9 ms·

Flush times for hackers in booming cyber security job market

162 points by mancerayder 9y ago

laurencei 9y ago
What are some realistic salary ranges for people in this field? And is it largely on site work, or is it more common as a remote consultant?
- janfry 9y ago
  Regarding onsite/remote, I think it depends on what you choose to specialise in. Most of the web application assessments I conduct are remote but there is still demand for onsite work.
- dsacco 9y ago
  NB: Assuming SF, NYC or a similar locale. Junior: $120k base. $10-15k annual bonus. Mid: $150k base. $20-30k annual bonus. Senior: $180k base. $30k annual bonus. Slightly skewed towards consulting; notch it up a bit to account for stock grants in addition to the bonus if you're thinking of something like Google, Facebook or Amazon. Sometimes the consulting firm pays separate bonuses for research time and bench projects that result in something useful or beneficial for the firm's brand. That's based on my own experience and talking with probably well over a hundred people in the industry about their salary by now. You can do remote, I've been remote almost my entire career thus far. Remote is more likely in consulting than it is at one of the reputable internal security teams, but it's not uncommon at smaller tech companies.
- unethical_ban 9y ago
  Central Texas 5 yrs experience, 95k when bonuses and 401k match are thrown in.
kdbg 9y ago
Low to mid 100k is very realistic in my experience. A lot more can be made with the right skills.
- mahyarm 9y ago
  So standard software engineer salary in the USA?
  - user5994461 9y ago
    Yes, like all tech jobs that pretend to be in demand. Security is usually worse than regular engineering, because it tend to be a succession of short quick gigs.
jph 9y ago
I advise companies on tech security, and talent is very much needed. What's surprising (at first glance) is that the security talent need is very strong in UI/UX/CX. For example, security is needed to gradually escalate a user's own identity verification -- think of things like two-factor auth and multi-factor auth, that can phase in (or ramp up) when a user's actions enter a gray area of risk. Some examples: when a user signs in from a new location, or a user does an especially large money transfer, or a user resumes an account that's been dormant for years, etc. The UI/UX/CX is especially necessary to 1) explain to the user that there's a security issue, 2) how the user can fix it, and 3) how to improve backend systems to handle users who ask for help.
- aphextron 9y ago
  >What's surprising (at first glance) is that the security talent need is very strong in UI/UX/CX. Which technologies specifically?
  - hoobledoo 9y ago
    >Which technologies specifically? I think that's part of the issue, security minded folks are often very analytical and come from CS backgrounds and the demand is for people who understand how design interacts with technology to, in this case, create secure methods of actually using a technology. So, to answer your question, none. It's about the mindset of the designer.
  - jph 9y ago
    For example some keywords: rapid web/mobile prototyping, info visualization, split test planning, throttle rollouts, accessibility areas, i18n/l10n, risk management, compliance verification, pattern recognition, time series analysis, threat modeling of web usage, relevance ranking, bloom filters, HIPAA/FERPA/SOX/ISAE etc., client-side cryptography, graylisting, social proof verification, identity theft mitigation, etc.
- micaksica 9y ago
  I work in infosec as a security engineer, I agree with this more than anything else anyone has posted about the state of the security industry on HN, ever. For security being a human problem, I have yet to meet infosec types with strong backgrounds in human factors or product design. Nearly everyone came to this industry from netsec/IT/SOC work, or low-level programming, and neither group has a decent understanding of the usability issues that plague the security posture of common users. What works for a CLI junkie with deep systems knowledge absolutely fails people who barely know how to navigate their Android phone. If anyone's interested in attempting to solve some of these design pattern issues, please reply here or DM me on Twitter. I'd love to actually get a group of people together trying to come up with standard, secure UX paradigms that can be referenced by others.
jomkr 9y ago
How can I get into this field? I used to love doing pen-testing when I was a teenager, and paid for my first car out of bug-bounties. Unfortunately, I got distracted by girls and booze at university and didn't keep it up, now I work in sigh enterprise C#/WPF land.
- devwastaken 9y ago
  How'd you get into enterprise C#/WPF land?
  - IIAOPSW 9y ago
    Start as a pen tester then get distracted by girls and booze.
    - chrisbennet 9y ago
      You say that like its a bad thing. ;-)
    - deleted 9y ago
      [deleted]
  - jomkr 9y ago
    Just sort of fell into it. Did an internship at university in $genericbigcorp and didn't bother looking for other/better jobs at graduation. (To be fair they paid a generous joining bonus - well £2000 "generous" to my broke 21 year old self).
  - OpenDrapery 9y ago
