1

For National Cybersecurity Awareness Month in October, my employer is sponsoring a secure code warrior competition where teams who sign up are presented with software code with security vulnerabilities, challenged with identifying the insecure code, and then presenting a solution to remediate the vulnerability. Teams will have 1 person leading and while one can state preferences for teammates, one is not guaranteed to be assigned with any of one's preferred teammates.

I see this as an excellent opportunity for professional development for me, my team members, and members not within the cybersecurity function but involved in SDLC (such as developers or QA). I initially signed up and stated who I wanted to work with for team mates. I did not get any of my preferred choices. As it turned out, none of the team members I was randomly assigned with had any prior application security experience or previous experience in related areas such as penetration testing, other than myself. I am hesitant now as to whether I should withdraw, as I am concerned poor performance due to lack of a good team may lead to negative perception in my main job role.

  1. Can poor performance in optional activities meant for employee engagement have a negative effect on one's standing or perception at work?

  2. Is there anything I can do to mitigate, but still participate as I find this to be a very valuable, hands-on experience? Cybersecurity is about experience, so more I feel can only help.

5
  • How large is your employer? How well do you personally know the people who make decisions about your role and position in the company? – Ben Barden Sep 29 '20 at 17:28
  • It is quite sad that you consider quitting in this situation rather than an oportunity to teach. – guest Sep 29 '20 at 20:42
  • @BenBarden - large employer with 1000+ employees in the financial services industry in the USA and I am well respected in the company having worked there for many years. Good relationship with my manager and other folks at different levels in the hierarchy – Anthony Sep 29 '20 at 22:43
  • @guest - The last thing I would want is for folks to think I am not competent or to have their trust in me / our team be degraded, so just trying to balance between learning and playing it safe here. I have received comments from my manager in the past commending me for the fact that I mentor junior folks well , so I enjoy teaching – Anthony Sep 29 '20 at 22:45
  • 2
    Were the assignments really random? It seems quite plausible that you were grouped with those inexperienced in this work precisely because you do have experience. Look and see if the experienced employees have been distributed across teams rather than concentrated in a few. – Chris Stratton Sep 30 '20 at 6:07
10

... none of the team members I was randomly assigned with had any prior application security experience ...

These sort of contests are intended as learning exercises. If you were all experts, there would be very little point in doing them. Therefore, it's expected that the teams will make mistakes, miss vulnerabilities and so on, in an environment in which it is safe to do so - the intention being that they are more likely to know what to look for when it's a real situation.

We can't guarantee that there won't be negative consequences for not scoring well, but it would be perverse of your company to make it so. There are much more likely negative consequences for withdrawing - if you are indeed an expert on security then the reason you should be there is to share your skills with the team; if not, then you should be there to learn. Pulling out (without a more pressing engagement) will seem weird and cowardly.

3
  • Any kind knowledge granted to your company about your capability can negatively effect your standing in the company. There is no such thing as a "safe environment". – Malisbad Sep 30 '20 at 2:13
  • @Malisbad safe enviroment in this case means a designed. The poster isn‘t talking about the paranoia you‘re implying – morbo Sep 30 '20 at 7:34
  • So, while I agree that it may feel paranoid, the fact of the matter is that your performance during these events may colour the way your coworkers see and judge your performance. The same goes for attitude during these events. These coworkers may or may not have power and/or influence over your career. In a right-to-work state, that could include termination. – Malisbad Oct 1 '20 at 11:24
0
  1. Can poor performance in optional activities meant for employee engagement have a negative effect on one's standing or perception at work?

In most of the cases, no, because as you mentioned this is optional one and not some sort of a performance review, where the outcome is real and can be felt upon. Usually doing great in these types of events can be a plus, but doing average or less is just that, doing average or less.

Actual performance on a contest can be decided(which is one-off instead of months or years you're working on a company) on a lot of things, such as are you sick or not, what are your team members(maybe you've got lucky and got the best cyber security specialists on your company). In a company, these things are usually taken into consideration, so you're good here.

  1. Is there anything I can do to mitigate , but still participate as I find this to be a very valuable , hand on experience? Cybersecurity is about experience, so more I feel can only help.

There are some things you and your team could do, such as:

  • Practising on cyber security problems.
  • Coming up with a some sort of a strategy before the event.
  • Talking with your team and creating a mindset that the actual goal of this event is to learn, and not to show off your skills(could be wrong).

and so on.

Not participating is also an option, since there could be a myriad of reasons of why you decided to not participate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .