2 ms·

I’m an engineer who now works security. Very few of us come from an engineering background. Most lack the technical skill to do much than apply controls and run

I’m an engineer who now works security. Very few of us come from an engineering background. Most lack the technical skill to do much than apply controls and run tooling. Some try to do design work but imagine a junior dev with 2-3 years experience trying to write a service. Those of us who are architects and coders don’t often get to do it anymore because we’re not working on single projects or solutions.. so we become people who swoop in on a project for a month at a time to make sure there’s no major smells before moving on. Our understanding our your system is shallow as a result.

sebazzz 2y ago
> I’m an engineer who now works security. Very few of us come from an engineering background. Most lack the technical skill to do much than apply controls and run tooling. I think you probably hit the nail on the head there. Often the people in Infosec I work with are not interested into putting things in context, thinking into the actual impact of a control not being met. Instead, just a bunch of controls are thrown out without any regard to the actual security. Now I have to say, most of our security has been outsourced to cheap workers in developing countries like India, which are of course rated on maintaining the standard and not rated on thinking and understanding what you want, and probably also work 60-70 hours per week during ungodly times so you can hardly blame them.