Advices on security career

The other day I recieved an email asking for advices on how to enter the ICT-security business from, to me, a complete stranger. I enjoy giving advices, and this person was very polite.

So I gave some thoughts:

First, consider your background, and your area of interest.

Say you have a programmer background, and like to continue, I would suggest secure programming, code auditing or even software architecture with focus on security.

If your background is within network and administration, then network security is a given. Also secure network architecture, network monitoring, and perhaps even security system administration might be your thing. Not to mention volnurability assessment and control.

If you are more into legal stuff, then compliance may be for you. And compliance is an area that seems to grow every year, with new regulations, standards and breeches arriving one after the other. The best (worst) is that noone can really tell when someone is compliant, the regulations are way too complex. Just consider the recent PCI breeches, where the companies where certified PCI complient!

These are only a few areas that pops into mind.

To get "in", I would suggest as a minimum a bachelor in computer science (whatever it is called in your country), and with focus on security. Adding a master wont hurt, especially if focused on your security area of interest. I would strongly suggest spending the recession on education if you can.

To get in to the industry, you may choose consulting (always openings for great ppl), locating a corporation that hires engineers, or find a vendor that need an addition to their sales team (sales is the ticket to vendors...).

Good luck! The time is rigth to move forward with your interest in security.

If not now - when?

---- edit: fixed the missing linebreaks ----