Being held to a much higher standard than my peers

Question

I am being held to a higher standard than my peers when it comes to security and best practices in my professional workplace.

Some Background. My company's main office is located in the United States but well over 1000 miles from where I live. About 40% of my peers (the software development organization within the company) works in the office while 60% are remote and spread out across the continent. I fall into the remote category.

There are certain things that my employer has slapped me on the wrist for while turning a blind eye to anyone else who does the exact same thing. For example, for years and years it was standard practice for my peers and I to share video through a web service called Screencast, and code snippets through unlisted, temporary Pastebins. One day, out of nowhere, someone from the security organization saw me using these services (as was considered perfectly normal for almost a decade up to that point) and I got slammed for it, being told that both websites were regularly scraped for content and that my actions had almost certainly leaked proprietary information to unintended observers across the Internet.

I ask what services I should use in replacement of Pastebin and Screencast. After pestering my manager and the security officer who had started all of this for a good while, I received no answer. My manager simply requested that I cease using the services and that maybe Security will come up with a long-term solution in the future. (Spoiler: a year later, they haven't.)

However, my immediate peers continue to openly use Pastebin and Screencast in their daily work (which I would happily do as it would save me so much time) and have never been approached by anyone regarding security. They also state that it's really weird that I got dinged for it from Security, saying that they had never had a problem with it.

Additionally, in Github, my Pull Requests are constantly hammered over the smallest of stylistic preferences and edge-cases that my peers can find, and I end up having to polish everything to an absurd degree. Additionally, if my code comes anywhere close to code someone else has written & that code isn't perfect, I am expected to clean up the other person's code as part of my own work.

Meanwhile, when I review my peers' works & I see the same minor defects in their code, I'm told that I'm being a ballbuster when I flag them and that my concerns are over-inflated and not worth pursuing. So, my coworkers are permitted to glide through their work at a much quicker rate, not being held to the same degree of perfection that I am.

Ultimately, I feel that these sort of things make my job harder and make it appear that I'm not working as hard as the others in my team. I'm trying to keep up, but it's stressful and I have to work longer hours to still get less done than my peers. It's worrisome because this company is so big that the highest tiers of executives can only afford to evaluate workers' performance through Jira summary spreadsheets which detail how much an individual accomplished over time, and I feel like that alone is going to cause me to be held back.

How should I address this within my team and with my manager?

Answer 1

Getting held to a higher standard isn't a penalty to your career; it's often a good thing.

When I was starting out out of college, there was me and a lazy "old hat" programmer (which is funny, since he was only in his fourties.) My code was heavily reviewed and nitpicked, I was slammed if I missed test cases, I'd get chided if I made design decisions that turned out to be suboptimal, etc. And the "old hat" programmer never had their code reviewed, never was scolded for breaking code because they didn't test, frequently made design decisions we had to just learn to live with, etc. Fast forward 10 years. I'm a good programmer - I write good code, I test the heck out of it, can architect solid solutions, etc. A company can depend on me to do the job without causing problems/downtime/issues. And the "old hat" programmer... well, they're trying to maintain functions thousands of lines long being held together by goto's, with a server crash every other day.

Instead of comparing yourself to your coworkers, ask yourself this: Is the critique valid? If so, embrace it and improve. The security example is a great one: just because the security people aren't busting all your coworkers doesn't mean the coworkers are in the right. Them not getting busted doesn't harm you from learning/doing the right thing.

If you are right and this will ultimately turn out to hamper your career at your current company... so what? Unless you plan on working their for 10+ years, you should be more concerned with improving your skillset, abilities, and employ-ability. Which is naturally helped by being held to a high standard. It may be that, 2-4 years from now, you're taking the knowledge, abilities, and skill-set that you got at your current employer and taking them to someplace that will appreciate the sense of diligence.

Answer 2

Talk with your manager. Ask for insight.

You're in a situation where you don't understand why this is happening. By extension, there's critical information that you're missing or are incorrect on. It's good to know that. Hopefully, your manager doesn't want you to fail. (If you're working remotely, being leaned on by basically everyone, and your manager wants you to fail, you're sunk already. Time to start putting out resumes).

So talk with your manager about your concerns. Try to get a better understanding about what's going on. Listen to whatever it is that they have to tell you. When you're describing your own situation, use simple statements of commonly known fact and "I feel" statements - nothing that the manager would have reason to disagree with. Express that your perception is that you're being held to a different standard than your coworkers, and that you're having difficulty matching their level of productivity with those limitations.

It's possible that you're misunderstanding the default level of requirements that everyone is under (perhaps because there's a small group who are blowing things off, and you're more aware of them than you are of anyone else). It's possible that your boss isn't aware of the things that your coworkers are doing. It's possible that your coworkers are takign advantage of you to a degree (your company sounds a little cutthroat) and your manager can intervene on your behalf.

