Jobs that involve implementing good security <i>don&#x27;t exist</i>.  That&#x27;s because there are <i>no customers</i> for good security, because customers can&#x27;t tell the difference between good security, bad security, and no security, unless they happen to get compromised.  Even then, they usually don&#x27;t notice.  Often, they can&#x27;t even tell the difference after they notice a compromise: they can tell that some of their security was bad or absent, but they can&#x27;t tell what or how; so often their incident response is useless or actively counterproductive.<p>This information asymmetry problem means that, in a job implementing supposedly good security, an aptitude for security is not an advantage.  In fact, it&#x27;s a disadvantage, since that aptitude inclines you to do unprofitable things like auditing code, recommending to your customers that they scrap unsalvageable codebases, and staying up late at night patching production servers instead of ironing your suit and getting a good night&#x27;s sleep before that important client meeting.  Total incompetents wearing better suits will be able to bill a higher hourly rate than you do.<p>Because there are no customers for good security, the entire infrastructure of plausibly securable software that you would need to implement good security also doesn&#x27;t exist, because the market has failed to provide funding to develop it.  Big technical companies (Microsoft, Google), free-software organizations (Debian, Tor), and dedicated individuals (Bernstein, Moxie) have made significant progress, but it&#x27;s nowhere near being a viable option.<p>By contrast, I imagine that if you &quot;get paid to pop boxes&quot;, you can demonstrate to your customer that you succeeded at it, and you probably can&#x27;t convince them that you did if you didn&#x27;t.  This means that aptitude and expertise are an advantage in that field.  Don&#x27;t get me wrong: even from this distance, I can see that you&#x27;re right that the field is still full of the script kiddies who &quot;think [they&#x27;re] hot shit because [they] found some vulnerable systems on Shodan.&quot;  But <i>even they</i> are head and shoulders above many of the high-priced security consultants on the defense side from places like Keane or Wipro.<p>The upshot of all of this is that if you want to secure your network, the best you can do is figure out who the  expert attackers are, then convince them that it&#x27;s worthwhile to secure it.  But that&#x27;s still nowhere near enough to get to &quot;probably secure&quot;, much less &quot;assuredly secure&quot;.