7 ms·

I'm a senior level security leader and hiring manager. I focus on software security. Ask me anything about what I see, or don't, in candidates.

Izmaki 6y ago
How much do you value CEH?
- allanbreyes 6y ago
  A follow-up: how much do you value OSCP?
  - Izmaki 6y ago
    Hopefully the answer will be "A LOT more than CEH", but I wanted to test the waters. :P
    - beardedwizard 6y ago
      I do not value CEH or OSCP at all. The candidate will need to demonstrate they can apply that skill against a real world situation. I wont be more likely to interview you by having these on your resume, but it may help a recruiter put it in front of me (though I will never tell them to look for these keywords)
      - GekkePrutser 6y ago
        Good!! That's the right approach. I also think these certifications are forcing students to think in the direction intended by the underlying company, whereas hacking is about looking for the unexpected. It's about mastery of technology, not about ticking some boxes and knowing command-line parameters of common tools by heart. Indeed there is a major issue with HR focusing too strongly on certificates because they lack the knowledge to evaluate a candidate any other way.
      - Izmaki 6y ago
        > The candidate will need to demonstrate they can apply that skill against a real world situation. I thought this is exactly what holders of the OSCP certificate has demonstrated during the exam?
        beardedwizard 6y ago
        Im less interested in someone else telling me you can do it, and more into you demonstrating you can do it in a situation I care about. See my earlier comment regarding the relative strength of candidates with OSCP.
      - Izmaki 6y ago
        GekkePrutser: > Good!! That's the right approach. I also think these certifications are forcing students to think in the direction intended by the underlying company, whereas hacking is about looking for the unexpected. It's about mastery of technology, not about ticking some boxes and knowing command-line parameters of common tools by heart. CEH is box ticking. OSCP is breaking into stuff. That hacking is about "mastery of technology" I don't agree with. The latest major vulnerabilities identified this month were very low hanging fruits, and I bet you there's still way too many unpatched instances of BIG-IP, NetScaler and Windows DNS out there right this moment. ...two of which have available POCs online for any scriptkiddie to get their hands on. If not all three... the researchers who found the Windows DNS vulnerability have agreed to hold their horses for a while, letting admins patch their systems before releasing all details. Latteral movement in an Active Directory environment is trickier than looking up a version number and trying your luck with a POC, sure, but you give too much credit to hackers, man. :P
      - Izmaki 6y ago
        > See my earlier comment regarding the relative strength of candidates with OSCP. Have you been through the course and exam yourself, or are you basing this on something else? If you've been through the experience, which parts of it contribute to you not valuing it?
        beardedwizard 6y ago
        I have not, and have no plan to take OSCP - though im familiar with it. I'm relating the facts about candidates who applied to my roles with OSCP certifications. I did not hire any of them. I do not specifically dislike OSCP, its that I do not value any of the certs merely because someone possesses them. Certs are a marginal signal to me about your potential for discipline, may inform how deep I go on questioning, and thats it. Conversely, certs may lead to bias, particularly for some very lame ones. I don't think it's very fair to weight letters on a resume so heavily, it's about what you can do in the role I have for you. Having them is not something that will make a big difference to me.
  - beardedwizard 6y ago
    I have to be blunt - many of my weakest candidates came with these certs. Im impressed when you are already amazing at these things, and then show the discipline to get the cert anyway. Im passing on your candidacy when you have the cert, but put me to sleep with the practical application. I'm less interested if you can study, and more interested if you can LEARN.
allanbreyes 6y ago
Can you talk about your interview process? e.g. types of interviews, screens vs. on-sites, distributions, etc. What are the shortcomings that keeps a candidate from an offer in the final steps, e.g. the candidate passes screening interviews, but falls short on an on-site interview. What are the indicators you observe that differentiate a senior candidate? How do you go about evaluating entry-level and junior candidates? Thank you!
- beardedwizard 6y ago
  We do a few screens, starting with general security discussion - something like: intro, light tech/coding - just to make sure we aren't completely wasting our time The main interview centers on software security, and is focused on real world scenarios. We avoid "explain this OWASP top 10 blah blah blah" kind of questions. The goal is to see if you can reach the outcomes we expect, regardless of how you may approach them. I don't care if you can explain SQLi to me, you should be able to approach exploiting it on a live system. We will: * Give you a sample system and ask you to threat model it. Maybe you will use STRIDE, maybe you wont, but we hope you will find some threats using structured techniques. * Ask you about secure systems you have designed, why you made the choices you made, and how you would make them differently today. We want to know if you have a methodology, a structured approach, and experience. * Expose you to vulnerable code implementations, and running systems. We hope you will discover vulnerabilities. * Show you examples of our systems, and ask you how you would secure them. We want to understand if you can see, and discuss security architecture. * Role play developer interaction scenarios. Can you handle soft skills? * Have you done any of this at scale? Do you understand how to make it work for 10, and 1000 developers? Explain your experience, how would you do it differently? I can go on, but again the emphasis is evaluating whether or not you can do the tasks we need you to do, with a high degree of quality in whichever way works best for you, while also being able to completely ignore your resume if we want. It is extremely difficult for us to consider hiring junior candidates, and we frequently encounter candidates with no deep experience. While it is unfair to expect candidates to have spent time at home treating this as a passion project, those are the ones im going to hire because they can deliver the outcomes in an interview. To combat the hiring difficulty, we have arrived at this approach which allows us to send candidates through the machinery quickly, with low bias.
lormayna 6y ago
Are you hiring? :)
- beardedwizard 6y ago
  in sfbay
  - lormayna 6y ago
    I am in Europe, so nevermind. Thank you anyway
BearsAreCool 6y ago
I notice in your other replies you have several interview questions that seem to be targeted at previous experience. What kind of side projects, cybersecurity or just programming related, do you find the most appealing in a candidate?
- beardedwizard 6y ago
  I love to hear about the tools people have created. There is almost always a good story about a problem and a solution. However, this is not really what I mean. If you are interviewing for a role in software security, you should be current on the industry and ready to talk sources and research. At a minimum, you should have areas of interest that you are passionate about discussing, even if you are still ignorant about the deep details. You wont do well if security is something you only do 9-5, but I don't want you working for me after hours.
  - ggerts 6y ago
    I think I've got a good example of a tool that I created that comes with a good story about a problem and a solution. Would love your feedback as I'm a recent CS grad struggling along. https://www.gfrom83.xyz/ https://www.gfrom83.xyz/

