Interested in a career in InfoSec

[IndyJaws]

I work for a large company who is starting to lay off employees, primarily due to the fact that the CEO is a raving idiot. While I don't think my job is in immediate danger, I want to be prepared for any eventuality. The severance packages are fairly generous, so I would receive 6+ months of salary in a lump payment. Sucks, but could be much worse.

I'm not currently in an IT position but have worked in IT for several years in the past (workstation management/repair, basic network support and maintenance, training). I got an A+ certification on a whim several years ago (something to do and my employer paid the test fee) but have no other certifications. I'd like to pursue a career in Information Security, as I believe it would be a high-demand field of employment.

So here's my question...what would be the best course of action? I see many locations offering intensive boot camps for several different certifications. I know they're quite expensive, but as I said earlier, I will have the funds available, and Mrs. IndyJaws makes enough to cover us while I train. I also know they're no substitute for real-life experience, but I'd like to get rolling as quickly as possible.

Should I pursue network certifications prior to security certs? In what order would you suggest going about this? Any advice anyone can give me would be hugely appreciated.

Thanks in advance!
Indy

 

[Zugzwang152]

If you have solid networking knowledge, you'll be fine to start. Lacking security or IT work experience, however, any certification will help.

Look into attending the SANS Institute's SEC401 class. It's about $3000-3500 for a six-day course. Pick up the $500 entry-level GSEC certification to go along with it (if you have the option and feel confident enough, take the proctored exam that's usually offered at the end of the training). The GSEC certification seems to still be lesser known than other entry level certifications like Security+, but is much better training when paired with the SEC401 class.

After this, look into networking certifications like CCNA or vendor-specific training like MCSE with Security. The higher end security certifications like CISSP, CISA, and CISM all require full-time work experience.

If you have the money and time available, look into the more specialized SANS certifications. GCIH and GCIA both seem interesting, though I haven't taken either (only GSEC).

There are many security certifications to avoid as well: Certified Ethical Hacker comes to mind, though I'm not sure if they've improved their program since I last looked.

Keep us up to date on your experiences, good or bad. The security field is hot, and it will only get hotter in the future.