Some firms are very open to taking total noobs with promising intuitions and who can code well (you need to be able to code well for this). If you can go this w

Some firms are very open to taking total noobs with promising intuitions and who can code well (you need to be able to code well for this). If you can go this way, you should. Otherwise: 1. If you have found bug bounties consistently across the gamut of web application vulnerabilities, you're probably ready (you will have gaps - supplement with lots of theory). 2. If you can competently write a custom debugger and reverse engineer apps, you're ready. 3. If you would honestly call yourself an expert C/C++ programmer, you're ready. 4. If you actually completed the Matasano Crypto Challenges, you're ready. You are specifically not ready just because you got yourself a certification, especially if that certification is the CISSP. The CISSP is an HR drone criteria that has more relevance on a SaaS pricing table than it does in a real security firm. 'tptacek and 'patio11 are working on Starfighter, which will be of interest to you. Check it out.