Ryen M.’s Post

I have an open role for a Staff Product Security Engineer (https://lnkd.in/g_ymi3s4 ) and I wanted to give interview questions tips. Earlier in my career, I took a role at an organization that I later regretted. I don’t regret working there because I learned a lot, but I did regret that I didn’t do my due diligence to see if I would succeed at that company in the longer term. I had a great manager and a strong team, but I also had a lot of friction with one part of the business. Unfortunately my role had me team up with that part of the org 60% of the time. I felt ineffective and while I had support from my manager, I wasn’t satisfied with what I delivered and ultimately decided to move on. I learned a great life lesson, I need to interview the organization as much as they interview me. Here is my list of Top 7 questions that I typically ask during the interview process. Questions 1️⃣  What is the overall ratio between Security Engineering and Engineering?  • While this doesn’t tell the whole story, I use this to understand the current investment into SecEng and understands how much the business cares 2️⃣  How does leadership demonstrate their commitment to security, and what role do they play in promoting a security culture? • If leadership does not promote security, it doesn’t matter how hard you try, you will not be effective 3️⃣  Every organization talks about the concept of "security is everyone's responsibility". Are there shared goals that highlight the collective responsibility for security? • Another question to figure out if the organization actually cares about security and if I can be effective 4️⃣  Do you mind sharing your overall 2 year vision for the Security Engineering program?  • A lot of hiring managers don’t have a plan, see if they are YOLOing it 5️⃣  Does the Security team have a top-down or a bottom’s up approach to Security? • Trick question 😅, you need both, but I want to understand the hiring manager’s thoughts 6️⃣  How is the team currently structured and what is the plan for hiring in the future?  • Good to know if there will be more investment into SecEng and how the manager will restructure the team if it grows 7️⃣  How is risk communicated to the engineering team in a way that resonates with their objectives? • I want to make sure that there is strong partnership between Engineering and Security I ask a lot more questions to make sure that I will be the best version of myself, but these questions help me understand if it is even worth going further with the interview process. Personally, I like to hire Security Engineers that are curious and not afraid of asking difficult and thought provoking questions. If they ask me good questions during the interview process, I know that they will ask great questions in the future and they will challenge me to be a better leader. What are some of your favorite interview questions?

I have an open role for a Staff Product Security Engineer and I have seen a number of resumes. I wanted to give some suggestions to those that are applying for positions these days. At the Senior, Staff or Principal levels, I have an expectation that I will see a lot more *impact* on resumes. What positive impact have you made to the security program? How have you reduced risk? When reviewing resumes, I have seen a lot more around roles and responsibilities. Here are some examples of what I see vs what I would like to see. 1. Example of Security Review or Threat Modeling 1️⃣ I conducted threat models for clients in the financial and healthcare industries vs 2️⃣ Led and streamlined the security review process for mission-critical applications, resulting in a 25% reduction in review cycle time and a 15% improvement in overall detection of critical vulnerabilities in the design phase. I developed and implemented standardized security review templates and guidelines, ensuring thorough assessments of software architecture and design. In the first example you can see that it is really difficult to determine what a candidate has accomplished by conducting threat models. What happened, what was the impact of your assessments? Did you improve the client’s situation? In the second example, I am able to tell that the individual 1) cares about metrics and has a data-driven approach, 2) looks to improve processes and 3) has had a positive impact on the security review program. 2. Example of bug bounty program 1️⃣ I am the subject matter expert on bug bounties and I run the program from end-to-end vs 2️⃣ I orchestrated and managed a comprehensive bug bounty program, which resulted in a 45% increase in identified vulnerabilities and a 36% reduction in critical security issues over a span of two years. In the first example, it is hard to quantify what a subject matter expert is within a bug bounty program. Did they launch the program? Is the program successful? Are there runbooks made for others to support the program? In the second example, it is easy to know that the individual established the program and the success that it has had. Personally, I care a lot about critical findings in bug bounties, when I noticed that there is a reduction in findings, it also means that there are other things being done in their security program to have a positive impact. — I do not expect the entire resume having examples of impact, but I do expect to determine the impact an individual has on their program from their resume. The market is difficult and you need an edge to make sure that your resume stands out for hiring managers. Think about the impact and share that in your resume. It makes it much easier for hiring managers to understand how you contributed at your organization. If you are interested in applying, here is our open staff role (remote North America): https://lnkd.in/gWuW-SaD 

I have an open role for a Staff Product Security Engineer and I have seen a number of resumes. I wanted to give some suggestions to those that are applying for positions these days. At the Senior, Staff or Principal levels, I have an expectation that I will see a lot more *impact* on resumes. What positive impact have you made to the security program? How have you reduced risk? When reviewing resumes, I have seen a lot more around roles and responsibilities. Here are some examples of what I see vs what I would like to see. 1. Example of Security Review or Threat Modeling 1️⃣ I conducted threat models for clients in the financial and healthcare industries vs 2️⃣ Led and streamlined the security review process for mission-critical applications, resulting in a 25% reduction in review cycle time and a 15% improvement in overall detection of critical vulnerabilities in the design phase. I developed and implemented standardized security review templates and guidelines, ensuring thorough assessments of software architecture and design. In the first example you can see that it is really difficult to determine what a candidate has accomplished by conducting threat models. What happened, what was the impact of your assessments? Did you improve the client’s situation? In the second example, I am able to tell that the individual 1) cares about metrics and has a data-driven approach, 2) looks to improve processes and 3) has had a positive impact on the security review program. 2. Example of bug bounty program 1️⃣ I am the subject matter expert on bug bounties and I run the program from end-to-end vs 2️⃣ I orchestrated and managed a comprehensive bug bounty program, which resulted in a 45% increase in identified vulnerabilities and a 36% reduction in critical security issues over a span of two years. In the first example, it is hard to quantify what a subject matter expert is within a bug bounty program. Did they launch the program? Is the program successful? Are there runbooks made for others to support the program? In the second example, it is easy to know that the individual established the program and the success that it has had. Personally, I care a lot about critical findings in bug bounties, when I noticed that there is a reduction in findings, it also means that there are other things being done in their security program to have a positive impact. — I do not expect the entire resume having examples of impact, but I do expect to determine the impact an individual has on their program from their resume. The market is difficult and you need an edge to make sure that your resume stands out for hiring managers. Think about the impact and share that in your resume. It makes it much easier for hiring managers to understand how you contributed at your organization. If you are interested in applying, here is our open staff role (remote North America): https://lnkd.in/gWuW-SaD