I also think that to be a good builder, you have to be a good breaker — which is most especially the case with crypto. Of course, you already know this, thus your competition, but you didn't bother to say it.
To be a good crypto-builder, I think you need to be a good breaker. I don't think that holds for other kinds of building.
I meant for software in general; I guess you don't agree? My reasoning is that you have to think systematically about what can go wrong in order to be a good programmer, which is a skill that you can only acquire by finding bugs in programs.
No, I don't agree. I think in many cases it's possible to code defensively without having what my partner Dave calls "killer instinct", the X-factor for being good at finding vulnerabilities in systems. Also, good breakers have to deal with arbitrary technologies; a good developer can specialize, substituting experience and depth of knowledge for intuitive feel.
I've done both throughout my career. I've lead and shipped very large projects, and I've spent years breaking. To be a good breaker, you have to be a good builder; you need to be able to intuit what someone building the target was trying to do, then think a step ahead of them and predict their mistakes. To do the job professionally, you need to be capable of doing that in a wide variety of environments, too. Most "builders" are Rails devs, or Java devs, or C devs. Good breakers have to be all of those.
There are a lot of "breakers" out there who repeat a cookbook of well-known techniques to find lots of instances of the same bug. But if you look at the very best in the field, to a one, they're all top-caliber builders as well.