Izmaki 6y ago

How much do you value CEH?

allanbreyes 6y ago
A follow-up: how much do you value OSCP?
- Izmaki 6y ago
  Hopefully the answer will be "A LOT more than CEH", but I wanted to test the waters. :P
  - beardedwizard 6y ago
    I do not value CEH or OSCP at all. The candidate will need to demonstrate they can apply that skill against a real world situation. I wont be more likely to interview you by having these on your resume, but it may help a recruiter put it in front of me (though I will never tell them to look for these keywords)
    - GekkePrutser 6y ago
      Good!! That's the right approach. I also think these certifications are forcing students to think in the direction intended by the underlying company, whereas hacking is about looking for the unexpected. It's about mastery of technology, not about ticking some boxes and knowing command-line parameters of common tools by heart. Indeed there is a major issue with HR focusing too strongly on certificates because they lack the knowledge to evaluate a candidate any other way.
    - Izmaki 6y ago
      > The candidate will need to demonstrate they can apply that skill against a real world situation. I thought this is exactly what holders of the OSCP certificate has demonstrated during the exam?
      - beardedwizard 6y ago
        Im less interested in someone else telling me you can do it, and more into you demonstrating you can do it in a situation I care about. See my earlier comment regarding the relative strength of candidates with OSCP.
    - Izmaki 6y ago
      GekkePrutser: > Good!! That's the right approach. I also think these certifications are forcing students to think in the direction intended by the underlying company, whereas hacking is about looking for the unexpected. It's about mastery of technology, not about ticking some boxes and knowing command-line parameters of common tools by heart. CEH is box ticking. OSCP is breaking into stuff. That hacking is about "mastery of technology" I don't agree with. The latest major vulnerabilities identified this month were very low hanging fruits, and I bet you there's still way too many unpatched instances of BIG-IP, NetScaler and Windows DNS out there right this moment. ...two of which have available POCs online for any scriptkiddie to get their hands on. If not all three... the researchers who found the Windows DNS vulnerability have agreed to hold their horses for a while, letting admins patch their systems before releasing all details. Latteral movement in an Active Directory environment is trickier than looking up a version number and trying your luck with a POC, sure, but you give too much credit to hackers, man. :P
    - Izmaki 6y ago
      > See my earlier comment regarding the relative strength of candidates with OSCP. Have you been through the course and exam yourself, or are you basing this on something else? If you've been through the experience, which parts of it contribute to you not valuing it?
      - beardedwizard 6y ago
        I have not, and have no plan to take OSCP - though im familiar with it. I'm relating the facts about candidates who applied to my roles with OSCP certifications. I did not hire any of them. I do not specifically dislike OSCP, its that I do not value any of the certs merely because someone possesses them. Certs are a marginal signal to me about your potential for discipline, may inform how deep I go on questioning, and thats it. Conversely, certs may lead to bias, particularly for some very lame ones. I don't think it's very fair to weight letters on a resume so heavily, it's about what you can do in the role I have for you. Having them is not something that will make a big difference to me.
- beardedwizard 6y ago
  I have to be blunt - many of my weakest candidates came with these certs. Im impressed when you are already amazing at these things, and then show the discipline to get the cert anyway. Im passing on your candidacy when you have the cert, but put me to sleep with the practical application. I'm less interested if you can study, and more interested if you can LEARN.

