Got that entry level Infosec job? Don't be this guy!

I know there’s a ton of people out there trying to make it into the Infosec arena. I’m posting this so once you secure the gig, make sure you won’t be this guy. This is a long story but there’s a lesson or two here somewhere.

To provide background, my team believes in developing talent. This is a decent sized company so people get promoted left and right and we like to have a pipeline in case someone makes a move. A little bit over half the team is senior level engineers and the rest are jr. A couple of years ago we hired a guy fresh out of college. The guy was hungry to learn and quickly got up to speed. Although the full IT background wasn’t there, this guy could put two and two together and either try to figure out things by researching or escalating to the appropriate individuals. He has proven to be a valuable addition to the team.

That worked out pretty well, so we tried it again earlier this year with very different results. This time the guy just didn’t live up to the expectation. Keep in mind the guy has an IS/Risk Management degree, so it’s not like he hasn’t been exposed to security things before. Example of deficiencies:
• Severe lack of foundational knowledge: no idea what nslookup is, struggled to find a Windows machine’s IP, looking at logs he thought a MAC address was an Apple Mac computer, no idea what NT Authority\SYSTEM is, etc.
• Zero research ability. Most of the questions he asks the senior guys can literally be answered by the first few hits in Google (e.g: had no idea what a file called “brochure_design.ai” was and was convinced it was an exfiltration attempt)
• Inability to take notes. Procedures are explained, he takes notes, later on can’t make sense of what he wrote down. Meetings were delegated to this guy and we were left with useless notes.
• Cannot connect the dots. Zero critical thinking
• Overthinks the most basic stuff
• Constantly missing SLAs for super basic stuff
• Given access to expensive $BigSecurityVendor training for free, he let it expire without completing the first of 4 courses.

I can go on but I think you get the picture. This person has been with us for 6 months so far and improvement, if any, is at glacial pace. He has been talked to by both peers and manager on how to improve and what the expectation is. We even removed some of the original technical duties to see if he could master the “crappy” stuff. Yet nothing! I am personally convinced he will never get it and it’s not meant for this type of work. Hey, some people do belong in McDonald's. Everyone in my team has spent considerable amounts of time trying to ramp up the guy but things come in through one ear and go out the other. We are at the point where everyone’s workload is getting affected. It is obvious we need to cut ties. Overall a sucky situation. The best part: I opposed hiring this person since day one and the boss had to tell me the other day “Yeah, you were right. This is on me.”

Takeaway: be the best you can be, especially if you are surrounded by great talent who stop what they are doing to sit with you and show you the ropes.

TLDR: new guy sucks, can’t learn, doesn’t understand the basics, everyone has spent too much time helping, we will need to fire him and go back to square one.

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

TheFORCE

kMastaFlash wrote: »

Sounds like an under achiever. The saying C's get degrees is sad but true! If you don't mind me asking Cyberguypr did this guy have any certifications and if so which ones? My best advice is that he will fall over his own feet at some point and make a critical mistake putting him next on the chopping block. From the way you are describing it, it shouldn't be to long before this kid makes a critical mistake. Also, all because he went to a brick and mortar school doesn't mean jack. It all depends on if he "learned" anything in the degree program.

I finished my CS degree with a C, 2.0 gpa. That didn't hold me back in my career. I've gotten all the way to a VP position 10 years after graduating. So for what they were teaching me at school was not interesting. I found othet interesting things myself since then. So dont assume a C student is a bad student in every subject and course.

adrenaline19

I always heard "D equals degree" lol.

Even the best college programs have dbags.

scaredoftests

theforce wrote: »

i finished my cs degree with a c, 2.0 gpa. That didn't hold me back in my career. I've gotten all the way to a vp position 10 years after graduating. So for what they were teaching me at school was not interesting. I found othet interesting things myself since then. So dont assume a c student is a bad student in every subject and course.

agreed!!!!

[Deleted User]

Not all C students are bad. From an employer's eyes for new college hires, what else do you think they have to go based off of? Not work experience for most kids. They will usually go based off GPA. The place I work at now won't even look at you if you don't have above a 3.0 GPA. That may have been fine for you back then, but times change.

UnixGuy

cyberguypr wrote: »

Lucky for me my team is solely technical. Compliance is our sister dept. I'm just trying to help them out. When I have roles open up for my team I'll post them here.

He will fit in nicely in the auditing and compliance department

No offense to him or anyone, but his degree is in Risk management...and he doesn't have the technical knowledge/desire to learn so he is in the wrong team.

On another note, people leave companies when bad behavior is tolerate(or celebrated) so if he is bothering good team members and management are okay with it, good people will leave.

soletek

What they mean by company culture is someone they can be buddies with after work and bar hop. If this guy didn't have a bit of technical aptitude there is no way he would be on my work force. If he could meet us half way I could understand giving him a chance . I could understand if he knew the basics but geesh. My first IT job i didnt know crap on the firsr portion of my technical test but I killed the second easier part. They knew I had the foundation they was looking for and 5 promotions later I'm doing great. Just fire the hack and move on. Stop hiring people who don't have a basic foundation for IT.

Hippodrome

Blucodex- what is a local non profit cybersecurity range?

Rylee1246

It is stories like this that aggravate me to no end. From the perspective of someone looking for an entry level position in the security side of IT that is having a hard time just getting an interview, seeing someone like this get the position is frustrating.

NetworkingStudent

Rylee1246 wrote: »

It is stories like this that aggravate me to no end. From the perspective of someone looking for an entry level position in the security side of IT that is having a hard time just getting an interview, seeing someone like this get the position is frustrating.

Yup.............

I always wondered why so many IT teams pushed so hard for passion for IT, and now I see why. The OP's co-worker gives entry level IT people a bad rap.

