People just don't see them because this happens well above the IC pay grade and takes some time to percolate down and no one wants to publicly announce you shitcanned 5-10 people in middle management and security leadership because you enter thorny employee litigation territory.
That said, I agree with the author about mismatched expectations, though I can safely say that $500k year is VERY HIGH for a CISO. I know CISOs for publicly listed F500s who earn around 200-300k at most after 15-20 YoE.
The bigger issue is CISOs, VP Security, and Security ICs are not enabled institutionally.
If I'm honest, most security engineers suck. 90% are crappy IT Admins or Compliance Monkeys who did CISSP and maybe worked for PWC or an MDR for 1-2 years and don't know the difference between NFTables and NTFS. Most CISOs and VP Sec are former security engineers in turn.
Security Engineering NEEDS Security Minded Engineers. Now that development teams own Platform Management and Deployment, they should also be enabled to own Security, and a Security Team of 10x Engineers with a Security background should help with implementation and guidance internally. At least this is the model I've seen in tech forward public companies (some of whom HNers wouldn't even realize are tech first).
I also agree with Scarlett that data protection laws are critical and need to be enforced. That said, it's not enough (wouldn't protect against a vulnerability disclosure or misconfigured ACLs), and several Security ICs I trust recognize that as well. That said, the tone of the author and a couple well intentioned security minded engineers can impact this larger effort. You trap more flies with honey as they say.
A security minded engineer cannot present this kind of an article to their non-technical leadership, as it opens multiple questions about liability, ownership, and potential incompetence.
> Absolutely no amount of gentle pleas disguised as executive orders from the White House urging people to use memory-safe languages will solve the problem. CISA, despite all the phenomenal work they do, can't charge people who mishandle data with negligence; critical infrastructure involved or not
Amen to that! There's a reason why pushing for cybersecurity insurance might be a good push - hurting the bottom line is a good forcing function for change.
----------
Also, Engineers need to stop being shitty to QA and Platform Engineers.
Treat QA, IT, and DevOps as a first class citizen.
I don't give a rat's ass that you like using Mosh or xyz project on GitHub (not trying to pick on Mosh).
I don't care that you feel restricted by having to use MacOS laptops and SSHing into a CoLo protected behind ZPA when you'd rather use ArchLinux on your work laptop.
Every bug, misconfiguration, or non-standard platform deployment needs to be treated as a potential security liability.
Sure it might slow down the deployment of your "yet another wrapper around an LLM SaaS" but there absolutely needs to validation.
As a security engineer, I agree. I hang up and work with really skilled people, so sometimes I'm shocked when I work with a client's it security engineer and they barely know how to use a terminal. Sometimes don't even have a way (or skill) to use SSH. Not to mention that I code/script every day, and most "standard" big company security engineers just use ready made tools.
Sorry for the rant.
>I don't give a rat's ass that you like using Mosh or xyz project on GitHub (not trying to pick on Mosh). >I don't care that you feel restricted by having to use MacOS laptops and SSHing into a CoLo protected behind ZPA when you'd rather use ArchLinux on your work laptop.
I somehow agree with your examples, but not sure if I agree with the overall idea behind your messages (as written). People have different workflows, and forcing everyone to the same mediocre one will just hurt productivity. Of course there need to be standards, but if people feel restricted by having jump through hoops on unfamiliar operating systems and spend a lot of time and frustration fighting them... Then they're probably right. You should listen and give way more than rat's ass to engineers problems.
I completely agree with you!
I think all us people in the cybersecurity space are cranky ;)
But it also brings up a good point. I feel bad quality User Experience is a critical cause for bugs and misconfigurations. And UX isn't just "look pretty" - it's about optimized and simplified workflows.
> most "standard" big company security engineers just use ready made tools
I've worked for vendors and have funded vendors, so I might be biased, but ready-made tools can be helpful.
The issue is if you are using tools without understanding the underlying architecture or design of your platform.
If you're just a script-monkey and only concentrating on the what, security automation is going to take your job away (and is already in the pipeline in the IR world as we speak)
> Sorry for the rant
No worries. You yourself replied to my rant XD
Yeah well, this is why we don't like security engineers. You absolutely should care that the policies you push for are making workers feel restricted.
For your job to even exist, engineers must be able to produce just remember that.
Ideally, Security Ownership should be taken up by the Application/Dev team with an open understanding that heads roll if you messed up ("ownership"), and a security team and platform team exists to help consult and implement security and deployment.
I guess they call philosophy "DevSecOps" or "Shift-Left" in the Gartner world.
That said, a lot of "security" practices are pure BS and security theatre.
So it will almost always get the backburner. Hell even if there are financial consequences: those don't matter if you don't really make money in the first place.
…
If I'm honest, most security engineers suck. 90% are crappy IT Admins or Compliance Monkeys who did CISSP and maybe worked for PWC or an MDR for 1-2 years and don't know the difference between NFTables and NTFS. Most CISOs and VP Sec are former security engineers in turn.
You get what you pay for. Dinosaur companies still can’t stomach paying “nerds” more than their Assistant Regional Managers and it shows. Maybe they’ll be extinct soon.
I'm curious what are the dinosaur companies in your mind.
Some "dinosaurs" are actually extremely technical and on top of their shit, and some companies HNers/Redditors/LWers love for their supposed engineering chops have their pants off.
Also the number I gave was for a sexy publicly listed tech company that a lot of HNers try to Leetcode grind to.
> more than their Assistant Regional Managers
In most companies outside of the High Tech and Finance sector, margins are extremely low and even a GM will earn at most $150k and maybe $20-30k stock, despite owning a 9 figure BU.
isn’t making only $500k a year in total comp. Nor is an assistant regional manager at say, Target, making only $180k/year.
Quit making things up.
Law enforcement love that gmail addresses can generally be tied back to real people. Tax agencies love that most financial transactions are recorded for several years.
Anyone who reads this comment probably believes these positive externalities are over merited, but it’s formidably difficult to debate the case to a politician.
To put a slightly more explicit phrasing around the blog's message: Consequences fall on the wrong people. The ones screwing up chasing profit are not the ones feeling the pain.
The damage falls on the innocent people the companies were trying to use as resources.
This can be broadly classed as an economic externality, much like how a company can make money dumping poison into the lake but the people who suffer are the ones who drink from it.