The State of Cybersecurity Hiring, 2026 content plans, and the weekly news - ESW #441
Ayman discusses the current state of cybersecurity hiring, noting that the job market has improved slightly but still requires candidates to demonstrate a broader range of skills, including the use of AI and modern tools. He suggests that aspiring professionals can gain valuable experience by working on personal projects, such as deploying open-source applications or learning DevOps practices, to build practical skills that are in demand.
Transcript
Only Ayman's parts of this conversation are included, with the question before each answer for context.
We will put in if we find pay-per-view tickets that you can purchase to these fights, we will include it in the show notes. But yeah, love that you're getting active in your local community there, Jackie.
That's great.
And some people could definitely use some treatment for their winter skin around here. I was just checking to see how ashy I was today. The legs definitely much worse than the arms, but the arms get pretty dry as well. Also joining us, the connoisseur of cloud security, our single origin co-host and resident coffee sommelier, Ayman Elsawah. How are you doing, Ayman?
Good, Adrian. How are you doing?
Do you get ashy in cold weather? You've got darker skin.
A little bit. Yeah. Yeah.
I know. Everybody gets dark skin. It's just, you know, the darker or everybody gets dry skin. It's just the darker your skin and the more embarrassing and obvious it is, right?
Yeah. I need the lotion. And California is, you know, very dry. So, you know, it doesn't help. Not much humidity.
Yeah, I'm the color of ash.
Yeah, and you're part of California.
You know where has it really kind of transformed things for people i want to hear more of that because i'm just not seeing a whole lot of it and i'm sure it's happening out there and yeah maybe some guests we can have in the show we can talk about that not a cool demo right like how at scale like this is you know move the needle for a company in terms of you know revenue or productivity or efficiency or something like
You know, one thing that we probably don't talk much about previously that I would like to hear more is how enterprise security teams are shaping up these days, right? With a few things. One, the labor, excessive labor, like, you know, there's, well, one, smaller budgets, two, a lot more talent out there, and then three, the use of AI. But, you know, would like to make the AI part like a smaller portion, but... How teams are shaping, whether it's a small startup or a large enterprise team. 15:37 So I'd be curious, maybe we get more, a variety of security leaders on the show and see how their teams are doing or what their plans are for the year.
I know Jackie, you and Ayman were very excited to cover this. Sean, I'm sure you have some experience here as well. I'm mostly going to stay out of it because I haven't done any hiring and So I'm sure some things have changed, but I'm very interested to hear both about, yeah, like what do you want to cover it from the person trying to get hires perspective, the hiring managers perspective? We're going to cover it from both. What's the idea here?
I would do both. Yeah.
Yeah.
Yeah, we can do both state of the job market, all that kind of stuff.
Yeah, why don't you, you prepared a little bit for this, Ayman, so why don't you kick us off?
Yeah, well, you know, I mean, so some background. I had a podcast previously called Getting Into Infosec, where I interviewed people and saw how their journey came in. And the reason I mentioned this, because it's important, because there's no one way to get into security. There's so many. So I could interview a thousand different people and literally get a thousand different ways of how Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 25:13 Right now, let's moving up to now, you know, the job or last year, last year, the job market was pretty bad. Past two years, it's been really bad, like super brutal. We're talking about like CISOs getting laid off, CISOs taking more than 50% pay cuts, just the teams, you know, being reduced. And that's, I think some combination is the lack of funding that's out there and also people getting paid a lot during the pandemic. And now they're, you know, companies trying to save. 25:43 Now, I think the market is starting to warm up a little bit, at least here. So in the Bay Area, there's a lot of AI companies, a lot of new companies coming up, and they're trying to sell enterprises and they need a head of security. So both in New York and San Francisco, it's starting to warm up. There are paying less. So companies are paying less than they used to. So that's something different for folks. Unless you're in a niche space, expect to get paid a little less. 26:15 What else? Oh, and... People are expecting more. So because the job market, it's still not super, super hot or super warm. So they're going to expect you to do more, which is, you know, in the age of AI, you can do more now as well. So they're going to expect you to know how to, you know, do more things and know how to use AI and the modern tools and things like that. So I'll pause here, Jackie.
Good question.
Well, I mean, yeah, so that is a good question. I probably don't have a good opinion to say on that one.
So it sounds to me like that should be just a common interview question, right? Like, how do you leverage AI to be more efficient, more effective? Is that...
