Careers in security, ethical hacking and advice on where to get started

Re:Careers in security, ethical hacking and advice on where ... by Bartweiss on Tuesday December 20, 2016 @02:43PM (#13223254)

An example: Matasano (I have no affiliation) is a well-respected security company. Their hiring process involves (or involved) taking applications from interested people with interesting resumes, sending them a textbook, and asking them to come back when they felt qualified.

I've seen this sort of outlook (usually without the textbook) across the board. Either a company will train people from scratch, or they want to see applicants with actual records of working security, finding and reporting vulnerabilities, or patching holes in OSS.

"Have a certificate" is nowhere on that list. It probably can't hurt for a candidate, but I certainly don't think it will bridge the gap from inexperienced to experienced the way an actual work record would.

[ Parent | on HN ]

Re:Careers in security, ethical hacking and advice on where ... by tptacek on Tuesday December 20, 2016 @02:44PM (#13223266)

I cofounded Matasano, for whatever it's worth.

Having a certificate actually can hurt you, for elite jobs (it's not really going to hurt you if you're just breaking into the field).

[ Parent | on HN ]

Re:Careers in security, ethical hacking and advice on where ... by Bartweiss on Tuesday December 20, 2016 @03:25PM (#13223594)

Now there's an irony, I had no idea.

The timing never worked out, but applying to Matasano was tied to the start of my interest in security. It was one of the most welcoming and positive interview processes I've ever seen.

[ Parent | on HN ]

Re:Careers in security, ethical hacking and advice on where ... by tptacek on Tuesday December 20, 2016 @03:54PM (#13223840)

Thanks! I'm looking forward to reproducing it this year at Latacora. :)

[ Parent | on HN ]

Re:Careers in security, ethical hacking and advice on where ... by alltakendamned on Tuesday December 20, 2016 @02:58PM (#13223387)

Hi Thomas, I'm interested to hear what the elite jobs are you speak of and in what respect having a cert would hurt one in them?

[ Parent | on HN ]

Re:Careers in security, ethical hacking and advice on where ... by tptacek on Tuesday December 20, 2016 @03:00PM (#13223401)

It's a lack-of-clue signal.

I'm not saying it should be. If you're hiring exploit developers, your process should begin and end at having candidates build model exploits. But almost nobody hires like this; most organizations have tea-leaf-reading hiring processes, and proudly advertising that you have a CISSP or CEH is one of the tea leaves they read.

[ Parent | on HN ]

Re:Careers in security, ethical hacking and advice on where ... by JumpCrisscross on Wednesday December 21, 2016 @04:39AM (#13227892)

On the trading floor we called them girl/boy scouts: more interested in collecting "merit badges" than getting dirty.

[ Parent | on HN ]