Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License. The OWASP Foundation OWASP AppSec June 2004 NYC Emerging Roles in Application Security Hiring trends and career strategies. Jeff Combs Senior Recruiter Alta Associates, Inc

OWASP AppSec Overworked AppSec Professional’s Drinking Song 99 vulnerabilities in the code, 99 bugs in the code, Fix one bug, compile it again, 101 vulnerabilities in the code. 101 vulnerabilities bugs in the code, 101 bugs in the code, Fix one bug, compile it again, 103 vulnerabilities in the code…

OWASP AppSec Alta Associates, Inc. Specialists in Information Security 17 years of experience Security focused since 1994 Front row seat to the growth of an industry Builders of wide and deep professional networks High level perspective on emerging trends and developments in our industry

OWASP AppSec Corporate Clients Financial Services Healthcare Manufacturing Pharmaceuticals Retail Utilities

OWASP AppSec Professional Services Public Accounting Firms Pure-play Information Security Consulting Firms Product Vendors with consulting services Managed Security Service Providers Management Consulting

OWASP AppSec Product Vendors Software, Hardware, Research and Development Founder level startups High growth up-and-comers Established companies needing fresh talent Industry giants

OWASP AppSec August 2001 A CISO from a major investment bank called asking for help and said: “ I don’t know if this person exists, but I know what I need them to do.”

OWASP AppSec I’m looking for someone who can: conduct vulnerability assessments on new and existing applications. work with developers to address vulnerabilities and remediate problems. teach developers how to write better, more secure code act as a liaison between Information Security and application development teams firm wide

OWASP AppSec Someone who: has an application development background understands and has a passion for security is outgoing and a good communicator.

OWASP AppSec Fast Forward Due to an increase in awareness (partly due to the efforts of OWASP and the highly publicized challenges faced by companies like Microsoft) … Application Security is an issue that every organization is working to address. Application Security has become a specialization within Information Security Newly defined roles and career opportunities are emerging.

OWASP AppSec Application Security Opportunities Professional roles in Application Security are in a constant state of flux. They’re currently being defined and continually being redefined. The goal is the same: address application related vulnerabilities, minimize application risk. General Role Profiles….

OWASP AppSec Corporate Application Security Roles Key objectives: Assessing, reviewing, remediation Evaluating application risk Promoting awareness Educating developers Providing SME to ongoing and new projects Understanding compliance issues, standards

OWASP AppSec Professional Services Key objectives: Evaluation of Application development processes and procedures Infrastructure and platform security testing Review of the application's architecture and source code Functional security testing, Penetration Testing Secure application development Provide recommendations Fly off into sunset

OWASP AppSec Vendor roles Key objectives: Application security tool development Vulnerability research and development Product development Position types: Professional Services / Sales Engineering Product Evangelizing / Strategy Product Management Sales and Marketing

OWASP AppSec Career Development Strategy A Big Picture View

OWASP AppSec DISCLAIMER The advice I’m about to offer is not given to help you write a better resume, figure out which certification to get or pick which tie to wear on an interview. The insight I’m about to provide is deceptively simple in nature but if used and applied appropriately, both short and long term career success will result.

OWASP AppSec Culture Shift Aside from the traditional qualifications that get people hired like hard skills, technical knowledge and experience… there is a culture shift within our industry that every security professional needs to be aware of, and a way to stand out above your peers that will give you an advantage when seeking your next position.

OWASP AppSec Backroom to Boardroom Technology is taken for granted. Information Security is less and less considered an elite “dark art” by executive management. In an effort to better align itself with business objectives, Information Security is being redefined as an Operational Risk Management discipline.

OWASP AppSec What does this mean to you? It means that no matter where you stand, from technically focused engineer to executive management with an acronym for a title… you need to understand the work you’re doing in the context of the business you support, the forces that affect it and the priorities that shape its direction.

OWASP AppSec Why? Because it is more critical than ever to be seen as part of the solution, to be seen as an enabler and to be seen as a person who “gets it” in the eyes of decision makers. This is the way to gain credibility and visibility with those who have an impact on the success of your career.

OWASP AppSec HOW? Know and understand the industry you support. Understand the language of business and learn to define your efforts as a security person in this context. Learn the discipline of Risk Management and use this knowledge to help you develop better risk driven Security solutions.

OWASP AppSec Standing Out, Standing Apart Despite the fact that Application Security professionals with the right combination of hard and soft skills are in high demand, there is always competition for the best jobs. To rise above the competition and stand out as the better candidate you need to find ways to differentiate yourself.

OWASP AppSec Ways to Differentiate  Technical ability, experience and exposure  In-the-trenches Application Security experience  Involvement with OWASP, industry groups and research projects  Published papers, speaking engagements  Tool and methodology development Having real world application security experience is a significant differentiator but this will only help in the short term while market demand is hot. Unfortunately, most of us will still have to work beyond this timeframe and need to plan accordingly.

OWASP AppSec Ways to Differentiate – Beyond Technical Ability Find ways to define your accomplishment in terms that are relative to the success of the business you’re in. increasing revenue reducing cost saving time saving resources executing enacting change enabling

OWASP AppSec The Results Employers and decision makers will view you as: well rounded, business savvy, progressive, professionally mature, and most importantly… as someone who stands out from all of the other people they’ve been interviewing or considering for promotion.

OWASP AppSec That’s all folks….

OWASP AppSec Thank you. Alta Associates Inc. Leaders in Human Capital Risk Management