Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Looking For A Security Job? You Don't Need To Be Bo Derek
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
Greg MacSweeney
50%
50%
Greg MacSweeney,
User Rank: Apprentice
10/31/2013 | 3:18:34 PM
re: Looking For A Security Job? You Don't Need To Be Bo Derek
Great column. Although, 75% of millennials reading this article have no clue who Bo Derek is, (they are all googling her right now) LOL.

Tip #2 is a great point, although finding the hiring manager is sometimes extremely difficult.
Mark Aiello
50%
50%
Mark Aiello,
User Rank: Apprentice
10/31/2013 | 5:07:37 PM
re: Looking For A Security Job? You Don't Need To Be Bo Derek
Thanks Greg. Glad you liked it. I guess the Bo Derek reference shows my age. Maybe Hollywood will do a remake with Scarlett Johansson.

LinkedIn is a great resource for finding a hiring manager. Not perfect but 99% accurate. Go #RedSox
TerryB
50%
50%
TerryB,
User Rank: Ninja
10/31/2013 | 5:38:13 PM
re: Looking For A Security Job? You Don't Need To Be Bo Derek
I'm not sure your doing anyone any favors here, Mark. Besides the unqualified guy who is hired to handle your computer security that is. If there is one place where you don't someone learning on the job, it's security. Is there really a entry level job in security, except maybe reviewing IDS logs?
Mark Aiello
50%
50%
Mark Aiello,
User Rank: Apprentice
10/31/2013 | 5:50:15 PM
re: Looking For A Security Job? You Don't Need To Be Bo Derek
Hi Terry. Every experienced professional began their career without experience. I would not recommend hiring someone with no experience to lead your security group but I do recommend hiring a combination of knowledge and attitude. Knowledge does not always equal experience.

And yes, there are lots of "entry-level" jobs in security. What's wrong with accepting a job to review IDS logs? If you are good and have a good attitude, it will lead to other opportunities. Not everyone can start at the top.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/1/2013 | 2:29:46 AM
re: Looking For A Security Job? You Don't Need To Be Bo Derek
Tip 1 is apt...but too bad HR staffers and hiring managers often forget it themselves.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/1/2013 | 2:32:03 AM
re: Looking For A Security Job? You Don't Need To Be Bo Derek
There are very very very very few jobs that can't be mostly learned on the job, even if you didn't go to school for it (including, if State Bars didn't mostly forbid it, mine -- attorney).

I'll take the dedicated quick study over the guy that looks good on paper any day.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/1/2013 | 2:33:57 AM
re: Looking For A Security Job? You Don't Need To Be Bo Derek
Of course, you may not be able to contact them if you're not in their network.

So perhaps the lesson is to use LinkedIn to find the hiring manager, then use Facebook or some other platform to touch base with them. (And even Facebook, now that it has introduced Graph Search, duplicates many LinkedIn search functions -- in some ways better than LinkedIn does.)
Mark Aiello
50%
50%
Mark Aiello,
User Rank: Apprentice
11/1/2013 | 1:39:05 PM
re: Looking For A Security Job? You Don't Need To Be Bo Derek
Hi Joe. "I'll take the dedicated quick study over the guy that looks good on paper any day." From your lips to the Hiring Managers ears. I agree.

You are correct re: Tip 1. It is exactly why one must control their own message. It is important to figure out what needs to be done and then draft a response that explains why you are qualified. Lots of "job descriptions" are not descriptive. With many positions, individuals can use social media to locate who was employed in that role previously and see if it is possible to figure out what they did.
Becca Lipman
50%
50%
Becca Lipman,
User Rank: Apprentice
11/1/2013 | 3:17:14 PM
re: Looking For A Security Job? You Don't Need To Be Bo Derek
Guilty of the Googling. As for tip #2, easier said than done. HR will come for you eventually.
TerryB
50%
50%
TerryB,
User Rank: Ninja
11/1/2013 | 5:44:41 PM
re: Looking For A Security Job? You Don't Need To Be Bo Derek
You are obviously talking about big companies if you have a "security group". I would agree there is something they could do at entry level. I'm talking about bringing someone in to lock down your extranet site. You really want someone with a "good attitude" and no other track record doing that?
And Joe, while your premise that anyone can learn on job is theoretically true, some jobs you just can't make mistakes to learn from. I'm a developer, if I had a dime for every piece of code I ever wrote that didn't work the first time, I'd be buying Bill Gates mansion. In security, you may learn something after someone hacks in and steals your credit card info but you won't be around to learn from it. At least not at that company.
And lawyers can afford to make mistakes to learn from, it's someone else that will pay price for that. You'll be on to next client, who know nothing about your mistake. Little comparison to someone employed by a business for a career, like IT outside of consulting.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-41152
PUBLISHED: 2021-10-18
OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system. In affected versions by manipulating the HTTP request an attacker can modify the path of a requested file download in the folder component to point to anywhere on t...
CVE-2021-41153
PUBLISHED: 2021-10-18
The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check. Thi...
CVE-2021-41156
PUBLISHED: 2021-10-18
anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior to 1.19.30.5601, it was possible to craft ...
CVE-2021-42650
PUBLISHED: 2021-10-18
Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.
CVE-2021-41151
PUBLISHED: 2021-10-18
Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a `github:publish:pull-request` action and a parti...