The most actively asked question about security is how do I gain traction in the security field without experience? Answer is, it's difficult but not impossible. First you need to ask yourself what exactly do you want to do in security and what are your skill gaps to get there? Security in general is a huge field but one that you really need to know the underlying technology to be able to secure it. I had no idea until recently just how complicated Identity and Authorization Management could get, taking months to learn all the various layers and complexities of securing this environment and hundreds of hours of combined effort to get there. This is an example of hard learning that took more effort than imagined at the start. The result is my architecture will meet the clients demands as the technology become robust enough to satisfy the requirements. In a couple of years. Again, you really need to understand what it is your working with before you can secure said technology.
Today I work with a number of past and present security managers, directors, all the way up through CSO/CISOs doing remarkably well on the front lines as security engineers and architects. Really, not uncommon to see former executives on the front lines than you may think. Reason is simple, most management level positions no longer exist. My current project team of 750 has one true manager but a ton of lead roles. We are extremely flat and I do not see this changing anytime soon. Then again, I am a consultant so we have more project managers to fill those gaps.
Security and certificates can become a bit uncomfortable here depending on whom your discussing the topic. From what I am reading you would likely be seeking another management role looking for the CISM or CISA as the bridge to another management role. The CISA is the gold standard for auditors and probably the best place to start your security based career. If you already have 3 years (its been a while) of audit experience already this is an excellent certification to obtain. Otherwise, its also one of the most fluffed up certifications on resumes. I see this cert too often on recent college grad resumes with zero work experience.
The CISM is aimed at active security managers and high level engineers or architects with management responsibilities. Certainly, a good bolstering cert if your already in the field but in my experience is just another nice to have element on your resume. Sorry, when Certification Magazine asks me if I outright cheat exams I know its become as common place as my consulting peers openly tell me.
Starting in security is a bit like choosing a major in college. Good luck.
