“Should I start directly in security or should I work in IT first?”

This seems like a question that is frequently asked by folks who want to get into infosec. When I’ve been asked this, I’ve always said to start out in IT or development first. To be candid, my response is largely based on my own path into security.

But is it a good answer? Someone I know and have a great deal of respect for has the exact opposite opinion. This caused me to reconsider my view.

Let’s take a quick look at the two.

Starting out in IT or development

I think there are some benefits to starting out in a job that writes apps or manages IT systems. 

You learn a lot about how networks are managed, what practices are used in development, and generally what our technology counterparts are dealing with. You are able to learn about a lot of the mistakes that are made and why it can happen. You also figure out what makes their lives hard and why.

This has helped me out a number of times, so I’m partial to this path. It’s a longer road though.

Starting immediately in security

As I thought about the opposite approach to beginning in security, there are also some positives that come to mind.

Primarily, you don’t have to spend years doing a job you don’t want as a stepping stone to getting to infosec. The time and energy that would be put into learning how to manage Active Directory (for example) could be put into learning forensics, incident response, penetration testing, etc. That’s a definite advantage, since you’d likely be younger during that initial learning stage and would probably have fewer non-work responsibilities. 

So I can see why others would recommend going straight to security.

So which is better for someone? I still have my preferences, but it varies from person to person. 

Which would you recommend? What thoughts do you have? I’d love to hear what you think.