Episode 27 · · 48 min
Nick Jeswald Confessions of a Cybersecurity Recruiter (Part 2)
Director of Corporate Development at Red Mesa
Episode summary
Part 2 of 2 - Nick Jeswald has been an external and internal recruiter in security. He shares with us what he looks for in a candidate, common mistakes made by candidates, and the nuances of hackers he's learned over the years.
Before infosec: Developer, sales engineer and external security recruiter
Chapters
- 0:00
How Ayman and Nick first met
Ayman recounts the dinner at DEF CON and how Nick had once recruited him.
- 1:16
Why Nick could not give VM test feedback
Nick explains the pass-fail policy, the 40-plus hour VM test and why he apologized.
- 6:29
Designing a better entry-level hiring process
Nick would start with a body of work, CTFs and bug bounty, then use a one to four hour evaluation.
- 14:51
Advice for companies sending VM tests
Know what you are looking for and remember candidates never forget how you treated their time.
- 17:24
Ghosting and bulk third-party recruiters
Nick explains why large firms and bulk recruiters ghost candidates and how specialized roles get less effort.
- 20:27
Interview your interviewers
He shares questions to ask, including why the recruiter stays and the company's growth path.
- 29:09
Security pop-ups and reactive companies
Nick describes merged security startups and firms that only discovered security after a breach.
- 32:13
Your job is not your friend
He urges candidates to protect themselves, keep an exit plan and expect recruiters to notice burnout.
- 36:39
Big Four attitudes and recruiter horror stories
Nick covers treehouse culture, not trashing ex-employers and a company that dismissed security until it was breached.
- 41:19
Research the employer and meet the team
Check public filings, board attention to security and how the team interacts before accepting.
- 46:11
Wrap-up and thanks
Ayman and Nick close the conversation and Nick offers to help listeners.
- 47:57
Closing plug for Ayman's community
Ayman invites listeners to join the new community linked in the show notes.
Key takeaways
- Show a body of work, such as CTFs, bug bounty reports or tools on GitHub, before you ask a company for a long technical test.
- Always have questions ready when an interviewer asks, and if time runs out ask to follow up by email.
- Ask what is driving the role, whether growth, restructuring or a recent breach, because it shows how the company treats security.
- Read a company's public filings and look for board-level discussion of security to judge budget and support.
- Ask to meet your future team and watch whether they are supportive and self-starting.
- Never trash a former employer to a recruiter, and keep a written exit plan in case a job turns bad.
Notable quotes
I just don't believe that empirical evaluation needs to take 40 hours.
if you can't recruit for something you're proud of, you need to leave.
your job is not your friend, your job is your function.
Questions answered in this episode
- Why do security companies give candidates long VM tests?
- Nick Jeswald says large firms get a flood of resumes and use long tests as a filter. He thinks that is unfair to entry-level candidates and prefers a short, targeted evaluation after reviewing a body of work.
- Why do recruiters ghost security candidates?
- Nick says large companies and bulk third-party recruiters handle many roles at once and are glad when names drop out of the pipeline. The more specialized the role, the less effort a bulk recruiter puts in.
- What should you ask in a security job interview?
- Nick suggests asking why the recruiter stays, what the company's growth path is and what conditions are driving the role. Also ask to meet the team and research its public filings.
Show notes and links
Show the original episode notes
Part 2 of 2 - Nick Jeswald has been an external and internal recruiter in security. He shares with us what he looks for in a candidate, common mistakes made by candidates, and the nuances of hackers he's learned over the years.
Show Notes
SEE PREVIOUS EPISODE FOR COMPLETE NOTES & RECRUITING TIPS FROM NICK.
Getting Into Infosec:
- Follow Me on Twitter: https://twitter.com/coffeewithayman
- Subscribe To YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
- Checkout My Book: https://amzn.to/2HP2i25
- Sign up for updates and commentary: https://mailchi.mp/467573a314e5/gettingintoinfosec
- Website: https://gettingintoinfosec.com
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
So what was interesting is how we met recently. Yes. Where I walk into the room and I'm like, oh, hi, I'm Eamon. And you're like, hey, just want to jump in here for a second. I mean, the fact that someone knew my first name, let alone my last name, I found that quite intriguing. And you're like, oh, Eamon Osoa? I'm like, huh? And I'm like, OK, does this guy listen to my podcast? How does he know? And, you know, it was a mutual gathering. So I'm like, OK, I probably met him in the past and I just didn't know. I'm really bad with faces and names. Opsec leakage there. Anyway, so and then you tell me that you actually tried to recruit me once. And then you just all of a sudden kind of changed your face and you felt really sad.
You know, so I guess I'll describe the scenario. I was applying to a security consulting firm or a security firm. And I was given a VM and, you know, I had to find the vulnerability in it and I did not find it in time. You know, that was part of the journey where I learned about something about myself was that I'm more of a builder than a breaker, right? I had this long career of building and here I was drawn to the allure of pen testing and the glamour of that. So I was trying to, you know, break into that field. But, you know, I have more of a building background than breaking. In any case, tell me the backstory behind that from your perspective.