This guy has no passion for IT, he's just filling a seat. Think about the cost of replacing him.. maybe $5,00 plus in lost productivity...?

There are so many people that hear about all the money you can make at a coding,web development, or security job. All these people only see the $$$ signs.

The people that just want to make an easy buck in IT, make it harder for the people that actually want to work in IT!!

Phalanx

Be careful in putting up with him, or people like that in general. It can lead to this, which I have been on both sides of having to deal with:

He might be the problem, but people will see the management putting up with him.

kurosaki00

I'm a very pro employee above the company person. But people need to understand that welcoming someone, training, showing him the ropes, answering questions is very different from pampering and individual special treatment. The guy has been given an opportunity and is not reacting well to it.

Another thing is that I dont know everyone else but myself in like 8 years of IT experience, it's rare to have a company care to raise you and develop you.
Usually its hey this is ur AD credential, figure it out (more or less). So if you have a decent company or decent coworkers investing time in you, take advantage of it and be grateful. I dont mean buy them cookies (although I do like cookies). Just do your job and contribute to the team, thats how you thank them.

TheFORCE

I put myself in that 75% recently. Left because someone i was working close with was an hole.

TechGromit

Phalanx wrote: »

Be careful in putting up with him, or people like that in general. It can lead to this, which I have been on both sides of having to deal with:

He might be the problem, but people will see the management putting up with him.

That's an interesting position. Do you think it's a personality clash issue, where some people don't get along with others. Where as another person in the same position might get along great with the same boss where the other employee thought he was the worst boss in the world? Or are some people just all around A-holes, no one can get along with them and if the company could recognize the issue, they would save themselves a ton of money by getting rid of the bad apple that spoiling the whole basket.

UnixGuy

+1 I'm one of those 75% as well....

Moldygr33nb3an

I tell people who want to break into IT that it's easy, but if you expect to advance then you better turn it into a passion. Don't leave your work at the door until you're in a position you are happy in.

This individual should do everything in his power to get to your level or better. Even if this means 2-5 years of non-stop training. Lunches should turn into training, weekends should turn into learning, evenings should turn into research.

If you just want to get into IT because it pays well or it's "cool." You will more than likely get washed out or get stuck in a entry position.

Problem is I see these kids fresh out of HS that once they're out of work, they turn their afternoons and evenings into gaming/partying.

Phalanx

TechGromit wrote: »

That's an interesting position. Do you think it's a personality clash issue, where some people don't get along with others. Where as another person in the same position might get along great with the same boss where the other employee thought he was the worst boss in the world? Or are some people just all around A-holes, no one can get along with them and if the company could recognize the issue, they would save themselves a ton of money by getting rid of the bad apple that spoiling the whole basket.

I think it's less of a personality clash, and more the inherent realisation that people will blame the individual only so much. At that breaking point, they will move the blame to management, as they see it as a failing of management to deal with the issue in any meaningful way. I have been on the side of blaming management after putting up with a bad employee for over a year, and then I was on the other side AS management having to deal with a bad employee. At that point, I put initial training into place and when it was obvious he wasn't picking up, we went down the disciplinary route. I didn't want to lose my other staff due to, as you say, a "bad apple" in the basket.

UnixGuy

Moldygr33nb3an wrote: »

..... Don't leave your work at the door until you're in a position you are happy in.

......
Problem is I see these kids fresh out of HS that once they're out of work, they turn their afternoons and evenings into gaming/partying.

I understand your argument, but you sound like Lumbergh here

Remedymp

$bvb379 wrote: »

Yup, got beat out by a guy like this. Would have increased my salary by $20,000. My friend was trying to get me a job as an entry level security analyst but I got beat out by a guy right out of college with a Security and Assurance degree. My friend then proceeded to tell me that he had to tell the guy what a router was and what it did. What a shame some words on a piece of paper can do for and against people.

I just find these stories hard to believe. Before you graduate, your capstone forces you to define these devices and why you would need and use them in a network.

I just find it hard to believe that a person coming out of school now with a degree in IS would make it pass faculty without this knowledge.

PJ_Sneakers

cyberguypr wrote: »

You guys make it sound like I work at Mom&Pop's IT shop. Of course there was a full background check conducted. The degree is 100% valid. What we question is if the guy really did the school work or if he either ended up buying papers off Chegg, got answers provided by an unscrupulous teacher, or something like that. The other day I went to the college's website, checked the curriculum and brought up conversation and questions about topics covered in the classes. He deflected every one of my questions. Bizarre.

This has played out in front of me before. Management brought in a person due to their salesmanship.

Legit regionally accredited masters degree in infosec. Online program from a B&M. No knowledge of the field. Less than basic knowledge of Windows or any other OS. No idea about rudimentary programming. Couldn't describe defense in depth, network segmentation, DMZs, or Active Directory. Couldn't understand a simple SQL statement. No idea what ISO or NIST was. Etc etc etc. I mean, the normal undergraduate level stuff was way over this person's head.

I asked them a lot about coursework and their thesis, and got nothing but redirection and BS.

The program is 100% lab projects and essays, with no proctored examinations like those used by WGU and others. I found out that this person bought all of their papers online, and got all of their assignment answers from another student.

I would mention the name of the school but I don't want anyone to be able to reproduce the scenario.

$bvb379

Remedymp wrote: »

I just find these stories hard to believe. Before you graduate, your capstone forces you to define these devices and why you would need and use them in a network.

I just find it hard to believe that a person coming out of school now with a degree in IS would make it pass faculty without this knowledge.

Happens more often than you think. I.E. OP's post. Also, they provide on the job training.

cyberguypr

Well, guy has finally been terminated. Life is beautiful again. We are restructuring a bit so now the person who replaces him will be working under me. If you are in security in Chicago and looking to make a move, hit me up. I will be posting something later with more details.