So, yeah, I mean, I think you're right, but I think we're going down a rabbit hole, but we're not understanding how AI can help us with the job, like help you get a job. What, like, it's like, I can't stress enough. It's like such an amazing age right now. Why? Because AI can help you do things that you could like took weeks for you to learn before you could do it now. So like a lot of CISOs, not a lot, some CISOs are coding again, right? 39:16 Like, you know, the technical CISO, there's a couple of tracks of CISOs. But the ones that used to be technical, we like to code. We like to tinker and make things. Now you can create new things. And so in some of the talks, every time I say, and back to what Jackie was saying, is like, do, right? So write a blog post. But what are you going to write a blog post about? Well, learn something, right? And so what are you going to learn about? Well, come up with some project. I mean, it could be a non-security thing. You could take some sort of open source CMS, like Ghost or anything like that, and deploy it on Docker. 39:51 And even if you know nothing, you could just set up cloud code or something and say, hey, start me from basics and help me deploy this. And now you'll learn Docker, you'll learn CICD or GitHub deployment, you know, forking and branching and all these kind of things that will make you a better security engineer, right? Because what we want is people with skills. And what's hard is for people to get those skills. And colleges are not teaching them those skills. So how are you going to get those skills, right? 40:22 It's kind of like that conundrum. So go there and just do things. It could be a simple JavaScript app or make a game or whatever it may be. But AI can really help you with that. I'm not talking about cut and pasting Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria.
And apparently they didn't get much of anywhere because they already had some good protocols in place. Like I would love to know what that looked like, you know, how they managed to detect and stop it. But yeah, they had a cellular modem on this thing and everything. So, you know, they didn't have to be physically present if it was detected.
Well, luckily the ferry wasn't in motion. I think it was just about to depart, right? So...
I think that precluded all of those.
I mean, the whole maritime industry is kind of like a little, you know, behind technology. I mean, there's there's some there's some there was a documentary about like ships can just turn off their transponders and you just don't know where they are.
It's like soaking airplanes. Yeah.
Yeah.
Was the best day to announce they couldn't wait one more day they ruined a whole lot of christmases and they dropped an easily exploitable vulnerability disclosure just before christmas which is perfect because you really guarantee to mess up christmas day if you drop it if you give the attackers just a little bit of a head start yeah
I mean they're always attacking around the holidays anyway so it's like just like a gift.
Absolutely. I mean, that is well agreed upon, right, for coordinated disclosure. Like, you know, this isn't, you know, this is a security vendor. This isn't somebody on full disclosure mailing list dropping something anonymously from a throwaway email account. This is a vendor. Yeah, they should, they should plan this better. Shame.
Was there a timeline of when they, did they contact MongoDB or anything or?
No, nothing formal, but people have long memories. Yeah. When you make them have to work on a common holiday in their country. Well, the original poster was a Joe.
They'll remember. The original poster was a Joe, right, from Elastic Security? Or am I reading it wrong?
Yeah, so they disclosed the vulnerability, but it was a different vendor who wrote a blog post on exactly how to exploit it that then was used by attackers.
So, a mess all around, it looks like.
You know, these things usually take weeks or months to coordinate everything, to make sure there's a patch, you know. You know, my company's blog post, your company's, hey, there's an update, you're gonna have to install, like go out on the same day, like, like, there's a lot of coordination that usually happens with these kinds of things. That sounds like maybe it didn't happen here.
Yeah, yeah, first got published when I 1219. And then Mongo, It seems like somebody knew about it in the Mongo world like December 15th. Anyway, it's an interesting timeline.
All right, a few more items here. Man, let's just jump to AI vending machines, should we? Yes. Did you all get a chance to watch this? Yeah.
Yeah, it was a fun watch. Actually, it was like me in my night. I was like, oh, I can sleep now.
Again, I think this is... One of the things making me think this year is going to be like when we see everything fall out, like the experiments either worked or they didn't. But I think everybody's had enough time with AI now that, you know, it should be more clear after 2026, like where we can get value out of it and where it's just not able to do it without a babysitter.
Yeah, I think people are starting to wake up to some of them to the hype, but then also really kind of figure out what the real use cases are going to be for AI.
The Louvre, right? Yeah. Yeah, yeah. So we have the... It wasn't too long ago. Exactly. So we have this situation where we have the electronic bits that people are after, but they're still after the physical bits as well.
Mm-hmm. I mean, you know, look at the, to be honest, I mean, look at the vault, right? Who puts concrete, I mean, like a brick around the vault. You're supposed to have, what is it, like five, six feet of either steel and concrete around it, you know? So, I mean, it's like, and you put it next to a parking garage, they probably share the wall.
I mean, but you can see it in the photo. You can see the two layers of wall and like that's maybe doable with a sledgehammer given a little bit more time.
I know this is negligence on the bank's fault.