5 ms·

I’m a security engineer, so my work is a bit different than SWE - data wrangling and analysis, tying systems together and correlating events across them, buildi

I’m a security engineer, so my work is a bit different than SWE - data wrangling and analysis, tying systems together and correlating events across them, building defense in depth, cool and effective under stress. That said, LLMs are showing up a lot in my job. Being a good sec eng is having a 70% base in most systems, solid comp sci and programming chops (I call it I can build and run a mediocre app), and solid security expertise. GPT is really good at radically speeding up how to get past the 70% starting point I usually operate from. I run (sanitized) terminal output through it so the 60% of the output I table to RTFM later to understand, I can understand immediately via GPT. Sec eng benefits a lot from leaning into pandas/notebooks vs log csvs, and GPT does that really well too. The big marker for me is incident response - standardized tech data requiring analysis and correlating in a pinch. I’m going to have an incident response LLM partner soon enough. Analyzing open source codebases for how they do input sanitizing with a new to me language? LLM partner walking me through. All this together - goodbye entry level cybersecurity jobs in a few years I think. Many of the things you’d need a security analyst for or the more busy work sec eng 1 jobs I truly think are turning into LLM jobs. My lived experience this past year reflects it. I think layoffs, and productivity gains from LLMs are under the hood of tech layoff tight now. Curious if other engineering tracks are seeing this though? A SWE buddy at Google thinks so.

