5 ms·

On my end the growingest vector is audit remediation. Your cyber insurance providers have noticed that you constructed your environments out of swiss cheese and

On my end the growingest vector is audit remediation. Your cyber insurance providers have noticed that you constructed your environments out of swiss cheese and are now mandating actual pentesting and practical demonstrations of your fixes if you want to maintain your policy. Those self service checklists seem to be going away. gotta say, audit remediation is a pretty chill field to be in as well. The recent round of 'hackers dont sleep for the holidays' articles made me feel glad to get out of the incident response game.

ethbr0 5y ago
It's insane they wrote policies without this as an expectation. I mean, you could write a policy that's essentially LifeLock's "What are the odds someone will actually notice you?" priced, but I feel like market forces would have resulted in drastically under-pricing those premiums (to get sales).
- Mountain_Skies 5y ago
  Self-certification has been a big thing over the past few years. It doesn't make much sense to me unless insurers are planning on rejecting claims when previous self-certification claims can't be verified.
SandwichTeeth 5y ago
Doing incident response was the most stressful job I've ever had. I left it to do security engineering and don't miss it in the slightest. So many nights and weekends blown on calls with lawyers, executives, etc.
wilkommen 5y ago
What company do you work for (if you don’t mind being asked)? I’m curious about audit remediation, it sounds like a field I might be interested in. I’m currently in an SRE role.
- jabroni_salad 5y ago
  I work for a big4, which is finance's version of FAANG I guess. I don't really recommend it if you are already situated elsewhere, as noob consulting life is a real drag if you are used to being an FTE. However, all of these financial audit firms are beefing up on tech staff right now. This is one of the better non-developer IT jobs in the midwest.

ethbr0 5y ago

It's insane they wrote policies without this as an expectation. I mean, you could write a policy that's essentially LifeLock's "What are the odds someone will actually notice you?" priced, but I feel like market forces would have resulted in drastically under-pricing those premiums (to get sales).

Mountain_Skies 5y ago
Self-certification has been a big thing over the past few years. It doesn't make much sense to me unless insurers are planning on rejecting claims when previous self-certification claims can't be verified.

SandwichTeeth 5y ago

Doing incident response was the most stressful job I've ever had. I left it to do security engineering and don't miss it in the slightest. So many nights and weekends blown on calls with lawyers, executives, etc.

wilkommen 5y ago

What company do you work for (if you don’t mind being asked)? I’m curious about audit remediation, it sounds like a field I might be interested in. I’m currently in an SRE role.

jabroni_salad 5y ago
I work for a big4, which is finance's version of FAANG I guess. I don't really recommend it if you are already situated elsewhere, as noob consulting life is a real drag if you are used to being an FTE. However, all of these financial audit firms are beefing up on tech staff right now. This is one of the better non-developer IT jobs in the midwest.