4 ms·

Articles like these are a great anecdote of the ease of getting people into security. Despite the need for people, you'll still encounter a lot of barriers to

Articles like these are a great anecdote of the ease of getting people into security. Despite the need for people, you'll still encounter a lot of barriers to getting a job. It doesn't make sense to have a bunch of hoops to jump through when the demand is there, you can train people easily, and there are people willing to learn. You can disregard 99% of calls-to-action regarding security hiring and talent demand.

jcims 7y ago
I think you're disregarding the fact that Rita was almost certainly better than anyone in that company at playing the role of state health inspector specifically and getting into that prison without stink eye from anyone. She brought the interest (she asked for the job) and a deep domain expertise that the company was able to directly leverage into an engagement. This is something the industry is begging for and will trip over themselves to invest in. It's not clear that you're describing that kind of situation. Taking someone with essentially zero relevant experience and training them up to be someone that can deliver a skilled service to a client is a much different ask. There are companies that are willing to make that bet, I work for one now that is hiring pure developers in a security role, but they have the resources to play the long game. Little infosec consulting firms can't do that. This comes across as me disagreeing with you. I'm not, I agree security is easy to get into and there is way too much black box bullshit surrounding it. I just have been involved with companies along the full spectrum of services and capabilities and feel that not everyone is in the position to make the bet you're laying out as a sure thing.
- vsareto 7y ago
  Many physical pentesters have gotten into places where they didn't have requisite deep domain knowledge because they can research particulars or just rely on regular social engineering. If someone is able to breach a prison without the deep domain knowledge, then it's not actually that important. It's good for demonstrating the damage an insider threat could pose. This article doesn't have a comparison engagement with someone lacking domain knowledge though. I don't think the industry is tripping over themselves to get talent in any aspect. It just isn't what I've encountered. None of my prior domain knowledge counted (what little there is). Only certs and recent activity.
  - jcims 7y ago
    Depends on where you’re looking. Companies like the one in the article are not going to be in a position to do a lot of staff development unless they have no other choice..you need to be able to hit the ground running in many cases. Depending on what experience you do have you might find good luck in hiring on at larger firms like insurance, financial, healthcare where they are going to need in-house staff and can make use of other skills that you might bring while they train you up on the security side.
    - vsareto 7y ago
      I personally am going back to a dev job. It pays better and there's work to be done (incl. security). I got OSCP and 5 months later eventually landed a security job and ended up sitting on my hands for 3 months doing nothing. It isn't what the industry sold to me as "needing talent". I know there's smart people doing good work, but it could not deliver for me within a reasonable time despite putting in the work, and that was enough to realize most of the call-to-action was bullshit. If anyone asks me for career advice (no one should), I just tell them to learn to code and do code reviews in their spare time. Don't even bother with the pentesting side of it.
      - jcims 7y ago
        I blame it on the security industry because we are terrible at communicating, but your idea of how this works isn't aligned with reality. Think of it as a dumbed down version of the current staffing situation with healthcare. We have a huge talent gap, but that doesn't mean we put fresh grads to work on surgery. Pen tests and red teaming are about both skills and decision making, both of which have very high potential for significant damages if carried out incorrectly. For me personally, getting the OCSP would just tell me you have very basic skills and have demonstrated some interest. I would then have to fold you into the engagement pipeline, which would involve some thumb-warming, as basically a water person until i get feedback from the rest of the team that you are asking the right questions and are making good decisions. You would then get progressively more responsibilities and operate under scrutiny for a couple of years before you would be asked to lead anything. The fact that you did nothing for three months just tells me they were too busy to figure out how to get you started on that ramp...or they were idiots. Who knows. Again, it's a communication issue and your expectations were set too high, but that definitely doesn't mean the industry is secretly flush with talent.

jcims 7y ago

I think you're disregarding the fact that Rita was almost certainly better than anyone in that company at playing the role of state health inspector specifically and getting into that prison without stink eye from anyone. She brought the interest (she asked for the job) and a deep domain expertise that the company was able to directly leverage into an engagement. This is something the industry is begging for and will trip over themselves to invest in. It's not clear that you're describing that kind of situation. Taking someone with essentially zero relevant experience and training them up to be someone that can deliver a skilled service to a client is a much different ask. There are companies that are willing to make that bet, I work for one now that is hiring pure developers in a security role, but they have the resources to play the long game. Little infosec consulting firms can't do that. This comes across as me disagreeing with you. I'm not, I agree security is easy to get into and there is way too much black box bullshit surrounding it. I just have been involved with companies along the full spectrum of services and capabilities and feel that not everyone is in the position to make the bet you're laying out as a sure thing.

vsareto 7y ago
Many physical pentesters have gotten into places where they didn't have requisite deep domain knowledge because they can research particulars or just rely on regular social engineering. If someone is able to breach a prison without the deep domain knowledge, then it's not actually that important. It's good for demonstrating the damage an insider threat could pose. This article doesn't have a comparison engagement with someone lacking domain knowledge though. I don't think the industry is tripping over themselves to get talent in any aspect. It just isn't what I've encountered. None of my prior domain knowledge counted (what little there is). Only certs and recent activity.
- jcims 7y ago
  Depends on where you’re looking. Companies like the one in the article are not going to be in a position to do a lot of staff development unless they have no other choice..you need to be able to hit the ground running in many cases. Depending on what experience you do have you might find good luck in hiring on at larger firms like insurance, financial, healthcare where they are going to need in-house staff and can make use of other skills that you might bring while they train you up on the security side.
  - vsareto 7y ago
    I personally am going back to a dev job. It pays better and there's work to be done (incl. security). I got OSCP and 5 months later eventually landed a security job and ended up sitting on my hands for 3 months doing nothing. It isn't what the industry sold to me as "needing talent". I know there's smart people doing good work, but it could not deliver for me within a reasonable time despite putting in the work, and that was enough to realize most of the call-to-action was bullshit. If anyone asks me for career advice (no one should), I just tell them to learn to code and do code reviews in their spare time. Don't even bother with the pentesting side of it.
    - jcims 7y ago
      I blame it on the security industry because we are terrible at communicating, but your idea of how this works isn't aligned with reality. Think of it as a dumbed down version of the current staffing situation with healthcare. We have a huge talent gap, but that doesn't mean we put fresh grads to work on surgery. Pen tests and red teaming are about both skills and decision making, both of which have very high potential for significant damages if carried out incorrectly. For me personally, getting the OCSP would just tell me you have very basic skills and have demonstrated some interest. I would then have to fold you into the engagement pipeline, which would involve some thumb-warming, as basically a water person until i get feedback from the rest of the team that you are asking the right questions and are making good decisions. You would then get progressively more responsibilities and operate under scrutiny for a couple of years before you would be asked to lead anything. The fact that you did nothing for three months just tells me they were too busy to figure out how to get you started on that ramp...or they were idiots. Who knows. Again, it's a communication issue and your expectations were set too high, but that definitely doesn't mean the industry is secretly flush with talent.