...and if the response is, in effect, "Well, you're just supposed to work harder than everyone else", it's time to bail. They're using you, and they will keep using you, and they'll likely try to give you as little credit as they can while they do. That sort of situation only gets better by leaving it - either switching branches within your company, or moving out of it entirely.

Answer 3

This does not seem to be targeted at you, I feel it is more that you were the poor guy getting caught and now you are in the spotlight, but it seems like a general problem. My solution for such situations:

Forward your pain.

I consider such problems a systemic misalignment, like someone sitting on his foot all day. That's unhealthy for the poor ankle, but the person won't change his position unless the brain feels pain from said ankle. It's similar with companies, the people that can change problems need to feel the pain that you are currently bearing in your everyday work.

What to do:

1. Talk to your manager: Line out your problem, tell him you need some way to send around code and videos or your work will be hampered. Ask if you can temporary keep using the services until the security department has a proper solution. Try to suggest alternatives. If he denies these requests, get that in writing (e.g. as email at least) and clarify that it is generally an issue to use these tools. You seem to have done most of this already.
2. Forward the pain: Whenever you are in a system where you have no direct authority to change it, but you feel it works in an inefficient way, where you have to work around an issue (thus you feeling the pain), you need to make sure to forward that pain towards the person with authority.

In this case, you need to be able to work properly or you will slow down. If it is just you that is slower, that might be overlooked (or be considered your inefficiency). So you need to make sure the pain is forwarded and spread out:

1. Tell everyone in the team that keeps using these services that it's not okay. Do that once. Not in a bossy way, but be sure they know that the policy forbids this, e.g. along these lines (exaggerated):

   Oh gosh! Have you heard? We cannot use our tools any longer. It is against company policy and a security issue! Just ask manager X or security dude Y, they say we're all screwed if we keep using those!

2. Whenever your boss asks why something isn't done, try to mention the lack of those tools, but with a concrete reference to your task. Like

   I wanted to do X, but I first had to write a three page mail to coworker Y with details how to do task Z, as I could not just show it to him via shared screen.

3. If your colleagues keep using the services tell security and your manager that this is still a widespread thing done in your team/the company. Suggest they block the sides to prevent that from accidentally happening. Try to follow up on that. You can argue that this is much easier to enforce then to talk to everyone. Try to avoid pointing fingers on individual colleagues, but be persistent. If that's the company policy, it's only fair to live by it.

If all your colleagues will be upset as well that they cannot use their services, that will build up more pressure than if you're alone. And if everyone is affected and the whole team is less efficient it should be easy to point out that this is the cost of not having the tools you need, e.g. in a retrospective.

Warning

You need to walk a fine line here, in that you need to take the guideline serious and attempt to uphold it in the spirit of keeping your company secrets safe, while also pushing for a secure (enough) solution that let's you work properly and has the acceptance from management and security department. In the same way, you need to try not to appear as ratting out your co-workers but to try and find a real solution for all of you while taking the security concerns serious.

Disclaimer: Limits of the approach

When applying this "pain redirection approach", you should always make sure that the pain you feel is a structural problem someone actually has the authority/possibility to change and it's not just your own working style that causes the pain for you. Also never conflate it with being petty or revengeful. In addition, sometimes as a team (or team lead) you decide that certain aspects/tasks simply are a pain in the ass and there is (currently) no cost-effective way to solve the problem. In that case there typically is some position whose task it is to take the pain and deal with it (e.g. do some annoying task) and shield the rest of the team from it. Please always remember those distinctions. (If something goes against company policy and causes your team additional pain, that's a good indication though^^). If you push for change even when it is an attempt to solve problems, you are always at a certain risk that people will resent you for it, as they need to adapt. However, this approach tries to avoid direct conflict. Instead of you pushing head on for change you want for yourself, you make everyone aware of the problem and make them want to solve it themselves. That should minimise the risk, but obviously cannot completely take it away.

Answer 4

Your company allows remote work and use of third party online services.

After security scolded you,ask yourself:

What are the written security regulations and policies telling you about which services are allowed and which arent and which are required to be used ?

Follow these guidelines to the letter.

If there are processes that require additional services that are not mentioned, escalate to higher management and security that your work REQUIRES services that haven't been vetted by security and that you need guidance on how to proceed.

If the service that has been used so far was deemed insecure by security you need to request an alternative from them in order to CONTINUE your work.

If they can't or won't name an alternative, escalate to higher management that you require security guidelines after previously used services have been excluded to you by security.

Make sure higher management and all your team leads are included in all these mail chains.

BEFORE you do this, ask your lead as well how you should proceed and what tools to use.

IF THEY DON'T KNOW, GET THEM ON BOARD if you can and send out your requests to higher management together or let them do it for you (as would usually be the case)

A WARNING:
It could well be that you're being set up to fail in which case it is VITAL for you to establish a paper trail proving these shenanigans!