allanbreyes 6y ago

Can you talk about your interview process? e.g. types of interviews, screens vs. on-sites, distributions, etc. What are the shortcomings that keeps a candidate from an offer in the final steps, e.g. the candidate passes screening interviews, but falls short on an on-site interview. What are the indicators you observe that differentiate a senior candidate? How do you go about evaluating entry-level and junior candidates? Thank you!

beardedwizard 6y ago
We do a few screens, starting with general security discussion - something like: intro, light tech/coding - just to make sure we aren't completely wasting our time The main interview centers on software security, and is focused on real world scenarios. We avoid "explain this OWASP top 10 blah blah blah" kind of questions. The goal is to see if you can reach the outcomes we expect, regardless of how you may approach them. I don't care if you can explain SQLi to me, you should be able to approach exploiting it on a live system. We will: * Give you a sample system and ask you to threat model it. Maybe you will use STRIDE, maybe you wont, but we hope you will find some threats using structured techniques. * Ask you about secure systems you have designed, why you made the choices you made, and how you would make them differently today. We want to know if you have a methodology, a structured approach, and experience. * Expose you to vulnerable code implementations, and running systems. We hope you will discover vulnerabilities. * Show you examples of our systems, and ask you how you would secure them. We want to understand if you can see, and discuss security architecture. * Role play developer interaction scenarios. Can you handle soft skills? * Have you done any of this at scale? Do you understand how to make it work for 10, and 1000 developers? Explain your experience, how would you do it differently? I can go on, but again the emphasis is evaluating whether or not you can do the tasks we need you to do, with a high degree of quality in whichever way works best for you, while also being able to completely ignore your resume if we want. It is extremely difficult for us to consider hiring junior candidates, and we frequently encounter candidates with no deep experience. While it is unfair to expect candidates to have spent time at home treating this as a passion project, those are the ones im going to hire because they can deliver the outcomes in an interview. To combat the hiring difficulty, we have arrived at this approach which allows us to send candidates through the machinery quickly, with low bias.

lormayna 6y ago

Are you hiring? :)

beardedwizard 6y ago
in sfbay
- lormayna 6y ago
  I am in Europe, so nevermind. Thank you anyway

BearsAreCool 6y ago

I notice in your other replies you have several interview questions that seem to be targeted at previous experience. What kind of side projects, cybersecurity or just programming related, do you find the most appealing in a candidate?

beardedwizard 6y ago
I love to hear about the tools people have created. There is almost always a good story about a problem and a solution. However, this is not really what I mean. If you are interviewing for a role in software security, you should be current on the industry and ready to talk sources and research. At a minimum, you should have areas of interest that you are passionate about discussing, even if you are still ignorant about the deep details. You wont do well if security is something you only do 9-5, but I don't want you working for me after hours.
- ggerts 6y ago
  I think I've got a good example of a tool that I created that comes with a good story about a problem and a solution. Would love your feedback as I'm a recent CS grad struggling along. https://www.gfrom83.xyz/ https://www.gfrom83.xyz/