MattGaiser 3y ago
Entry level devs will need to be much more skilled than I was to enter the field a few years ago. My internships and the first 6 months of my first full time job are trivial to ChatGPT. Copilot would be needed for work since then (as it is specific to the codebase), but even so, I am far more productive with them. One of my first internships was hacking together a mobile demo of a digital ID concept. I’d be surprised if it took more than a few hours to replicate a month of vanilla HTML/CSS/JS effort from back then. I would prefer ChatGPT to me as a co-worker up until about 1.5 years of experience, if simply because it replies instantly and doesn't forget stuff.
- shrimp_emoji 3y ago
  New devs' code looks like ChatGPT wrote it if it had been trained on pre-existing parts of the codebase. Copy pasta eeeverywhere :p
  - adamredwoods 3y ago
    For this specifically, is no different than when StackOverflow was the go-to solution.
    - evilduck 3y ago
      Worse maybe. I used to be able to tell when someone was using SO because everyone was blindly copying the same email regex answer. You can carry Mixtral in on a personal computer and transcribe novel output now. It’s so much harder to detect from just looking at a PR.
- dogman144 3y ago
  Right - I think when the equivalent of CoPilot shows up in incident response, security employment market changes for good. When a “cleared” CoPilot (for govt-supporting work) shows up, total overall. If you don’t operate in the approach I describe, or are not just an all around tech expert who likes security for some reason, the stable high paying market is around digital forensics/incident response firms. Those folks have a lock bc there’s a small group of who knows assembly and OSs across multiple systems very well and knows if from a security context. Tribal work for a LLM soon enough as it’s just parsing OpCodes and stretching across log sources, end of the day. Scary stuff, glad I’m past entry level and I’m no fool thinking that I don’t have to worry too.
  - ZeroSolstice 3y ago
    I'm not sure I see this as a reality anytime soon. > Those folks have a lock bc there’s a small group of who knows assembly and OSs across multiple systems very well and knows if from a security context. There is two parts to this. The first is for some of these business in that arena I'm sure if they could speed up analysis to take on more client jobs requiring less labor they would have done so. Second is, what output are you going to provide that wouldn't need the very same people to decipher, validate, or explain "what" is going on? As an example if you get hacked and you make a cyber insurance claim you are going to have to sufficiently explain to the insurance company what happened so they can try to get out of paying you and you won't be able to say "Xyz program says it found malware, just trust what it says." If people don't understand how the result was generated they could be implementing fixes that don't solve the problem because they are depending on the LLM/decision tree to tell them what the problem is. All these models can be gamed just like humans. I'm not quite sure I agree that a better LLM is what has been keeping people from implementing pipeline logic to produce actionable correlation security alerts. Maybe it does improve but my assumption is much like we still have software developers any automation will just create a new field of support or inquiry that will need people to parse.
    - dogman144 3y ago
      I think the impact of LLMs in DFIR will come down to - speed at which actionable insights can get generated (otherwise needing a very high paid eng poking through Ghidra and cross-log correlation) - reduced need for very high paid DFIR engs due to the above.
maximinus_thrax 3y ago
> All this together - goodbye entry level cybersecurity jobs in a few years I think If nobody is entry level how would anyone be able to penetrate the job market? Nobody graduates into a mid-senior level job, right?
- dogman144 3y ago
  That is the question. I think SWE is going to experience what cybersec already has an issue with. The “talent shortage” in cyber is for mid levels, not entry level security analysts. This is bc cyber is applied IT and engineering through a security lens. It’s hard to make the jump into a sec eng career bc of this. IMO, LLMs build the wall higher. To your point, nobody is really graduating right into cyber. Most go to non-technical compliance jobs or MSSPs if they are cyber first, or get really luck on a self-developed path. Rest are lateral transfers from IT or SWE/ops. MSSPs are hard to get out of (24hr security triage centers), and are prime targets for LLMs. I speculate SWE starts experiencing what cyber has dealt with for years - what do you do if entry level is automated, or the knowledge bar is really high. I think cyber just gets worse/harder to get into.
  - ZeroSolstice 3y ago
    You will start to see this turn around as companies realize they need to go back to the path of entry -> mid -> Senior/Principal. For cybersecurity this is operations and/or development -> cybersecurity w/ focus on either dev or operations. Then at the Senior/Principal layer people can float between things. This isn't too far off from many other jobs, no EE out of school is designing circuits and boards from scratch its debug what Senior EE's have created or problems in existing products, then you work your way up. Its the same with cybersecurity does a person that hasn't developed software start out doing reverse engineering? Does a person develop or approve security policies, devices, network architecture or designs if they haven't every deployed an application or service in production? How are you determining if something is an incident or valid alert if you haven't managed a network. When money was free companies could hire people for very specific tasks and knowledge areas because it wasn't costing them anything to get the money. This is why lay-offs in engineering, while smaller percentages compared to other departments in the company, are for jobs that are specialized where in previous times it might have made sense to get a consultant or contractor.
