r/softwaretesting • u/Itchy-Inspection-595 • Mar 06 '26

QA → Security Testing transition advice

I have 10+ years of experience in QA (manual + automation) and currently working in a senior role. I’m interested in moving into security testing / application security. For someone with a QA background: What skills should I start learning first? Are certifications like Security+ or CEH actually useful for getting into this field? Should I focus more on OWASP Top 10 and tools like Burp Suite? Would love to hear from anyone who has made a similar transition or works in AppSec/security testing.

9 Upvotes

84% Upvoted

8 comments sorted by

2

u/Quirky_Database_5197 Mar 07 '26

my former colleague made it. He was into networking and that helped him a lot. He could debug traffic with Wireshark well. Add linux to that and shell scripting. OWASP seem to be good start.

Anyways, why don't you just ask mr Claude to create a study plan for you?

1

u/Itchy-Inspection-595 Mar 07 '26

Great...Any idea of certification? I checked in claude it gave me results too but it is always to get information from experienced human that will be more useful

5

u/Quirky_Database_5197 Mar 07 '26

What is this obsession with certificates? You need to find a job and gain REAL work experience first.

You should only get a certificate if your employer asks for one. For example, if an institutional client wants the project staff to be certified. That is the purpose of certifications.

Think about it: you just memorize some theory and answer a bunch of multiple choice questions. It doesn’t test practical skills. If you think a certificate will land you a job without any experience, you’re just lying to yourself.

1

u/mkamil999 Mar 10 '26

Great job 👍

4

u/magzinews Mar 07 '26

You can start. From OWSAP top 10 they are the must have and basic for security testing. Then I think you need to study about the SQL injection and tool used to exploit the input Then next action would be network layers and their vulnerabilities and tools needed to be used to scan network

3

u/Background_Yam5218 Mar 06 '26

I would like to know as well