Freelance security work

Question

What types of jobs within IT security lend themselves best to freelancing or working remotely, as opposed to being a standard office job?

Answer 1

Anything in the consultancy side of the field will leave you at home some percent of the time. That favors jobs such as security audits/assessments, penetration testing, or security design work.

When consulting, you'll spend some percent of your time at the client site and some amount of time in you home office. The trade-off is that travel to the client site can be more painful than getting a regular job in the office 45 minutes down the road. Some jobs may be 10% client location, others may be 90%. Some travel may be local, some may be on a plane, depends on the consultancy's clientele.

Consulting can be great, and it can be terrible, but it sure does present an alternative to a standard office job. You can see a lot more, learn a lot more, and have a totally different accountability profile (it's not how often you're at your desk, it's how good and how timely your deliverables are). If you're smart, flexible, and willing to work hard, you can get some rewarding years out of it.

I do agree with @Robert David Graham, standard jobs security haven't caught on to work-at-home yet.

Answer 2

None.

With that said, once you've put in your time in a standard office and built trust with your manager, then they'll let you work remotely from home a lot. Or, if you get extremely skilled at something (anything), you'll be in such high demand that you can dictate terms, such as working from home.

Answer 3

From my experience a role conducting Application Security assessments is likely to be possible to do from home. Most of the consultancies that offer this service have many members of staff either working from home permanently (all around the globe) or members of staff that frequently work at home for remote tests.

The opposite to doing "remote application testing" would be "on-site infrastructure testing", different set of core skills and often involves traveling to a client-site and spending longer periods working with them to secure their network infrastructure.

So if you do want to go remote this may be something to think about when you are developing your core skills. If you are better at application development, app sec, mobile application security you have a greater chance of working remote. If you are an infrastructure person who enjoys port scanning, enumerating network services, exploiting servers then you will probably find yourself traveling around and visting clients at their locations (not at your home).