How to become a security engineer
The Web Application Hacker's Handbook
Probably the first book you want to read; this will teach you the core mindset you need for finding security flaws in web applications as well as give a very strong foundation for the different classes of vulnerabilities.
The Mobile Application Hacker's Handbook
Good supplement to #1 for application security, obviously focused on mobile apps.
The Art of Software Security Assessment
The bible of the security industry. Especially instructive for source code review.
Security Engineering (Ron Anderson)
Supplements #3. Very instructive for injecting security into the overall SDLC and designing secure software.
The Tangled Web
Excellent historical background and good high level overview of many information security topics. Every engineer should read this, even if they don't work in security.
Gray Hat Python
Very hands on, good introduction to aspects of reverse engineering and the typical work an e.g. security consultant will do at a top firm.
Practical Malware Analysis
Very good introduction to malware analysis.
