4 ms·

Like who? I have better than an IT background, I have a degree in software engineering and a couple of years experience and have never been seriously considered

Like who? I have better than an IT background, I have a degree in software engineering and a couple of years experience and have never been seriously considered for an infosec position.

godelmachine 9y ago
How did you apply? Which companies? How did you fare in the interviews?
marpstar 9y ago
I'm a "software engineer", but I know a plenty of other "software engineers" who know less about TCP/IP than IT people I know. What about being a SWE makes you feel more suited for the job?
- bitexploder 9y ago
  In my experience knowing about TCP/IP is not required depending on the individual's background (say, graphics driver developer). It just turns out most good hackers tend to be curious and either learn it very quickly or already know it. We like software engineers because they can synthesize complex software architectures, whereas someone with only networking knowledge will be at a much larger knowledge deficit on most software focused assessments. Infosec has trended toward application focused security for many years now.
- Mandatum 9y ago
  This is part of the problem with hiring in InfoSec. I was turned down years ago for a role as a junior because I didn't know enough about some very specific, foundational technology. I joined a consultancy and within a year I was speaking at those same conferences that I met that would-be employer. In an hour you can go over only a finite amount of knowledge, I was asked about aspects of technology I knew very little about because I hadn't tried anything in that space (FWIW it was a segment of networking). To pass over candidates based on a minuet lack of detailed knowledge - to me is crazy. It's like interviewing a builder and asking them if they know where the majority of local maple wood comes from. Who cares, and if you need to know - Google it! Great, now you know more than you ever needed about the local maple industry! YMMV, sample size 1, etc
  - fancyfacebook 9y ago
    If you're speaking at conferences then you are doing your infosec career wrong.
    - qaq 9y ago
      Hmm why?
    - Mandatum 9y ago
      If I was a fully funded academic, I'd agree with you. But the reality is I trade my time for money - to maximize the latter, appearing as a "leader" in my field requires I give talks to both technical and business tracks. The former might pay my bills (if they're a successful tech startup), the latter definitely will. Conferences are great for networking and entertaining. They're not great for learning new stuff, there's much better media out there. I'm not sure what your gripes are with it.
- dogecoinbase 9y ago
  I could pick some random piece of intrinsic tech you know nothing to devalue you quite easily. I work with TCP at a protocol level every. single. day. and I don't doubt that a decent mid-level SWE could pick it up in a less than a week, and be making clever modifications in less than a month. Standards aren't hard. Code isn't hard. Willingness to ask questions is hard. Knowing when you need to stop and think is hard. Dealing with people, in a way that respects their perspective and experience, is hard, and is the primary talent of any engineer, software or otherwise.
bitexploder 9y ago
This is precisely why we have tuned our hiring process to find people with no infosec experience but a strong technology background. If you come in understanding, fundamentally how computers work (at a systems level) and a genuine interest in information security there limited barriers. Most organizations are not equipped to hire for one-of roles on dev teams involving information security.
deleted 9y ago
[deleted]
qaq 9y ago
It's hard for me to say why without more information. There is an interesting middle ground you can work as a software engineer for a company working on security products so it might be easier to switch later.
rhexs 9y ago
I've found that tech companies have harder interview loops for infosec than in software engineering. For software engineering, know your college algorithms and you'll have a decent shot. For infosec, the hiring bar is entirely random. Know your algorithms as those questions are all still fair game, know an enormous and entirely random amount of security trivia as infosec has interviewers with incredible ego, be able to solve CTF challenge problems under extreme pressure in 30 minutes, be able to review code in all programming languages for security defects, etc. I recently had an interview for a IoT penetration testing role (requiring C and Python) at a large tech company. The first phone screen was an engineer on an unrelated team asking me Java OWASP Top 10 style questions. What on earth??? Apparently CTFs (which do nothing except teach you how to get better at CTFs) are the new hiring bar. God only knows what's next. So don't feel bad. Keep interviewing and you'll get lucky. Luck has far more to do with it than anything else at the moment.

