»

[rayt]

I am currently studying Computer Science in Switzerland. Before that I used to work as a C++/Windows developer for some small games company in Germany.

[Snoozy]

Am an Optometrist, consult both at Hospital and private practice

[Fats]

I am in the microelectronics world. Doing so called full custom chip design; current main task is designing radiation hardened SRAM blocks and a 'compiler' for it.

greets,
Staf.

[LoadWB]

Originally Posted by Duce

There's generally 2 guys that have no *******ed idea what they are doing, and they are generally your superiors. They will screw things up horribly in a fashion that a guy even with an A+ cert wouldn't have, and pin it on you - even after you stagger into the data center in the middle of the night to fix what they buggered up.

This is precisely why I work for myself.

[cv643d]

I am currently in SEO and WP-web development. Soon celebrating 10 years in the industry.

[Piru]

Originally Posted by esc

Hi Piru,

This is the type of job I'm trying to work my way into. Without hijacking the thread, do you have any pointers for someone interested in your field? I'm working on training and getting certifications now. I hope to go live this fall / winter as a consultant with the goal of quickly turning that into a real office with full time employees servicing a large metro area.

First of all, certification is of little use, unless if you work for specific fields (PCI QSA) and/or for customer that require it (government could require certs). Not only are the certification systems just cash machines for the companies running them, but the actual tests are a joke as well. Of course if you intend to compete for customers who require or prefer certified consultants that's something you will have to do.

As to actual training, well I have little to contribute here, as I myself had no official training in the field whatsoever. In fact, this is more of a norm than rule for anyone I know in the field. Most of them are self-taught hackers, and only very few have even completed their academic degrees (this isn't that unusual these days in general though).

While it probably won't be of much help, perhaps a story how I got involved in the security field in the first place could be an interesting to some.

In spring 2008 I read some bit of news regarding web security breaches. I got interested about the topic and read everything I could find. In less than 3 months I found over 400 vulnerabilities in various web sites, for instance: finnish govt, most finnish banks, most finnish telecom providers, most finnish media, finnish police, ny times, washingon post, FBI, CIA, several US govt websites (NASA, darpa, various military branches), Ebay, w3.org, Paypal, facebook etc. Looking back though, the manner I did it wasn't probably the best approach available. It did result in couple of high profile articles though (mainly about Paypal and CIA).

When I was recruited, several things of my background had been dug up: For example that I had done a lot of reverse engineering, and was writing my own operating system. Also, they knew about my quarrel with Telewell regarding GPL usage (it had required some nice reversing and hacking, which was all noted). Of course they had also noticed my "freelance work", but needless to say I wasn't "ready". What they looked for was someone who could learn the trade, not someone who was born as a super hacker. Once recruited it took several months to get anywhere near skilled enough to consider myself competent.

Of course the field is constantly evolving and changing, and you have to keep up. For instance I follow several security related mailing lists, and attend security conferences (for example t2, ph-neutral, blackhat).

There are ton of books that are relevant to the field, but perhaps the most famous and most commonly referred one is The Web Application Hacker's Handbook: http://www.amazon.com/The-Web-Applic.../dp/0470170778

I'd say it's a good read for anyone, even though you might not be interested about the field. I'd very much like every web developer to read it at least. ;-)

There's much more to the field than just web app security though. A good resource is for instance Center for Internet Security: http://www.cisecurity.org/. https://www.owasp.org/ has some good stuff as well, but the material is of varying quality. Much of it it really sh*tty to be honest.

Anyway, good luck and welcome. I hope maybe some of my message was at least in some way useful.

[LoadWB]

Originally Posted by Piru

First of all, certification is of little use, unless if you work for specific fields (PCI QSA) and/or for customer that require it (government could require certs). Not only are the certification systems just cash machines for the companies running them, but the actual tests are a joke as well. Of course if you intend to compete for customers who require or prefer certified consultants that's something you will have to do.

This is relevant to my degree.

[CSixx]

Android developer for a DoD organization.
http://www.t2health.org/

[persia]

IT Manager at a university....

[wiser3]

Computer programmer for a large global corporation. Although the general computer part is disappearing. All my projects tend to be web apps or web sites with the occasional spreadsheet thrown in.

[tone007]

Network administrator at a small IT company, been here since 1998, I guess they like me.

[Ilwrath]

Originally Posted by Haranguer

I work for HP. I'm a helpdesk operator - like I didn't already hate Windows enough lol.

Which desk are you at? There's a few people here, myself included, who have served time at HP and / or EDS.

I served on the ill-fated Dearborn, MI HP network team (mostly for Ford) and then for an even more ill-fated US government project before bailing from HP a couple days before I'd have been laid off at the end of that debacle.

Nowadays I'm a general IT guy for a privately owned manufacturing company. It's a huge wide array of stuff I do. I might be fighting with the AD or Exchange in the morning, replacing a motherboard in a giant stamping press in the afternoon, and then tweaking some firewall rules in the evening.

Originally Posted by Piru

First of all, certification is of little use, unless if you work for specific fields (PCI QSA) and/or for customer that require it (government could require certs). Not only are the certification systems just cash machines for the companies running them, but the actual tests are a joke as well. Of course if you intend to compete for customers who require or prefer certified consultants that's something you will have to do.

Yeah... The only real reason to get a cert is because your customer needs to mark that you have one in their checkbox sheet. I can verify that at least most areas of US Gov do require certs. (They have a 'pick one from this column, one from this column' -type menu of requirements, depending on your role.)

Originally Posted by Piru

As to actual training, well I have little to contribute here, as I myself had no official training in the field whatsoever. In fact, this is more of a norm than rule for anyone I know in the field. Most of them are self-taught hackers, and only very few have even completed their academic degrees (this isn't that unusual these days in general though).

Most of the best technicians I've met are people who just worked into the job, much like this process. (Though to later in your post, even for academic purposes, I wouldn't recommend aggressively scanning any networks you don't have permission to.)

[Fester]

I used to code/program/develop but now I'm part of an install team. I'm home-shored doing prep work on servers remotely.

[motrucker]

Originally Posted by ral-clan

Museum collections technician / archaeological technician variably over the past few years.

Far out. I restore antique furniture/ keyboard instruments in my own small shop. I have done work for the Smithsonian, but never could get my foot in that door.

[AJCopland]

Game Developer
This is me: http://uk.linkedin.com/pub/andrew-copland/2/292/87a

Also for some reason my MobyGames entries are split in two as well as being incomplete!
http://www.mobygames.com/developer/s...operId,362849/
http://www.mobygames.com/developer/s...operId,419430/