[bawolff]

The easiest way to transition is to transfer internally in a company you already work for. However that doesn't seem like something available to you.

Try maybe looking for roles labelled "software security engineer" - those might be more likely to take a pure software background.

> I’m currently trying to get a CompTIS Security+ certificate.

Certs are not respected in the security industry, especially the easier ones like security+, to the point wherr its almost considered negative signal on a resume. Some of the harder ones like cssip are controversial in that it depends where you're applying whether or not its worth anything.

As a general rule, i would not bother with certs, but they can be useful as a general study guide sometimes, if you're not sure where to start.

[CodeGlitch]

> Certs are not respected in the security industry, especially the easier ones like security+

I'm a software engineer, but have no certs myself however I'm familiar with the security-related certs. I find it bizarre that an industry would find the certs useless, as certs at least give a baseline. You can give someone a bunch of tests at interview, but there's no way you can check someone's knowledge in just a few hours - unless your tests look something like the questions you'd be asked to gain a cert! I'm trying to get a Network+ cert, but it's taking me awhile due to the massive amount of stuff you have to learn...and Security+ is seen as the next cert after that. I've learnt a massive amount already, so cannot see why it would be useless or seen as a negative. It's almost like saying "nah we won't use this standard baseline, we'll be the judge!"

I wish the software dev industry would embrace certs a bit more. Hiring is basically a massive gamble. Recent example: chap I worked with who had been a programmer for decades...didn't know what Base64 was, and used globals a lot. This is basic stuff.

[bawolff]

Its not that certs are inherently bad [although they are easy to game and tend not to be very related to job skills], its that they are highly correlated with not knowing anything.

People who know stuff have no need to gets certs so don't, even though they could easily pass the test. The end result is the only people who get certs are the people who have nothing better to put on their resume, which typically are bad hires.

I suspectcthe main reason cssip is worth anything to anybody is you have to have at least 4 years experience to take it, and having 4 years is definitely worth something.

[parkerhiggins]

I understand the premise and perspective here around certs, but as a hiring manager on dozens on hires it leaves me sick.

It’s chicken and the egg. How does a candidate get the experience if they cannot get the job for that experience? They up-skill via courses and certifications. Now certs are a red-flag for the opportunity they’re applying for?