4 ms·

>Increasingly, if you want to be in infosec, you have to learn how to code on the level of a SWE I think this depends on what kind of infosec work you plan to

>Increasingly, if you want to be in infosec, you have to learn how to code on the level of a SWE I think this depends on what kind of infosec work you plan to be doing. I have been a security engineer for the past 4ish years, and while I do have some programming/scripting skills it certainly isn't at the level of a SWE. Most of the projects I work on I end up doing pentesting, risk assessments, remediation for compliance, assisting with policies/procedures, and/or security focused devops work. It would definitely be useful if I could program at the level of an SWE, and I do plan to continue to develop my skills, but I wouldn't say that to be in infosec you have to learn to code at the level of an SWE. I agree with all your other points

dogman144 7y ago
There's obviously a lot of mileage left still to be 'good at a scripting language' but not a SWE. Frankly I'm not there yet but getting there. I see getting spun up to SWE-levels of programming as a mix of a intelligently defensive career move as shift-left becomes more of a thing in sec and SDN is "replacing" traditional networking, it gives you a ton of bona fides with devs as you can code your own solution or at least work 1-1 with a dev as a lot of problems originate in their area ("I'm asking you to do this work, but I'll do it with you all the way" counts for a lot), and then lastly ensures you can't get wool pulled over your eyes by devs/etc. Sec and Ops have always had a pretty common language, and for a really good reason. As everything gets so code-heavy (see: SREs in Ops land), seems like Sec and Dev need that meshing.