Sure. So many of you may already know that part of the evaluation process for candidates going into any security consultancy will involve some amount of evaluation of that candidate's skill set. You know, we try to capture that empirically if we can. The particular company that I was interviewing Amen for had a fairly rigorous evaluation for its technical side. Now, due to internal company policy, let's say, we were not allowed to give any feedback whatsoever other than pass-fail.
Mm-hmm.
And it was to me a little unfair because we were asking people to sync. In some cases, I actually knew one person who did sync 60 hours into that VM that you worked on. And to my knowledge, they passed, they ended up getting hired, but it was a slog and it was tough. But think about those other people like yourself who spent 40 45 hours were not selected and remember you only got into that vm after you had an hour of your time invested with me on the phone previously so now you're into this process for about 44 to 46 hours Of your own personal time, and you are out of the pipeline with no explanation. So this was the case for a great many people I interviewed at that particular company, because we simply were not allowed to give any far feedback.
And so when I see people that I interviewed in the past who I have specific memories of How hard they tried. Because I did speak to you again afterwards, real briefly. You know, I had specific memories of how hard you tried. And I had specific memories of the frustration in your voice when I was speaking to you. When I do meet people face to face, and of course, that tends to happen around death. But I do run into people face to face who I interviewed in the past, and we simply weren't allowed to get I try to convey my actual feelings about it. And my actual sense was, I'm horribly sorry, man. And that's, I believe, the first thing I said to you. I'm horribly sorry. You tried your ass off and you came close.
I can't tell you what you didn't get, but it was close. It wasn't quite up to snuff for the team. And at that moment, at that particular time and place, they had a specific standard there. Your response didn't hit that standard at that moment. And I guess I put it that way because I was always a moving target. And it usually is for recruiters, by the way, you know, where they're asking you to look for somebody and you get that somebody in the pipeline and the next day they send you an updated spec sheet and you think, Oh, I'm interviewing. I'm about to waste somebody's time. So, yeah.
Well, I appreciate that. Of course. And, I accept your apology.
Yeah.
I think what you told me is you weren't allowed to give me more information. No. You wanted to, right?
Of course, because I feel that as a recruiter, it's on me, especially when I'm talking to entry level people. It's on me a bit to if I am not going to bring you onto my team or advocate for the next round of people to bring you on the team, then I think it's on me to at least provide you direction or else we both wasted each other's time.
Right.
That's how I feel about it. So I would have much preferred if every single one of those people I could have said, hey, you know, work on the network side, work on your web app, you know, work on your writing skills because you had to turn in a report with that. If you recall, you know, work on that stuff. You had to be able to tell them something or I just didn't feel like it was of value. And luckily with Red Mesa, when we talk to people, we'll tell them flat out, you know, OK, you need to improve these kind of skills before we could really use you on our team.
Yeah. A little bit of pay it forward, right?
Yeah, exactly. Because bottom line, I don't care what a man's skill set was four years ago. I know that a man is going to be around and I'm going to run into you. You know what I mean? And maybe you decide to go on the builder side and that's pretty awesome. And down the road, I end up scheduling my team for a purple team session with your team. With the rest of the builders that happens all the time and it's like oh hey I remember I interviewed you I'm so glad that you dug in and went the direction that we talked about that would be nice but unfortunately with that first company there just isn't that opportunity the only opportunity I have for the folks that we did not select is to go back and just sort of offer my apologies for not yeah
Responding in a constructive sense i appreciate that of course and it all comes down to you know what's your motivation for recruiting right now are you an internal recruiter who understands that you know their company will be in contact with these people later for better or worse or are you a gunslinger external third-party recruiter who might do some security recruiting sometime in the future and if they do your name might pop up on their linkedin search that's about it
Yeah. So do you think the whole VM thing I'd like to talk about a little bit? Sure. Because actually someone randomly pinged me and they're going through a VM test as well. Sure. And they're struggling through it as well. And, you know, from my perspective, I mean, I went from recruiter initial talk to VM test, right? Yeah. Yeah. There wasn't really anything in between to kind of gauge whether I would be successful Sure.
At that VM. Nope. I mean, from my perspective, I was like, how many hours am I supposed to invest in this? Right? Yeah. Because we all know that there's a certain amount of time. Everything's a matter of time, right? Sure. If you're like. If you're like super expert, it's going to take you less time. But if you're, you know, more in the entry level, then you're going to have to invest more time. But like, how much time do I really need to invest? So what are some other steps or how would you have done things differently if you had the choice?
Okay. So if I had to build my own process for bringing in entry-level infosec folks, is that sort of where we're looking at?
Yeah, I think so.
Okay. Okay. And honestly, this is something that's been a point of discussion within our company recently.
Okay.
Because we're preparing for that. You know, it's something we're looking at in 2021, you know, down the road as we grow, going to need that mentoring pipeline internally. So we understand we're going to need the best possible way. To recruit from that pool of folks who are just getting it. So really, let's look at this holistically. From a company side, what do I want out of recruiting somebody who's fresh and new, right? So I want potential, right? I want someone who's going to be able to grow. And I want someone who's passionate. I'm not going to invest a bunch of time in mentoring it at this person, have them turn around and say, you know, I really just rather be in management. You know, because there isn't any of that in our company.
