Programming in the Security Field?

Question

Is there such a market for programmers who are interested in security (exploits, antivirus, firewalls, etc)? Reason I ask is that I really love software development and I am also interested in security. I'm wondering if I can have a career in this field.

If there is such a market, what kinds of concepts and topics should I learn? Any particular languages or operating system? I know some basic networking concepts, C, Unix..

Answer 1

Computer Associates, Symantec, Microsoft, MITRE, RSA Security, Network Intelligence, ESET, Veracode, Rapid7, Sourcefire and there are many more companies than I could think of that are concerned with this field.

I worked for a pretty well-known security company and interviewed for an experimental security developer position at a government-funded research organization (but chose instead to do military software instead).

When I first started, I really didn't know anything. I had my degree in CS and started in a security company, where I learned all the stuff like XSS, XSRFs, vulnerabilities, secure programming, some exploitation stuff like code injection, stack smashing, etc.

What knowledge companies might expect you to bring to the table really depends. An understanding of networking and networking protocols is important if you want to work in stuff like exploiting systems or network intrusion. Knowledge of vulnerabilities and threat vectors is good. It's really a pretty broad field, as then you can get into stuff like behavioral analysis and heuristics to determine if someone is really attempting to break into a system.

For example, take a look at a job posting on Rapid7 (they bought Metasploit): http://www.rapid7.com/careers/metasploit-exploit-eng.jsp

Here's one from Veracode: http://www.veracode.com/careers/index.html

When I worked in the security industry, I was one of the only big Linux/Unix experts in the company (out of hundreds of devs and QA). But having experience with Unix-y systems would be good as well. You want exposure to different platforms.

Answer 2

Of course. There are plenty of security products on the market and these are (largely) written by professional software engineers.

A computer science degree is probably a good entry point into this market. I say this as I started my career as a (then) recent graduate at an anti-virus software company.

Good luck!

Answer 3

For sure, it's a very specialized field though (kind of like the video game industry). But definitely best to learn C, Linux, Operating Systems, Networking, Exploits, for that stuff. Linux rules when it comes to security/networking tools. So best use that. Also, you can get more input about this from hacker circles.