The Workplace Stack Exchange is a question and answer site for members of the workforce navigating the professional setting. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A person indulged in the negative aspects of information security (social engineering, active information gathering etc.)

  • Should he reference these experiences in his CV
  • And if so, how should he reference it?

The debate about the legality and morality of the mentioned actions will be irrelevant here and out of the scope of the argument.

share|improve this question

migrated from security.stackexchange.com Sep 4 '13 at 11:01

This question came from our site for information security professionals.

marked as duplicate by jmac, CincinnatiProgrammer, Chad, nadyne, enderland Sep 4 '13 at 17:23

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

5  
The debate about legality is quite important when it comes to your CV. Don't put on paper that you did anything illegal. It's bad for you, and bad for the company who wants to hire you. – tylerl Sep 4 '13 at 9:24
2  
By themselves, those aren't illegal. Companies often have people or hire consultants to try to break security through means such as those that you have mentioned. Was this your job, or were you using these techniques outside of employment for possibly illegal reasons? – Thomas Owens Sep 4 '13 at 11:15
1  
I don't usually forward received resumes to the police, but I also don't have a policy against it. – emory Sep 4 '13 at 16:19

It somewhat depends on the role, but in general I'd steer clear of any mention of legally dubious activities on a CV.

A lot of large companies like to play it safe with that kind of thing and could drop an otherwise good candidate to avoid potential complications down the line.

Also if it is legally dubious putting it in writing is never a good idea.

I'd say that if the person has expertise that's relevant to the role (so the role includes Social engineering for example) that kind of thing could be expressed verbally in an interview where it can be put in the correct context.

share|improve this answer
5  
... if it is legally dubious putting it in writing is never a good idea. YES! – FrustratedWithFormsDesigner Sep 4 '13 at 13:55
2  
@RoryMcCune - As you point out there is a difference between a reference to a report on an exploit say in Android you have discovered and documented at a security conference ( with references to the white paper for bonus points ) and saying you were the person responsible for the Linken compromise. One isn't illegal as you in theory reported the exploit to Google before you released the paper the other is illegal and anyone who read that on a resume would be without any moral compass not to report it to the proper law enforcement. – Ramhound Sep 4 '13 at 14:16
1  
@Ramhound absolutely, I don't think many employers would have a problem with responsibly disclosed vulnerability research, I was guessing that the question referred to a greyer area than that. Obviously if it was outright criminal putting it in writing would be an amazingly bad plan. – Rоry McCune Sep 4 '13 at 15:15

It depends. If you're not applying to a security company, then I would leave them off or reference them in an innocent way - "security consultant" or some highly spun version of the truth.

If you are applying to a security company, it still depends. If you are outside of the statute of limitations or you've been tried for the illegal activity, just list it (with some spin to provide the right tone). People with practical experience breaking security are invaluable to security companies.

If you've done things that people don't know about, and are within the statute of limitations I suggest listing something inbetween. You've done something shady, but unspecific enough to be useless as evidence (by itself).

share|improve this answer
2  
I would advise ever in any capacity putting on paper that you admited to a crime. The laws can be changed at any time. Working for a security company is legal, their work legal, nobody is harmed by that work. Illegal activity is illegal for a reason, some harm is likely done to somebody, doesn't matter who. – Ramhound Sep 4 '13 at 14:18
    
@Ramhound - Ex Post Facto criminalization is itself prohibited by many countries' constitutions. If you've been tried for the crime, it is public knowledge anyways. Do you want a good job or do you want to chicken out because you backdoored a few machines on your university network? – Telastyn Sep 4 '13 at 14:32
    
The constitution can be changed to. If creating a backdoor to an insecure university network gets you a good job, sure admit to it, but don't expect people even in the security industry to accept it. – Ramhound Sep 4 '13 at 14:36
    
@ramhound - in my experience in computer security, nobody worth anything had completely legal experience - quite the opposite. And that came through in how we vetted candidates. Hell, the CTO spent a few months in jail for breaking into a backbone provider (who then promptly hired him). – Telastyn Sep 4 '13 at 14:44