There really isn't. We all deliver something, I guess is what I'm saying. You know, you want passion. You want commitment to that sort of role. You want loyalty. You know, we're not interested in being a high turnover company. And most companies aren't, frankly. You know, they just understand that the security resources tend to turn over. So that's what I want on my side. So if everybody wants to read my cards, there they are. So on the recruit side, what are you looking for? You're looking for interesting work, right? And you're looking for money. Sure, money's there. Anybody Getting Into Infosec immediately believes they should be worth twice as much money, which isn't the case, by the way.
Entry-level infosec is not that much better paying than mid-level Java development. You know, you really got to factor that in. You've got to be realistic, you know. Right. And I hate to use this and go on one of those websites or several websites that purport to be able to tell you average salaries for various, you know, geographies. Go and take a look at security analysts. Just analysts and see what that looks like. It's actually a pretty broad range. The last couple of times I looked, it is. Yeah, but it's not that high. So, of course, the motivation will include interesting work, more money and some amount of flexibility. There is a perception that with security, there are more options available to you in terms of the sort of work that you do in your day to day.
And of course, you know, people look at security, people who are true information security professionals, they also have that desire to find a place where they will be able to build their own recognition within the community. And when I say that, I mean, the sort of role where their research and presenting their research specifically will be supported. Okay. So I, as the recruiter, I've got to, you know, I've been on both sides, so I'm looking at both sets of cards. And so for me, the best way for me to get what I want and the best way for these recruits to get the things that They want out of our recruiting process is number one, provide me with a body of work to look at and let me make that my first step.
Okay. I mean, even if it's like the security equivalent to hello world. Okay. And whatever that is at the moment, like you wrote a tool, you know, you wrote whatever, a perfect concept of some sort of exploit, something. Let me check that out. OK, because if you give me that first interview on the phone, I get to feel you out. OK, this is, you know, a mammal. This person will be able to sit in front of an executive somewhere and not terrify them. Let me just see that you have a body of work. And if it isn't conveyed on the resume, make sure I can get into a website or something. Just look and see what you've done. That would be preferable as a first two steps to me. Now, that doesn't mean there shouldn't be some form of empirical evaluation.
I just don't believe that empirical evaluation needs to take 40 hours.
Right.
So we're not expecting our security assessors to be able to write like Shakespeare. That's not happening. Yeah, you got to be able to write a report in general. We have hired PhDs actually to be able to clean up your reports.
Wow.
Yeah. So, I mean, I'm not looking for you to be able to do those things necessarily. Right. But I guess what I'm saying is there has to be some kind of empirical evaluation.
Maybe having multiple levels, right?
In our sense, we have sort of a minimum bar of what we want to see in your body of work.
Yeah.
And we're going to talk to other people because, you know, remember, we're looking towards, OK, if we're going to hire from that entry level pool, what do we expect to see? Well, I expect to see CTFs because I don't care if you're on the red side or the blue side. You can go to a CTF, right? Right.
Yeah.
I expect to see some form of development.
CTF time.org.
Yep. There you go.
CTF every weekend all over the world.
There it is. There is. There are so many places for people to get involved locally, remotely. I don't care where you are. As long as you have a halfway decent internet connection, you can get involved with CTF work. And that's a wonderful way to cross pollinate, learn new things, all of that. So as long as there is a body of work in terms of CTF activity that I can verify, by the way, I got to be able to verify these things.
Right.
Oh, bug bounty activity. That's a great one to show.
Yeah.
That's a good one. You know, you want to show me, you know, your web app prowess. Show me your bug bounty work. I had a guy do that. I actually have a number of people. A woman at the last company I was recruiting for showed me some of her bug bounty work. And I mean, she had two really good years financially. From one particular very large company that has a pretty cool web presence that she found some pretty blockbuster stuff on cool so yeah she kind of took a few years off just did her own research and that's the dream right you know the dream you find the very box of money you find you know the big vulnerability that somebody pays you lots and lots of money for and you think You'll be creative and find yourself for a year or two.
Anyway, so my point here is, let me see what you've actually done. Let me get a look at all of that. And then our third stage will be a very pinpoint evaluation of the specific skills that we want to really check out. Because we have people that come to us, and let me give you some context around that.
Be able to ask for that sort of thing, because we do a lot of work around critical infrastructure, monetized gaming, and other very specific verticals, you know, radio frequency work that not a lot of other firms do. So it's easy for us to pinpoint certain skill sets with, you know, small, tighter evaluations. But of course, bringing in people on that lower level It causes us to have to broaden that approach. So of course, we're going to have some sort of empirical evaluation, but ours will be a bit more pinpointed than what you went through. We're targeting something that takes in the order of one to four hours. Does that make sense? Sorry if that was a bit long winded, but I mean, I have to give a little bit of context around, you know, us as a company.
I'm going to design this in a much different way than Dell Secureworks will. Right.
So in summary, what's some pointed advice for companies that are still sending out VMs to entry level folks right now? What is some advice for you to them?