    That's the path of least resistance. Just passively accept calls and interviews via recruiters, and next thing you know you're in the enterprise. It's what happens when you don't have a plan.
- unixhero 9y ago
  Didn't we all. (Similar story:) )
sebcat 9y ago
What saddens me is that, while red team pen testing is a very "hot" (high employer demand, high salaries) job market, people don't generally care about the blue team. It's easy to get a pentesting gig that pays well, but employers don't ask for/value people with the competence to build/maintain secure applications/networks/solutions in my experience. Instead they pay for recurring pen tests which results in internal tickets/issues/BUGs, while the development/operation practices are kept the same.
- solatic 9y ago
  It's because internal econometrics are resulting in perverse incentives. Defensive security is a cost center without clear, deterministic metrics for success. Let's say you pay X on defensive security (which is an oversimplification when you're talking about a cultural change, but that cultural change involves people learning how to pay attention to security, and paying attention is a form of man-hours, for which a cost can be calculated). If you don't get attacked, is it because the X you paid is high enough to deter/foil attackers, or could you have paid less and achieved the same result? If you are attacked and the attackers get past your defenses, is it because the X you paid wasn't enough, or if you had spent more, would the attackers have succeeded anyway, because of their relative power and motivation? For defensive security, it's very, very hard to justify to bean counters that X was the correct amount of money spend, no matter what the real outcome is, because it's hard to understand X's affect on that outcome. Pentests which result in tickets/issues/etc. are much easier to justify. The company spent X on the pentest, and it got Y feedback in return. Simple, and effective, at least in the short-term. It's part of the overall challenge that organizations face when they become metrics-driven. People choose the path of least resistance, so if you ask people to measure data, they'll measure the data that's easiest to measure. Data that's harder to measure - culture and social attitudes - becomes "not a priority" to measure.
  - dmitri1981 9y ago
    You probably meant Economics rather than Econometrics. Economics concerns itself with incentives and payoffs, whereas Econometrics is the statistical study of economic systems. Apologies for the pedantry
deleted 9y ago
[deleted]
taylorfinley 9y ago
I am totally into this field as a bystander. When many people would watch late night TV or listen to music or a podcast, I'll scour YouTube for defcon and CCC talks I haven't seen yet. I am good with python, Javascript, web and graphic design, technical writing, all kinds of stuff. I live in rural neighbor-island Hawaii and the only tech jobs I ever see out here are military, which I deeply respect but don't think would be a good culture fit for me. I've just transitioned to working part time and intend to dive in to some open source projects with my extra time. Is there a good path of entry for someone with a deep natural curiosity about the field, self-trained in coding but with no industry connections or much in the way of related professional experience?
- ohm 9y ago
  Fastest way would be OSCP cert.
  - jabberwockwock 9y ago
    OSCP, red teaming, possibly CISM or CISSP for upward mobility.
    - mkagenius 9y ago
      I would not waste time and money on certifications.
      - monkeydgrif 9y ago
        As someone not in the field, but curious of getting in, could you explain why not?
        mr_overalls 9y ago
        There is a bias against certifications by some (but by no means all) professionals in InfoSec, since it is a heavily "hands-on" field. There is more emphasis on demonstrating actual ability through CTFs, bug bounties, published exploits, etc. However, unlike Certified Ethical Hacker, CISSP, and other "mile wide, but inch deep" certs, the OSCP is a heavily hands-on certification that tests actual ability. No knowledgeable employer would discriminate against you for earning it. And CISSP or CISSM are valuable if you're applying for a management job. For government defense-sector jobs, they are often required.
deleted 9y ago
[deleted]
rhexs 9y ago
Always cracks me up thinking about how much the press talks about cybersecurity being in demand then looking at the actual IOT and embedded cybersecurity market. Everyone should be very, very scared about infrastructure/medical security and the effective lack of anyone doing anything about it. I'm sure web/network pentesting is doing well though.
- jerrylives 9y ago
  https://www.youtube.com/watch?v=pd91c5ZwSf0 https://www.youtube.com/watch?v=pd91c5ZwSf0 Excellent talk from last year's HOPE about the vulnerability of medical devices - he even connects to some live
goshx 9y ago
I'd love to get back to hacking and be paid to do it legally.
drraid0 9y ago
I'm looking to get out of security after being in IR and security research at a large startup for 5 years. I am having no luck finding anything besides glorified helpdesk jobs and other entry level positions.

