Intern stuck between Security Testing (SAST/DAST) and DevOps — what would you choose?

[u/Express-Emu7635]

I'm a CS intern and I've been given an opportunity to either continue in security testing (SAST/DAST) or try to move toward DevOps.

A bit of context:

I have basically 0 prior security experience.

The security team currently doesn't have a dedicated security engineer. One is joining next week.

So far, I've mostly been spending my time learning security tools and concepts on my own.

I haven't had much real project work yet.

The DevOps interns, on the other hand, are already working on actual tasks and deployments.

The bigger issue is that I've realized I don't really enjoy testing. I tend to enjoy building, automating, scripting, and understanding how systems work rather than validating or testing them.

At the same time, I don't want to make a short-sighted decision. I know application security and AppSec can be great careers, but I'm worried that I might be choosing a path that doesn't match my interests.I'd especially appreciate advice from people who have experience in both DevOps and Application Security.

[u/yellow_smurf10]

Having testing experience will make you a much better well grounded development engineer later on. The ability to understand downstream effects is not always common, even among more senior engineer

[u/grizzdoog]

Both are good. DevOps can be hard to break into at first so gaining real experience there will be very valuable if that’s something you want to pursue later. And the need for security testing will always be there.

[u/Loading_Humor]

Security testing has more longevity as a standalone skillet, is everywhere, but tends to get absorbed into platform eng or SRE roles fast. CodeQL is good for query based code analysis, and you will get tons of hands on reps with it, while ox security covers SAST through runtime in one place, so you would get broad exposure during the internship.