Careers in Security

Careers in Security
Jason Chan
Engineering Director @ Netflix
@chanjbs | chan@netflix.com

I lead the cloud security team @ Netflix
Previously:
- Security at large tech and startups
- Security consulting, defense work
Also:
- Grew up in Whitney Point
- Mom graduated from BU

Trends in Security Hiring

Why?

Partially Due to Market Forces

This drives hiring:
4 Organizations for their own security teams
4 Vendors to build security solutions
4 Startups to invent new security products
4 Services organizations for consulting, audit, etc.

Partially Due to Dynamics of the Field

There are three professions that beat their
practitioners into a state of humility: farming, weather
forecasting, and cyber security.
-- Dan Geer

Defender's Dilemna

cybersecurity is perhaps the most difficult intellectual
profession on the planet
-- Dan Geer

So, what's it like to work
in security?

Employer Characteristics
4 Large vs. Small
4 Government vs. Corporate
4 Financial Services vs. Technology
4 East Coast vs. West Coast
4 Startup vs. Established
4 Consultant vs. Full-Time Employee
4 Criticality (e.g. Nuclear Plant or Netflix)

Basic Focus
Build (Defense/Blue Team)
- Defensive product development
- Controls design, architecture, and operations
- Monitoring and response
Break (Offense/Red Team)
- Offensive tools and product development
- Penetration testing

House as Analogy

Architecture and Design

Construction

Standard Operations

Non-Standard Operations

Security @ Netflix

Intelligence, Response, and Investigations
4 Respond to incidents (i.e. fire department)
4 Investigate threat actors targeting Netflix and its
members
4 Produce and integrate security intelligence

Product and Application Security
4 Work on security-related features of the product
4 Examples:
4 Password reset process
4 Credit card storage
4 Help engineers develop secure applications
4 Lead security testing and disclosure programs

Security Tools and Operations
4 Manage our security infrastructure (Amazon Web
Services)
4 Help teams use cloud infrastructure securely
4 Build tools and automation to monitor and secure
the environment

Corporate Information Security
4 Protect our employees and corporate systems
4 Network and device (mobile, laptop) security
4 Vendor risk management
4 Regulatory compliance

Privacy Engineering
4 Design and engineering for consumer data privacy
4 Collection, retention, disposal, use, sharing
4 Compliance with global data privacy requirements

Security Data Analytics
4 Extract security value from large data sets
4 Machine learning
4 Anomaly detection

Device and Content Security
4 Digital Rights Management (DRM)
4 Content partner security
4 Device partner security
4 Secure playback

Platform Security
4 Create security-related software components used
by other developers and services
4 Examples:
4 Encryption key management
4 Network traffic management

Security Career Tips

Ideal skills & traits for a career in security
4 Computer Science/Engineering/Math training
4 Specific security training is great but not required
4 Communication
4 Creative and pragmatic
4 Curiosity
4 Problem solving

Free resources to learn more
4 Coursera - Dan Boneh's crypto classes
4 OWASP
4 Trail of Bits CTF Guide
4 Twitter

Questions?

Careers in Security

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (20)

Similaire à Careers in Security

Similaire à Careers in Security (20)

Plus de Jason Chan

Plus de Jason Chan (6)

Dernier

Dernier (20)

Careers in Security