I went the software developer -> security route, so maybe I can weigh in a little. Security takes a different mind-set in some ways; not incompatible, but not

I went the software developer -> security route, so maybe I can weigh in a little. Security takes a different mind-set in some ways; not incompatible, but not necessarily there to start with. I've always been interested in how things fail, and with what might happen when it does. Many school-mates going through CS were interested in how to build things, so their goal was achieved if things were constructed and seemed to run well. Edge cases might seem then to resemble the background noise when talking about big-O issues in an algorithm. In reality though, small gaps might lead to larger consequences. In that way, I think security might more closely resemble QA, except that the consequences of failure have more interesting implications. To that end, how can you incorporate security analysis into the software development work you do today? For me, it was a matter of trying to help secure our own product; from there I could bounce to some level of consulting.