Information Security and Development Skills

From one of my quora answers

What jobs in the information security realm require strong development skills?

By development skills if you mean application development skills then yes whatAndrew Olson pointed out seems correct, You can use those skills during the static analysis code review. Code review has always been part of security engineering in most of the organizatons. When you come to offensive security you should have strong development skills as you will be developing exploits in order to publish or test the vulnerabilities. Skills that you need at this level are completely differnt from the application development skills which is largely based on Language and thrid part libraries available in the language. Its kind of hard to segregate responsibilities based on the job role but let me try and list some for you

Information security engineer (Application Security) - Code Review(Both manual and automated using the tools), Should have good knowledge of the frameworks and language used for the applications. A Java guys cannot review code of .NET application its as simple as that.

Information security engineer (Network Security) - Minimal or no use of the develoment skills, Most of the work is done with the tools available. If you google “Networking Tool” you can see almost all tools are available. Administration and Configurations is the task that info security engineeer in this field primarily does.

Information Security Analyst (Access/Identity Management) : Same as Network Security

Information Security Consultant - They have to be up to date with compliance, regulations and policies. They perform lots of training and workshop sessions. Softskills are requred more at this level. You dont need to be hard core technical but still you need to have technical skills at this level.

Information Security Manager - Same as Security Consultant, additionally they might manage otther security groups, people development skill is must and this is a non technical job as far as daily practice is concerned, primarily because big part of their time goes on certification, accredation and decision making.

Information Security Architect - Fairly good use of development skills, tools and softskill. This role demands right blend of domain, technology and people development skills. they make decision on technlogy stack and provie recommendation from security stand point.

Security Engineer(Exploit development / Computer forensics) - Knowledge of assembly level language and good command over atlest one low level language helps a lot. This role is about closlely monitoring the behaviour of OS under differnt circumstances and build patch of that, failry technical role.

Penetration testing - Minimal development skills, tools based but development skills are always plus to position you better penetration tester.

Personally I feel application security and security architecture is the role where strong development skills count.