Know what you're looking for. Before you ask that much of these people, know what you are looking for. Are you really looking for every little last thing that you're trying to see that these people can find in that vehicle? You know, is that really what matters to you? The report that they write, does it matter to you that it is a huge report? You know, can you just accept these people's reporting as fill in the blanks? Can you accept that they gave you some amount of prose in a paragraph and, you know, sort of look forward to, well, we'll have someone help them with QA and we'll mentor them in reporting. Really understand what you're asking.
Do you think it's a little bit of gatekeeping sometimes where they just kind of want the entry level person to just go away?
Sure. I mean, the bigger the outfit, the more of a fire hose of resumes that they see coming in. It's just the truth. I see a trickle because people know that we're only hiring for senior level roles. So for a company, like I said, I'll go back to the Dell SecureWorks model. I mean, can you imagine how many resumes they get? I can't even imagine what that looks like. So they basically have to have a big discriminant, a weed out, so to speak, there. And so they'll say, look, you want to throw yourself at this all day long, that's on you. See you around. But for a company like ours, I'm going to actually remember your name. I personally will remember you. And that's not comfortable for me if I remember you and I remember wasting your
Because the time is the one thing I can't give back. So yeah, that's the advice I give to these other companies. Make sure you know what you're asking of these folks. And yes, you might be a company that feels that they are in the driver's seat on recruiting and people are beating down your
They will never forget it. Never. Because I still remember, you know, the interviews and the interview processes where I felt that somebody, you know, essentially was not completely respectful of my time or, you know, other things. I still remember that. So, yeah, same thing. I would counsel them. Don't forget, you're dealing with human beings. Certainly, you're getting a fire hose of resumes on a daily basis. But the more jaded you, the other recruiters out there become, the more those sought after resources are going to be interested in talking to me instead.
I mean, there's a lot of ghosting out there by recruiters. It's insane.
Of course, they don't have time to get back to anybody. Oh, yeah. I mean, if you have listeners who have stories of being ghosted by recruiters, you know, they put in X amount of time and, you know, all of a sudden this person disappeared, never got any feedback. Yes, absolutely. That happened to you. It's going to happen again. It happens more often. In proportion to, you know, the larger the outfit you're interviewing with because of that fire hose issue. They have so, so many people happening that those recruiters are usually just happy to see names drop out of the pipeline. They're just happy to see fewer names the next morning. It's less people for them to have to answer questions about.
It's, you know, less names on the spreadsheet, you know, or whatever they're using. There are so many recruiting systems out there. It's just less to have to deal with. I mean, at the end of the day, especially to a third party recruiter, don't be surprised when you're ghosted. That recruiter is hiring for 20 different roles right now. They're probably hiring for agriculture, distribution, all kinds of things, all the way to your security role. By the way, here's another one. I don't know if anybody ever told you this, but The more specific the role, the less a bulk third-party recruiter is going to want to do it. The less they're going to want to work on it and put effort into it. Because as a bulk recruiter, in the time it takes me to fill a security role at some company, I could have already placed three or four.NET developers somewhere else for essentially the same money.
So why am I writing back candidates that you rejected? Probably not. It just doesn't mean anything to me as a bulk third party recruiter. So yes, you will be ghosted. That's going to happen. Okay, I'm sorry. Now we're getting into all the world of that, you know, your interviewers understand that every single interaction with an interviewer betrays something about the underlying company. So if you were ghosted by the interviewer, well, okay, that means one thing if it was a third party and another thing if it was an internal. If you're dealing with an internal recruiter and you were ghosted, well, okay, that particular recruiter may have had a bad day and completely missed his own reminder to email you back or something.
Or it could betray if it's a common thing. And you see this across the board with a bunch of people you know interviewed with that company. That probably betrays some amount of internal mismanagement. It should tell you something about that company. And I remember I sent you something about this in an email the other day, but you really need to interview your interviewers. And by the way, recruiters who are listening to this, if you can't answer these questions, you really need to stop and think about how successful you're going to be at getting the recruit you want or the right recruit for your role. So you really need to be able to answer these things. And if you can't answer them, really think about why you, the recruiter, are in that role either.
Because if you can't recruit for something you're proud of, you need to leave. Oh, that's the truth. If you're a recruiter out there listening to this and you cringe every time and you're listening to this because you want to know about getting these resources, making it easier to work with recruiting security folks. If it makes you cringe to try and recruit security folks seriously, you know, take that vertical off of your lap because it's going to show for better or worse. Pretty much every single person I interview is smarter than me. Just throwing that out there. You guys are all smarter than me. And you ladies, all of you can change. Just think circles around me every single time so all you other recruiters out there unless you're some kind of genius they're probably staring straight through you on that phone so make sure you know why you're in the role you're in too so let's just talk really quick about interviewing your interviewers here's some things that you want to ask the interviewer so when the interviewer gets to the point of do you have any questions for me don't knee jerk like nope not at all
Oh my god never do that yeah that's the best way to say i'm desperate hire me you know no you don't want that i don't want to hire somebody necessarily who's like absolutely desperate or it says that you're uninterested also so yeah we're just uninterested in my company right i mean that's a little you know what's going on there why aren't they interested or why are they just wanting like you know plow on to the next step without learning anything weird right i always have questions
Ask one, maybe two questions, by the way, I would say. Don't ask too many questions. Just ask one or two good questions and think of them during the interview as well.
