cancel
Showing results for 
Search instead for 
Did you mean: 

Incident responders: Build or buy?

Level 10

Incident responders: Build or buy?

There is far more to security management than technology. In fact, one could argue that the human element is more important in a field where intuition is just as valuable as knowledge of tech. In the world of security management I have not seen a more hotly debated non-technical issue than the figurative “build or buy” when it comes to incident responder employees. The polarized camps are the obvious:

  • Hire for experience.
  • In this model the desirable candidate is a mid-career or senior level, experienced incident responder. The pros and cons are debatable:Hire for ability
    • More expensive
    • Potentially set in ways
    • Can hit the ground running
    • Low management overhead
  • In this model, a highly motivated but less experienced engineer is hired and molded into as close to what the enterprise requires as they can get. Using this methodology the caveats and benefits are a bit different, as it is a longer term strategy.
    • Less expensive
    • “Blank Slate”
    • Requires more training and attention
    • Initially less efficient
    • More unknowns due to lack of experience
    • Can potentially become exactly what is required
    • May leave after a few years

In my stints managing and being involved with hiring, I have found that it is a difficult task to find a qualified, senior level engineer or incident responder that has the personality traits conducive to melding seamlessly into an existing environment. That is not so say it isn’t possible, but soft skills are a lost art in technology, and especially so in development and security. In my travels, sitting on hiring committees and writing job descriptions, I have found that the middle ground is the key. Mid-career, still hungry incident responders that have a budding amount of intuition have been the blue chips in the job searches and hires I have been involved with. They tend to have the fundamentals and a formed gut instinct that makes them incredibly valuable and at the same time, very open to mentorship. Now, the down side is that 40% of the time they’re going to move on just when they’re really useful, but that 60% that stick around a lot longer? They are often the framework that thinks outside the box and keeps the team fresh.

16 Comments
Level 13

The best approach can depend in part on how large the incident response team will be, because that dictates the extent to which the organization can withstand the loss of that carefully-trained employee, and still have adequate depth within the incident-response area.

Level 17

Retention is the key - but for anyone who feels stuck where they are at - change is the only option.

  - Nice breakdown of both ends of the spectrum. I find myself right there in the middle and maybe infosec is where I should be..

The trick is to find the perfect malleable turnkey candidate.

Level 15

‌hire for ability grow into position. I wish we had better apprenticeship programs but that's what good references from past employees are for.

Level 15

It's all relative.  If I'm forming a new team I want a mix.  I want seasoned vets as my leads and then hire/train other employees to grow into the role.  Contract to hire can also be a useful tool for the senior candidates to make sure they are what you hope they are.

Level 16

I always say HIRE THE PERSON.  Personality, drive, work ethic and team dynamics are very important.  A team that works together and respects each other will accomplish significantly more then a bunch of possible egos.  Now, that said, there needs to be at least one experienced highly paid employee in the team with 2 or 3 more levels below him/her.  Knowing there is a path to promote also falls into this.  Morale is a large factor and helps with motivation.

I say hire the person and spend the saved money on training and conferences that keep ideas fresh and morale high.

Level 16

Forgot to mention that internships are great...  win win and at least half of our current employees were hired that way, including our NOC team lead.

MVP
MVP

Depending on where my team is at I'll go either way.  Sometimes you need an experienced person when expansion/projects pop up and you need headcount that can hit the ground running.

All in all very good points here.

I don't think there is a one-size-fits-all solution here. I think the environment, maturity of the organization, whether or not the individual will be joining a team or will be responsible for creating one, and other pertinent details weigh in on the decision. With many hiring decisions I always say, "Go with your gut!"

Level 12

Don't forget the companies that are in denial over what mid to senior level engineers can make, those companies are stuck with the level 1 mold as you go model.  Its not always a choice of which way you should go.

Level 15

Great point...I had three interns on my team at my last org....all three were brought on full time after the internship

Level 10

Pay scale is a whole issue in and of itself. Budgeting for FTEs is hard and for whatever reason many organizations see the IT staff is easily replaceable and fail to retain them even when it is a simple budget adjustment.

Level 15

This been a good discussion and matches my long time experience in the IT field. 

Level 15

It does seem that lots of organizations think IT is just break and fix support rather than arterial support for the lifeline of the business.

Level 7

My company is currently is spending a lot of time hiring Penetration Testers. More money usually means more experienced testers.

Level 17

These past few interviews I have been on were more like Skill Assessments.... though they didn't increase the pay just because I wowed them. There were still only the posted positions. Coming in they got one heck of a deal!

Level 17

College is not for everyone.. honestly I would rather have someone who had the drive to get some certs and hands on experience - rather than someone who has been in the classroom for the past 4 years.

About the Author
15+ years IT experience ranging from networking, UNIX, security policy, incident response and anything else interesting. Mostly just a networking guy with hobbies including, film, beer brewing, boxing, MMA, jiu jitsu/catch wresting/grappling, skateboarding, cycling and being a Husband and Dad. I don't sleep much.