but it will level you up to a point where many customers/clients are indifferent to the extra value implied by other peoples high cost signals. Is it an honest signal of skill or technical capability? No, but it's sufficient for most procurement cases.

The market (and the ISC2) has tried (and largely succeeded in it) to make the CISSP a bar to entry. It sounds from the OPs post that he is an individual contributor (IC) (instead of a manager) who wants to get into security because it is an IC role with a better future for an older worker than devops.

Realistically, a Masters in information security (distance education on this galore) is sufficient for a drop-in director of security role, as the role is mainly about navigating a large organization and buying technical talent as-needed. I would say having serious technical chops will differentiate you among security pros, where the market has become flooded with non-technical audit and governance people whose role is as an organizational gatekeeper.

Some amazing technical security pros will scoff at this, but what most people don't get is there is a point of diminishing marginal return on technical skill, where the only people who can even begin to appreciate your skills need to be at least half way there, and coincidentally, employers can't tell the difference, and they are a lot cheaper than you are.

The professionalization of the field has meant a new class of administrators will just buy tech expertise when they need it, and operate largely by trading on their political veto (the black box of risk) in their respective organizations.

If you are a technical IC who wants to rebrand as a security technical IC, it's interesting and challenging work with a great culture around it. However, be aware that given the expense and demand of it, the market is being flooded, and my recommendation would be that the longer term game would be to use it as a lever into a general management (or at least SE) role, one that you can still find work in when you are 50.

In answer to your final question, get education that is portable that you can leverage into that general management role. So again, Masters of infosec will set you up for a role you can do when you are 50, whereas technical courses only have about a 5-8 year value horizon.

- Do the Matasano security challenges - Talk to tptacek (tqbf on twitter): they almost certainly have pointers and opinions

I write resumes and consult to job seekers on search strategy topics. I've worked with several clients this year who have transitioned from more traditional IT/admin roles into security - for experienced pros I'd say that IT/admin types are the most common background (as opposed to software dev) for those seeking to enter infosec.

The value of certs depends a bit on the cert, and to be honest I don't typically see the SANS certs. CISSP is much more common, Certified Ethical Hacker is also pretty common, and Comp TIA Security + is one that most junior level IT folks start with (in my experience).

Saying you make 6 figures without saying where you live makes it pretty tough to figure out what you might make in your market. 100K is a ton of money in some areas and peanuts in others.

get your CISSP, it cost $700 to take the exam... and you can command 100K with your background. I didn't even have my CISSP and started off at 75K. Granted I have 20 years in programming, DBA, Network Administration and System Administration. You'll do just fine.

I will tell you one thing... security is pretty boring if you are a person that likes to be in the trenches. It's more of a manager role (they even tell you to think like a manager when getting your CISSP). Your role is to identify a problem, document the solution and then audit the outcome. You don't ever fix or correct problems.

Find complements to what you do now that are security related and move from there. If you do devops and SRE, you’re a practitioner in security.

To the right organization, someone with your operational and Dev background is super useful. Many security orgs came from a policy background and have challenges because they lack experienced operations or dev focused people.

Make sure that you understand what you want to do. Map your experience to the appropriate security lingo. Understand the core concepts in NIST 800-53

A lot of the material you’ll find on the web about the industry is consulting focused.

Background in infrastructure is the best you can have - you will be far ahead compared to many newly educated ‘security engineers’, knowing the application domain.

What I would think about if I were you (was so 15 years ago - started as systems engineer in telco, although has been playing around with systems since childhood) is to try and capitalize on knowledge you’ve got - pick entrypoint to secuirty market as ‘security for X’, where X is the type of systems you’ve been administrating. This way, you’ll have a solid base of problem domain experience, and will be able to easily associate new learning material and new work challenges with experience you’ve already got.

Security is a huge domain of knowledge - being able to bite it with digestible chunks is crucial not to turn into another checklist drone or certified skript kiddie.

You'll do fine.

Don't waste time with certificates. They mean fuck all in the industry. Any job that cares about them is a job you don't want.

Try to get some clarity about what part of security you want to work in. All the subfields are open to you. Do you want to do operations work? Do you want to exercise your software development muscles? Do you want to work offense or defense? My advice might be different depending on the answers to those questions, but no matter what you want to do, you should be fine.

I started my career in security at 35, a few years ago.

I had a strong reverse engineering background from the software development projects I'd worked on professionally, and had dabbled in security-related things in my free time, so certifications weren't required.

It has been a pay increase rather than a pay cut, but I think that was partly due to moving location. I've had two jobs so far, and no shortage at all of offers when I was looking.

Having significant prior software development experience has been useful. About half of my work so far has been writing tools to assist vulnerability research, and the other half analyzing and discussing security bugs with the developers responsible for making the fix, so having this background has helped in both of these. But it depends what area of security you're aiming for.

I would say go for it, put your resume out there, if you've done anything at all even tangentially related to security in your working life then you have a good chance.

To be honest, I didn't think I had a chance compared to all the elite hackers and researchers who've been doing this sort of thing for years, and was surprised it all worked out.

Starting career X at age Y. In tech, answer is always yes. How bad do you want it?

40? By God, that's a young whippersnapper. I do remember starting to feel discrimination/agism around 42, and even considered leaving IT, knowing my age would only go up.

Go for it! The agism counter-wind is still weak at 40.

six figures at 40 is not a brag ...

do it. you have the right background and demand is off the charts.

don’t waste time with certs. do buy a CISSP book though to make sure you know what you need to know.

You could take a pay cut learn the business at another firm then start your own shop in two years, #win.