RE: Interview Questions

["Randy Johnson" <randyj () holydiver com>]

I couldn't agree more. Certs are worth exactly what they're printed on.
I've hired for 15 positions in the past year, in the US and abroad. Of the ~
100 candidates I interviewed, allof them had one or another certification
listed on their resumes.

Oddly enough... only about 5% could actually produce that cert, give a
number, show any kind of proof that they held the certs they'd said they
had.

One of the easiest ways for me to 'weed out' candidates is to find the liars
amongst them.

Will says he'd be insulted to be quizzed. Too damn bad. You want to work
here, work for me, you'll do what I say, and you'll answer my questions. I
don't 'owe' you a job ......

-----Original Message-----
From: Keith T. Morgan [mailto:keith.morgan () terradon com] 
Sent: Wednesday, August 23, 2006 11:01 AM
To: security-basics () securityfocus com
Subject: RE: Interview Questions

<rant>
I personally could care less if a candidate is "insulted" by having to
demonstrate understanding of specific technology in an interview.  If he
has "checkpoint firewalls" on a resume, I expect him to be able to
provide me some details about checkpoint firewalls.  If he has
"extensive cisco experience" on his resume, you can bet I'm going to be
asking him to write me a quick ingress/egress ACL during the interview
process.

We get yahoos that come in the door boasting so many certifications
it'll make an HR director have an orgasm.  Then where the rubber hits
the highway, we find those certifications don't mean a thing.  Lots of
certified people out there are very good at taking certification tests.

To prove this point, about six months ago I had five MCSEs and two CCNAs
walk into my office boasting extensive networking experience.  None of
them could subnet a network.  Out of twenty candidates I interviewed for
the position, all of which boasted networking experience, exactly two
understood subnetting and could convert a CIDR block to a network mask.
Neither of those had any certifications at all.  One was an experienced
network engineer, the other was a guy fresh out of college who had spent
his time running the school's networks while his buddies were out
partying.

This has been a hot button issue with me.  I've had my time wasted by so
many candidates that the first thing I do after interview introductions
is start grilling them on specific technologies they've listed on their
resumes.  This sorts out the people who have greatly exaggerated their
experience level with various technologies and systems.  It's that
exaggeration of skill and experience that drives me nuts.  I don't care
if candidates don't have a decade of experience with some technology we
use here.  But if you don't have the experience, don't put it on your
resume. At least not on a resume you're going to send to me.  I will
call BS and "thank you very much for your time" and send you on your
way.

</rant>

Now back to the subject at hand.

What I've found works, is a compromise between very specific technical
questions, and then more general questions such as the one mentioned by
another poster.  I hit 'em with a tech quiz, then follow it up with the
"we're planning on deploying ....... and security is a huge concern with
this project, as such what suggestions would you have for ...... and how
would you approach ......"

But that comes after I determine if their resume is full of lies and
exaggerations.

We've had great hiring success with this mixed approach. 

> -----Original Message-----
> From: BARRETT,WILL [mailto:BARRETW () airproducts com]
> Sent: Wednesday, August 23, 2006 5:15 AM
> To: revnic () gmail com; security-basics () securityfocus com
> Subject: RE: Interview Questions
>
> If you are going to do that why bother?  Chances are pretty good that
> the person you are interviewing has already passed certification so
why
> ask them again?  Personally I find this kind of interview insulting
and
> it definitely indicates that the company either doesn't know about
> security, or more likely doesn't care enough about it to make it worth
> my while to work there.  Bad interview techniques = bad hire = bad
> security.

<snip>
****************************************************************************
******************
IMPORTANT: The contents of this email and any attachments are confidential.
They are intended for the 
named recipient(s) only.
If you have received this email in error, please notify the system manager
or the sender immediately and do 
not disclose the contents to anyone or make copies thereof.
*** eSafe scanned this email for viruses, vandals, and malicious content.
***
****************************************************************************
******************


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------