A post in an online developer community caught my eye this week. A full stack developer with six years of experience wants out of the fast-paced, burnout-prone side of development and is eyeing cybersecurity. They wanted to hear from people who made the switch, and whether hiring managers treat a transition differently.
It’s a question I’ve been thinking about too. I’m planning a move in the same direction, and this is the plan I’m working from.
Starting with the job I have
The cheapest way in is the work already in front of me. Most companies have security tasks nobody wants to own, and a developer who knows the codebase can take them. I plan to ask for that work on my current team before looking anywhere else.
Three kinds of work usually exist already:
- AppSec fixes: patching reported vulnerabilities, and finding the ones nobody has reported yet.
- Compliance: SOC 2 and similar programs need engineers to implement controls and gather evidence.
- Pentest findings: someone has to take an outside tester’s report and resolve each item properly.
None of it needs a new employer, only someone willing to say yes.
Why I think AppSec is the bridge
Cybersecurity is a wide field. Red, blue and purple teaming are real career tracks, and they lean on skills a developer may not have yet: networking depth, incident response, attacker and defender tooling.
Application security sits right next to what a full stack developer already knows. You understand how auth works because you built it. You know where input gets trusted when it shouldn’t be. You can read a finding that says “IDOR on /orders/:id” and go straight to the handler. Years of development count for something here.
It isn’t the only route, but it looks like the shortest one for a developer, so I’m aiming there first.
Expect a lot of documentation
I’ve worked on SOC 2 audits, and the first thing I learned is how much of the job is paperwork. Fixing a vulnerability is one task. Proving that you fixed it, that you have a process for finding the next one, and that the process runs every time is a bigger one.
In practice that means:
- Evidence for everything: access reviews, onboarding and offboarding records, device and encryption checks, change approvals. A control with no record behind it counts as a control you don’t have.
- Samples, not summaries: auditors pick items from the population and ask you to show each one. The gaps you never noticed are the ones they find.
- Policies that match reality: a written policy is only useful if the team actually follows it, and any difference between the two becomes a finding.
- Waiting and coordinating: plenty of the work is chasing other people for records and sign-offs, then answering the same question again for a different reviewer.
It can be draining, and it doesn’t go away. It also taught me that an audit only credits what you can prove. I’d rather go into this field knowing that.
Building credentials alongside the work
I’m studying for a master’s in cybersecurity and I’ve earned a web pen tester certification (CWPT), which you can verify online. I’m also eyeing CompTIA Security+ next. Credentials matter less than work I can point to, so the plan is to keep studying while the hands-on experience builds.
What I hope this looks like when applying elsewhere
The original poster asked whether it makes a difference once you apply for a transitioned role. I expect it does. Someone with only a certificate has little to show, and someone who has worked on vulnerabilities, compliance and pentest findings has real examples to talk through.
Burnout from pace is real. A move into security won’t remove pressure entirely, but the work is different, and I don’t want to throw away years of development to get there.
I’ll write up how it goes, including the parts that don’t work. Wish me luck.