Hacker News Reader

Comment by mancerayder | Hacker News Reader

Security people cost a lot, and infosec people in particular can sometimes be utterly useless bureaucrats, while the security engineers are extremely hard to find. It could be something terrible happened, and it was realized they're all useless and need to be replaced.

Alternatively maybe the devops or other team took over their functions. They're not legally required in that industry, while in some industries / publicly traded companies they can be.

View on HN

>can sometimes be utterly useless bureaucrats

I think that's a wrong attitude to have. The entire point of security systems is to be bureaucratic, i.e. to follow proper procedures.

A good chunk of security incidents in the software industry could be avoided by people following procedures rather than winging it, the annoyance is often not justified or an indication that people are playing too fast and lose.

I would hope that the point of security systems would be to make the company secure.

Being bureaucratic and following "proper" procedures ranges from being a way to achieve that goal to being actively counterproductive. It's not exactly rare for a "proper" procedure to be optimized for CYA, compliance or security theater at the expense of actual security!

It's not an attitude, it's my experience: the infosec teams are deputized to make assertions they aren't qualified to make. Most of the time they're the intended bridge between legalese/contracts/regulations and technology reality. The good ones do this creatively. The shitty ones do this blindly or perhaps bureaucratically, in the context here.

I've borne witness to infosec people so hands off I'm convinced they secretly have two jobs as remote workers.

Good DevOps and dev folks obviate infosec, leaving the latter roles to industries that mandate it.

Yeah who needs security for Financial services.

If Patreon falls into the category of financial services, then I take back that piece of what I said.

I view them as a media hosting company of sorts, like YouTube or Vimeo. The fact that they collect money makes them nothing special, since everyone technically collects money somehow.

Patreon does not host media to any meaningful extent.

I have a Patreon page with hundreds of supporters. If I want to post a video for my supporters, it has to be hosted elsewhere. Patreon will not host and serve it.

Maybe by gigabytes, but the bulk of the volume of posts is probably paywalled high quality image files, chapters, audio files, etc. Their tools for organizing it is lacking, but it's great for hosting most things. I expect video to join it the moment native video hosting is available to everyone.

Security Engineering roles imo don't pay enough compared to software engineering roles.

It depends on the industry. Finance is usually one of the exceptions.

Yes, best way to get crazy comp without passing a Google interview is security with “engineer” in your JD and especially cloud familiarity. Average dev at the average company is probably earning less and less lifetime potential than the average security engineer.

At any company worth working for, security engineers tend to be paid more than software engineering roles, because security engineers are in higher demand. If the company is paying less for a security engineer, they're going to get folks with little to no experience.

Not aligned with my personal experience as a security engineer. The most senior roles I see out there top out at 200k-250k in total comp with some exceptions.

In the bay area, or where? That's unusually low total comp for a senior security engineer (I wouldn't accept a role that offered less than $500k total comp in the bay area, for a staff level).

Reply on news.ycombinator.com