4 ms·

So given that I may likely be hiring in the web and mobile application security spaces again next year (I've _somehow_ filled all of my open positions this year

by eganist 10y ago

So given that I may likely be hiring in the web and mobile application security spaces again next year (I've _somehow_ filled all of my open positions this year; appsec is difficult to fill with external hires), I'm focusing specifically on three skills: • ability to assess tech/architecture risks in apps • experience in devops automation ("secdevops" if you will) • proven skill in communication regardless of depth The ideal candidate would have all three, but I could settle with any two of these and still be happy. I am not currently hiring, but I'll gladly keep any CVs I receive and prioritize follow-ups with anyone who reaches out to me directly. Austin/DC for curious souls. --- p.s. the web appsec space is in ludicrous demand. If you've got a breaker mindset, you'll probably come out ahead if you read up on it. If you're a developer right now and want to dip into it, I'd suggest: https://www.amazon.com/Web-Application-Hackers-Handbook-Exploiting/dp/1118026470/ https://www.amazon.com/Web-Application-Hackers-Handbook-Expl... Trust me, us security folk will thank you. Heck I'd suggest it to non-hackery devs too. It's a good way to find out how us security types see the world.

616c 10y ago
Super interested in this space. I checked your profile but only saw a keybase profile. A friend JUST hooked me up with an alpha tonight! What if I am infosec/netsec/whatever student and I watch a ton of Pluralsight on AWS and Docker and I am starting to build my own lab. Will people hire someone like me? I ask publicly because I assume I'm not the only one.
- eganist 10y ago
  Possibly. Especially if you're using building the environment as a testbed for teaching yourself how to break into apps or how to automate security tools. About that... you know what's more likely to get you hired in the space? If you have no work experience in appsec but walk in and tell or show me a pattern for how you automated appsec testing in a build pipeline or QA process at home and describe the challenges you had to overcome, or if you have a few fleshed-out bug bounty submissions (with exploits) and can describe your favorite one in depth, or if you've taught yourself how to review code for flaws and could do it in front of me in an interview setting, I might be quite willing to waive the years in appsec requirement. Other smart hiring managers probably will too. https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project https://www.owasp.org/index.php/Category:OWASP_WebGoat_Proje... <<This is a good starting point for learning how to break things. Also for learning how to fix them :)
  - 616c 10y ago
    Got it. This is what I will spend my weekends on after an exam. Thanks for your response, and aapologies for my late reply.
sidcool 10y ago
This is my absolutely favorite work. I love coding, but I absolutely love enabling developers by providing a solid architecture and DevOps ready infrastructure. Would love it.
- eganist 10y ago
  Nice. If your background is strong in automation engineering, you can frankly probably get an appsec engineer position at most decent in-house shops right now just because so many of them are trying to avoid relying on consultants for pentests and assessments. One of the larger challenges right now at most firms building out internal appsec programs is to get to a point where security-focused static code analysis and pentest tools can be automated such that devs only need to address issues that magically pop up in Jira (or any other defect tracker) rather than having to learn new tools. If you already have that experience but not specifically in security, it'd be a great fit and you'd be encouraged to apply wherever automation is even barely touched on as a requirement. Guarantee you any appsec hiring manager will consider that background.
  - fma 10y ago
    I wasn't aware that was a big problem. My company is a large corporate company and I feel we lag behind a lot of things. However we have automated static code analysis through HP Fortify. It points to our build, scans and reports are generated automatically. Someone on the app security team needs to run the HP Webscan for pen test. I'm a senior developer and I made a name for myself when we started having the requirement. I helped secure ~10 webapps as I was the most knowledgeable about security amongst the devs. The app sec guys I know at my company, though intelligent, are not strong developers. There were times I spun a story to get them to mark something as false positive - or I knew what the scan flagged for and coded around it. I know, bad practice, but sometimes the scanners mark something as critical when IMHO it's not. Once our apps were secure, maintenance is pretty low as we'd just fix any new vulnerabilities introduced by coding, or updated by the scanner tools. Do you see a need for strong developers in app sec world? If so, any recommendations on ways to make the leap? Not really looking for something where I just click a button and scan...but something more in depth that would use my development experience. I have a Security+ cert, doubt I can get a CISSP since I don't know anyone with it to get sponsored.
JamesBarney 10y ago
What are competitive rates for an appsec engineer? I'm a tech lead who's always been interested in appsec(very passively), but it always seemed like a long journey from here to there. And I was under the impression the rates were pretty similar which made the task seem more daunting.
- eganist 10y ago
  Depends on your locale and the firm. I know of firms in the bay willing to pay well over 200 for lead appsec engineers, but the spread there can be wide and you'd need to meet most of the qualifications for the role to get it. I can share more detail in private eg on twitter.
hoorayimhelping 10y ago
Thanks for this post. I've had that book on my shelf for months now, and I'm going to start reading it. Thanks in general for the information here, it's helped validate a few suspicions I've had, cheers!
- eganist 10y ago
  Of course! And by showing initiative, you're also motivating others and thereby live up to your username (for what it's worth =).
devilsavocado 10y ago
What counts as 'proven skill in communication' to you? Other than how they communicate throughout the interview process, I'm not sure how else to test for this.

