4 ms·
I’m loving the eternal September of constantly watching people totally misunderstand the industry. Since you aren’t following the conversation, I’ll break it d
by c0pium 3y ago
I’m loving the eternal September of constantly watching people totally misunderstand the industry.
Since you aren’t following the conversation, I’ll break it down for you into smaller chunks. First, most places don’t use SOAR (you can see this in the marketing or sales numbers) as they don’t have the technical maturity or budget to leverage it. Bringing it up is pointless. Most jobs (see any of the usual industry survey results or do some analysis of posted jobs) are basic SOC-monkey positions looking at a SIEM (as I previously said) and doing basic research and response.
Get alert, google signature, update ticket, interview user, remediate/slick the box, repeat. Throw in complaining about the lack of tooling to make their lives better, a good bit about how the desktop/server/dev team should really work on standardization so everything isn’t a one-off and you have most person-days at most f1000 shops.
- ofjcihen 3y agoFrom what you’re saying it sounds like we just have different experiences. The companies I’ve worked for have respect for security and invest heavily in it. Before the days of SOARs we made an effort to script our own automation using Python/Bash/etc. But to your point, these companies that you work for that don’t invest in security and instead use outdated methods: why would they suddenly pay what I assume would be top dollar for AI when they’ve gotten along fine using ticket monkeys so far? Seems like they would continue while the far more efficient ones that take advantage of things like SOARs and already have those positions at a bare minimum would be the ones to invest the money.