4 ms·

The consulting work I do delivers things in a day that would usually take clients' staff 10-20 days to do, and there are many things I do in a minute that woul

The consulting work I do delivers things in a day that would usually take clients' staff 10-20 days to do, and there are many things I do in a minute that would take most people in my field an hour. I can do this because security skills are a very long tailed distribution. Does that make me 10x to 60x?

brundolf 6y ago
A friend of mine recently said: > The 10x programmer is a myth, it's just that corporate collaborative software development practices routinely produce teams of >10 that get less done than a single competent developer working independently My theory is this is one of the main benefits of hiring a consultant. They can cut through bureaucracy.
- PeterisP 6y ago
  Yep, some of the most added value I have seen in consulting was essentially taking recommendations that department A was unsuccessfully requesting for a long time already and getting department B to actually implement them, i.e. an organizational shortcut enabling something that simply wasn't possible given their current structure. Pretty much every large company has a lot of good things that they aren't doing because of their dysfunctional internal bureaucracy that causes them to disregard good proposals (and sometimes intentionally sabotage them for reasons of internal politics) until they are re-packaged by some expensive consultants for top management blessing.
  - systemBuilder 6y ago
    Agreed; my dad interviewed to be a VP at Lockheed in the 1960s and eventually turned down the job saying, "All your problems are political! None are technical!"
    - perl4ever 6y ago
      At my previous job, I used to sit in meetings thinking all the problems were political/communication, and those are the only interesting ones. Over the years, I didn't come to the conclusion "I want to be insulated from non-technical problems" (which is an easy thing to achieve) but rather "I want to be involved in solutions that are technically trivial, but solve organizational issues". Because those are the ones where the most leverage and meaning exists.
- CameronNemo 6y ago
  Anecdote time: I requested a CI runner from the systems/infrastructure team, and they ghosted me for two years. I just stood up a CI runner myself using my own resources, about a week after they ghosted. Recently they hired a third party firm from India to make a CI/CD pipeline, never told me, and claimed credit for "the first CI/CD pipeline at the company".
- jandrewrogers 6y ago
  It is necessary but not sufficient to be a legitimate 10x technical subject matter expert. Most organizations lack the expertise but they also lack effective leadership and organization to apply the expertise even if they have it. Part of the job of being a highly paid “10x engineer” is to fix the organization so that the organization can fix the technical problem. The former will consume 90% of your time. Some 10x engineers have legitimately exceptional technical abilities that stand on their own, but the critical skill for many (most?) is being really good at smoothly fixing broken engineering processes and organizations from first principles. A handful are good at both. The main benefit of hiring a consultant is that management can blame them for uncomfortable changes.
jcims 6y ago
A career in infosec tends to develop an extremely broad set of skills (with commensurate lack of depth in many of them) that can turn you into a generalist superhero when shit hits the fan. Back in my heyday I would get called in to help fix outages as much as I would for security work. Feltgoodman. Ten years later and I'm now adrift in some weird role between an engineer and program director with zero accountability. I just go from Zoom meeting to Zoom meeting knocking down bullshit and connecting the right people in a big company. I've essentially become a giant tube of organizational lube. Feelsbadman.
- geoduck14 6y ago
  >organizational lube Hey honey, happy Valentines day!
- motohagiography 6y ago
  Indeed, the breadth piece is huge. The depth, so long as you have some extra self awareness that you literally only know the table of contents level of most things, and can do some composition of them while knowing where to find people with depth in them, you can solve a lot of problems. If you can tell whether you need new science to solve a problem, or it's a function of work by composing a bunch of solved problems, that's going to elevate your abilities fast as well. I wonder if the right metaphor is security is like the eng.sci of tech. Reality is in security is we've spent a career navigating, negotiating, and implementing the real power relationships that the technology facilitates. These are performance, economic, legal, business, organizational, environmental, institutional, etc.
  - jcims 6y ago
    Perfect encapsulation of why I love working in infosec.

brundolf 6y ago

A friend of mine recently said: > The 10x programmer is a myth, it's just that corporate collaborative software development practices routinely produce teams of >10 that get less done than a single competent developer working independently My theory is this is one of the main benefits of hiring a consultant. They can cut through bureaucracy.

PeterisP 6y ago
Yep, some of the most added value I have seen in consulting was essentially taking recommendations that department A was unsuccessfully requesting for a long time already and getting department B to actually implement them, i.e. an organizational shortcut enabling something that simply wasn't possible given their current structure. Pretty much every large company has a lot of good things that they aren't doing because of their dysfunctional internal bureaucracy that causes them to disregard good proposals (and sometimes intentionally sabotage them for reasons of internal politics) until they are re-packaged by some expensive consultants for top management blessing.
- systemBuilder 6y ago
  Agreed; my dad interviewed to be a VP at Lockheed in the 1960s and eventually turned down the job saying, "All your problems are political! None are technical!"
  - perl4ever 6y ago
    At my previous job, I used to sit in meetings thinking all the problems were political/communication, and those are the only interesting ones. Over the years, I didn't come to the conclusion "I want to be insulated from non-technical problems" (which is an easy thing to achieve) but rather "I want to be involved in solutions that are technically trivial, but solve organizational issues". Because those are the ones where the most leverage and meaning exists.
CameronNemo 6y ago
Anecdote time: I requested a CI runner from the systems/infrastructure team, and they ghosted me for two years. I just stood up a CI runner myself using my own resources, about a week after they ghosted. Recently they hired a third party firm from India to make a CI/CD pipeline, never told me, and claimed credit for "the first CI/CD pipeline at the company".
jandrewrogers 6y ago
It is necessary but not sufficient to be a legitimate 10x technical subject matter expert. Most organizations lack the expertise but they also lack effective leadership and organization to apply the expertise even if they have it. Part of the job of being a highly paid “10x engineer” is to fix the organization so that the organization can fix the technical problem. The former will consume 90% of your time. Some 10x engineers have legitimately exceptional technical abilities that stand on their own, but the critical skill for many (most?) is being really good at smoothly fixing broken engineering processes and organizations from first principles. A handful are good at both. The main benefit of hiring a consultant is that management can blame them for uncomfortable changes.

jcims 6y ago

A career in infosec tends to develop an extremely broad set of skills (with commensurate lack of depth in many of them) that can turn you into a generalist superhero when shit hits the fan. Back in my heyday I would get called in to help fix outages as much as I would for security work. Feltgoodman. Ten years later and I'm now adrift in some weird role between an engineer and program director with zero accountability. I just go from Zoom meeting to Zoom meeting knocking down bullshit and connecting the right people in a big company. I've essentially become a giant tube of organizational lube. Feelsbadman.

geoduck14 6y ago
>organizational lube Hey honey, happy Valentines day!
motohagiography 6y ago
Indeed, the breadth piece is huge. The depth, so long as you have some extra self awareness that you literally only know the table of contents level of most things, and can do some composition of them while knowing where to find people with depth in them, you can solve a lot of problems. If you can tell whether you need new science to solve a problem, or it's a function of work by composing a bunch of solved problems, that's going to elevate your abilities fast as well. I wonder if the right metaphor is security is like the eng.sci of tech. Reality is in security is we've spent a career navigating, negotiating, and implementing the real power relationships that the technology facilitates. These are performance, economic, legal, business, organizational, environmental, institutional, etc.
- jcims 6y ago
  Perfect encapsulation of why I love working in infosec.