digital_sawzall 3y ago
I'm 15+ years in security and just this week I needed to hit a few domains, find a script tag that imports JS from a certain CDN, parse and make sense of it. After 20 minutes of telling ChatGPT exactly what I needed and a couple of test runs and optimizations, I had the perfect tool. 10 years ago this would have been a half to full day project. I had a meeting with an entry level security engineer and he asked if I need him to do the task, as we were both in the meeting where it was being discussed. I didn't even think to ask him! It was quicker and easier to do it myself. This was the type of project I had been assigned dozens of times during my first job. I don't know what that means for the future of work but it's changing fast.
- dogman144 3y ago
  Fascinating to hear similar from you.
- datavirtue 3y ago
  This. We were supposed to hire a junior dev to help me build out a new app. I'm moving so fast using copilot we just forgot about it. I'm putting out a complex product at break-neck speed using frameworks and tech I was barely familiar with when I started. This is not a good time to be a grad or junior dev, or a search engine.
  - ZeroSolstice 3y ago
    Why did you think you needed to hire a junior dev before even starting work on the application? I know estimation can be a difficult task but the typical "I'm moving so fast..." type experiences usually mean you didn't or don't understand your tooling or the scope. Also how were you going to take on a junior dev and a new framework at the same time? Were you expecting them to know the framework? As the saying goes though the last 20% takes 80% of the time.
    - datavirtue 3y ago
      Because the project was big enough to warrant more than one person. I have a whole team surrounding me to handle non-technical/non-development incidentals. Most companies would have had a lot more budgeted and would have pre-hired five devs. Then everything would have moved glacially slow, fulfilling the prophecy that five devs were needed.
ZeroSolstice 3y ago
80% of being a good security engineer is knowing the big picture, all the parts and how they work. The correlation that LLM produces has no value if its not actionable. You are the one that determines the weights, values, and features that are important. I'd be very curious of how you currently account for scheduled outages, unscheduled outages, new deployments, upgrades of existing systems, spinning instances up and down for testing, laptop device swap-outs, traffic in different silos. How are you baselining normal communications and session timing between services or across protocols? If you are in the cloud is baselining done by service HTTP, DNS, DB, etc? I could see different weights being constructed to represent defense-in-depth but this would seem to be a constant amount of work while also investigating or feeding true/false positives back into the system. Entry-level cybersecurity isn't a thing which is why it isn't working out as typically you need prior dev, ops, devops, sre, sysadmin, etc existing experience. The talent shortage is because you can't do an undergrad in cybersecurity and somehow pick-up the prior operational knowledge that develops your skills for understanding and troubleshooting how systems, networks, and applications all function together. Cybersecurity as it stands, and you mention, is in my experiences best as a focus off-of computer science. I mean even the CISSP requires working experience in the field. The one item I think you are overlooking is that you have the experience in how everything works together which makes a tool like ChatGPT or some other analyzer where you can ask the "right" questions a useful tool because you have the mental mapping and models through experience of the questions to ask. So while a security analyst job might go away you are back at the original problem of developing security engineers that know the architecture, flows, daily expectations, etc and having a LLM buddy is not going to turn a security analyst directly into a cybersecurity engineer over night.
- dogman144 3y ago
  > The correlation that LLM produces has no value if its not actionable. For security, there are two parts to this: - correlation within detection engines, i.e. what Crowdstrike does: CS and so on are already doing what you describe (baselining normal system and identity behaviors). It is hit-or-miss still, but noticeably better than a few years ago, and I think this current AI era will push it further. These already took away the need for several sec eng hires. - correlation across logs, i.e. an incident is happening and under time/under stress, and usually this is a IR team putting together ad hoc search queries and so on. LLMs, as many of them seem to have indexed query languages docs and much of the open source docs on AWS, O365 etc, are in almost invaluable tool here. It's hard to explain how quickly security dev across pre-incident prep or in-incident IR are sped up by them. > where you can ask the "right" questions a useful tool because... Yes, this specifically is one of the great value-adds currently - gaining context much quicker than the usual pace. For security incidents, and for self-build use cases that security engineers often run into, this aspect specifically enough to be a huge value add. And I agree, it will exacerbate the existing version of this, which is my point on replacing analysts: > you are back at the original problem of developing security engineers... This is already a problem, and LLMs help fix the immediate generation's issues with it. It's hard to find good sec engs to fit the developmental sec eng roles, so those roles become LLMs. The outcome of this is... idk? But it is certainly happening.

