Careers in Security

Careers in Security
Jason Chan
Engineering Director @ Netflix
@chanjbs | chan@netflix.com

I lead the cloud security team @ Netflix
Previously:
- Security at large tech and startups
- Security consulting, defense work
Also:
- Grew up in Whitney Point
- Mom graduated from BU

Trends in Security Hiring

Why?

Partially Due to Market Forces

This drives hiring:
4 Organizations for their own security teams
4 Vendors to build security solutions
4 Startups to invent new security products
4 Services organizations for consulting, audit, etc.

Partially Due to Dynamics of the Field

There are three professions that beat their
practitioners into a state of humility: farming, weather
forecasting, and cyber security.
-- Dan Geer

Defender's Dilemna

cybersecurity is perhaps the most difficult intellectual
profession on the planet
-- Dan Geer

So, what's it like to work
in security?

Employer Characteristics
4 Large vs. Small
4 Government vs. Corporate
4 Financial Services vs. Technology
4 East Coast vs. West Coast
4 Startup vs. Established
4 Consultant vs. Full-Time Employee
4 Criticality (e.g. Nuclear Plant or Netflix)

Basic Focus
Build (Defense/Blue Team)
- Defensive product development
- Controls design, architecture, and operations
- Monitoring and response
Break (Offense/Red Team)
- Offensive tools and product development
- Penetration testing

House as Analogy

Architecture and Design

Construction

Standard Operations

Non-Standard Operations

Security @ Netflix

Intelligence, Response, and Investigations
4 Respond to incidents (i.e. fire department)
4 Investigate threat actors targeting Netflix and its
members
4 Produce and integrate security intelligence

Product and Application Security
4 Work on security-related features of the product
4 Examples:
4 Password reset process
4 Credit card storage
4 Help engineers develop secure applications
4 Lead security testing and disclosure programs

Security Tools and Operations
4 Manage our security infrastructure (Amazon Web
Services)
4 Help teams use cloud infrastructure securely
4 Build tools and automation to monitor and secure
the environment

Corporate Information Security
4 Protect our employees and corporate systems
4 Network and device (mobile, laptop) security
4 Vendor risk management
4 Regulatory compliance

Privacy Engineering
4 Design and engineering for consumer data privacy
4 Collection, retention, disposal, use, sharing
4 Compliance with global data privacy requirements

Security Data Analytics
4 Extract security value from large data sets
4 Machine learning
4 Anomaly detection

Device and Content Security
4 Digital Rights Management (DRM)
4 Content partner security
4 Device partner security
4 Secure playback

Platform Security
4 Create security-related software components used
by other developers and services
4 Examples:
4 Encryption key management
4 Network traffic management

Security Career Tips

Ideal skills & traits for a career in security
4 Computer Science/Engineering/Math training
4 Specific security training is great but not required
4 Communication
4 Creative and pragmatic
4 Curiosity
4 Problem solving

Free resources to learn more
4 Coursera - Dan Boneh's crypto classes
4 OWASP
4 Trail of Bits CTF Guide
4 Twitter

Questions?

Careers in Security

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Careers in Security

Similar to Careers in Security (20)

More from Jason Chan

More from Jason Chan (6)

Recently uploaded

Recently uploaded (20)

Careers in Security