3 ms·
Based on my experience, there is a huge talent shortage, especially outside of the Bay Area. I'm not a security person myself, but my team tried to hire a secur
by puzzle 9y ago
Based on my experience, there is a huge talent shortage, especially outside of the Bay Area. I'm not a security person myself, but my team tried to hire a security person multiple times.
You'll often find people that have experience running automated scans, filling up compliance paperwork, setting up firewalls and SIEM tools, etc. but don't know how to deal with source code or mitigation. At the other end of the spectrum, there's a small number of people who can review code and write tools, exploits, etc. but hate the bureaucratic work. In the middle, which is the kind of person that a startup or small company would want to hire, there is an even tinier number of candidates.
The kinds of things you are doing sound great. Perhaps try to participate in bug bounties, too. One reason you don't see a ton of job postings is that many companies don't know yet they need them. :-) Also, a lot of recruiting might just happen through word-of-mouth or in an outbound fashion. In my limited interactions, I found that the security community can sometimes work like a club or a society, more than in other tech circles.
- dboreham 9y ago>but don't know how to deal with source code or mitigation actually I have noticed this and so we are spinning up a security consulting practice in 2018 looking to address this gap (staffed with experienced developers or former developers). Time will tell if this is a workable approach..
- skgoa 9y agoThat would be awesome. IME people care about security in principle, but no one really knows how to write secure software.
- tradesmanhelix 9y agoThat sounds like a fantastic idea. Would love to follow the journey / potentially throw my hat in the ring as you start looking for devs. I'm @tradesmanhelix on Twitter if you'd like to chat.
- rasz 9y ago>small number of people who can review code and write tools, exploits, etc. but hate the bureaucratic work Because once you learn enough of the stuff you start to realize its all bullshit. Compliance (hipaa hitech, pci, sox) and most industry standard practices (antivirus, firewalling) are lipstick on a pig. Very often you have to chose between being secure or standard compliant (for example running antivirus can be a big security hole, or give false sense of security).
- puzzle 9y agoThat's very true, but at the same time, with the right auditors who really understand this stuff, you have a fair amount of latitude.