6 ms·

We are looking for a developer experienced in securing our whole stack: Rails backend, Vue frontend and infra on AWS. This kind of person isn't easy to find, b

by snicky 5y ago

We are looking for a developer experienced in securing our whole stack: Rails backend, Vue frontend and infra on AWS. This kind of person isn't easy to find, because: - she has to have extensive knowledge about these frameworks - feel very confident configuring servers - follow the latest exploits - perform security reviews - audit dependencies and: - still be able to address vulnerabilities writing elegant code. I guess it's a lot to ask for, but we had a team mate in the past who did exactly this.

MaknMoreGtnLess 5y ago
> we had a team mate in the past who did exactly this Did they die or move on to a better paying opportunity?
- rekabis 5y ago
  Likely the latter. Far too many employers are used to high job competition allowing them to pay only pennies on the dollar for that work. The moment people ask for rational and reasonable wages, it’s suddenly “No OnE WaNtS tO wOrK” because they’re wanting champagne work output on a horse piss beer salary.
  - stillblue 5y ago
    >they’re wanting champagne work output on a horse piss beer salary Permission to steal this line?
  - snicky 5y ago
    In our case that's simply not true. The person I mentioned in the original post was the best paid developer in the company with a very competitive rate.
    - MaknMoreGtnLess 5y ago
      > was the best paid developer in the company with a very competitive rate OK, so did they die or move on to a better paying opportunity?
balutdev 5y ago
I am a unicorn of sorts because I could do all that and yet I would not want to because I am going to guess that the minimum amount of hours required to meet the previous person's output I would have to work ~65 hours a week. I personally see a minimum of three jobs, done well, at 30 hours a week.
- tra3 5y ago
  Bang on. 1. Backend Engineer = Rails 2. Front End Engineer = Vue 3. Infra Engineer/Devops = AWS ...and with a security background. ...and all 3 at an expert level. I've worked with a lot of bright and capable people over the years but I can't think of anyone matching this level of expertise. If I had to guess; did the project grow organically for a few years where the original developer learned all of the skills as they went and now this person left?
  - snicky 5y ago
    > If I had to guess; did the project grow organically for a few years where the original developer learned all of the skills as they went and now this person left? Well, sort of. He was experienced before he joined, but staying with us many years definitely helped him to structure everything correctly and automatize a lot of tasks. What's interesting, he actually worked only 3 days a week. It's doable if you clearly define the responsibilities.
- MaknMoreGtnLess 5y ago
  > I personally see a minimum of three jobs, done well, at 30 hours a week. Concur! It isn't that enough people arn't wildly smart enough/don't have the mental capacity to be a full-stack developer AND a penetration tester simultaneously. It's that it just don't make sense to enough of these wildly smart people to take on what's essentially three jobs, that when done well, individually consume 30+ hours a week each. Businesses that hire these frankenstien's monster as employees instead of contractors just don't have a clue. It's also extremely likely these frankenstien's monsters will burn themselves out as employees essentially juggling three jobs as a salaried flat rate employee. The only scenario in which being this frankenstien's monster make sense is to bootstrap a consultancy as a founder or a contractor, sign up enough clients and scale out by hiring specialist employees. The only reason why these frankenstien's monsters