Currently I'm working in Selenium, REST API testing. And our company wants us to do security testing and ethical hacking.

I want to know the difference between them, if I take the responsibility of security testing, it is good for me to do an extra tough task?

There are various positions for testing like manual tester, Selenium tester, performance tester, security tester...

I'm told to specialize towards one job. If you do everything you can't progress. I'm uncertain whether I should perform only one specific job or do security testing, too.


I think you should aim for becoming a Pi-shaped tester. (In the long run.)

enter image description here

From what I read you are in the process of becoming Comb-shaped. For most people this means lack of focus or you just become a generalist and not specialised in anything. Becarefull you do not become an I-shaped person (this is someone with only one skill)

Specialise in things you enjoy. First try to be come a t-shaped tester, pick one of the primary test skills like manual, automated, performance or security and learn it in and out. There are more skill area's, have a look at the Agile testing quadrants.

Keep broadening your software development and testing knowledge. Eventually (in some years) pick a second skills you want to master until you become a Pi. Do keep working on your general skills too, understand the basics of different testing parts in the full SDLC.

Learn to delegate: You cannot do everything by yourself in a software company. Hire someone for security audits if this is not your speciality. Teach and spread general testing efforts over the development team so you have more time to specialise.

| improve this answer | |

Ethical hacking vs. security testing

First, let's take some "definitions" to start with.

From EC Council (emphasis mine)

A Certified Ethical Hacker is a skilled professional who understands and knows how to look for weaknesses and vulnerabilities in target systems and uses the same knowledge and tools as a malicious hacker, but in a lawful and legitimate manner to assess the security posture of a target system(s).

From Tutorialspoint

Security testing is a testing technique to determine if an information system protects data and maintains functionality as intended.

From the emphasis you can already spot a difference: ethical hacking is looking for weaknesses, whereas in Security Testing you're looking whether the defined security measures have been applied.

In Ethical Hacking, you're using the information available from outside (black box), whereas in Security Testing you can also use information available inside your company (white box).

IMHO, Security Testing is broader because hacking can be a part of the test. You can e.g. also check the Backup procedure, which is important for the availability after a data loss, but hackers are usually not interested in that topic.

One task vs. many tasks


It depends on how much information fits into your brain. Some people can remember lots of things, other can't. Some of my colleagues, manual testers in QA, are very good in what they do, but are easily overloaded with extra tasks, e.g. when it comes to programming / test automation.

On the other hand side, I do manual testing, programming, debugging, test automation, I deal with virtualization, maintain Bugzilla, have set up our Wiki, experiment with Raspberry and I'm now attending online classes for Kali Linux and Metasploit. And I still have fun doing everything.

Expert vs. generalist

When you concentrate on one topic, it's likely that you become an expert in that topic. This is what some people like to be. If you want to become an expert, I recommend doing that for a technology rather than a tool. Tools become obsolete and a new version of a tool may require you to re-learn everything. Think of the change from Office 2000 to 2007. That hit many experts hard. It also means you can only do one job, so it'll be harder for you to leave the company.

When you know many things, you become a generalist. You can combine things and see the associations between them. Just make sure you know enough about those many topics. Do not just spend one month to learn it, spend at least 8 months on a topic so that you have enough knowledge to find out whether someone tells you a lie or not.

The Pluralsight course Learning technology in the information age by Dan Appleman was really helpful in deciding what I want to learn. If you don't have an account, you might use the trial period to watch it.

| improve this answer | |

It is hard to point you in any direction here.

Specialization will make you grow, giving lots of solving power in the direction you selected. But it will cause you to fit in only that one slot, limiting your career options as well.

What you are doing now seems a good approach: Investigate the options near to your current skill set and decide based on solid information.

I'd suggest testing the waters in various directions, then go from there and indeed go for it.

However in general you become best doing what you love to do. Doing something for the salary and/or future perspective only will lead to dissatisfaction and ultimately a new search for different opportunities.

Have fun!

| improve this answer | |