That's fair advice. But to be honest, I sat with people who had a good five solid minutes of questions for me. And I was happy to answer every single one because that person might stay.
I would say it depends, right? The recruiter, you could probably ask a lot more questions of. But as you go up higher in the chain to people you're talking to and also depending on how much time is left in the interview, right? I mean, it's also incumbent on the interviewer to leave time for questions. Sometimes they won't leave at any time. I'm like so annoyed.
Well, true.
Yeah.
And if that's the case, you should always, always be able to say, hey, I know we're running out of time. I have a few questions for you. Can I follow up over email?
That's a good one.
And if they won't respond to you, something's wrong there. If they're genuinely interested in you, the candidate, going forward and investing some time into what's going to be probably a technical evaluation or something, or even just more interviews, they need to be interested enough in answering your questions. I mean, otherwise, it all comes down to, hey, do you really value your workforce? And why are you hiring in the first place? I want to be able to answer every question you've got. Everything. And honestly, I am more and more confident in you as you ask me the good questions. Because I'm proud of what we're building. And I know that people will be happy here at the right level if we're not throwing them into the deep end too early or something.
And I love to answer all of these sort of questions. So, I mean, I do have a list for people. And maybe it is easier to ask just the recruiter or maybe email just the recruiter. But they should be able to answer these. And these are questions that really are going to matter to you going forward as the employee. Ask your recruiter, first of all, why do you stay with them? And really listen to their answer. I mean, is it this cold, clinical, I make X amount, you know, it's a lot of money. Or do they really know something about you? The vision, the future of that fund. Can they communicate that to you? That's a big deal because that recruiter should be the ombudsman for that company to you. And if they can't do it, think about that.
You know, is this a third party recruiter who really hasn't thought through who it is they're recruiting for? And therefore, it's a huge possibility. They're just trying to stick a butt in that seat and you're that butt. Maybe not so good, you know, because if the answer is, oh, I don't stay with them. I'm third party. Of course, you got that one nailed.
Right.
That really cover yourself. Secondly, what's the intended growth path? Of this company? Maybe your recruiter, if they're a third party, probably can answer that one, but you should be able to get that answer via email through them. What's the incentive growth path? Organic growth? Are they going to open up some sort of channel model and bring all their business in through business partner channeling? Or are they going to try to go with an initial public offering? And you know be a listed stock all three of these things provide you with a different potential future right you're getting into a company that wants to go initial public offering cool that company is going to do a lot of attempting to make itself look more valuable this year so be real careful because there's going to be a lot of window dressing smoke and beers going out around oh interesting yeah your company is going to try to grow via channel sales and
Okay interesting that means third party off payroll sales people are going to be sending your team projects what's that going to look like do they know what they're selling has anybody trained the sales people out in the channel Or are they just going to be saying like, hey, these people need a firewall, send it over. And you're like, firewall? I do web apps. What are you talking about? Is that what's going to be going on? I've seen it happen. Is there going to be merger acquisition activity going on?
Well, I like your question about what conditions are driving. So I'm going to publish this list. Sure, please do. But you want to talk about what's driving this role?
Oh, yeah. So what conditions are driving this role? Is it internal restructuring? Is it organizational growth? So here's a question. So you're going to interview this company, right? And you've read something, you know, some chatter about their whole team sort of quitting within a two month space last year. Really think about that.
Yeah.
See if you can dig in through the community and find out what happened there. I mean, if you see that an established firm has a whole range of vacancies all of a sudden somewhere, is that a new office? It's just organic growth. They're opening a new office in a new city and they just got to staff it out. That's pretty awesome, right? I mean, that's a great time to get in. Internal restructuring. Ooh, okay. Are they creating a new team? Did they kill off an old team? What happened here? Is security now reporting to the CFO and will never, ever get another budget approved? What's happening? So you really have to understand those sort of things moving into accepting a role with somebody.
Yeah. How long has the role been open? Sure. Did they have an incident recently? And is that why they have the role, right?
Yeah, exactly.
Like, are they being proactive or reactive, right? All these kind of things will tell you about the culture of the team.
Sure. And that's for those internal security roles, right? Blue team. Right. So that's exactly it. You know, did you read about this company having a huge breach last week and now they're looking to staff up the blue team? That could be a little interesting going in, you know, if they're doing their staffing reactively at that point. They may not really know what they're looking for. The roles that they're staffing right at that moment may be obviated in a year. You know, maybe their reaction to this incident is, Sure, it might follow their determined disaster recovery path or whatever it is they're following. But is that path going to leave the company sustainable?
Yeah.
I've seen many companies whose disaster recovery left them unsustainable.
Wow.
Yeah. So really think about that. I mean, if you're going into an internal role based on a recent breach, talk to people. Again, reach out to your community.
Or even worse, where your role is kind of just really a checkbox role. That's the worst.
Oh, yeah. The job satisfaction is gone, right? You know, so I have known people who ended up in an enterprise security role, right? They're doing all that GRC stuff. At a firm that really just wants to be able to say that they exist in that role.
Yeah.
And so that role will never go anywhere. There will be no upward movements. You know, they just want someone to sit in that spot for, you know, how many years?