162 points by mancerayder 9y ago

What are some realistic salary ranges for people in this field? And is it largely on site work, or is it more common as a remote consultant?

janfry 9y ago
Regarding onsite/remote, I think it depends on what you choose to specialise in. Most of the web application assessments I conduct are remote but there is still demand for onsite work.
dsacco 9y ago
NB: Assuming SF, NYC or a similar locale. Junior: $120k base. $10-15k annual bonus. Mid: $150k base. $20-30k annual bonus. Senior: $180k base. $30k annual bonus. Slightly skewed towards consulting; notch it up a bit to account for stock grants in addition to the bonus if you're thinking of something like Google, Facebook or Amazon. Sometimes the consulting firm pays separate bonuses for research time and bench projects that result in something useful or beneficial for the firm's brand. That's based on my own experience and talking with probably well over a hundred people in the industry about their salary by now. You can do remote, I've been remote almost my entire career thus far. Remote is more likely in consulting than it is at one of the reputable internal security teams, but it's not uncommon at smaller tech companies.
unethical_ban 9y ago
Central Texas 5 yrs experience, 95k when bonuses and 401k match are thrown in.

kdbg 9y ago

Low to mid 100k is very realistic in my experience. A lot more can be made with the right skills.

mahyarm 9y ago
So standard software engineer salary in the USA?
- user5994461 9y ago
  Yes, like all tech jobs that pretend to be in demand. Security is usually worse than regular engineering, because it tend to be a succession of short quick gigs.

jph 9y ago

I advise companies on tech security, and talent is very much needed. What's surprising (at first glance) is that the security talent need is very strong in UI/UX/CX. For example, security is needed to gradually escalate a user's own identity verification -- think of things like two-factor auth and multi-factor auth, that can phase in (or ramp up) when a user's actions enter a gray area of risk. Some examples: when a user signs in from a new location, or a user does an especially large money transfer, or a user resumes an account that's been dormant for years, etc. The UI/UX/CX is especially necessary to 1) explain to the user that there's a security issue, 2) how the user can fix it, and 3) how to improve backend systems to handle users who ask for help.

aphextron 9y ago
>What's surprising (at first glance) is that the security talent need is very strong in UI/UX/CX. Which technologies specifically?
- hoobledoo 9y ago
  >Which technologies specifically? I think that's part of the issue, security minded folks are often very analytical and come from CS backgrounds and the demand is for people who understand how design interacts with technology to, in this case, create secure methods of actually using a technology. So, to answer your question, none. It's about the mindset of the designer.
- jph 9y ago
  For example some keywords: rapid web/mobile prototyping, info visualization, split test planning, throttle rollouts, accessibility areas, i18n/l10n, risk management, compliance verification, pattern recognition, time series analysis, threat modeling of web usage, relevance ranking, bloom filters, HIPAA/FERPA/SOX/ISAE etc., client-side cryptography, graylisting, social proof verification, identity theft mitigation, etc.
micaksica 9y ago
I work in infosec as a security engineer, I agree with this more than anything else anyone has posted about the state of the security industry on HN, ever. For security being a human problem, I have yet to meet infosec types with strong backgrounds in human factors or product design. Nearly everyone came to this industry from netsec/IT/SOC work, or low-level programming, and neither group has a decent understanding of the usability issues that plague the security posture of common users. What works for a CLI junkie with deep systems knowledge absolutely fails people who barely know how to navigate their Android phone. If anyone's interested in attempting to solve some of these design pattern issues, please reply here or DM me on Twitter. I'd love to actually get a group of people together trying to come up with standard, secure UX paradigms that can be referenced by others.

jomkr 9y ago

How can I get into this field? I used to love doing pen-testing when I was a teenager, and paid for my first car out of bug-bounties. Unfortunately, I got distracted by girls and booze at university and didn't keep it up, now I work in sigh enterprise C#/WPF land.

