Re: From Developer to Security...
by dragonchild (Archbishop) on Sep 25, 2003 at 01:43 UTC
|
I am a hiring manager and I have two resumes to choose from. One is a person with 15 years pure development experience and nothing else. The other is a person with 8 years development experience and 2 years in system security. All other things being equal, I know exactly whom I will choose every time.
No-one will ever be a "pure" anything. Not even consultants hired for a specific task. My current contract was to convert VB scripts on Win32 to Perl scripts on Unix. That was in May. I found out two days ago that this project is (and apparently has been) on indefinite hold and that my contract ends in 5 weeks, not 10. So, what have I been doing for almost 4 months? Very little Perl. I've been doing (in no particular order):
- VBA for Excel and Word
- Batch scheduling
- Perl (on both Win32 and Unix, both one-offs and modules)
- Project management
- Test development
- Project analysis
- Project design
- Batch schedule paradigm shifts
- Process analysis and remediation
- Document-generation automation
And, that's just what I can think of off the top of my head!
In other words, get the exposure! Have fun working. So what if you're not a "pure" developer?!? "Pure" is useful for virgins, academics, and chemicals. Nothing else.
------ We are the carpenters and bricklayers of the Information Age. The idea is a little like C++ templates, except not quite so brain-meltingly complicated. -- TheDamian, Exegesis 6 Please remember that I'm crufty and crochety. All opinions are purely mine and all code is untested, unless otherwise specified. | [reply] |
Re: From Developer to Security...
by jdtoronto (Prior) on Sep 25, 2003 at 02:20 UTC
|
Well, this is one that tugs at my heart-strings a little. I am nearly 50, and am in my fifth career, let alone all the minor variations I have had along the way! When I left high school I knew exactly what I wanted to be. But that certainty lasted for all of three months out of University because novody would hire me to do what I wanted to do - I had no experience. So, I took a job that came along. I had to work through out University to pay my way, my parents care nothing for education and by the time I finished I had no debt, but nothing to live on. So, on my way to being what I wanted to be, an electronics design engineer, I started fixing high speed motion picture cameras. Then one day I solved a problem with a camera that had been plaguing the company for months - I analysed the design and found where hte problem was and a rather expensive rotating prism camera was saved.
The next week I found myself designing a rather basic servo speed controller for an AC motor. The following week I was designing the control electronics for a film processor. Then came my big break. A client of the company was having a problem and I was asked if I could think of a way to find a solution.
About a month later I was on loan to the client, and within three months I had left my original employer and had a new career, darn it I had turned from a hopeful young engineer into repair technician and now mathematician! How? Well, turns out I had a hobby interest (electronics of course!) in a field that I never thought of as a career. After I solved the mathematical problem I was being re-assigned to another problem in the UK (I am originally from Australia). But I asked if I could join the design team and they agreed - I got to work on making my mathematics a reality.
So why do I say all this? Just recently a friend who is a year younger than I asked "why can't I seem to get a new job?" - he has been working as a developer for the same company using a nice, but totally in-house language for twenty years this year. Oh he knows other things, but he has nothing that says he is flexible, able to learn, able to organise people, able to do any project or business analysis or able to even manage a project. So what happens? He is stuck.
I am older than he is, in thirty years now I have had more positions than I can remember. I have worked in more places in more countries than most people would see on vacations for a lifetime! Some of my jobs have lasted a week or two, one for a number of years. I keep getting job offers, some pretty darned good ones too.
But now I can pick and choose! I love working from home, I hate managing anything - even my own bank account, I love challenges and I love doing things I have never done before, and every day I get the chance to do it while comfortably bringing in an (only just mind you!) six figure income.
I commute no more than 10 metres every day, I spend valuable time with my wife and daughter, I get to go to the park every day pretty much and I go to the coffe shop whenever the mood takes me - as long as my work gets done. I enjoy life and because I have a proven ability to adapt to almost any situation I keep getting offered work doing just about anything. So after thirty years as engineer, technician, mathematician and pysicist what do I do now? I write Perl code!
You can be whatever you want, but expose yourself to as much as you can while you have the opportunity. It will pay off later. I hope I haven't been too long winded, but good luck in whatever you choose to do. You will inevitably make some bad choise, I know I did. But if you do then be honest about it later on your CV and in interviews and people will respect you for it.
jdtoronto | [reply] |
|
|
Here, here!
I agree, get as much experience with different things as you can.. (Though I don't mean change jobs every month, thats not experience.. :) - You never know when theres going to be a shortage of jobs in your chosen career, or one comes up in a place you'd like to be, and don't have the experience to take it.
On the other hand, I wouldn't go for jobs that I know from the start I'm not going to like much, unless theres some chance it'll change to be something better soon.. You'll start out resentful, which won't be much fun.
C.
| [reply] |
|
|
This begs the question -- how long is long enough at a job?
I mean you specifically indicate that every month is not long enough, and of course YMMV, everyone learns differently, etc., but what would you say is the absolute minimum amount of time that a hiring manager would not think flaky?
-----------------------
You are what you think.
| [reply] |
|
|
Re: From Developer to Security...
by markjugg (Curate) on Sep 25, 2003 at 01:40 UTC
|
If it seems like you'll be less happy in the new place, I'd stay where you are. Also, it sounds like from the tone of your message that you prefer development work and have some reservations about moving into security work.