Like who? I have better than an IT background, I have a degree in software engineering and a couple of years experience and have never been seriously considered for an infosec position.

godelmachine 9y ago

How did you apply? Which companies? How did you fare in the interviews?

marpstar 9y ago

I'm a "software engineer", but I know a plenty of other "software engineers" who know less about TCP/IP than IT people I know. What about being a SWE makes you feel more suited for the job?

bitexploder 9y ago
In my experience knowing about TCP/IP is not required depending on the individual's background (say, graphics driver developer). It just turns out most good hackers tend to be curious and either learn it very quickly or already know it. We like software engineers because they can synthesize complex software architectures, whereas someone with only networking knowledge will be at a much larger knowledge deficit on most software focused assessments. Infosec has trended toward application focused security for many years now.
Mandatum 9y ago
This is part of the problem with hiring in InfoSec. I was turned down years ago for a role as a junior because I didn't know enough about some very specific, foundational technology. I joined a consultancy and within a year I was speaking at those same conferences that I met that would-be employer. In an hour you can go over only a finite amount of knowledge, I was asked about aspects of technology I knew very little about because I hadn't tried anything in that space (FWIW it was a segment of networking). To pass over candidates based on a minuet lack of detailed knowledge - to me is crazy. It's like interviewing a builder and asking them if they know where the majority of local maple wood comes from. Who cares, and if you need to know - Google it! Great, now you know more than you ever needed about the local maple industry! YMMV, sample size 1, etc
- fancyfacebook 9y ago
  If you're speaking at conferences then you are doing your infosec career wrong.
  - qaq 9y ago
    Hmm why?
  - Mandatum 9y ago
    If I was a fully funded academic, I'd agree with you. But the reality is I trade my time for money - to maximize the latter, appearing as a "leader" in my field requires I give talks to both technical and business tracks. The former might pay my bills (if they're a successful tech startup), the latter definitely will. Conferences are great for networking and entertaining. They're not great for learning new stuff, there's much better media out there. I'm not sure what your gripes are with it.
dogecoinbase 9y ago
I could pick some random piece of intrinsic tech you know nothing to devalue you quite easily. I work with TCP at a protocol level every. single. day. and I don't doubt that a decent mid-level SWE could pick it up in a less than a week, and be making clever modifications in less than a month. Standards aren't hard. Code isn't hard. Willingness to ask questions is hard. Knowing when you need to stop and think is hard. Dealing with people, in a way that respects their perspective and experience, is hard, and is the primary talent of any engineer, software or otherwise.

bitexploder 9y ago

This is precisely why we have tuned our hiring process to find people with no infosec experience but a strong technology background. If you come in understanding, fundamentally how computers work (at a systems level) and a genuine interest in information security there limited barriers. Most organizations are not equipped to hire for one-of roles on dev teams involving information security.

deleted 9y ago

[deleted]

qaq 9y ago

It's hard for me to say why without more information. There is an interesting middle ground you can work as a software engineer for a company working on security products so it might be easier to switch later.

rhexs 9y ago

I've found that tech companies have harder interview loops for infosec than in software engineering. For software engineering, know your college algorithms and you'll have a decent shot. For infosec, the hiring bar is entirely random. Know your algorithms as those questions are all still fair game, know an enormous and entirely random amount of security trivia as infosec has interviewers with incredible ego, be able to solve CTF challenge problems under extreme pressure in 30 minutes, be able to review code in all programming languages for security defects, etc. I recently had an interview for a IoT penetration testing role (requiring C and Python) at a large tech company. The first phone screen was an engineer on an unrelated team asking me Java OWASP Top 10 style questions. What on earth??? Apparently CTFs (which do nothing except teach you how to get better at CTFs) are the new hiring bar. God only knows what's next. So don't feel bad. Keep interviewing and you'll get lucky. Luck has far more to do with it than anything else at the moment.