by eganist 10y ago

616c 10y ago

Super interested in this space. I checked your profile but only saw a keybase profile. A friend JUST hooked me up with an alpha tonight! What if I am infosec/netsec/whatever student and I watch a ton of Pluralsight on AWS and Docker and I am starting to build my own lab. Will people hire someone like me? I ask publicly because I assume I'm not the only one.

eganist 10y ago
Possibly. Especially if you're using building the environment as a testbed for teaching yourself how to break into apps or how to automate security tools. About that... you know what's more likely to get you hired in the space? If you have no work experience in appsec but walk in and tell or show me a pattern for how you automated appsec testing in a build pipeline or QA process at home and describe the challenges you had to overcome, or if you have a few fleshed-out bug bounty submissions (with exploits) and can describe your favorite one in depth, or if you've taught yourself how to review code for flaws and could do it in front of me in an interview setting, I might be quite willing to waive the years in appsec requirement. Other smart hiring managers probably will too. https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project https://www.owasp.org/index.php/Category:OWASP_WebGoat_Proje... <<This is a good starting point for learning how to break things. Also for learning how to fix them :)
- 616c 10y ago
  Got it. This is what I will spend my weekends on after an exam. Thanks for your response, and aapologies for my late reply.

sidcool 10y ago

This is my absolutely favorite work. I love coding, but I absolutely love enabling developers by providing a solid architecture and DevOps ready infrastructure. Would love it.

eganist 10y ago
Nice. If your background is strong in automation engineering, you can frankly probably get an appsec engineer position at most decent in-house shops right now just because so many of them are trying to avoid relying on consultants for pentests and assessments. One of the larger challenges right now at most firms building out internal appsec programs is to get to a point where security-focused static code analysis and pentest tools can be automated such that devs only need to address issues that magically pop up in Jira (or any other defect tracker) rather than having to learn new tools. If you already have that experience but not specifically in security, it'd be a great fit and you'd be encouraged to apply wherever automation is even barely touched on as a requirement. Guarantee you any appsec hiring manager will consider that background.
- fma 10y ago
  I wasn't aware that was a big problem. My company is a large corporate company and I feel we lag behind a lot of things. However we have automated static code analysis through HP Fortify. It points to our build, scans and reports are generated automatically. Someone on the app security team needs to run the HP Webscan for pen test. I'm a senior developer and I made a name for myself when we started having the requirement. I helped secure ~10 webapps as I was the most knowledgeable about security amongst the devs. The app sec guys I know at my company, though intelligent, are not strong developers. There were times I spun a story to get them to mark something as false positive - or I knew what the scan flagged for and coded around it. I know, bad practice, but sometimes the scanners mark something as critical when IMHO it's not. Once our apps were secure, maintenance is pretty low as we'd just fix any new vulnerabilities introduced by coding, or updated by the scanner tools. Do you see a need for strong developers in app sec world? If so, any recommendations on ways to make the leap? Not really looking for something where I just click a button and scan...but something more in depth that would use my development experience. I have a Security+ cert, doubt I can get a CISSP since I don't know anyone with it to get sponsored.

JamesBarney 10y ago

What are competitive rates for an appsec engineer? I'm a tech lead who's always been interested in appsec(very passively), but it always seemed like a long journey from here to there. And I was under the impression the rates were pretty similar which made the task seem more daunting.

eganist 10y ago
Depends on your locale and the firm. I know of firms in the bay willing to pay well over 200 for lead appsec engineers, but the spread there can be wide and you'd need to meet most of the qualifications for the role to get it. I can share more detail in private eg on twitter.

hoorayimhelping 10y ago

Thanks for this post. I've had that book on my shelf for months now, and I'm going to start reading it. Thanks in general for the information here, it's helped validate a few suspicions I've had, cheers!

eganist 10y ago
Of course! And by showing initiative, you're also motivating others and thereby live up to your username (for what it's worth =).

devilsavocado 10y ago

What counts as 'proven skill in communication' to you? Other than how they communicate throughout the interview process, I'm not sure how else to test for this.