Request for comment: Stack Overflow is hiring a Director of Information Security

Question

This is a bit unorthodox, but also extra meta: we (Stack Overflow, the folks behind this here site), are looking to hire our first Director of Information Security and I'd appreciate any feedback you all might have.

Things I'd love to hear your take on:

• What's missing / unclear in the listing itself?
• What would make it more appealing?
• What questions would you have about the job or company if you were looking?
• Any ideas / tips on how to reach people interested in this job? We're advertising on Stack Overflow but we're aware that's not the perfect audience.
• Should this job be open to people not named Rory?

Anything else I missed?

Answer 1

Your listing seems to imply that the director of information security will respond to the CTO. This may be suboptimal. The CISO, theoretically, should respond only to the CEO and the board. (At least so it says in the CISM manual.)

An enlightening (or not) metaphor is that the CISO is Darth Vader:

• Springs into action to plug a critical data leak.
• Runs from emergency measure to emergency measure throughout a whole movie.
• Responds only to the Emperor. Has no clearly defined position in the hierarchy, but still gets to talk at board meetings.
• Everybody fears him and hates him.

The one redeeming quality of the job is the totally awesome costume. Maybe you should provide that.

Answer 2

Personally I like the advert, I think it's positive, quirky enough to gain interest, and has most of the information I would need. However I have a couple of thoughts:

• Advertising

To reach people, I would suggest that SO jobs is not your best bet. Purely because it is so heavily weighted to developer jobs that security folks don't use it. Instead, I would suggest professional networks are the way to go. LinkedIn is an obvious one, and I'm more than happy to share the advert with my network as around 1400 of my contacts are senior security folks [status-completed]. You could also sponsor or attend the odd security event or conference - this is after all where security people go, however different conferences have different audiences, so choosing the right one will be essential.

Another option is the professional headhunter route - pretty effective, and I have used this in the UK, but it is a cost option so perhaps wait until networking fails.

• Reporting Line

Typically, I'd expect the Director of Security in an organisation the size of Stack Exchange to be, in effect, the CISO, as they will have to shoulder the responsibilities and accountability of a CISO, especially as regards the New York State Legislation on named individuals taking responsibility for Cyber Security (currently only mandated for banking, insurance or FS, but likely to spread further). So this role really needs to be a peer of CTO and CRO, or at least able to have a seat at the top table on security decisions, otherwise they will not be empowered at a sufficient level and will still be blamed for failures in security.

• Location

The advert doesn't make it 100% clear that this role could be anywhere. It sounds very US based. Those of us who know Stack Exchange well have seen how well you work across the globe, both remotely and office-based, but I think you could perhaps expand on the non-US possibilities for those who may not be as familiar.

• Existing In-House Security Experience

Another small thing would be to give an indication of the existing security expertise. While you may not have dedicated security staff, it can be very reassuring to candidates to know what they have to work with. Sure, this can be discussed in interview, but it would be good to know what experience Jarrod, Mark, Geoff etc have in security.

Happy to chat further on any of those on my usual email if you need.

p.s. To solve the Rory issue, just make a renaming ceremony part of the onboarding process :-)

Answer 3

Very exciting development, though I do have a few comments:

• What you’ll do:
  • Some additional tasks should include things like SDLC and threat modeling (though perhaps this was intended in the things mentioned, just missing the terms of art)
  • Software security reviews, such as code reviews, static analysis, penetration testing, etc - or managing external testers.
  • Are there other relevant regulations? E.g. PCI-DSS, GDPR... Or leaving this up to them?
• What we're looking for:
  • "Experience in information security" - this is actually a very very wide range of topics. Are you looking specifically for someone with software/appsec experience? Is a cryptographer a good match? What about a malware researcher? And so on.
  • Assuming you are looking more for someone focused on software security - what about your technology stack? (I am familiar with it, but not everyone is. Some people won't touch .NET...) Will they be expected to be elbow-deep in the code, or is this a hands-off / astronaut type of task?
  • Re "frameworks and processes" - some of that is likely to be too "heavy" for a place like SO, and may draw more enterprise-minded people. As opposed to e.g. OWASP's ASVS or OpenSAMM on the appsec side.
  • The certifications requirement is a big question mark in the security industry, even more so than in development. Some are big proponents of it, some are completely dismissive, my opinion is that for that most part the major value of most of these certs is in the low- to mid-range. (E.g. CISSP has a requirement of 4-years experience; that's about the sweet spot, and after 10 years in the industry it is not worth the upkeep). So while certs may be a helpful signal (and possibly useful in some markets), I appreciate that it was marked as "(preferred)" - but please do not put too much weight on this, one way or the other.
• Is this the first InfoSec hire, or is there already a team? If it is the first, are they expected to grow the team, or will it be a one-person show in perpetuity?
• What is the current status of security operations in the company? Are there currently external auditors doing all the security reviews, and is that supposed to continue? What is the level of security expertise amongst the developers/SREs/etc? (Some people love working with only the best, some relish the challenge of a clean slate.)

This may be helpful - at the last OWASP Summit we created an AppSec version of the Joel Test :-) https://www.owasp.org/index.php/Joel_Test_for_AppSec

Answer 4

Would the successful applicant have a team (@AviD references this also):

your job is to design, implement, and monitor a security program that keeps our customers’ information safe

This suggests there's currently no real Information Security program and that the position holder will be designing and implementing a program rather than supporting and enhancing an existing program. If this is done in collaboration with the CTO, is there additional support independent from the CTO's team?

It also suggests the applicant may also function as a Security Analyst while also being Director which would not be a leadership or strategic position.

In relation to GDPR, is the position also functioning as the Data Protection Officer or working in collaboration?

Agree with previous comments of position reporting to the board due to Conflicts of Interest in reporting to CTO. Certainly, these positions should support each other but there needs to be independence.

Answer 5

Maybe it makes sense to describe your new product more, because that is why you're hiring an entire Director of Information Security. (Is it only private Q&A-ing? What else?)

Our newest product, Stack Overflow for Teams, allows teams to ask and answer questions on Stack Overflow in a private space. This puts security at the center of our company strategy.

Two sentences and that's it? It's important to emphasize that you want to create an entire private space in an environment which has been (quite) public ever since. You've never provided anything like private messaging or anything similar within the stackexchange network before. Almost all information have been public. And now comes your new product which adds a new private area to it.

I think that more information on that would trigger more creative thinking towards this goal. Future job interview will be more interesting since the applicant may bring his own ideas which he made up for your product.

Answer 6

"Work towards a goal of SOC 2 type II certification"

Is that the goal of this entire position, or is that simply the successful applicant's first project after hiring?

Answer 7

I think the one thing missing from the ad, which is usually a little bit relevant to a "cleanup and improvement" person, would be to nominate the technology stack the company operates with.

"We currently run production, uat and development environments on a Tandem mainframe and development is in Ada..." is going to get different risk profile candidates (and with different backgrounds) than "Production environment is built on Linode, development is done on Microsoft Windows with Adobe technology stack..."

Answer 8

I like the advert. Things missing from my perspective:

1. A short glance at your (technical) environment. Do you use cloud services extensively? Do you run your own office infrastructure? What are the dominant operating systems? Which stacks, frameworks, management systems do you use? Drop some technical terms so people know what about they are looking at.
2. For non-US-citizens: What are the requirements regarding visa, especially if working remotely? Can you provide assistance with any bureaucracy necessary?