Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

Is there such a market for programmers who are interested in security (exploits, antivirus, firewalls, etc)? Reason I ask is that I really love software development and I am also interested in security. I'm wondering if I can have a career in this field.

If there is such a market, what kinds of concepts and topics should I learn? Any particular languages or operating system? I know some basic networking concepts, C, Unix..

share|improve this question

closed as off-topic by MichaelT, Robert Harvey, GlenH7, gnat, Bart van Ingen Schenau Nov 28 '13 at 11:20

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking career or education advice are off topic on Programmers. They are only meaningful to the asker and do not generate lasting value for the broader programming community. Furthermore, in most cases, any answer is going to be a subjective opinion that may not take into account all the nuances of a (your) particular circumstance." – MichaelT, GlenH7, gnat, Bart van Ingen Schenau
If this question can be reworded to fit the rules in the help center, please edit the question.

    
I believe companies such as Alwil, Symantec and McAfee might be interested in such people. –  Anto Mar 17 '11 at 19:23
    
Look at DoD companies or Government jobs too. –  Kenneth Mar 17 '11 at 19:43
    
The book Hacking: The Art of Exploitation is a good place to get started: en.wikipedia.org/wiki/… –  Joe Internet Mar 18 '11 at 1:00
add comment

3 Answers

Computer Associates, Symantec, Microsoft, MITRE, RSA Security, Network Intelligence, ESET, Veracode, Rapid7, Sourcefire and there are many more companies than I could think of that are concerned with this field.

I worked for a pretty well-known security company and interviewed for an experimental security developer position at a government-funded research organization (but chose instead to do military software instead).

When I first started, I really didn't know anything. I had my degree in CS and started in a security company, where I learned all the stuff like XSS, XSRFs, vulnerabilities, secure programming, some exploitation stuff like code injection, stack smashing, etc.

What knowledge companies might expect you to bring to the table really depends. An understanding of networking and networking protocols is important if you want to work in stuff like exploiting systems or network intrusion. Knowledge of vulnerabilities and threat vectors is good. It's really a pretty broad field, as then you can get into stuff like behavioral analysis and heuristics to determine if someone is really attempting to break into a system.

For example, take a look at a job posting on Rapid7 (they bought Metasploit): http://www.rapid7.com/careers/metasploit-exploit-eng.jsp

Here's one from Veracode: http://www.veracode.com/careers/index.html

When I worked in the security industry, I was one of the only big Linux/Unix experts in the company (out of hundreds of devs and QA). But having experience with Unix-y systems would be good as well. You want exposure to different platforms.

share|improve this answer
add comment

Of course. There are plenty of security products on the market and these are (largely) written by professional software engineers.

A computer science degree is probably a good entry point into this market. I say this as I started my career as a (then) recent graduate at an anti-virus software company.

Good luck!

share|improve this answer
    
I'd hope that security products would be written by professional teams. There's a lot of potential drastic mistakes that aren't obvious to the non-professional. –  David Thornley Mar 17 '11 at 21:26
add comment

For sure, it's a very specialized field though (kind of like the video game industry). But definitely best to learn C, Linux, Operating Systems, Networking, Exploits, for that stuff. Linux rules when it comes to security/networking tools. So best use that. Also, you can get more input about this from hacker circles.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.