MattGaiser 3y ago

Entry level devs will need to be much more skilled than I was to enter the field a few years ago. My internships and the first 6 months of my first full time job are trivial to ChatGPT. Copilot would be needed for work since then (as it is specific to the codebase), but even so, I am far more productive with them. One of my first internships was hacking together a mobile demo of a digital ID concept. I’d be surprised if it took more than a few hours to replicate a month of vanilla HTML/CSS/JS effort from back then. I would prefer ChatGPT to me as a co-worker up until about 1.5 years of experience, if simply because it replies instantly and doesn't forget stuff.

shrimp_emoji 3y ago
New devs' code looks like ChatGPT wrote it if it had been trained on pre-existing parts of the codebase. Copy pasta eeeverywhere :p
- adamredwoods 3y ago
  For this specifically, is no different than when StackOverflow was the go-to solution.
  - evilduck 3y ago
    Worse maybe. I used to be able to tell when someone was using SO because everyone was blindly copying the same email regex answer. You can carry Mixtral in on a personal computer and transcribe novel output now. It’s so much harder to detect from just looking at a PR.
dogman144 3y ago
Right - I think when the equivalent of CoPilot shows up in incident response, security employment market changes for good. When a “cleared” CoPilot (for govt-supporting work) shows up, total overall. If you don’t operate in the approach I describe, or are not just an all around tech expert who likes security for some reason, the stable high paying market is around digital forensics/incident response firms. Those folks have a lock bc there’s a small group of who knows assembly and OSs across multiple systems very well and knows if from a security context. Tribal work for a LLM soon enough as it’s just parsing OpCodes and stretching across log sources, end of the day. Scary stuff, glad I’m past entry level and I’m no fool thinking that I don’t have to worry too.
- ZeroSolstice 3y ago
  I'm not sure I see this as a reality anytime soon. > Those folks have a lock bc there’s a small group of who knows assembly and OSs across multiple systems very well and knows if from a security context. There is two parts to this. The first is for some of these business in that arena I'm sure if they could speed up analysis to take on more client jobs requiring less labor they would have done so. Second is, what output are you going to provide that wouldn't need the very same people to decipher, validate, or explain "what" is going on? As an example if you get hacked and you make a cyber insurance claim you are going to have to sufficiently explain to the insurance company what happened so they can try to get out of paying you and you won't be able to say "Xyz program says it found malware, just trust what it says." If people don't understand how the result was generated they could be implementing fixes that don't solve the problem because they are depending on the LLM/decision tree to tell them what the problem is. All these models can be gamed just like humans. I'm not quite sure I agree that a better LLM is what has been keeping people from implementing pipeline logic to produce actionable correlation security alerts. Maybe it does improve but my assumption is much like we still have software developers any automation will just create a new field of support or inquiry that will need people to parse.
  - dogman144 3y ago
    I think the impact of LLMs in DFIR will come down to - speed at which actionable insights can get generated (otherwise needing a very high paid eng poking through Ghidra and cross-log correlation) - reduced need for very high paid DFIR engs due to the above.

maximinus_thrax 3y ago

> All this together - goodbye entry level cybersecurity jobs in a few years I think If nobody is entry level how would anyone be able to penetrate the job market? Nobody graduates into a mid-senior level job, right?

dogman144 3y ago
That is the question. I think SWE is going to experience what cybersec already has an issue with. The “talent shortage” in cyber is for mid levels, not entry level security analysts. This is bc cyber is applied IT and engineering through a security lens. It’s hard to make the jump into a sec eng career bc of this. IMO, LLMs build the wall higher. To your point, nobody is really graduating right into cyber. Most go to non-technical compliance jobs or MSSPs if they are cyber first, or get really luck on a self-developed path. Rest are lateral transfers from IT or SWE/ops. MSSPs are hard to get out of (24hr security triage centers), and are prime targets for LLMs. I speculate SWE starts experiencing what cyber has dealt with for years - what do you do if entry level is automated, or the knowledge bar is really high. I think cyber just gets worse/harder to get into.
- ZeroSolstice 3y ago
  You will start to see this turn around as companies realize they need to go back to the path of entry -> mid -> Senior/Principal. For cybersecurity this is operations and/or development -> cybersecurity w/ focus on either dev or operations. Then at the Senior/Principal layer people can float between things. This isn't too far off from many other jobs, no EE out of school is designing circuits and boards from scratch its debug what Senior EE's have created or problems in existing products, then you work your way up. Its the same with cybersecurity does a person that hasn't developed software start out doing reverse engineering? Does a person develop or approve security policies, devices, network architecture or designs if they haven't every deployed an application or service in production? How are you determining if something is an incident or valid alert if you haven't managed a network. When money was free companies could hire people for very specific tasks and knowledge areas because it wasn't costing them anything to get the money. This is why lay-offs in engineering, while smaller percentages compared to other departments in the company, are for jobs that are specialized where in previous times it might have made sense to get a consultant or contractor.

digital_sawzall 3y ago

I'm 15+ years in security and just this week I needed to hit a few domains, find a script tag that imports JS from a certain CDN, parse and make sense of it. After 20 minutes of telling ChatGPT exactly what I needed and a couple of test runs and optimizations, I had the perfect tool. 10 years ago this would have been a half to full day project. I had a meeting with an entry level security engineer and he asked if I need him to do the task, as we were both in the meeting where it was being discussed. I didn't even think to ask him! It was quicker and easier to do it myself. This was the type of project I had been assigned dozens of times during my first job. I don't know what that means for the future of work but it's changing fast.