Mark | [reply] |
Re: From Developer to Security...
by DrHyde (Prior) on Sep 25, 2003 at 10:11 UTC
|
Hell yes, having security on your CV is a Good Thing. I get more recruiters contacting me because of the background I have in security than for any other reason. And those aren't just for purely security jobs. Some are for sysadminning, some programming, some teaching, even some incident analysis/computer forensics. Even if you later end up in a job where security isn't part of your remit - like I am now - people will sit up and pay attention if you can talk sensibly about intrusion prevention, data and system integrity, authentication, encryption, backups, disaster recovery and their ilk. | [reply] |
Re: From Developer to Security...
by x1b (Initiate) on Sep 25, 2003 at 13:29 UTC
|
I would very much say Perl and IS/IT tie very well together. I'm a Security Analyst for a small firm and code
most of the inhouse IDS utillities. From Port Scanner to Network Analyzer and several common network tools like DNS Enumeration and Whois etc. Perl being 100% cross platform ? Lets us use my utillities on every and any machine on our open architecture LAN.
There is no reason why you cannot and should not continue to develope in perl and do IS as well. In fact it would be wise to pursue IDS development now while you're gaining IS/IT hands on experience.
x1b | [reply] |
|
|
I would very much say Perl and IS/IT tie very well together.
It really depends on what you are doing in security. Setting up PGP keyrings? Automating FTP processes? Moving from FTP to SSH? Running "Crack" Periodically? -- Or administrating firewalls?
The first four of these, "Thinking" security jobs, I would think a 2-4 year stint in security could be very good for your career. ESPECIALLY if you want to work in "real IS", not the shrink-wrapped world. If it's an "unthinking" job where you are really a computer operator who runs security software ... run away quickly.
JMHO. If location is an issue, consider it deeply.
regards,
Matthew Heusser,
heusserm at student dot gvsu dot edu
| [reply] |
|
|
When I was doing a job that sounds similar to yours, I too re-implemented some tools in perl. With hind sight, I would have just used pre-existing tools, using perl for analysing their reports. Most of the important tools - snort, tripwire etc - are sufficiently cross platform already.
I think the original poster should be careful, and if he thinks he needs to write some tool from scratch should look very carefully at the options that area already available. His time is probably better spent in understanding the existing tools and writing better analysis tools, rather than re-implementing everything himself.
| [reply] |
Re: From Developer to Security...
by woolfy (Chaplain) on Sep 25, 2003 at 16:43 UTC
|
I have been the personnel manager of my own company for over 14 years and in total I have hired more than 70 people. I've read hundreds of resumes. I've done hundreds of job interviews. dragonchild put it quite right: I know exactly whom I will choose. I too would have chosen the person who did some work related to security.
Several other people made it clear as well. Having more than one job title on your resume makes you more interesting (and that's just talking about the job title). People that can do one thing might be interesting if they are very good. But I always wanted my programmers, system engineers and system operators to be at least a bit versatile. At least a bit of this and a bit of that. They have to prove to me they have learned how to learn. Flexibility. Being eager to do something new. Surprising.
Once I turned down somebody who worked as a Unix, C and Oracle programmer his whole adult life, creating and maintaining financial systems. Even though he has made some very nice programs. But he could not tell me that he has done some other things, like setting up and maintaining servers, working with more than one database system, working with networks and security, trying to learn other programming languages, because he never gave it much of a try. He understood my point, and asked me if he could proof his quality to me. Of course I agreed. Three months later he visited me again. He had learned more than the basics of Perl and MySQl (and a bit of Linux, Apache and sendmail) and made a database-driven website for me, with a small web shop. Basic, rudimentary, but impressive nontheless. I hired the guy and he turned out to be a wonderful colleague.
Your current job might be nice and safe. You're probably good at what you do. The least you could do is broaden your horizon. if you're not going to take the other job, invest in yourself and learn in your own time about security and other interesting things. And try to apply your knowledge in your job. Who knows what it will bring you. | [reply] |
Re: From Developer to Security...
by Old_Gray_Bear (Bishop) on Sep 25, 2003 at 17:59 UTC
|
As others have already pointed out, adding tools and techs to your CV is a _good_ thing. It shows the Suits that you are not just a (fill in the blank); you do not want to get pigeon-holed as a one-trick pony.
The real question here is your statement "The job will probably involve more money, but relocating to a place that I dont really want to be." You need to analyze why you are thinking this.
Is it because the new location has physical defects? (I have turned down more than one job because it would entail living in the Los Angeles Air basin; and I wouldn't take a contract in either Bagdhad or Jerusalem right now, either.) Are there social defects? (The new city is too big/small? Will my Wife/SO/LTR be willing to relocate? What is the cost of living like in the New Location? Can I afford to move?)
You need to analyze your hesitation factors, because no matter how good the job is, if you are not happy with where you are living, you won't be happy with the job.
This is a long way round to say 'it depends' Adding a new tool set is a goodness. Living where you don't want to isn't. Also consider, you are _not_ stuck in any job. You can always take what you have learned and apply it elsewhere. Having more than one tool set on your CV makes that move immensely more possible. (I got my current gig because the hiring-manager looked at my job history and determined that I can learn almost anything. (I have been a Mainframe COBOL Developer, a Systems Programmer (IBM and Hitachi main frames), an UNIX SysAdmin, a Mail Engineer, a Directory Developer, and a Perl/COBOL/FORTRAN/C/etc hacker during the course of the last thirty years.))
Think about your options. Consider why you feel the way you do about the new job. And also consider your feeling about the current job, are there things that will increase your satisfaction level? How likely are they to happen?) Once you have worked through these equations you will have a better feeling about your final decision.
OGB
(There are no easy answers, only easy questions. Like "Why?" and "How?" -- Jay Score) | [reply] |
Re: From Developer to Security...
by schmoe (Beadle) on Sep 27, 2003 at 02:38 UTC
|
moving out of development and relocating to an undesirable location? Are you kidding me? Take a good look around, you're gonna miss it later. | [reply] |