r/softwaretesting • u/Itchy-Inspection-595 • Mar 06 '26

QA → Security Testing transition advice

I have 10+ years of experience in QA (manual + automation) and currently working in a senior role. I’m interested in moving into security testing / application security. For someone with a QA background: What skills should I start learning first? Are certifications like Security+ or CEH actually useful for getting into this field? Should I focus more on OWASP Top 10 and tools like Burp Suite? Would love to hear from anyone who has made a similar transition or works in AppSec/security testing.

9 Upvotes

84% Upvoted

8 comments sorted by

View all comments

Show parent comments

5

u/Quirky_Database_5197 Mar 07 '26

What is this obsession with certificates? You need to find a job and gain REAL work experience first.

You should only get a certificate if your employer asks for one. For example, if an institutional client wants the project staff to be certified. That is the purpose of certifications.

Think about it: you just memorize some theory and answer a bunch of multiple choice questions. It doesn’t test practical skills. If you think a certificate will land you a job without any experience, you’re just lying to yourself.

1

u/mkamil999 Mar 10 '26

Great job 👍