If this stuff fascinates you
and you're a solid software developer
and you'd be interested in having this be your full-time job for awhile
and you're willing to sink a little bit of your own time into ramping up, give us a ping. We'll help you get there.
This page has a lot of info on how we recruit. We're getting pretty good at turning systems programmers into breakers, and we love hiring from HN:
http://www.matasano.com/careers/
The great thing about this field is that it's always changing. A long-term dev job gives you a chance to master two or three different technology stacks. Your next three projects at an appsec shop might each be just two weeks apart, and each will use radically different technologies. Even (maybe even especially) with web software.
You could join one startup... or spend a couple years beating up all of all the startups.
Also: I understand why Cody didn't write it this way, but the reality is, if you're going to test web apps, Burp is the standard tool. You can use things like mitmproxy or even WebScarab, but most people end up in Burp. Burp is also extremely valuable for testing even if you're not doing appsec full-time.
This page has a lot of info on how we recruit. We're getting pretty good at turning systems programmers into breakers, and we love hiring from HN:
http://www.matasano.com/careers/
The great thing about this field is that it's always changing. A long-term dev job gives you a chance to master two or three different technology stacks. Your next three projects at an appsec shop might each be just two weeks apart, and each will use radically different technologies. Even (maybe even especially) with web software.
You could join one startup... or spend a couple years beating up all of all the startups.
Also: I understand why Cody didn't write it this way, but the reality is, if you're going to test web apps, Burp is the standard tool. You can use things like mitmproxy or even WebScarab, but most people end up in Burp. Burp is also extremely valuable for testing even if you're not doing appsec full-time.