Sorry, I was a bit hyperbolic - let me clarify. I didn't mean that educational experience is a critical portion - more that working in the security field is a

Sorry, I was a bit hyperbolic - let me clarify. I didn't mean that educational experience is a critical portion - more that working in the security field is a lot more theoretical than most and requires a much higher investment of time to start to comprehend. People without degrees absolutely can be security experts, and people with degrees can be utterly clueless - but if you're working on a webapp and given a week to write a login system then it almost certainly will be vulnerable. So it's less specifically required that people have PhDs and more... this stuff takes time to fully understand, I know a lot of pitfalls on the topic but I wouldn't say I'm an expert - I just know enough to know that I don't know.