• 0 Posts
  • 8 Comments
Joined 1 year ago
cake
Cake day: June 10th, 2023

help-circle


  • My #1 recommendation is reading https://staffeng.com/book. There’s so much variance between orgs at this level (or worse, implied during a reorg).

    One of the things that book helped me with is understanding the lens others view this level as four separate personas. That unlocked for me that you might be getting advice from people expecting something other than you’re going after.

    Another lens is the product engineering v corp/cloud security world. They can act very differently and you often find these roles straddling 2-3 unique orgs.

    1. Services / customer experience of what your org delivers
    2. Threat modeling mindset: look for the big picture so you can help make sure you can help put emergencies and day to day stuff in context.
    3. Get real feedback from others to put that judgement in perspective. Sometimes they are missing your perspective and other times you are off base!

    Just remember there’s a lot of variance in higher level processes. Read the book above, then read 20 job descriptions for these titles. See if you can understand what they really want from the role.




  • Read, reproduce, understand. Think of how the programmer was solving a problem and left a problem. Did they probably didn’t understand the problems. The synthetic challenges are often a skill to themselves.

    Re attention span, consider different expectations. Professional product engagements are often 2 ftes/2 weeks. Getting a few good findings out in that time is the goal.

    Sometimes they run out of time on a thread they are looking at. Sometimes they pull on a thread only to find out there’s no way from here. Sometimes years later there’s an insight that x could work.

    Building up that last skill is what makes you more effective. Find someone to bounce ideas off of that’s in the learning curve with you.


  • cmg@infosec.pubtoLinux@lemmy.mlSell Me on Linux
    link
    fedilink
    arrow-up
    2
    ·
    8 months ago

    Agree here.

    Spend your time making sure you are protected against ransomware with good offline backups and able to recover your practice. Keep your payments separate from your comms machine.

    Your job is going to have lots of shady things to click on/invoice/etc

    Plan for it so a malicious client/infected evidence/mistaken click doesn’t take down your practice.

    I’m 25y into this as a technologist and still make mistakes on “oh this will be quick”. Make sure your time sinks are 100% aligned with your business. Think of automation / value and you’ll have the right mindset.

    If you find the tech side fascinating, there’s always demand for good tech lawyers and lawyer comms are entryways into technology management.