7 ms·
How do you know what everyone was paid? That’s definitely not the norm though - security engineers are typically classified the same as an SDE for payroll purp
by lawnchair_larry 7y ago
How do you know what everyone was paid?
That’s definitely not the norm though - security engineers are typically classified the same as an SDE for payroll purposes, and tend to have less negotiating leverage than high level SDEs who build and ship products, except maybe some very rare exceptions. But most companies also don’t have their security engineers actually write shipping code.
I think this article, like every security related article from bloomberg, is pretty much BS.
Also, they use the example of CISO at a large company. CISOs aren’t actually security experts in the vast majority of companies. They’re usually business people or outright frauds, disappointingly. The people who hire and interview them have no way to validate them.
The article makes a case for why CISOs are worth a lot, justifying the cost of a breach. The problem is that CISOs have virtually no impact on whether or not you get breached, and they usually bear no responsibility for it. It doesn’t matter who you pay how much - it isn’t going to affect the outcome much. Alex Stamos is one of the few that actually has any background in security at all, and look what good that did Yahoo and Facebook. Not much. The other problem is CISOs rarely get any actual authority over product, and when they try to flex, they just get pushed out. The ones who survive are simply master politicians who manage their messaging and their image.
The real reason for this article, I suspect, which appears to be primarily sourced from a security recruiting firm, is that they take a cut of every position they fill. It’s very much in their best interest to pump up the value to justify their fees.
Most security money is very poorly spent. I think part of the problem is that hackers are usually bad managers, and tend to be less interested in playing corporate politics. So the manager jobs go to someone else, who has to make decisions they don’t understand. The higher up you go, the more this gets amplified. For every breach you hear about, that company likely has a few competent security folks saying, “see, I told you...”
- Bhilai 7y agoAgreed on most points except in some cases where CISOs are actually people who rise up through the ranks within security and actually know their shit. But I concede that its not very common.
- tptacek 7y agoI don't know what they did at Microsoft, but this is just pants-are-shirts wrong for SFBA tech companies. I could tell you I know this from near-firsthand experience (getting offers, watching friends get offers, for both SDE and security roles, as well as doing technical recruiting work for our clients, who are almost all SFBA startups), but you're also responding to someone giving you firsthand knowledge at Netflix. The people telling you security talent commands a premium are not lying and they're not wrong. There is a general instinct people have to push back on "look at these high salaries" data points because, not to put too fine a point on it, they're not good negotiators and get second-tier offers. That includes a lot of people with truly extraordinary talent; negotiating skill and delivery skill are, of course, orthogonal. But even that is changing; all you have to do is keep your ear to the ground to know that the standard SFBA SDE salary is not the market clearing rate for (e.g.) software security.
- novok 7y agoSo what is the market clearing TC for security SDEs? A google staff level security eng vs a google staff level general eng for example?
- lawnchair_larry 7y agoGoogle does not differentiate those roles (like just about every company). Most companies have a “faux title” and a real title. The real title for security engineers is usually the same title as software engineers. I’m not saying that no company exists with security engineers in a separate pay ladder (because who knows), but I’ve personally never heard of one. It’s about as difficult to answer that as it is to answer what the market rate is for SDEs. They vary wildly. Like hundreds of thousands in variation. And even the same role at the same level varies wildly depending on negotiated initial offer and performance bonuses/discretionary equity grants. Facebook in particular gave out $1M in DE to their top performing SDEs, even at lower pay grades. Also, appsec tends to be distinct from IT security (who tend to be classified as IT/SRE/Ops or similar), and often outside of the CISO/CSO scope, but not always.
- lawnchair_larry 7y ago
- allthecybers 7y agoMost of my years spent in the cyber security space revolved around consulting with large companies. The most common activity we consulted on was cyber security related technical transformation. Basically a company would hire a new security manager or CISO who had all their favorite security solutions and vendors. So everything already implemented had to be replaced with the CISO preferred solution. This kept an army of consultants and business analysts and project managers in business as well as gave the security org the feeling they were making a difference. Might not be the case everywhere but was certainty the norm in the consulting world.
