I remember when I realized that the lawyers had taken over cybersecurity. It was 2018. I was in a meeting, looked around, and realized that I was the only person in the room who codes or has ever coded, and also the only person without formal certifications in security. 5 years earlier, security teams were full of people from all walks of life, who often got into security from (let’s call it) “practical” experience.
Thankfully, that really depends on the org. I started in security before “security engineer” was a thing. It was different times, for sure. When the 2008 housing bubble popped, banks started the trend of splitting out engineering roles from the newly formed risk and governance groups. This eventually morphed into what we have today: Security engineering teams and separate GRC/Legal teams.
I can’t hate on compliance too much through. If ran correctly, tracking and auditing networks and processes is an extremely important thing to do.
I just learned both worlds over the years. At my age, I have the technical experience to hold my own and also the balls to push back on stupid compliance requirements to people very high up in organizations. (The trick is to not give a fuck about getting fired for speaking my mind.)
Sorry. Went on a bit of a tangent to say “I understand you completely.” ;)
Haha, no worries, and totally agreed. I’m finding that more and more, not only is there no security engineering team, but the legal side of security has no concept of that whatsoever. They are the security team. Security, to them, is fundamentally a compliance process, which of course involves coordinating and working with the engineering team, but it isn’t really a technical practice so much as a managerial and administrative one.
I remember when I realized that the lawyers had taken over cybersecurity. It was 2018. I was in a meeting, looked around, and realized that I was the only person in the room who codes or has ever coded, and also the only person without formal certifications in security. 5 years earlier, security teams were full of people from all walks of life, who often got into security from (let’s call it) “practical” experience.
Thankfully, that really depends on the org. I started in security before “security engineer” was a thing. It was different times, for sure. When the 2008 housing bubble popped, banks started the trend of splitting out engineering roles from the newly formed risk and governance groups. This eventually morphed into what we have today: Security engineering teams and separate GRC/Legal teams.
I can’t hate on compliance too much through. If ran correctly, tracking and auditing networks and processes is an extremely important thing to do.
I just learned both worlds over the years. At my age, I have the technical experience to hold my own and also the balls to push back on stupid compliance requirements to people very high up in organizations. (The trick is to not give a fuck about getting fired for speaking my mind.)
Sorry. Went on a bit of a tangent to say “I understand you completely.” ;)
Haha, no worries, and totally agreed. I’m finding that more and more, not only is there no security engineering team, but the legal side of security has no concept of that whatsoever. They are the security team. Security, to them, is fundamentally a compliance process, which of course involves coordinating and working with the engineering team, but it isn’t really a technical practice so much as a managerial and administrative one.