4 ms·

I used to do interviews for pentesters at an old job, and I was suprised as well. I think it's because CyberSecurity is relatively new, so companies have no ide

by dx87 6y ago

I used to do interviews for pentesters at an old job, and I was suprised as well. I think it's because CyberSecurity is relatively new, so companies have no idea how to hire for it, and end up hiring whoever can talk the best. I interviewed a lot of people with titles like "Senior Cybersecurity Engineer" who had no security knowledge beyond how to run an automated scan against an IP range, and put the findings it printed out into a report for management.

tinco 6y ago
That's also the kind of report that management would like to hear instead of the real report, which should say things like "every single person on teams X-Z should use a password manager and 2-FA for everything they access both in business and in private". Security is a bother at best, and disruptive at worst. It's a tough sell, and it's so much easier to point at some badly configured network devices.
- dx87 6y ago
  > Security is a bother at best, and disruptive at worst. Yep, the devs where I work actually went to my manager and said that me reporting security findings that need to be remediated is messing up their timeline, so they wanted all testing to be put on hold until the app was already in production. Luckily my manager pushed back and said that if they don't want their timeline messed up by constantly having to remediate findings, they should stop including basic vulnerabilities in their code.
PenguinCoder 6y ago
And yet here I am with half a decade actual experience in 'Cyber Security', can write passable Golang, C, C++, Python, hands on, real world knowledge and experience of threat actors and APT TTPs, for Blue team threat hunting, IDS/IPS signature creation, incident response... etc. And I can't even get a callback from any other company, because I don't check the "Bachelor degree required" box. Fucking, awesome.
- staticassertion 6y ago
  That's very surprising. I don't have a degree and at Dropbox, the last company I worked for, dropouts were more common than those who held a bachelors. Maybe there's something else going on?
  - user5994461 6y ago
    Location most likely. Search cyber security jobs on indeed in London and there is hardly anything coming up. I can't imagine what it's like in a small city.
- 616c 6y ago
  Was curious to learn more about you, your website is nice, but the blog (blog.penguincoder.com) redirects to the main site (penguincoder.com), FYI.
  - PenguinCoder 6y ago
    Hey, thanks for the reply. My blog isn't ready for primetime yet, so I do have it redirecting to the main page for now.

by dx87 6y ago

tinco 6y ago

That's also the kind of report that management would like to hear instead of the real report, which should say things like "every single person on teams X-Z should use a password manager and 2-FA for everything they access both in business and in private". Security is a bother at best, and disruptive at worst. It's a tough sell, and it's so much easier to point at some badly configured network devices.

dx87 6y ago
> Security is a bother at best, and disruptive at worst. Yep, the devs where I work actually went to my manager and said that me reporting security findings that need to be remediated is messing up their timeline, so they wanted all testing to be put on hold until the app was already in production. Luckily my manager pushed back and said that if they don't want their timeline messed up by constantly having to remediate findings, they should stop including basic vulnerabilities in their code.

PenguinCoder 6y ago

And yet here I am with half a decade actual experience in 'Cyber Security', can write passable Golang, C, C++, Python, hands on, real world knowledge and experience of threat actors and APT TTPs, for Blue team threat hunting, IDS/IPS signature creation, incident response... etc. And I can't even get a callback from any other company, because I don't check the "Bachelor degree required" box. Fucking, awesome.

staticassertion 6y ago
That's very surprising. I don't have a degree and at Dropbox, the last company I worked for, dropouts were more common than those who held a bachelors. Maybe there's something else going on?
- user5994461 6y ago
  Location most likely. Search cyber security jobs on indeed in London and there is hardly anything coming up. I can't imagine what it's like in a small city.
616c 6y ago
Was curious to learn more about you, your website is nice, but the blog (blog.penguincoder.com) redirects to the main site (penguincoder.com), FYI.
- PenguinCoder 6y ago
  Hey, thanks for the reply. My blog isn't ready for primetime yet, so I do have it redirecting to the main page for now.