Hacker News Reader

Comment by symlinkk | Hacker News Reader

Like who? I have better than an IT background, I have a degree in software engineering and a couple of years experience and have never been seriously considered for an infosec position.

View on HN

I'm a "software engineer", but I know a plenty of other "software engineers" who know less about TCP/IP than IT people I know. What about being a SWE makes you feel more suited for the job?

In my experience knowing about TCP/IP is not required depending on the individual's background (say, graphics driver developer). It just turns out most good hackers tend to be curious and either learn it very quickly or already know it.

We like software engineers because they can synthesize complex software architectures, whereas someone with only networking knowledge will be at a much larger knowledge deficit on most software focused assessments.

Infosec has trended toward application focused security for many years now.

This is part of the problem with hiring in InfoSec. I was turned down years ago for a role as a junior because I didn't know enough about some very specific, foundational technology. I joined a consultancy and within a year I was speaking at those same conferences that I met that would-be employer.

In an hour you can go over only a finite amount of knowledge, I was asked about aspects of technology I knew very little about because I hadn't tried anything in that space (FWIW it was a segment of networking). To pass over candidates based on a minuet lack of detailed knowledge - to me is crazy.

It's like interviewing a builder and asking them if they know where the majority of local maple wood comes from. Who cares, and if you need to know - Google it! Great, now you know more than you ever needed about the local maple industry!

YMMV, sample size 1, etc

If you're speaking at conferences then you are doing your infosec career wrong.

Hmm why?

If I was a fully funded academic, I'd agree with you. But the reality is I trade my time for money - to maximize the latter, appearing as a "leader" in my field requires I give talks to both technical and business tracks. The former might pay my bills (if they're a successful tech startup), the latter definitely will.

Conferences are great for networking and entertaining. They're not great for learning new stuff, there's much better media out there. I'm not sure what your gripes are with it.

I could pick some random piece of intrinsic tech you know nothing to devalue you quite easily. I work with TCP at a protocol level every. single. day. and I don't doubt that a decent mid-level SWE could pick it up in a less than a week, and be making clever modifications in less than a month. Standards aren't hard. Code isn't hard. Willingness to ask questions is hard. Knowing when you need to stop and think is hard. Dealing with people, in a way that respects their perspective and experience, is hard, and is the primary talent of any engineer, software or otherwise.

I've found that tech companies have harder interview loops for infosec than in software engineering. For software engineering, know your college algorithms and you'll have a decent shot.

For infosec, the hiring bar is entirely random. Know your algorithms as those questions are all still fair game, know an enormous and entirely random amount of security trivia as infosec has interviewers with incredible ego, be able to solve CTF challenge problems under extreme pressure in 30 minutes, be able to review code in all programming languages for security defects, etc. I recently had an interview for a IoT penetration testing role (requiring C and Python) at a large tech company. The first phone screen was an engineer on an unrelated team asking me Java OWASP Top 10 style questions. What on earth???

Apparently CTFs (which do nothing except teach you how to get better at CTFs) are the new hiring bar. God only knows what's next.

So don't feel bad. Keep interviewing and you'll get lucky. Luck has far more to do with it than anything else at the moment.

This is precisely why we have tuned our hiring process to find people with no infosec experience but a strong technology background. If you come in understanding, fundamentally how computers work (at a systems level) and a genuine interest in information security there limited barriers.

Most organizations are not equipped to hire for one-of roles on dev teams involving information security.

It's hard for me to say why without more information. There is an interesting middle ground you can work as a software engineer for a company working on security products so it might be easier to switch later.

How did you apply? Which companies? How did you fare in the interviews?

Reply on news.ycombinator.com