4 ms·

Security people cost a lot, and infosec people in particular can sometimes be utterly useless bureaucrats, while the security engineers are extremely hard to fi

Security people cost a lot, and infosec people in particular can sometimes be utterly useless bureaucrats, while the security engineers are extremely hard to find. It could be something terrible happened, and it was realized they're all useless and need to be replaced. Alternatively maybe the devops or other team took over their functions. They're not legally required in that industry, while in some industries / publicly traded companies they can be.

ReGenGen 4y ago
Yeah who needs security for Financial services.
- tjr225 4y ago
  - jszymborski 4y ago
    Yes.
  - t-writescode 4y ago
    Yes.
- mancerayder 4y ago
  If Patreon falls into the category of financial services, then I take back that piece of what I said. I view them as a media hosting company of sorts, like YouTube or Vimeo. The fact that they collect money makes them nothing special, since everyone technically collects money somehow.
  - SpelingBeeChamp 4y ago
    Patreon does not host media to any meaningful extent. I have a Patreon page with hundreds of supporters. If I want to post a video for my supporters, it has to be hosted elsewhere. Patreon will not host and serve it.
    - Kye 4y ago
      Maybe by gigabytes, but the bulk of the volume of posts is probably paywalled high quality image files, chapters, audio files, etc. Their tools for organizing it is lacking, but it's great for hosting most things. I expect video to join it the moment native video hosting is available to everyone.
Barrin92 4y ago
>can sometimes be utterly useless bureaucrats I think that's a wrong attitude to have. The entire point of security systems is to be bureaucratic, i.e. to follow proper procedures. A good chunk of security incidents in the software industry could be avoided by people following procedures rather than winging it, the annoyance is often not justified or an indication that people are playing too fast and lose.
- tikhonj 4y ago
  I would hope that the point of security systems would be to make the company secure. Being bureaucratic and following "proper" procedures ranges from being a way to achieve that goal to being actively counterproductive. It's not exactly rare for a "proper" procedure to be optimized for CYA, compliance or security theater at the expense of actual security!
- mancerayder 4y ago
  It's not an attitude, it's my experience: the infosec teams are deputized to make assertions they aren't qualified to make. Most of the time they're the intended bridge between legalese/contracts/regulations and technology reality. The good ones do this creatively. The shitty ones do this blindly or perhaps bureaucratically, in the context here. I've borne witness to infosec people so hands off I'm convinced they secretly have two jobs as remote workers. Good DevOps and dev folks obviate infosec, leaving the latter roles to industries that mandate it.
anony23 4y ago
Security Engineering roles imo don't pay enough compared to software engineering roles.
- bink 4y ago
  It depends on the industry. Finance is usually one of the exceptions.
  - dogman144 4y ago
    Yes, best way to get crazy comp without passing a Google interview is security with “engineer” in your JD and especially cloud familiarity. Average dev at the average company is probably earning less and less lifetime potential than the average security engineer.
- ryan_lane 4y ago
  At any company worth working for, security engineers tend to be paid more than software engineering roles, because security engineers are in higher demand. If the company is paying less for a security engineer, they're going to get folks with little to no experience.
  - anony23 4y ago
    Not aligned with my personal experience as a security engineer. The most senior roles I see out there top out at 200k-250k in total comp with some exceptions.
    - ryan_lane 4y ago
      In the bay area, or where? That's unusually low total comp for a senior security engineer (I wouldn't accept a role that offered less than $500k total comp in the bay area, for a staff level).

ReGenGen 4y ago

Yeah who needs security for Financial services.

tjr225 4y ago
- jszymborski 4y ago
  Yes.
- t-writescode 4y ago
  Yes.
mancerayder 4y ago
If Patreon falls into the category of financial services, then I take back that piece of what I said. I view them as a media hosting company of sorts, like YouTube or Vimeo. The fact that they collect money makes them nothing special, since everyone technically collects money somehow.
- SpelingBeeChamp 4y ago
  Patreon does not host media to any meaningful extent. I have a Patreon page with hundreds of supporters. If I want to post a video for my supporters, it has to be hosted elsewhere. Patreon will not host and serve it.
  - Kye 4y ago
    Maybe by gigabytes, but the bulk of the volume of posts is probably paywalled high quality image files, chapters, audio files, etc. Their tools for organizing it is lacking, but it's great for hosting most things. I expect video to join it the moment native video hosting is available to everyone.

Barrin92 4y ago

>can sometimes be utterly useless bureaucrats I think that's a wrong attitude to have. The entire point of security systems is to be bureaucratic, i.e. to follow proper procedures. A good chunk of security incidents in the software industry could be avoided by people following procedures rather than winging it, the annoyance is often not justified or an indication that people are playing too fast and lose.

tikhonj 4y ago
I would hope that the point of security systems would be to make the company secure. Being bureaucratic and following "proper" procedures ranges from being a way to achieve that goal to being actively counterproductive. It's not exactly rare for a "proper" procedure to be optimized for CYA, compliance or security theater at the expense of actual security!
mancerayder 4y ago
It's not an attitude, it's my experience: the infosec teams are deputized to make assertions they aren't qualified to make. Most of the time they're the intended bridge between legalese/contracts/regulations and technology reality. The good ones do this creatively. The shitty ones do this blindly or perhaps bureaucratically, in the context here. I've borne witness to infosec people so hands off I'm convinced they secretly have two jobs as remote workers. Good DevOps and dev folks obviate infosec, leaving the latter roles to industries that mandate it.

anony23 4y ago

Security Engineering roles imo don't pay enough compared to software engineering roles.

bink 4y ago
It depends on the industry. Finance is usually one of the exceptions.
- dogman144 4y ago
  Yes, best way to get crazy comp without passing a Google interview is security with “engineer” in your JD and especially cloud familiarity. Average dev at the average company is probably earning less and less lifetime potential than the average security engineer.
ryan_lane 4y ago
At any company worth working for, security engineers tend to be paid more than software engineering roles, because security engineers are in higher demand. If the company is paying less for a security engineer, they're going to get folks with little to no experience.
- anony23 4y ago
  Not aligned with my personal experience as a security engineer. The most senior roles I see out there top out at 200k-250k in total comp with some exceptions.
  - ryan_lane 4y ago
    In the bay area, or where? That's unusually low total comp for a senior security engineer (I wouldn't accept a role that offered less than $500k total comp in the bay area, for a staff level).