For a fresh graduate with quite a bit of development (mainly web) background - what is the easiest way to break into the security field?

Are certifications a necessity? Is it possible to get intern jobs doing this kind of stuff?


  • What's your degree?
    – nmichaels
    May 2, 2011 at 14:08
  • Senior at pretty well known school for Information Systems (BSIS)
    – user24325
    May 2, 2011 at 14:12
  • I would hope this is a full fledge university and not a technical college. If you have taken courses on security ( it doesn't sound like you have ) you will have a great deal work ahead of you.
    – Ramhound
    May 2, 2011 at 14:31
  • Its a full-fledged university, ever heard of Drexel ? I am going to take (2) classes my last quarter dealing with IT/IS security
    – user24325
    May 2, 2011 at 14:33
  • My understanding of BSIS is that it is a biz/CS hybrid. is that correct? if so, i think the lack of programming, math, and obviously security/networking courses could be tough to overcome May 2, 2011 at 14:43

1 Answer 1


When I did this, I did it by developing a web-based security related product. In my case, a CA (Certification Authority), but there's plenty of other options out there in security topics - web interfaces are used all over the place in device management, access control, log management, intrusion detection.

As a new grad, your best bet is likely to get hands on with the code, staring with technologies you already know and gradually learning areas of the system security stuff. If you want to bone up a little, look into security aspects of web development:

  • OWASP - has a great website
  • SSL understand the options for setting up SSL sessions
  • PKI - learn at least the basics, since this is a common mechanism for the higher end of SSL authentication
  • get familiar with some of the coding libraries that support this. They vary from language to language - for Java/JEE, I mean stuff like bouncy castle, NSS, the Java security packages. Also - not related strictly to Java - Open SSL.

I wouldn't recommend certifications right after getting your degree. Your skills are up to date, and as a new grad, you are (hopefully) the cheapest in salary that you will ever be -- which makes you seductive to companies with a lot of long term, expensive security engineers.

The certifications I know of in the industry are usually targeted to having a broad systems level knowledge and are based on the concept that the certificate holder already has a number of years of experience in the field. This is hard (if not impossible) to have going right after you graduate. The people I know pursuing certifications are all in the 5+ year range.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.