It's a great time to be in security, definitely a job seeker's market. I've been in security for ~8 years now and don't have any certs and don't see a whole lot of value in them unless your employer/clients require them (some consultant or government shops do). I place a much higher value on knowing your stuff and being able to earn the respect of other engineering teams when helping them understand more secure ways to build what they're trying to build.
Some of the best security engineers I've known came from a network engineer or sysadmin background. So don't worry if you don't have a "masters in security". I'd spend some time thinking about the last large system you built. How would someone attack it? How would you detect those attacks? What would you do if they were successful? How could you have architected around those weaknesses? If doing that seems like fun, my team is hiring in Seattle, feel free to drop us a message at [email protected]
Some of the best security engineers I've known came from a network engineer or sysadmin background. So don't worry if you don't have a "masters in security". I'd spend some time thinking about the last large system you built. How would someone attack it? How would you detect those attacks? What would you do if they were successful? How could you have architected around those weaknesses? If doing that seems like fun, my team is hiring in Seattle, feel free to drop us a message at [email protected]