Or they won't listen to your advice, right?
Well, that's going to be, well, that's a whole other issue, right? I mean, internal advice a lot of times is threatening to those around the advisor and That's kind of the reason why consultancies do as well as they do, right? They won't listen to me. I got to bring in a third party to kick the doors in and then point and say, see, it's what I've been saying. Our door's broken. That happens all over the place.
Something else, man. That's something else.
That's how it works. And that's the other thing. I mean, does this company really understand the care and feeding of hackers?
Right.
Are you about to go into a company? So here are the two worst case scenarios. OK, number one, worst case scenario is you're going into a security pop up. OK, and I'm saying pop up, meaning rich investors say, you know, I start a security company, a security thing. Sounds like it's doing well.
Awesome.
And yeah, it happens. You know, I know somebody that's just had this happen to their company. You know, so what we're going to do is we have identified three to four mediocre failing security firms that we're going to buy and we're going to weld them all together and give them a cool name.
I love it.
We can't fail.
I love the impression.
It's awesome. Oh, it's great. You know, and the, oh yeah, Haram, Haram, good idea. Yeah. Yeah. So they go forward and then people do this and they go and they buy a security firm or two and then they go on a hiring spree, hang out their shingle and say, hey, bring us some business. We're ready to go. It never works out that way. You walk into that team as the new analysts, right? You walk into this company that's just been rebranded. You know, people are just getting used to the new logo on the coffee mug, right? You don't even know what anyone's role is. You've got two separate, fully formed, failing companies that now have to reconcile all of the structure that exists around the consultants, right?
So do you need two sales forces? Nah, let's get rid of the sales guys. All right, sales guys are out of here, at least at one company or two sales directors. Well, but the sales guy and the sales girl were really good friends with a couple of those consultants. Now those consultants are bumped because you treat them badly. Well, okay, there's a problem. Hey, do you need all those accountants? Yeah, let's get rid of the accounts, the healthy accounts. Okay, great. Now you've bummed out everybody who's friends with you. And so you end up with this smoking crater that used to be two different badly run companies. And here you are, the analyst who's just got this cool new opportunity with this new company that just sort of formed out a couple other companies.
And you're excited and you're in and it's your first security job. And all the lessons you learn that first year have nothing to do with technology. And they have everything to do with surviving in a corporate nightmare. And what you learn from that role and what you bring forward into my company When I interview you is then difficult, right?
PTSD, basically.
Right. And man, because there's a big disconnect between how companies communicate they value information security professionals to these people versus how they act like they value these people.
Gotcha.
So, you know, words, you know, it's that old axiom, your job is not your friend. Now, your job is your job. And, you know, keep that separate in your head. And you do everything you do to the best of your abilities, of course. But remember, end of the day, your job is not your friend, your job is your function. And if that function begins to ail you, Begins to harm you, then you need to step back. And when we look at it in a holistic sense, that's the other thing. Holistically, if you're in a position that is destroying you, are you protecting your value? Probably not. Because when you come to me as a recruiter, as a destroyed person, and I can tell, like, I'm looking at you and you're just tired.
And yeah, you're ready for a career change. I'm ready to get into something new. I really have to sit and consider, okay, am I giving this person a role that's going to ask, because it is a step up from where they were. Is it absolutely going to roll back on them and crush them because they've had their spirits crushed at this other role for so long? And it might not stop me from hiring somebody at all, but you know what it might do? It might make that person the one person I worry about the most and check up on the most in the company. And that definitely happens.
Yeah. Wow. That's deep.
Yeah, well, I mean, everybody's got somebody in the company they worry about the most. OK, if you're worth your salt, if you're a human being, there's someone else on your team, your squad that you worry about the most. And you know what? You're hiring that person they're going to worry about the most. And you've got to really think about that dynamic going into a tight knit red team, going into a really tight knit blue team. You know, what does that bring? When the person that everyone's going to rely on may be a shattered person at that point. And it's hard.
I think whether you're an internal recruiter or external recruiter, I think it's seldom that recruiters empathize so much past the hiring point, frankly.
And you're right. And that's because people don't understand the care and feeding of their employees. It's not that they don't understand, they just don't care. Once they're in the door, they're just human capital. Now they fail over, you know, in a big company, they fail over into now they're part of the human capital pool. They're managed by human resources. They're no longer on our radar screen necessarily from, you know, recruiting standpoint, because now they're strictly in a maintain and run mode with HR. And in like a boutique size company, go the other direction. So now you're answering to a founder. You know, you bring somebody in and now they're probably actually under the microscope, you know, far from falling away and disappearing.
Now they're under a microscope at the whim of that founder or founders, depending. So, you know, I mean, you're kind of taking it either way, no matter what kind of organization you're going into. Now, that being said, if you can find that unicorn, which is the self-aware, emotionally intelligent organization, then you'd be all right. But, you know, you can't really count on that. That's where it comes down to everybody needing to understand, hey, be true to yourself. Never forget who you are. Understand the value of the Halloween mask and just be holistic in your thinking, be holistic in your planning. Don't ever lose sight of the fact that it's not your friend. It's your job. You need an exit plan, whether it's the big exit plan where you're retiring in 40 years or the little exit plan where maybe you just need a way and escape hatch off the team you're on.
