-3

Our company has grown to the size that we are looking to specialize in the roles within the cybersecurity function. At a high level, we are diving into offensive security employees- colloquially also known as red team to act similar to a penetration tester attempting to exploit security, and a Blue team focused on defensive security, controls engineering, and incident detection / response.

Currently the Security Operations team is almost entirely focused on defensive security. We are starting recruiting for new employees to work in the offensive security capability. Form my experience in cybersecurity, and interacting with my network members working in cyber, successful penetration testers / red team members are "future focused",and "think like a black hat" reading and educating themselves on vulnerabilities discovered and how an adversary can exploit them. To summarize, learning how to learn.

I realize evaluating candidates how they learn and keep abreast of news within the cybersecurity profession may be somewhat subjective, because learning styles are different for all individuals. Also, the importance of events are often also subjective. For example, some sectors may be exposed more to a particular event / breach.

Edit to respond to comments and close vote

@DarkCygnus - its not so much there is a clear "expectation" for off - work learning, but just that a lot of learning happens organically. For example, many of us on the team subscribe to / contribute to podcasts , professional journals, or attend non - mandatory cybersecurity conferences. For some colleagues, learning overlaps with hobbies so learning is just organic without a clear separation between work vs personal life.

As to the close vote on question being too broad, I am asking how to assess how candidates learn of industry happenings and how to best assess their method of learning commitment, so I think question should be answerable.

  • How can I best objectively assess a candidates learning commitment and how they learn of news within the industry within specialized field in IT?

  • Given a certain amount of learning may happened outside of work, is such a question fair to the candidate? Would candidates likely see it as "intrusion" into their work - life balance and be turned off therefore?

closed as too broad by gnat, David K, IDrinkandIKnowThings, Nimesh Neema, Michael Grubey Jul 24 at 0:38

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    "Given a certain amount of learning may happened outside of work, is such a question fair to the candidate? Would candidates likely see it as "intrusion" into their work - life balance and be turned off therefore?" - Would you mind clarifying what you mean here, please? Are you expecting that your employees study work-related things outside work hours? Is that something you plan on asking during the interview? – DarkCygnus Jul 23 at 0:09
  • Any argument for allowing your defensive-focused team to be any more or less involved evaluating newly discovered risks? Those two may be less correlated than you are implying: you want more offensive capability and you want new hires who know more about the new and shiny stuff. – anx Jul 23 at 6:50
1

Penetration tester/red teamer here:

If you want to assess your candidates, give them a challenge like HackTheBox, and make them write a report as if it were to go to an actual client/department.

Form my experience in cybersecurity, and interacting with my network members working in cyber, successful penetration testers / red team members are "future focused",and "think like a black hat" reading and educating themselves on vulnerabilities discovered and how an adversary can exploit them

Yes and no. While looking at the future is important, the vast majority of methods-of-entry are already existing; specifically they are common configuration and web development SNAFUs, weak passwords and lax security awareness on the part of other staff. Your testers need a core understanding on how to use these before worrying about random new exploits.

Put the how they want to learn in their court. There are many resources out there, and a lot of it is free.

  • Good point about hands on exercise. Actually Kali came up in team meeting today and we may implement exercise based on it. Did you obtain your methods from personal experience or another source (OWASP?) – Anthony Jul 24 at 0:49
  • I agree knowing the more traditional attack vectors is critical, (such as examples you gave) , but what are your thoughts on vectors such as 0 days, and more experimental attack vectors? Feel free to ping me in chat to talk more! – Anthony Jul 24 at 0:55
  • 1
    @Anthony Exercises using Kali are a great idea for establishing basic competency - Kali to a pentester is like Photoshop/Illustrator to a graphic designer. As to how I obtain my methodologies, they are a mixture of other sources (OSCP, OWASP) as well as personal experience (general red team stuff, context sensitivity when performing certain kinds of attacks or enumeration). Banging your head for hours against a certain flaw only to discover you made a slight mistake is a damn good way to make sure you never make the same mistake again. Experience is a brutal teach but very effective. – 520 Jul 24 at 14:11
1

How can I best objectively assess a candidates learning aptitude within specialized field in IT?

First of all it is a bit tricky to be able to truly gauge and understand a candidate's aptitudes and skills solely during interviews. That is why most times there are several rounds of interviews, coding tests, etc..

Now, that being said, if you want to assess the learning aptitude a candidate has, I would suggest focusing your questions towards the ways and resources the candidate uses to solve problems.

You want to ask questions like "When facing a new penetration project/test, what are the usual steps you take?", or well "When you find a dead-end or are unsure what to do next what you usually do?"... and you want to see if the candidate's answer indicates learning aptitude (googling, searching on SO, searching on forums, reading doc, etc., or whatever aspects you are looking for).

As mentioned before, assessing candidates during interviews is not trivial, and sometimes only when the candidate is on-board and starts with real projects and tests is that you will really see if they have learning aptitude. That is why sometimes job roles may have a probation period, so both you and the candidate can see if you are a good fit. You could consider having a probation period so you have more time to better gauge their aptitudes.

Not the answer you're looking for? Browse other questions tagged or ask your own question.