This is a bit unorthodox, but also extra meta: we (Stack Overflow, the folks behind this here site), are looking to hire our first Director of Information Security and I'd appreciate any feedback you all might have.

Things I'd love to hear your take on:

  • What's missing / unclear in the listing itself?
  • What would make it more appealing?
  • What questions would you have about the job or company if you were looking?
  • Any ideas / tips on how to reach people interested in this job? We're advertising on Stack Overflow but we're aware that's not the perfect audience.
  • Should this job be open to people not named Rory?

Anything else I missed?

  • 8
    Your listing is lacking the Rory requirement. You may want to fix that :p – SEJPM Feb 19 at 22:33
  • 2
    Context for David – Tom K. Feb 20 at 7:33
  • Another minor nitpick: a CISO shouldn't be able to work remotely 100% of his/her time. Although this might be obvious to the applicants, I would include it into the listing to avoid arguments. Your CISO should at least be on site when a major information security incident takes place. – Tom K. Feb 20 at 7:49
  • 3
    @TomK. SO is a global, very remote-oriented place. If the CISO doesn't need to physically lock the doors or carry out the servers when there is a flood, there is barely any physical on-sitedness that really matters. (Personal communication with other people is important, but seems like SO has that mostly figured out). The only other on-site requirement is probably forensics, and I don't see that being a big part of the task, – AviD Feb 20 at 9:17
  • 2
    @AviD Maybe I should've included that, but for me this is mainly about two things in times of crisis: 1. communicating with people on site and 2. "signaling". I think when an incident happens, it reassures your employees when your head of security is on site, handling the situation (although he/she may actually do very little). This may be up for debate, but IMO it doesn't hurt to include, that from time to time it is required to be on the premises. – Tom K. Feb 20 at 9:29
  • 1
    Whats this "Employees will never be poked with a sharp stick"? :-) – Martin Schröder Feb 26 at 6:46
  • 1
    I just wanted to say I don't see the value in being onsite after a security incident. All the incident response handling I ever see is with virtual teams. Some of them may be in an office, but it certainly isn't important. – Douglas Held Mar 20 at 8:49
  • @David, the job posting would get more exposure/attention if added to SO's LinkedIn. Generally speaking, you need to give more specific information about experience and job roles/responsibilities. – Nikhil_CV Mar 20 at 16:34
  • @AviD "…when there is a flood" You mean like that time SO/Fog Creek made a bucket brigade in Hurricane Sandy? – Michael Mar 22 at 13:26
  • @Michael yes, that is exactly what I was referring to :-D – AviD Mar 22 at 21:29

Your listing seems to imply that the director of information security will respond to the CTO. This may be suboptimal. The CISO, theoretically, should respond only to the CEO and the board. (At least so it says in the CISM manual.)

An enlightening (or not) metaphor is that the CISO is Darth Vader:

  • Springs into action to plug a critical data leak.
  • Runs from emergency measure to emergency measure throughout a whole movie.
  • Responds only to the Emperor. Has no clearly defined position in the hierarchy, but still gets to talk at board meetings.
  • Everybody fears him and hates him.

The one redeeming quality of the job is the totally awesome costume. Maybe you should provide that.

  • 4
    I don't 100% agree, for much of the Empire (until after Ep.IV) Darth Vader was lackey to Grand Moff Tarkin. Which is probably closer to a CTO role there... – AviD Feb 19 at 23:22
  • 1
    More importantly, the CISO->CEO reporting structure that you mention is good practice for typical enterprises (the kind that look things up in the CISM manual). SO is a technology company, and an engineering-driven one at that. Also don't forget that in this case it is "East Coast CTO" that the post is referring to, not "West Coast CTO" - important differentiation in this case. – AviD Feb 19 at 23:25
  • 4
    Overall I actually would recommend that the CISO does report to the CTO, so as to prevent precisely the situations you describe: running between emergencies because everyone fears/hates them and so they don't share necessary information with the CISO. The CISO must be part of the engineering organization, not an external Sith wielding a force-club. – AviD Feb 19 at 23:26
  • 6
    Yeah this is something that we talked about and may change in the future. As a practical matter, we wanted to start with this person reporting to me (CTO) because (a) the bulk of the work will be in engineering, (b) they'll have more clout with engineers as part of engineering, and (c) I'm the executive best positioned to give them "air cover" and make sure that other departments pay attention. However, I get the argument for having them report directly to the CEO and we might make that change down the line once the position is a little more established. – David Fullerton Feb 20 at 0:09
  • 8
    I can confirm that working with @DavidFullerton is a lot like working with Grand Moff Tarkin – hairboat Feb 25 at 22:47
  • 2
    I would say the most important thing about this is that the CISO has the authority to cut anybody off the network if necessary, and ask questions later. – Duncan X Simpson Mar 4 at 4:34

