<rant>
I personally could care less if a candidate is "insulted" by having to
demonstrate understanding of specific technology in an interview. If he
has "checkpoint firewalls" on a resume, I expect him to be able to
provide me some details about checkpoint firewalls. If he has
"extensive cisco experience" on his resume, you can bet I'm going to be
asking him to write me a quick ingress/egress ACL during the interview
process.
We get yahoos that come in the door boasting so many certifications
it'll make an HR director have an orgasm. Then where the rubber hits
the highway, we find those certifications don't mean a thing. Lots of
certified people out there are very good at taking certification tests.
To prove this point, about six months ago I had five MCSEs and two CCNAs
walk into my office boasting extensive networking experience. None of
them could subnet a network. Out of twenty candidates I interviewed for
the position, all of which boasted networking experience, exactly two
understood subnetting and could convert a CIDR block to a network mask.
Neither of those had any certifications at all. One was an experienced
network engineer, the other was a guy fresh out of college who had spent
his time running the school's networks while his buddies were out
partying.
This has been a hot button issue with me. I've had my time wasted by so
many candidates that the first thing I do after interview introductions
is start grilling them on specific technologies they've listed on their
resumes. This sorts out the people who have greatly exaggerated their
experience level with various technologies and systems. It's that
exaggeration of skill and experience that drives me nuts. I don't care
if candidates don't have a decade of experience with some technology we
use here. But if you don't have the experience, don't put it on your
resume. At least not on a resume you're going to send to me. I will
call BS and "thank you very much for your time" and send you on your
way.
</rant>
Now back to the subject at hand.
What I've found works, is a compromise between very specific technical
questions, and then more general questions such as the one mentioned by
another poster. I hit 'em with a tech quiz, then follow it up with the
"we're planning on deploying ....... and security is a huge concern with
this project, as such what suggestions would you have for ...... and how
would you approach ......"
But that comes after I determine if their resume is full of lies and
exaggerations.
We've had great hiring success with this mixed approach.
-----Original Message-----
From: BARRETT,WILL [mailto:BARRETW@airproducts.com]
Sent: Wednesday, August 23, 2006 5:15 AM
To: revnic@gmail.com; security-basics@securityfocus.com
Subject: RE: Interview Questions
If you are going to do that why bother? Chances are pretty good that
the person you are interviewing has already passed certification so
why
ask them again? Personally I find this kind of interview insulting
and
it definitely indicates that the company either doesn't know about
security, or more likely doesn't care enough about it to make it worth
my while to work there. Bad interview techniques = bad hire = bad
security.
<snip>
**********************************************************************************************
IMPORTANT: The contents of this email and any attachments are confidential.
They are intended for the
named recipient(s) only.
If you have received this email in error, please notify the system manager or
the sender immediately and do
not disclose the contents to anyone or make copies thereof.
*** eSafe scanned this email for viruses, vandals, and malicious content. ***
**********************************************************************************************
---------------------------------------------------------------------------
This list is sponsored by: Norwich University
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------
