How would a random hiring manager know who to hire?

There are surely people out there who know security, but how does someone who doesn’t know security choose the right people to hire?

The very software that was the vector of this attack is produced by a company claiming to improve security.

The root problem seems to be that most businesses treat IT security as a cost center, rather than a value center.

How do I spend the least amount to get "security"? Rather than, what risk mitigation is appropriate for my business, and how can I gain value from approaching or exceeding that?

It feels like part of the problem is not blending IT security into a peer level with the Operations org, as that's what it functionally is to most companies these days, and looking at it from a revenue risk mitigation perspective makes more sense for funding it appropriately.

> The root problem seems to be that most businesses treat IT security as a cost center, rather than a value center.

I think it’s worse than that. It’s not just security that lacks investment, it’s the whole IT infrastructure.

Obviously the observations of one lowly employee can’t be generalised much, but creaky infrastructure seems too common.

Increasing pay might protect your company, but every security expert you hire is a security expert that just quit another company. So in the end the world lacks security experts right now. The main way increasing pay would help is that more people would try to get into the field and supply of talent might be better in a few years, but it wont do much for supply today.

When you say the pay is lacking then I’m curious what region you refer to. I’m pretty certain that the pay isn’t lacking in Silicon Valley for example.

In my experience, in practice a software engineer salary in England is usually advertised in the range, or just below, other middle-class jobs, such as a solicitor.

I can imagine so. That is probably true for many regions in Europe. But I would betcha it’s not true for London though.