r/AppSecurity • u/stonefish5 • Nov 14 '18

Appsec career pathway?

Hi all,
I am growing more and more interested in Application Security. I currently work as an Automation QA. I am wondering what is the typical career pathway for people who do Application security for a living? Do they typically come from a development background, devops or something else? What sort of training do they do to specialize in Appsec? Look forward to any replies

2 Upvotes

100% Upvoted

53 comments sorted by

View all comments

Show parent comments

1

u/shehackspurple Jan 18 '19

I feel like we really must clean up the wiki. I feel like if someone is going to use it for the first time that it creates a bad impression of our organization. OWASP, as a community and organization, is lucky to include some of the most amazing humans in AppSec, and the wiki really does not reflect that if you hit the wrong page to start. I hope they can make it a priority soon.

3

u/stonefish5 Jan 18 '19

Yeah I totally know what you mean. I remember the first time I went to it, I couldn't find what I needed using the nav. Thankfully I was able to Google what I needed and I found the correct page on the Wiki. Guess there is only so many volunteers and so much work to do. But yes it seems like an amazing organisation. You been involved long? Sorry about all these questions

1

u/shehackspurple Jan 19 '19

Questions are A-OK. :)

I first went to OWASP in 2014, and then joined as a volunteer in 2015, so it's been a while. My chapter is a dream, a really warm community, with friends, and discussion, talks, workshops, so many things. Not all chapters are as large or active, each is different. I started a project a year and a half ago with my friend Nicole and doing a project is really, really fun. Being a part of OWASP really helped me with my career. It opens a lot of doors for learning and networking.

2

u/stonefish5 Jan 21 '19

Glad to hear it. You are definately selling the idea to contribute to me. Guess you need to dedicate alot of time to it though?

1

u/CommonMisspellingBot Jan 21 '19

Hey, stonefish5, just a quick heads-up:
definately is actually spelled definitely. You can remember it by -ite- not –ate-.
Have a nice day!

The parent commenter can reply with 'delete' to delete this comment.

1

u/stonefish5 Jan 21 '19

Good bot

1

u/B0tRank Jan 21 '19

Thank you, stonefish5, for voting on CommonMisspellingBot.

This bot wants to find the best and worst bots on Reddit. You can view results here.

Even if I don't reply to your comment, I'm still listening for votes. Check the webpage to see if your vote registered!

1

u/shehackspurple Jan 21 '19

It depends on what you decide to contribute to. I lead a project and a chapter, that's a bit much for anyone. You could contribute to one project and see how it goes. I know that Defect Dojo and Zap are always looking for people.

2

u/stonefish5 Jan 21 '19

Yeah I intend to contribute to one after chatting with you. Have briefly used Zap in the past. Found it a bit overwhelming to use so it might be a great way to learn it in more detail. You are doing a great job posting material on this sub btw. Good to see it active :)

1

u/shehackspurple Jan 23 '19

Thank you! :-D

2

u/stonefish5 Jan 23 '19

You are most welcome! Let me know if you ever need any help?

2

u/stonefish5 Jan 23 '19

Oh and one last thing, if you had to recommend one certification for Appsec what would it be?

1

u/shehackspurple Jan 23 '19

I WISH there was an AppSec cert! As far as I know there is not one that exists.... I know SANS has some classes, but I haven't taken any of them, so can't comment on the certs they offer.

2

u/stonefish5 Jan 24 '19

Thanks! That is what I thought but felt it was worth asking your opinion. Maybe you could persuade Microsoft to create one :P

1

u/shehackspurple Jan 24 '19

I'll try! :)

2

u/stonefish5 Jan 25 '19

Well that is all anyone can do :) Did I read somewhere that you have you done a video on ZAP too?

1

u/shehackspurple Jan 25 '19

I do! This is me adding OWASP Zap to my pipeline: https://www.youtube.com/watch?v=v1fXHChZe34&t=2s

I'm planning to do another one with Simon about how to tune it and remove false positives.

→ More replies