dogman144 3y ago
Fascinating to hear similar from you.
datavirtue 3y ago
This. We were supposed to hire a junior dev to help me build out a new app. I'm moving so fast using copilot we just forgot about it. I'm putting out a complex product at break-neck speed using frameworks and tech I was barely familiar with when I started. This is not a good time to be a grad or junior dev, or a search engine.
- ZeroSolstice 3y ago
  Why did you think you needed to hire a junior dev before even starting work on the application? I know estimation can be a difficult task but the typical "I'm moving so fast..." type experiences usually mean you didn't or don't understand your tooling or the scope. Also how were you going to take on a junior dev and a new framework at the same time? Were you expecting them to know the framework? As the saying goes though the last 20% takes 80% of the time.
  - datavirtue 3y ago
    Because the project was big enough to warrant more than one person. I have a whole team surrounding me to handle non-technical/non-development incidentals. Most companies would have had a lot more budgeted and would have pre-hired five devs. Then everything would have moved glacially slow, fulfilling the prophecy that five devs were needed.

ZeroSolstice 3y ago

80% of being a good security engineer is knowing the big picture, all the parts and how they work. The correlation that LLM produces has no value if its not actionable. You are the one that determines the weights, values, and features that are important. I'd be very curious of how you currently account for scheduled outages, unscheduled outages, new deployments, upgrades of existing systems, spinning instances up and down for testing, laptop device swap-outs, traffic in different silos. How are you baselining normal communications and session timing between services or across protocols? If you are in the cloud is baselining done by service HTTP, DNS, DB, etc? I could see different weights being constructed to represent defense-in-depth but this would seem to be a constant amount of work while also investigating or feeding true/false positives back into the system. Entry-level cybersecurity isn't a thing which is why it isn't working out as typically you need prior dev, ops, devops, sre, sysadmin, etc existing experience. The talent shortage is because you can't do an undergrad in cybersecurity and somehow pick-up the prior operational knowledge that develops your skills for understanding and troubleshooting how systems, networks, and applications all function together. Cybersecurity as it stands, and you mention, is in my experiences best as a focus off-of computer science. I mean even the CISSP requires working experience in the field. The one item I think you are overlooking is that you have the experience in how everything works together which makes a tool like ChatGPT or some other analyzer where you can ask the "right" questions a useful tool because you have the mental mapping and models through experience of the questions to ask. So while a security analyst job might go away you are back at the original problem of developing security engineers that know the architecture, flows, daily expectations, etc and having a LLM buddy is not going to turn a security analyst directly into a cybersecurity engineer over night.

dogman144 3y ago
> The correlation that LLM produces has no value if its not actionable. For security, there are two parts to this: - correlation within detection engines, i.e. what Crowdstrike does: CS and so on are already doing what you describe (baselining normal system and identity behaviors). It is hit-or-miss still, but noticeably better than a few years ago, and I think this current AI era will push it further. These already took away the need for several sec eng hires. - correlation across logs, i.e. an incident is happening and under time/under stress, and usually this is a IR team putting together ad hoc search queries and so on. LLMs, as many of them seem to have indexed query languages docs and much of the open source docs on AWS, O365 etc, are in almost invaluable tool here. It's hard to explain how quickly security dev across pre-incident prep or in-incident IR are sped up by them. > where you can ask the "right" questions a useful tool because... Yes, this specifically is one of the great value-adds currently - gaining context much quicker than the usual pace. For security incidents, and for self-build use cases that security engineers often run into, this aspect specifically enough to be a huge value add. And I agree, it will exacerbate the existing version of this, which is my point on replacing analysts: > you are back at the original problem of developing security engineers... This is already a problem, and LLMs help fix the immediate generation's issues with it. It's hard to find good sec engs to fit the developmental sec eng roles, so those roles become LLMs. The outcome of this is... idk? But it is certainly happening.