QA Tester → Security Test Engineer

Transferable skills

• Penetration testing

Skills to learn

• OWASP Top 10
• Security scanning (SAST/DAST)
• Threat modelling
• Programming (Python/JS)
• Web security
• API security

Step-by-step learning plan

1. 1. Build on your QA Tester experience

   2–4 weeks

   Leverage

   • Penetration testing

   Map transferable skills — Penetration testing — against what a Security Test Engineer needs.

2. 2. Learn the core of the Security Test Engineer role

   6–10 weeks

   Learn

   • OWASP Top 10
   • Security scanning (SAST/DAST)
   • Web security
   • Reporting & remediation

   Technologies

   Burp SuiteOWASP ZAPNmap

   Cover the biggest gaps first: OWASP Top 10, Security scanning (SAST/DAST), Web security.

3. 3. Master advanced Security Test Engineer skills

   6–10 weeks

   Learn

   • API security
   • Threat modelling
   • Programming (Python/JS)

   Technologies

   MetasploitNessusSnyk

   Handle the advanced topics: API security, Threat modelling, Programming (Python/JS).

4. 4. Get productive with the Security Test Engineer toolchain

   4–8 weeks

   Technologies

   Burp SuiteOWASP ZAPNmapMetasploitNessusSnykSonarQubeCheckmarx

   Be hands-on with Burp Suite, OWASP ZAP, Nmap and the rest of the target stack.

5. 5. Practise Security Test Engineer work in real conditions

   4–8 weeks

   Ship a portfolio project or take on Security Test Engineer tasks at work.

6. 6. Get certified and position yourself as a Security Test Engineer

   4–8 weeks

   Technologies

   OSCPCEH (Certified Ethical Hacker)ISTQB Security Testing

   Update your CV and LinkedIn around Security Test Engineer, then apply to target roles.