Navigating job offers in InfoSec

I’ve been getting multiple job offers lately, which is a good position to be in, but it’s tough deciding without fully understanding the security posture of each company. Has anyone experienced similar pressure, and how did you evaluate which organization aligns better with your own values on security? I’d appreciate any insights on what factors to prioritize during the decision-making process.

‌⁠‍⁠​‍​‍‌⁠‌​​‍​‍​⁠‍‍​‍​‍‌‍​⁠‌⁠‍‌‌‍​‍‌‍‌‌‌⁠​‍‌⁠​⁠‌‍‌‌‌‍​⁠‌⁠‌‌‌⁠​‍‌‍‍‌‌⁠‌​‌⁠‍‌​‍​‍​‍⁠​​‍​‍‌‍‍⁠​‍​‍​⁠‍‍​‍​‍‌‍⁠‍‌‍‌‌‌⁠‌⁠‌‌⁠⁠‌⁠‌​‌‍⁠⁠‌⁠​​‌‍‍‌‌‍​⁠​‍​‍​‍⁠​​‍​‍‌‍‍‌‌‍‌​​‍​‍​⁠‍‍​‍​‍‌‍⁠‍‌‍‌‌‌⁠‌⁠​‍​‍​‍⁠​​‍​‍‌‍‌​​‍​‍​⁠‍‍​‍​‍​⁠​‍​⁠​​​⁠​‍​⁠‌‍​⁠​​​⁠‌‍​⁠​​​⁠‌‍​‍​‍​‍⁠​​‍​‍‌‍‍​​‍​‍​⁠‍‍​‍​‍‌‍⁠⁠‌​‌⁠‌​​‍‌​‍‌‌‍⁠‌‌​‍⁠‌‍⁠​‌‌‍‍‌​‍​‌‌⁠⁠‌⁠​‌‌‌​‍‌‌‌‌‌‌‍‍‌‌​⁠‌‌‍​​‍​‍‌⁠⁠‌​

It’s definitely tough to evaluate competing offers… I’ve found it helpful to have an informal chat with someone from the security team at the companies you’re considering. Hearing about real challenges they face and their approach to dealing with them can give you deeper insights into their security culture.

‌⁠‍⁠​‍​‍‌⁠‌​​‍​‍​⁠‍‍​‍​‍‌‍​⁠‌⁠‍‌‌‍​‍‌‍‌‌‌⁠​‍‌⁠​⁠‌‍‌‌‌‍​⁠‌⁠‌‌‌⁠​‍‌‍‍‌‌⁠‌​‌⁠‍‌​‍​‍​‍⁠​​‍​‍‌‍‍⁠​‍​‍​⁠‍‍​‍​‍‌⁠​‍‌‍‌‌‌⁠​​‌‍⁠​‌⁠‍‌​‍​‍​‍⁠​​‍​‍‌‍‍‌‌‍‌​​‍​‍​⁠‍‍​⁠‌‌​⁠‌⁠​⁠‍​​‍⁠​​‍​‍‌‍‌​​‍​‍​⁠‍‍​‍​‍​⁠​‍​⁠​​​⁠​‍​⁠‌‍​⁠​​​⁠‌‍​⁠​​​⁠‍​​‍​‍​‍⁠​​‍​‍‌‍‍​​‍​‍​⁠‍‍​‍​‍‌‌‌⁠‌‌​‌‌‍‍‍‌​​⁠‌⁠‍‌‌​‍‍‌‍‌⁠​⁠‌‌​⁠‌‌​⁠‌​‌​‍⁠​⁠​‍‌‍⁠⁠‌⁠‌‌​⁠‌‌‌​‍‍​‍​‍‌⁠⁠‌​

I’ve been in a similar boat, and I found it helpful to check the companies’ incident response history — it can give you insight into how seriously they take security. Maybe reach out to former employees on LinkedIn to get their perspectives. Have you thought about what specific values are most important to you?

‌⁠‍⁠​‍​‍‌⁠‌​​‍​‍​⁠‍‍​‍​‍‌‍​⁠‌⁠‍‌‌‍​‍‌‍‌‌‌⁠​‍‌⁠​⁠‌‍‌‌‌‍​⁠‌⁠‌‌‌⁠​‍‌‍‍‌‌⁠‌​‌⁠‍‌​‍​‍​‍⁠​​‍​‍‌‍‍⁠​‍​‍​⁠‍‍​‍​‍‌⁠​‍‌‍‌‌‌⁠​​‌‍⁠​‌⁠‍‌​‍​‍​‍⁠​​‍​‍‌‍‍‌‌‍‌​​‍​‍​⁠‍‍​⁠‌‌​⁠‌⁠​⁠‍​​‍⁠​​‍​‍‌‍‌​​‍​‍​⁠‍‍​‍​‍​⁠​‍​⁠​​​⁠​‍​⁠‌‍​⁠​​​⁠‌‍​⁠​​​⁠‍‌​‍​‍​‍⁠​​‍​‍‌‍‍​​‍​‍​⁠‍‍​‍​‍​⁠​⁠​⁠‌‍‌‍​‍‌‌‍‍​⁠‍​‌​⁠⁠‌​​‌‌‍​⁠‌​​⁠‌⁠‌⁠​⁠​⁠‌​‍​‌​‍‌‌⁠‍‍‌⁠​​​⁠‌​​‍​‍‌⁠⁠‌​

I agree, checking incident response history is key! Have you considered how their cloud security measures stack up? That can really influence your choice.

‌⁠‍⁠​‍​‍‌⁠‌​​‍​‍​⁠‍‍​‍​‍‌‍​⁠‌⁠‍‌‌‍​‍‌‍‌‌‌⁠​‍‌⁠​⁠‌‍‌‌‌‍​⁠‌⁠‌‌‌⁠​‍‌‍‍‌‌⁠‌​‌⁠‍‌​‍​‍​‍⁠​​‍​‍‌‍‍⁠​‍​‍​⁠‍‍​‍​‍‌⁠​‍‌‍‌‌‌⁠​​‌‍⁠​‌⁠‍‌​‍​‍​‍⁠​​‍​‍‌‍‍‌‌‍‌​​‍​‍​⁠‍‍​⁠‌‌​⁠‌⁠​⁠‍​​‍⁠​​‍​‍‌‍‌​​‍​‍​⁠‍‍​‍​‍​⁠​‍​⁠​​​⁠​‍​⁠‌‍​⁠​​​⁠‌‍​⁠​‌​⁠​⁠​‍​‍​‍⁠​​‍​‍‌‍‍​​‍​‍​⁠‍‍​‍​‍‌‍‌⁠‌⁠​‌‌‍‌​‌​​‌‌‌‌‍‌‍​‍‌‍‍⁠‌‍‍‌​⁠‍‌‌​⁠​‌⁠​​‌⁠‍​‌⁠‌​‌​⁠​‌‌‌​‌⁠​‌​‍​‍‌⁠⁠‌​