happen (outside being a founder or a contractor and I am talking exclusively about employees here) is that employee started off as one type (full-stack developer OR a penetration tester), failed to find employment and cross trained into the other, where they found employment. For example, without knowing any details, it's likely the full-stack developer AND a penetration tester started off as a penetration tester, failed to find employment and cross trained into full-stack developer. Of course, devil lies in the details, so if the full-stack developer failed to find employment as one but noticed significant demand for penetration testing, they could very well have become a penetration tester. Empirically a penetration tester doesn't have either time or energy to be an effective full-stack developer or vice versa, especially outside a founder or a contractor role in a bootstrap stage.
karmakaze 5y ago
What does the rest of the team do?
- snicky 5y ago
  The usual work: planning and developing new features, addressing bugs, dealing with tech debt, setting up infra, code reviews, writing documentation, etc.
  - karmakaze 5y ago
    So you're in a bind because a key person has left. Other team members do many of the things that the key person did. You're looking to hire another person in the same role that you can't afford to lose. Wouldn't it make sense to decouple some of the requirements? For instance, there's pretty good separation between front and back end. The person only needs a conceptual understanding of the other side and detailed understanding of the protocol to be used. I use both Vue and many backend tech, but my understanding is that I use Vue with a REST api and reactive rendering. The api design could be iterated by members from both groups.
keeeeeeeem 5y ago
I've got 5 years as a full-stack Vue.js/.NET Core/AWS developer and 2 years as penetration tester. I didn't know we were this rare, but it's nice to hear.
- MaknMoreGtnLess 5y ago
  > I didn't know we were this rare, but it's nice to hear. I don't think you're drawing the right conclusion. It isn't that enough people arn't wildy smart enough/don't have the mental capacity to be a full-stack developer AND a penetration tester simultaneously. It's that it just don't make sense to enough of these wildy smart people to take on what's essentially three jobs, that when done well, individually consume 30+ hours a week each. Businesses that hire these frankenstien's monster as employees instead of contractors just don't have a clue. It's also extremely likely these frankenstien's monsters will burn themselves out as employees essentially juggling three jobs as a salaried flat rate employee. The only scenario in which being this frankenstien's monster make sense is to bootstrap a consultancy as a founder or a contractor, sign up enough clients and scale out by hiring specialist employees. The only reason why these frankenstien's monsters happen (outside being a founder or a contractor and I am talking exclusively about employees here) is that employee started off as one type (full-stack developer OR a penetration tester), failed to find employment and cross trained into the other, where they found employment. For example, without knowing any details, it's likely the full-stack developer AND a penetration tester started off as a penetration tester, failed to find employment and cross trained into full-stack developer. Of course, devil lies in the details, so if the full-stack developer failed to find employment as one but noticed significant demand for penetration testing, they could very well have become a penetration tester. Empirically a penetration tester doesn't have either time or energy to be an effective full-stack developer or vice versa, especially outside a founder or a contractor role in a bootstrap stage.