Personally I like the advert, I think it's positive, quirky enough to gain interest, and has most of the information I would need. However I have a couple of thoughts:

  • Advertising

To reach people, I would suggest that SO jobs is not your best bet. Purely because it is so heavily weighted to developer jobs that security folks don't use it. Instead, I would suggest professional networks are the way to go. LinkedIn is an obvious one, and I'm more than happy to share the advert with my network as around 1400 of my contacts are senior security folks [status-completed]. You could also sponsor or attend the odd security event or conference - this is after all where security people go, however different conferences have different audiences, so choosing the right one will be essential.

Another option is the professional headhunter route - pretty effective, and I have used this in the UK, but it is a cost option so perhaps wait until networking fails.

  • Reporting Line

Typically, I'd expect the Director of Security in an organisation the size of Stack Exchange to be, in effect, the CISO, as they will have to shoulder the responsibilities and accountability of a CISO, especially as regards the New York State Legislation on named individuals taking responsibility for Cyber Security (currently only mandated for banking, insurance or FS, but likely to spread further). So this role really needs to be a peer of CTO and CRO, or at least able to have a seat at the top table on security decisions, otherwise they will not be empowered at a sufficient level and will still be blamed for failures in security.

  • Location

The advert doesn't make it 100% clear that this role could be anywhere. It sounds very US based. Those of us who know Stack Exchange well have seen how well you work across the globe, both remotely and office-based, but I think you could perhaps expand on the non-US possibilities for those who may not be as familiar.

  • Existing In-House Security Experience

Another small thing would be to give an indication of the existing security expertise. While you may not have dedicated security staff, it can be very reassuring to candidates to know what they have to work with. Sure, this can be discussed in interview, but it would be good to know what experience Jarrod, Mark, Geoff etc have in security.

Happy to chat further on any of those on my usual email if you need.

p.s. To solve the Rory issue, just make a renaming ceremony part of the onboarding process :-)

  • Re advertising - it depends on what profile they want. E.g. software security people DO actually use it, others not so much. And totally agree about the conferences - again for swsec types I would recommend OWASP / AppSec conferences (hint hint AppSec Israel is one of the best ;-) ) – AviD Feb 20 at 0:03
  • Re reporting - see my comment on @Thomas's post, SO is different from classic enterprises. CISO / SecDir must be embedded in the engineering organization to be able to effect the right kind of decisions. – AviD Feb 20 at 0:04
  • 1
    And yeah, a Rory-renaming is par for the course, Bruce. – AviD Feb 20 at 0:05
  • 1
    the good thing is they have a conference stipend - so that can be used. – Rory Alsop Feb 20 at 0:08
  • 1
    I agree with the update - it is a special situation, perhaps what they call "dotted line reporting" in some orgs. – AviD Feb 20 at 0:12
  • 2
    @RoryAlsop Thanks for the feedback, and good suggestion on the renaming. I may take you up on that offer to chat further, especially regarding reporting lines and role in the company. As for for the other points, yes, it's a global role, though overlap with US / EU timezones will be important. We're trying to use existing networks to recruit, but may hire a headhunter if that doesn't get us anyone. Existing formal experience is limited (no one who has ever been in an infosec role) but in general a top-tier team. – David Fullerton Feb 20 at 0:41
  • What does the "Jerrod Mark Geoff" comment mean? – Douglas Held Mar 20 at 9:01
  • They are members of the dev team. – Rory Alsop Mar 20 at 14:30

Very exciting development, though I do have a few comments:

  • What you’ll do:
    • Some additional tasks should include things like SDLC and threat modeling (though perhaps this was intended in the things mentioned, just missing the terms of art)
    • Software security reviews, such as code reviews, static analysis, penetration testing, etc - or managing external testers.
    • Are there other relevant regulations? E.g. PCI-DSS, GDPR... Or leaving this up to them?
  • What we're looking for:
    • "Experience in information security" - this is actually a very very wide range of topics. Are you looking specifically for someone with software/appsec experience? Is a cryptographer a good match? What about a malware researcher? And so on.
    • Assuming you are looking more for someone focused on software security - what about your technology stack? (I am familiar with it, but not everyone is. Some people won't touch .NET...) Will they be expected to be elbow-deep in the code, or is this a hands-off / astronaut type of task?
    • Re "frameworks and processes" - some of that is likely to be too "heavy" for a place like SO, and may draw more enterprise-minded people. As opposed to e.g. OWASP's ASVS or OpenSAMM on the appsec side.
    • The certifications requirement is a big question mark in the security industry, even more so than in development. Some are big proponents of it, some are completely dismissive, my opinion is that for that most part the major value of most of these certs is in the low- to mid-range. (E.g. CISSP has a requirement of 4-years experience; that's about the sweet spot, and after 10 years in the industry it is not worth the upkeep). So while certs may be a helpful signal (and possibly useful in some markets), I appreciate that it was marked as "(preferred)" - but please do not put too much weight on this, one way or the other.
  • Is this the first InfoSec hire, or is there already a team? If it is the first, are they expected to grow the team, or will it be a one-person show in perpetuity?
  • What is the current status of security operations in the company? Are there currently external auditors doing all the security reviews, and is that supposed to continue? What is the level of security expertise amongst the developers/SREs/etc? (Some people love working with only the best, some relish the challenge of a clean slate.)