Maybe that's all it is, but you've always got a plan. I met an attorney. Who was absolutely bored with his life. He was a tech patent attorney. You know what the guy told me? He said, my job involves describing in tiny detailed sentences what happens when everything blows apart.
Hmm.
That's his job. And you've got to play that role for yourself. You've got to be your attorney where you have that detailed granular step-by-step plan for when it all starts to come apart and you're no longer learning anything and you're getting burnt. They're just throwing you on project after project after project that just aren't you. You've got to already have that plan, whether you do it on a bar napkin or whatever, you got to be able to reach over for the good of your emotional health. You got to be able to look at Say there is a way out. I'm going to start executing against this list.
Yeah, I mean, I think a lot of people are willing to do the work. It's just how they're treated while doing the work, right? Well, certainly. They're willing to put in the extra mile, but I think they just want to be treated like humans, right?
You're absolutely right. And that's why, and I get further into that where, okay, If you're coming to me from big four, how are you treating my humans? And that's an enormous problem.
Yeah.
I mean, that's absolutely a huge problem because you're coming in from like big four. You got big four ideas. You got big four customer service skills. That's cool. You're going to be client facing. Also, you think you're up in the treehouse and everyone that gets hired after you isn't.
That's not OK. What does that mean exactly?
Up at the treehouse, like when you're kids, right? So a couple kids build a treehouse, and they're the cool people. And for a while, they let some other kids come up in their playhouse, but it's largely just to have the ability to then throw them out of the treehouse and denigrate them with their friends that they keep in the treehouse later.
I see. I always wanted a treehouse when I was younger, but I never got the chance to have one.
You know, we had this enormous mountain mash in the backyard that I always wanted to build a treehouse. And I was always allowed to, but it never got further than steps.
Yeah.
Because it always degenerated into a game of pirates and it just never got into the building phase because we were having too much fun building pirates.
That's funny.
And I get this all the time. Like I would interview people and they start to get comfortable with me. And here come the horror stories. OK. Right. And OK, guys, ladies and gentlemen, I should say, I behoove you do not tell horror stories to your recruiter. OK. Yeah. You never, ever, never trash an ex to your current. Right.
Absolutely. Yep.
Ever, ever, ever do it. I never do it. Now, that being said, I'm a different kind of recruiter and I don't mind someone crying on my shoulder. So, I mean, if you tell me your horror stories, I'll keep your secret forever. But most recruiters, it's considered kind of trashy to talk about Horror stories from the past, but it also allowed me to sort of accumulate a lot of horror stories. And I got to tell you, that security pop-up is one. And then the next worst is the reactive big company who just discovered security today.
Yeah.
Okay. Wonderful example. There is a company that I spoke to their CEO and CFO one day, specific events on the sidelines of a specific event. And these folks chuckled at me and said, quite literally, he called me son, which I hate. Wow. I said, son, nobody is going to want to hack us. Oh my God. You know why? We just do blank. And that blank was they were involved in some natural resources. And I said, okay. And they said, so you don't worry. All that is an insurance scam when it comes down to it. But I'm sure you folks will convince enough people. Wink, wink. And I thought, okay. I'm not trying to be conspiratorial with you, sir. And I don't believe that what we do is snake oil, but hey, best of luck, great meeting you.
And this was a while ago, by the way. And about a year later, of course, they have to disclose to all their investors they had a massive breach. All manner of sensitive data was exfiltrated, known to be exfiltrated. And it had to be disclosed to the investors.
Yeah.
So you get that. And you know what they did? They turned around and said, we're going to build us a security team. I even explained to you the absolute Rube Goldberg machine of a security apparatus they slapped together. After that point, I had spoken to someone who ended up basically leading an engineering team there. And it was one of these deals where you got security in your title awesome come on in i think we need somebody for aim that sounds good that's a three-letter acronym i can get behind you what do you do it was like that and they hired like a whole bunch of people and yeah these people had definite security skills and then over the next two years that company sort of sorted out what their actual security roles were well they already had people sitting in desks turnover was ridiculous job satisfaction was non-existent
Effective security detection was gone right you know you can only detect what you're looking for and they didn't know what the hell they were looking for half the time I think boy I don't want to get in any kind of specifics but it was basically one of those deals where I mean they really didn't even understand what their own threat surface looks like So when you go into a company and you're purporting to be defending them and that company doesn't actually know what their threat surface looks like, you know, it's somebody telling you, okay, you're going to go defend the castle. Well, where does the castle end? Over there. Go stand there. There's a spear. And that's kind of what it was like. So you got to be really careful.
Go into a company with your eyes open. Ask these interviewers questions. Go and be as creepy digging into that company as you figure they're going to be digging into your social media. And by the way, I don't do that for the record. I only look at your publicly available LinkedIn unless you link to me as a man did after our first interview. A man did link to me, and I went and snooped his profile, and it helped. I thought, great. Look at this guy. It's great stuff on his profile. I will not go and snoop your Facebook. That is completely unethical. It is not a professional network. I'm not looking at your Twitter. I'm not going to go find your Instagram. I may be different in that way. I know there are other recruiters that religiously do this sort of thing.
And they say, you know, well, OSI, right? You know, I want to be able to use open source intelligence in every part. I feel like, hey, you know, we're sort of making this agreement that you're going to sort of open the kimono a little and let me look into your professional life anyway. I want to at least be honorable and not start rifling through your personal life. So recruiters out there, I hope you're hearing that. It is kind of dishonorable to go and rifle through someone's personal life if you're interviewing them for a professional. That's just me. And that's how Red Mesa exists. But hey, you do you, recruiters. That's why we have such a great reputation out there. Anyway. Sorry, I'm going to bash my own kind, but man, I had enough of that tournament issue.
So anyway, as I'm saying, dig into your prospective employer. Look at everything. They're public. Go dig into those public reports. Learn how to read those quarterly and annual filings. Figure out if the board is driving a whole bunch of assessment next year or just security improvement. If you're seeing that showing up at the board level, you know that somebody in that big company is tasked with writing the strategic imperative that the C circle will have to follow. And they will push that down all the way to specific initiatives, specific projects, specific tasks, all the way down to the engineering level in that company. And when you see those things and report, think about that. Okay, I'm coming in on the blue team side of this company that has been basically inundated with discussion of defending that company at the board level.
There is a huge driver for this. I need to understand that going in because it's likely my team is going to have a pretty good size budget and cheerleading from the top levels. That's a great thing to know going into that company because you're going to be able to really make some sort of difference. You probably have more of a chance of making a serious delta. Whereas if you go and look up that company and there is absolutely nothing discussed about cybersecurity in any sense, in any of their filings, press releases, anything, you might be dealing with a company that just doesn't know what security is for. So do your research.
One last thing is you mentioned meet your team. Yeah. Watch the team interaction closely. If you're just interviewing one-on-ones, how do you get the opportunity to meet the team? Like maybe go to lunch?
Ask. Yeah, ask. You know, you get way into the interview where, you know, the interviewer is asking you to make commitments of any kind, of any kind. Stop and ask to meet your team. It should not be a problem. It should be something, unless it's a highly distributed company, ours is highly distributed, okay? So if you came to me and said, I want to meet my whole team, I would say you're going to have to wait till DEF CON.
Right.
That's the only time we're all in one place. We're spread out across the planet. I'm sorry. But what I will do for you is I will get in front of you and I'm sure our president at that point, Drew Porter, will want to get in front of you too. And you can see how we're going to interact. You're going to see You know, we're going to interplay. But remember, again, we're slightly different because everyone who comes into our firm has to be a self-starter and be able to manage their own projects. So the interplay you're going to see between me and Drew or me and the other consultants will be essentially a group of equals talking.
Yeah, but like, I think you're pointing out, are they supportive or adversarial?
Well, there's that. Yeah, there's are they supportive or adversarial? And are you seeing no one can do anything for themselves? And no one's a self starter? Are you seeing those kind of glimmers in the interaction? Are you seeing that no one can kind of do anything until one top guy moves? Think about that. Are you going to be cool in that environment?
Yeah.
Are you more of a self-starter? Are you more of an independent? Are you going to look at this team and saying, boy, my leash feels pretty short today?
Gotcha.
You know, that's a problem.
Yeah.
So remember, never forget who you are and never forget what you're going to be comfortable with in a team sense.
Yeah. Well, Nick, I really think you're one of the most unique recruiters out there.
I hope not. I hope not, man. I hope that's not true.
I don't know, man. I think you're one of the most human recruiters I've ever met.
Thank you.
I was definitely blown away by your humanity at dinner. And I was kind of lucky that we got to sit at the same table at dinner the other day through some awesome mutual friends.
Yeah, absolutely. I feel very lucky, too. I was very happy to have been able to see you again.
Yeah.
And frankly, I am honored to be included in the company at that table.
Yeah, same here.
Very much so.
Yeah. So I think everyone in all different levels of security hiring can benefit from this discussion.
I hope so.
Yeah. Whether you're a recruiter, analyst, hiring manager, everyone in between, board member. So I really appreciate your time today.
Certainly. Anytime.
Yeah.
If I can ever be of assistance to you or any of your listeners, go ahead and fire away. Yeah. Pretty easy to find out there on LinkedIn.
Cool.
So yes, anything I can answer.
Yeah. I think we'll have a follow-up next year and we'll see how the state of recruiting is next year.
Yeah. Hey, maybe we can panel at DEF CON or something.
There you go. That'd be awesome.
Hey, you should have your own event. Yeah, we'll try. Coffee with A-Man at DEF CON. Come on, man. It has a nice ring.
That'd be great.
Has a nice ring.
I'm always down to do that.
Anytime, man. Anytime I can help you. I am absolutely at your disposal. Let me know.
Cool.
And I love your channel. I love the concepts.
Thanks, man.
And please, anyone who hears this, just dig in. Don't lose faith. You will find the right spot. Just be patient, be confident in yourselves, and remember to adjust that Halloween mask.
Nice. Well said.
Thank you, Nick, for sharing. It's been awesome.
Anytime.
Thanks, man. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
