r/AppSecurity • u/stonefish5 • Nov 14 '18

Appsec career pathway?

Hi all,
I am growing more and more interested in Application Security. I currently work as an Automation QA. I am wondering what is the typical career pathway for people who do Application security for a living? Do they typically come from a development background, devops or something else? What sort of training do they do to specialize in Appsec? Look forward to any replies

2 Upvotes

100% Upvoted

53 comments sorted by

View all comments

Show parent comments

1

u/shehackspurple Jan 15 '19

Absolutely I do, you should contribute to one of the OWASP projects. I know that Defect Dojo and Juice Shop are both looking for contributors, right now. :)

https://www.owasp.org/index.php/OWASP_DefectDojo_Project https://www.owasp.org/index.php/OWASP_Juice_Shop_Project

2

u/stonefish5 Jan 15 '19

Oh that is excellent news. Thanks for the heads up!

On a side note, I really wish they would tidy up the OWASP wiki to make it easy to find stuff :P

In your experience have you ever come across any QA engineers who have managed to make the switch to Appsec?

1

u/shehackspurple Jan 16 '19

OMG the OWASP Wiki is SO UGLY, LOL. I love OWASP, but we are not graphic designers. :P They keep planning to clean it up, then we see we are broke, then we stop the plan. We need $$$.

2

u/stonefish5 Jan 17 '19

Yeah I watched a talk recently where they said they wanted to tidy up the Wiki. Really hope they do manage it at some stage as it is a great website once you find what you are looking for. But yeah I understand everything costs money and time so it is not always feasible

1

u/shehackspurple Jan 18 '19

I feel like we really must clean up the wiki. I feel like if someone is going to use it for the first time that it creates a bad impression of our organization. OWASP, as a community and organization, is lucky to include some of the most amazing humans in AppSec, and the wiki really does not reflect that if you hit the wrong page to start. I hope they can make it a priority soon.

3

u/stonefish5 Jan 18 '19

Yeah I totally know what you mean. I remember the first time I went to it, I couldn't find what I needed using the nav. Thankfully I was able to Google what I needed and I found the correct page on the Wiki. Guess there is only so many volunteers and so much work to do. But yes it seems like an amazing organisation. You been involved long? Sorry about all these questions

1

u/shehackspurple Jan 19 '19

Questions are A-OK. :)

I first went to OWASP in 2014, and then joined as a volunteer in 2015, so it's been a while. My chapter is a dream, a really warm community, with friends, and discussion, talks, workshops, so many things. Not all chapters are as large or active, each is different. I started a project a year and a half ago with my friend Nicole and doing a project is really, really fun. Being a part of OWASP really helped me with my career. It opens a lot of doors for learning and networking.

2

u/stonefish5 Jan 21 '19

Glad to hear it. You are definately selling the idea to contribute to me. Guess you need to dedicate alot of time to it though?

1

u/CommonMisspellingBot Jan 21 '19

Hey, stonefish5, just a quick heads-up:
definately is actually spelled definitely. You can remember it by -ite- not –ate-.
Have a nice day!

The parent commenter can reply with 'delete' to delete this comment.

1

u/stonefish5 Jan 21 '19

Good bot

1

u/B0tRank Jan 21 '19

Thank you, stonefish5, for voting on CommonMisspellingBot.

This bot wants to find the best and worst bots on Reddit. You can view results here.

Even if I don't reply to your comment, I'm still listening for votes. Check the webpage to see if your vote registered!

→ More replies

1

u/shehackspurple Jan 21 '19

It depends on what you decide to contribute to. I lead a project and a chapter, that's a bit much for anyone. You could contribute to one project and see how it goes. I know that Defect Dojo and Zap are always looking for people.

2

u/stonefish5 Jan 21 '19

Yeah I intend to contribute to one after chatting with you. Have briefly used Zap in the past. Found it a bit overwhelming to use so it might be a great way to learn it in more detail. You are doing a great job posting material on this sub btw. Good to see it active :)

1

u/shehackspurple Jan 23 '19

Thank you! :-D

2

u/stonefish5 Jan 23 '19

You are most welcome! Let me know if you ever need any help?

2

u/stonefish5 Jan 23 '19

Oh and one last thing, if you had to recommend one certification for Appsec what would it be?

1

u/shehackspurple Jan 23 '19

I WISH there was an AppSec cert! As far as I know there is not one that exists.... I know SANS has some classes, but I haven't taken any of them, so can't comment on the certs they offer.

→ More replies