Re:Careers in security, ethical hacking and advice on where ...
by SecurityAmoeba on Tuesday December 20, 2016 @06:11PM
(#13225213)
Like I said, its a small firm (also not in the US so I don't have anywhere near the pool to pull from that you have I am sure). I also don't disagree with you like I said, I am just pointing out that it can be a legitimate way for some people to get a foot in the door at a smaller firm, or less 'reputable' one, before moving somewhere else. You need to pay your bills while you wait for other opportunities, or develop your skills.
I am slowly working towards moving us into a position where we have more practical methods of finding out if candidates understand the above, but it takes time for me to develop testing methods etc. while simultaneously completing everything that needs to be completed.
If you have any recommendations, I'm more than open!
Re:Careers in security, ethical hacking and advice on where ...
by tptacek on Tuesday December 20, 2016 @06:13PM
(#13225235)
In fact, I do: https://sockpuppet.org/blog/2015/03/06/the-hiring-post/
Re:Careers in security, ethical hacking and advice on where ...
by SecurityAmoeba on Tuesday December 20, 2016 @06:15PM
(#13225262)
Thank you for this! I'll read through it!
I'm pretty confident in my answer here.
If you want to know whether someone understands disassemblers, debuggers, exploit code writing, and assembly, have them do tasks that involve disassemblers, debuggers, exploit code writing, and assembly. We had that problem, and we built Microcorruption to address it. But you don't need anything that elaborate.
I get that most firms don't hire this way yet (all of them will within the next 10 years). But so far as I know, none of the reputable firms rely on certifications. Of the top, say, 20 "offensive security" people I know, not one of them has any of these certifications.
If there's a major firm that outsources this stuff to certification programs, that would be surprising news for me.