devwastaken 9y ago
How'd you get into enterprise C#/WPF land?
- IIAOPSW 9y ago
  Start as a pen tester then get distracted by girls and booze.
  - chrisbennet 9y ago
    You say that like its a bad thing. ;-)
  - deleted 9y ago
    [deleted]
- jomkr 9y ago
  Just sort of fell into it. Did an internship at university in $genericbigcorp and didn't bother looking for other/better jobs at graduation. (To be fair they paid a generous joining bonus - well £2000 "generous" to my broke 21 year old self).
- OpenDrapery 9y ago
  That's the path of least resistance. Just passively accept calls and interviews via recruiters, and next thing you know you're in the enterprise. It's what happens when you don't have a plan.
unixhero 9y ago
Didn't we all. (Similar story:) )

sebcat 9y ago

What saddens me is that, while red team pen testing is a very "hot" (high employer demand, high salaries) job market, people don't generally care about the blue team. It's easy to get a pentesting gig that pays well, but employers don't ask for/value people with the competence to build/maintain secure applications/networks/solutions in my experience. Instead they pay for recurring pen tests which results in internal tickets/issues/BUGs, while the development/operation practices are kept the same.

solatic 9y ago
It's because internal econometrics are resulting in perverse incentives. Defensive security is a cost center without clear, deterministic metrics for success. Let's say you pay X on defensive security (which is an oversimplification when you're talking about a cultural change, but that cultural change involves people learning how to pay attention to security, and paying attention is a form of man-hours, for which a cost can be calculated). If you don't get attacked, is it because the X you paid is high enough to deter/foil attackers, or could you have paid less and achieved the same result? If you are attacked and the attackers get past your defenses, is it because the X you paid wasn't enough, or if you had spent more, would the attackers have succeeded anyway, because of their relative power and motivation? For defensive security, it's very, very hard to justify to bean counters that X was the correct amount of money spend, no matter what the real outcome is, because it's hard to understand X's affect on that outcome. Pentests which result in tickets/issues/etc. are much easier to justify. The company spent X on the pentest, and it got Y feedback in return. Simple, and effective, at least in the short-term. It's part of the overall challenge that organizations face when they become metrics-driven. People choose the path of least resistance, so if you ask people to measure data, they'll measure the data that's easiest to measure. Data that's harder to measure - culture and social attitudes - becomes "not a priority" to measure.
- dmitri1981 9y ago
  You probably meant Economics rather than Econometrics. Economics concerns itself with incentives and payoffs, whereas Econometrics is the statistical study of economic systems. Apologies for the pedantry

deleted 9y ago

[deleted]

taylorfinley 9y ago

I am totally into this field as a bystander. When many people would watch late night TV or listen to music or a podcast, I'll scour YouTube for defcon and CCC talks I haven't seen yet. I am good with python, Javascript, web and graphic design, technical writing, all kinds of stuff. I live in rural neighbor-island Hawaii and the only tech jobs I ever see out here are military, which I deeply respect but don't think would be a good culture fit for me. I've just transitioned to working part time and intend to dive in to some open source projects with my extra time. Is there a good path of entry for someone with a deep natural curiosity about the field, self-trained in coding but with no industry connections or much in the way of related professional experience?

ohm 9y ago
Fastest way would be OSCP cert.
- jabberwockwock 9y ago
  OSCP, red teaming, possibly CISM or CISSP for upward mobility.
  - mkagenius 9y ago
    I would not waste time and money on certifications.
    - monkeydgrif 9y ago
      As someone not in the field, but curious of getting in, could you explain why not?
      - mr_overalls 9y ago
        There is a bias against certifications by some (but by no means all) professionals in InfoSec, since it is a heavily "hands-on" field. There is more emphasis on demonstrating actual ability through CTFs, bug bounties, published exploits, etc. However, unlike Certified Ethical Hacker, CISSP, and other "mile wide, but inch deep" certs, the OSCP is a heavily hands-on certification that tests actual ability. No knowledgeable employer would discriminate against you for earning it. And CISSP or CISSM are valuable if you're applying for a management job. For government defense-sector jobs, they are often required.

deleted 9y ago

[deleted]

rhexs 9y ago

Always cracks me up thinking about how much the press talks about cybersecurity being in demand then looking at the actual IOT and embedded cybersecurity market. Everyone should be very, very scared about infrastructure/medical security and the effective lack of anyone doing anything about it. I'm sure web/network pentesting is doing well though.

jerrylives 9y ago
https://www.youtube.com/watch?v=pd91c5ZwSf0 https://www.youtube.com/watch?v=pd91c5ZwSf0 Excellent talk from last year's HOPE about the vulnerability of medical devices - he even connects to some live

goshx 9y ago

I'd love to get back to hacking and be paid to do it legally.

drraid0 9y ago

I'm looking to get out of security after being in IR and security research at a large startup for 5 years. I am having no luck finding anything besides glorified helpdesk jobs and other entry level positions.