- lawnchair_larry 7y agoI’ve spent time in consulting at and with the name brand pen testing shops and never heard of this type of consulting. I don’t doubt your account, but that’s a foreign concept to me. I’m curious which consulting shops work that way.
- allthecybers 7y agoInformation security system integration consulting shops. I think we had some pen testing going on but the but the money was made selling a new IBM governance tool or SIEM solution and then a new security manager comes in and he prefers SailPoint or Microsoft so everything gets switched over.
- jedberg 7y ago> How do you know what everyone was paid? We talked pretty openly about salary. Also, managers, or anyone involved in setting pay, had a spreadsheet of all the engineers salaries for level setting purposes.
- lawnchair_larry 7y agoAs far as you’re aware, does the same hold true for security engineers at netflix who don’t check in any code?
- jedberg 7y agoThose would be security auditors, and I don't know. They wouldn't have been on the engineering list. You're not a security engineer if you don't check in code.
- brown9-2 7y agoWho cares how the role is classified in the payroll system? That’s now how anyone serious determines what an individual’s compensation is.
- eitally 7y agoYes it is. Companies set salary ranges based on cost of labor in given markets. They do this by grouping job codes into job families. The job families are what's benchmarked. It's entirely possible for there to be a broad range of job codes and business titles (or even one job code & multiple business titles) with the same benchmark. Because CoL benchmarking only works if companies share labor data with each other, they typically have no problem sharing this information to clearinghouses that provide this analysis service for pay. It also means the benchmarking tends to be fairly accurate.
- staticassertion 7y agoI definitely feel like I have much more negotiating power than eng, as someone who used to be in an eng role and is now in security. There are more engineers and eng is a less niche skillset. There are very, very few people with my skillset. Hiring for my team takes months, minimum, with far far fewer candidates in our pipe. I work at an SF company and routinely field offers from other companies that I can view on levels.fyi, and my colleagues in eng are open with me about their salaries so I have lots of datapoints to compare to. To your other comment: > I seriously question whether you understand how mediocre the mean security engineer actually is, even at top tier companies This seems equally true for eng.
- bitcoinmoney 7y agoin The spirit of HN camaraderie: can you share salary info and your transition process?
- staticassertion 7y agoYou can go to levels.fyi and just add 5 to 10% to anything you see, and that's what I expect from the companies I apply to.
- trhway 7y ago>There are very, very few people with my skillset. "security" seems to be a very wide notion. Can you give some highlights of what that specific skillset is and what is your job actually consists of.
- staticassertion 7y agoI have an engineering background, which is quickly becoming a requirement for security roles. I do detection and response work.
- nesadi 7y agoI'm interested in getting into security. Can you give any insight on what you're looking for in candidates?
- croh 7y agoYour username is cool. m tired of cooperate bs. just want to sit in my lawn on my chair.
- wglb 7y agoThere are a lot of ways you are flat wrong about this issue. I was a CSO at a large technical company and we were successful in separating the role of Security Engineer from regular Engineer with HR. With regard to corporate politics, you have hit on an interesting aspect of the problem. Why is it that politics should trump the actions taken to prevent breaches? The CSO/CISOs that I know all have this stress of knowing what the risks are and the difficulty of moving the organization, incrementally, towards a safer posture. Successful ones know how to navigate whatever the culture is and somehow produce a solution. The underlying causes of breaches really come down to 1. the corporate culture, 2. the technical competence of the organization, top to bottom, and 3. the strength of the security team. If the security team up through the CSO is very good and the culture is not so good (recent breaches will give you names), or the technical competence of the company is low (e.g., putting a breach response site on the internet disconnected from your root domain), then the effectiveness of the CSO is not very good. There is a fundamental tension between spewing off features to win market share and producing quality, secure software. A wise company will find a CSO who can help move the culture and influence the technical practices. Those folks are very rare, and as such will have very high pay.