3 ms·
An example: Matasano (I have no affiliation) is a well-respected security company. Their hiring process involves (or involved) taking applications from interest
by Bartweiss 10y ago
An example: Matasano (I have no affiliation) is a well-respected security company. Their hiring process involves (or involved) taking applications from interested people with interesting resumes, sending them a textbook, and asking them to come back when they felt qualified.
I've seen this sort of outlook (usually without the textbook) across the board. Either a company will train people from scratch, or they want to see applicants with actual records of working security, finding and reporting vulnerabilities, or patching holes in OSS.
"Have a certificate" is nowhere on that list. It probably can't hurt for a candidate, but I certainly don't think it will bridge the gap from inexperienced to experienced the way an actual work record would.
- tptacek 10y agoI cofounded Matasano, for whatever it's worth. Having a certificate actually can hurt you, for elite jobs (it's not really going to hurt you if you're just breaking into the field).
- alltakendamned 10y agoHi Thomas, I'm interested to hear what the elite jobs are you speak of and in what respect having a cert would hurt one in them?
- tptacek 10y agoIt's a lack-of-clue signal. I'm not saying it should be. If you're hiring exploit developers, your process should begin and end at having candidates build model exploits. But almost nobody hires like this; most organizations have tea-leaf-reading hiring processes, and proudly advertising that you have a CISSP or CEH is one of the tea leaves they read.
- Bartweiss 10y agoNow there's an irony, I had no idea. The timing never worked out, but applying to Matasano was tied to the start of my interest in security. It was one of the most welcoming and positive interview processes I've ever seen.
- tptacek 10y agoThanks! I'm looking forward to reproducing it this year at Latacora. :)
- JumpCrisscross 10y agoOn the trading floor we called them girl/boy scouts: more interested in collecting "merit badges" than getting dirty.