This may be helpful - at the last OWASP Summit we created an AppSec version of the Joel Test :-) https://www.owasp.org/index.php/Joel_Test_for_AppSec

  • 1
    Thanks for the feedback! I'll take a pass at some edits tomorrow. To answer some of your questions: yes, more oriented towards software / app security, but not necessarily a hands-on tech role (though ability to do that would be a plus). No existing team, so this is more of a blank slate chance to build up from scratch. Expecting them to start with existing devs & SREs, and then look to grow the team through hiring specialists as needed. Also, we don't put a lot of faith in certifications in general, but I know people who have 'em like to feel that they're appreciated :) – David Fullerton Feb 20 at 0:19

Would the successful applicant have a team (@AviD references this also):

your job is to design, implement, and monitor a security program that keeps our customers’ information safe

This suggests there's currently no real Information Security program and that the position holder will be designing and implementing a program rather than supporting and enhancing an existing program. If this is done in collaboration with the CTO, is there additional support independent from the CTO's team?

It also suggests the applicant may also function as a Security Analyst while also being Director which would not be a leadership or strategic position.

In relation to GDPR, is the position also functioning as the Data Protection Officer or working in collaboration?

Agree with previous comments of position reporting to the board due to Conflicts of Interest in reporting to CTO. Certainly, these positions should support each other but there needs to be independence.

  • Agree very much. The primary thing i took from the ad is the disclosure that the company currently, appears to have no security team whatsoever. For a cloud company that seems a little terrifying (or exciting if you like to fix problems) – Douglas Held Mar 20 at 9:04

Maybe it makes sense to describe your new product more, because that is why you're hiring an entire Director of Information Security. (Is it only private Q&A-ing? What else?)

Our newest product, Stack Overflow for Teams, allows teams to ask and answer questions on Stack Overflow in a private space. This puts security at the center of our company strategy.

Two sentences and that's it? It's important to emphasize that you want to create an entire private space in an environment which has been (quite) public ever since. You've never provided anything like private messaging or anything similar within the stackexchange network before. Almost all information have been public. And now comes your new product which adds a new private area to it.

I think that more information on that would trigger more creative thinking towards this goal. Future job interview will be more interesting since the applicant may bring his own ideas which he made up for your product.

  • "Almost all information have been public" - how about mod chats, mod notifications, user settings, user email addresses, deleted posts and comments? – Bergi Feb 26 at 0:20
  • @Bergi All of the things you mentioned are either specific to mods, or are only necessary for the internal database (e.g. settings, email, etc). Deleted posts are public, you just need a high reputation to view them. Even if that weren't so, they were public at one time. These very few exceptions is why almost was the qualifier. – forest Mar 4 at 4:08

"Work towards a goal of SOC 2 type II certification"

Is that the goal of this entire position, or is that simply the successful applicant's first project after hiring?

  • 1
    I found it a strange and off-putting CISO goal. I assume it's a combination of "first project", and "we don't know what a CISO does but here is an example of something we know we need from a CISO" – Douglas Held Mar 20 at 9:03
  • P.S. Upvoted. It is a good observation. – Douglas Held Mar 20 at 9:38

I think the one thing missing from the ad, which is usually a little bit relevant to a "cleanup and improvement" person, would be to nominate the technology stack the company operates with.

"We currently run production, uat and development environments on a Tandem mainframe and development is in Ada..." is going to get different risk profile candidates (and with different backgrounds) than "Production environment is built on Linode, development is done on Microsoft Windows with Adobe technology stack..."

I like the advert. Things missing from my perspective:

  1. A short glance at your (technical) environment. Do you use cloud services extensively? Do you run your own office infrastructure? What are the dominant operating systems? Which stacks, frameworks, management systems do you use? Drop some technical terms so people know what about they are looking at.
  2. For non-US-citizens: What are the requirements regarding visa, especially if working remotely? Can you provide assistance with any bureaucracy necessary?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .