The required skills and suggestions for security automation

Security team developers and automation testing developers require different skill sets. Naturally, the core skills of automation testing developers and pentesters are different. However, achieving security testing automation won't be too difficult for anyone, so long as the appropriate tools and frameworks are adopted to reduce the learning curve and ensure consistent delivery quality. For example, the adoption of web UI automation will help security testing to explore the blind side of the user flows. However, web UI automation and the adoption of the Selenium automation framework can be a big challenge for the security testing team. This issue can be solved with the help of proper automation testing tools, which will be introduced in the coming chapters.

The skills that penetration testers and automation testing developers have in common are as follows:

• Familiar with a programming language, such as Python, PHP, Java, or C/C++
• Familiar with Windows, Linux and TCP/IP (Transmission Control Protocol/Internet Protocol), and HTTP networking

Those were some similar skills; the following table lists some key differences:

Penetration testers	Automation testing developers
Ability to identify software vulnerabilities by OWASP Top 10 security issues and practices Familiar with Secure Software Development Life cycle (SSLDC) and security frameworks such as Spring Security and Shiro Familiar with the use of OWASP ZAP, SQLmap, Nmap, Wireshark, and SSLtest	Familiar with unit testing, APIs, and web UI automation testing frameworks such as Robot Framework, Selenium, WebDriver, and JMeter Familiar with the defect cycle, issue tracking, and continuous integration/continuous delivery (CI/CD) frameworks Familiar with BDD frameworks Familiar with DDT frameworks