Growing the Ranks of Women in AppSec

Transcription

1 Growing the Ranks of Women in AppSec A Forum Discussion

2 Why Are We Here? 1 Million+ Security Jobs Need Filling! Global Information Security Statistics by Gender Europe 7% Women Men North America 14% Middle-East 5% Asia-Pacific 10% Latin America 8% Africa 9% Source: 2017 Global Information Security Workforce Study, (n=19,641) 2

3 Goals for this Panel Talk about our diverse backgrounds Highlight skills managers should think about when recruiting Identify what soft skills are important vs. hardware or vendor training Guidance on how to find a job in InfoSec: what does the beginning look like? Provide resources and roadmaps to get from looking at career options to becoming a highly-paid security expert Encourage managers, HR departments, C-levels to consider alternative sourcing methods Recommend certifications and vendor training 3

4 Who We Are Jeannie Warner Katie Skelton Kate Haworth Aurora Quinn-Elmore Ruchika Mishra Evangelist Trainer, Threat Research Center Application Security Engineer Product Manager Senior Manager, Product Marketing 4

5 Women in AppSec: Legendary Origins 5

6 AppSec Origin I listen to technical ideas and break them apart into human language write down and teach to others. Jeannie Warner Security Evangelist Music Degree 16 years Information Security Unix System Administration/Helpdesk Network & Security Ops Analysis & Forensics Program/Product Mgmt/Marketing AppSec is the future of InfoSec the Big Picture gap. 6

7 AppSec Origin I started in mathematics and computer science; computer science was more interesting. Now, I train ethical hackers. Katie Skelton Trainer - Threat Research Center University WhiteHat Coincidental interview Expansion of the TRC in Belfast Quickly absorbed material Became trainer to: Support, V&V, Pen Testers Software Development plans -> Security. Scary but better. 7

8 AppSec Origin I m a recent convert to AppSec within the last 3 years. My diverse background includes histology (medical field). Kate Haworth AppSec Engineer TRC Biology AppSec Pen Testing Biology into Histology Friend referred to AppSec/WhiteHat Interview proved me trainable AppSec makes a healthy Internet. 8

9 AppSec Origin I translate the needs of the business into projects and goals for our development teams. Aurora Quinn-Elmore Product Management University WhiteHat Hired as a TRC ethical hacker Promoted to Customer Success Manager Stepped into Product Management role Moved to Silicon Valley after college and realized I should really get in on this tech thing. 9

10 AppSec Origin More women in AppSec = greater diversity of thought and more innovation. Medicinal Chemistry Security Product Marketing Ruchika Mishra Senior Manager Product Marketing Started my career in Research (Drug Discovery) Marketing was my passion Everyday, I translate technology into stories that resonate Applications are how we live life online. Helping people understand how to keep Apps secure means I help improve how we all live more safely. 10

11 Paths to a Career in AppSec 11

12 The interconnectedness of Information Security Deciding how you want to interact with technology is important. There s overlap in all the disciplines of InfoSec. AppSec DevOps Vuln Mgmt Arch Decisions Directors/ VPs of IT and Security On the technical side, there are multiple disciplines and areas of focus. InfoSec NetSec Vuln Mgmt Ops/Forensics Rules CISOs Governance Audits Vuln Mgmt 12

13 The interconnectedness of all things Communication is the core! When we start looking at soft skills, the overlap is more obvious and persistent Communication skills are mandatory to succeed in all Information Security disciplines Communication AppSec NetSec Governance Education Process Education Process Vendor-specific training Education on Compliance Documentation Learn to manage Projects, Processes, People Process 13

14 What s in your Tool Kit? Fact: Women have a wider variety of undergraduate degrees than male counterparts How important is learning how to code? What classes had content that you still apply today? What kinds of skills do you look for when you interview others? 74% 11% 8% 8% What have other managers told you about their hiring criteria? What certifications open doors? 14

15 Learn the Language of Entry-Level (You may not need to be here long) Words to look for: Associate anything; Specialist; Entrylevel Junior can be awesome! Are you in school? Intern positions can often lead to full-time employment Word finder for Job Hunting v Manage your expectations. If new to security, you re a beginner for at least 1.5 years. 15

16 Big Company vs. Startup Big company Defined roles, often known scope Formal learning programs, job trees Often have more room for newcomers Limited pay advancement formal processes Likely to be around in 5 years Establishment vs. Startup Startups Roles not as well defined room for adjustment Room to learn and grow Might not have newcomer programs Lower entry pay higher possible rewards Less job security 16

17 Interviewing Be honest, and show your enthusiasm No one knows everything. Don t exaggerate your experience. Know how to ask questions Interview Best Practice Do your research in advance so questions are useful. Prepare questions about the company, technology, industry or competitors. Explain anything you know or have done in 2-4 sentences. Correlate how your past experience relates to the job, especially problem solving skills. 17

18 What do interviewers look for? What questions should you ask of a prospective employer? How do you secure the income you want up front? 18

19 Keeping Women in AppSec: Best Practices for Employers 19

20 What Factors Trend Well in Retaining Women? ü Examine the pay gap Never assume that a woman should start at a lower rate. Pay transparency is important. Look at internal statistics. ü Mentors & Sponsorship - Formal or informal, having mentors within an organization help women settle in quicker, make connections/friends, learn which technical skills are needed by priority. ü 51% of women experience discrimination Time the amount of time women speak in meetings; if not 50%, consider meeting structure. Watch the interruptions. Observe body language. Don t hug! ü Leadership development programs Managers, consider how to look for and train women to replace you as you move up. 20

21 Resources & Links 21

22 Best Certifications & Vendor Training Any Degree! Network+, Security+ (Check Groupon) CISSP needs 5 years experience (Highest $$) CISA/CISM Audit track, Management track for CISO PMP important for any Product/Program/Project Mgr SANS specific training like GCIH, GCIA for Ops jobs, incident forensics and field work 8% Developers CSSLP, GWEB, OWSE, WhiteHat s complimentary Certified Secure Developer 22

23 Resources - Education Education Links Top Global Universities for a Cybersecurity Program Scholarships for Women Studying IS Scholarships for ANYONE studying IS Cheap Training for the Security+ and Network+ exams ISC Certification Programs ISC(2) training WhiteHat Secured Developer Certification - FREE 23

24 Resources Hiring/Training/Diversity Hiring and Training Women Confidence & Leadership Training Recruiting for Diversity Why Some HR Diversity Programs Fail 24

25 Resources - Networking Networking for Women OWASP Women in AppSec Women in Cyber Security - Initiative Cyber Security Professional Program Executive Women s Forum Useful LinkedIn groups: Cloud Security Alliance, Security Orb, Cyber Security Forum Initiative, Regulatory Compliance Association Reviews, Certified IT Practitioners, Business Continuity Information Security Assurance and Compliance Management, Cyber Threat Alliance, Security Orb, Techno Security & Digital Forensics Conference Cyberpatriot program: Mentoring Girls/Kids for the Future 25

26 Questions? Thank you! 26