by snicky 5y ago

MaknMoreGtnLess 5y ago

> we had a team mate in the past who did exactly this Did they die or move on to a better paying opportunity?

rekabis 5y ago
Likely the latter. Far too many employers are used to high job competition allowing them to pay only pennies on the dollar for that work. The moment people ask for rational and reasonable wages, it’s suddenly “No OnE WaNtS tO wOrK” because they’re wanting champagne work output on a horse piss beer salary.
- stillblue 5y ago
  >they’re wanting champagne work output on a horse piss beer salary Permission to steal this line?
- snicky 5y ago
  In our case that's simply not true. The person I mentioned in the original post was the best paid developer in the company with a very competitive rate.
  - MaknMoreGtnLess 5y ago
    > was the best paid developer in the company with a very competitive rate OK, so did they die or move on to a better paying opportunity?

balutdev 5y ago

I am a unicorn of sorts because I could do all that and yet I would not want to because I am going to guess that the minimum amount of hours required to meet the previous person's output I would have to work ~65 hours a week. I personally see a minimum of three jobs, done well, at 30 hours a week.

tra3 5y ago
Bang on. 1. Backend Engineer = Rails 2. Front End Engineer = Vue 3. Infra Engineer/Devops = AWS ...and with a security background. ...and all 3 at an expert level. I've worked with a lot of bright and capable people over the years but I can't think of anyone matching this level of expertise. If I had to guess; did the project grow organically for a few years where the original developer learned all of the skills as they went and now this person left?
- snicky 5y ago
  > If I had to guess; did the project grow organically for a few years where the original developer learned all of the skills as they went and now this person left? Well, sort of. He was experienced before he joined, but staying with us many years definitely helped him to structure everything correctly and automatize a lot of tasks. What's interesting, he actually worked only 3 days a week. It's doable if you clearly define the responsibilities.
MaknMoreGtnLess 5y ago
> I personally see a minimum of three jobs, done well, at 30 hours a week. Concur! It isn't that enough people arn't wildly smart enough/don't have the mental capacity to be a full-stack developer AND a penetration tester simultaneously. It's that it just don't make sense to enough of these wildly smart people to take on what's essentially three jobs, that when done well, individually consume 30+ hours a week each. Businesses that hire these frankenstien's monster as employees instead of contractors just don't have a clue. It's also extremely likely these frankenstien's monsters will burn themselves out as employees essentially juggling three jobs as a salaried flat rate employee. The only scenario in which being this frankenstien's monster make sense is to bootstrap a consultancy as a founder or a contractor, sign up enough clients and scale out by hiring specialist employees. The only reason why these frankenstien's monsters happen (outside being a founder or a contractor and I am talking exclusively about employees here) is that employee started off as one type (full-stack developer OR a penetration tester), failed to find employment and cross trained into the other, where they found employment. For example, without knowing any details, it's likely the full-stack developer AND a penetration tester started off as a penetration tester, failed to find employment and cross trained into full-stack developer. Of course, devil lies in the details, so if the full-stack developer failed to find employment as one but noticed significant demand for penetration testing, they could very well have become a penetration tester. Empirically a penetration tester doesn't have either time or energy to be an effective full-stack developer or vice versa, especially outside a founder or a contractor role in a bootstrap stage.

karmakaze 5y ago

What does the rest of the team do?

snicky 5y ago
The usual work: planning and developing new features, addressing bugs, dealing with tech debt, setting up infra, code reviews, writing documentation, etc.
- karmakaze 5y ago
  So you're in a bind because a key person has left. Other team members do many of the things that the key person did. You're looking to hire another person in the same role that you can't afford to lose. Wouldn't it make sense to decouple some of the requirements? For instance, there's pretty good separation between front and back end. The person only needs a conceptual understanding of the other side and detailed understanding of the protocol to be used. I use both Vue and many backend tech, but my understanding is that I use Vue with a REST api and reactive rendering. The api design could be iterated by members from both groups.

keeeeeeeem 5y ago

I've got 5 years as a full-stack Vue.js/.NET Core/AWS developer and 2 years as penetration tester. I didn't know we were this rare, but it's nice to hear.

MaknMoreGtnLess 5y ago
> I didn't know we were this rare, but it's nice to hear. I don't think you're drawing the right conclusion. It isn't that enough people arn't wildy smart enough/don't have the mental capacity to be a full-stack developer AND a penetration tester simultaneously. It's that it just don't make sense to enough of these wildy smart people to take on what's essentially three jobs, that when done well, individually consume 30+ hours a week each. Businesses that hire these frankenstien's monster as employees instead of contractors just don't have a clue. It's also extremely likely these frankenstien's monsters will burn themselves out as employees essentially juggling three jobs as a salaried flat rate employee. The only scenario in which being this frankenstien's monster make sense is to bootstrap a consultancy as a founder or a contractor, sign up enough clients and scale out by hiring specialist employees. The only reason why these frankenstien's monsters happen (outside being a founder or a contractor and I am talking exclusively about employees here) is that employee started off as one type (full-stack developer OR a penetration tester), failed to find employment and cross trained into the other, where they found employment. For example, without knowing any details, it's likely the full-stack developer AND a penetration tester started off as a penetration tester, failed to find employment and cross trained into full-stack developer. Of course, devil lies in the details, so if the full-stack developer failed to find employment as one but noticed significant demand for penetration testing, they could very well have become a penetration tester. Empirically a penetration tester doesn't have either time or energy to be an effective full-stack developer or vice versa, especially outside a founder or a contractor role in a bootstrap stage.