Job Hopping

I felt a kind of relief when I read Richard Bejtlich's blog where he said that security professionals should "routinely work both offensive and defensive operations". In my interview with an intelligence agency in the past, one of the interviewers asked me why I wanted to work there. "I don't know", was my reply. But out of every employer in the career fair I attended, I explained that theirs was the only organization I bothered to write a (lengthy) cover letter for. Although I did not understand my exact attraction to that organization, I knew and wrote about one strategic advantage that no other organization could provide: the opportunity to cover multiple roles and have an understanding of the full spectrum of cyber security.

I got a verbal offer to work there pending security clearance, which I of course had to fail - perhaps because I had a foreign partner at the time. So unfortunately (or fortunately) I am left in the private sector, which leaves me with no choice other than to job hop around multiple organizations in the future to fulfill my want to work in different roles because most companies do not offer that many roles. And employers do not like job hoppers, especially not the kind who switches companies every 1-3 years continuously. But think about it. All other things equal and assuming both are not slackers, would you think more competent in advising your security the person who, for example, worked in penetration testing for 10 years, or the person who covered 10 different roles in 10 years? Personally, I would trust the latter.

In my current position in which I've been in for less than half a year, I already understand most of how the company's product provides security for their customers - enough so to already begin to advise our systems engineers who have years of experience on certain aspects of how the security logic of the product worked. I would be staying in this company for at least 1 year. And to be honest, I believe that even if I did nothing else until the end of 1 year, I would already have delivered enough value to the company due to some of my work. This is not to boast, but simply an observation I make that an employee does not need to stay in an organization for years to start delivering value. For every job hop that I make, I would make sure that I first gave more than I took from the organization.

The kinds of positions I am interested in are:
Security Analyst - the kind working in a Security Operations Center.
Security Researcher - researching about system internals, could be things like mobile phones or operating system internals
Advanced Penetration Tester - I think it is important to make the "advanced" distinction because (and I am not sure about this) I believe that many penetration testers do very basic testing (e.g. Owasp Top 10).
Vulnerability Researcher - the kind who tries to find a multitude of exploits in things. Similar to penetration testing, the vulnerability researcher should not only look at easily exploitable flaws such as buffer overflows.
Incident Response / Forensics - understanding the trails that the attacker leaves behind is critical in understanding how they could have been prevented or detected in the first place.
Malware Researcher - I think a Vulnerability Researcher is the coolest job possible in the realm of cyber security - how many "security professionals" can write exploit code? But if I had to choose a role which I am most interested in and could do it for the rest of my life without job hopping, it would probably be this (disclaimer: still job hopping)!

Come to think of it, there are not that many positions I like, huh? Incidentally, FireEye is one of the companies I plan to apply to in the future. They also are one of the few organizations in the world which have most of the positions I am interested in. Since Richard Bejtlich is the Chief Security Strategist at FireEye, I suppose I would point the interviewing manager to Richard's blog if I get asked why I am moving around :)