About this job
Technologies
Job description
Doug Tetzner (Head of Talent Acquisition) and Andrew Dunbar (Head of Security) met to discuss Shopify’s need to find and hire a Security Operations Engineer. Here is the resulting conversation:
Doug: Ok, what is the role you wanted to discuss?
Andrew: I need to find a security operations engineer.
Doug: What is it?
Andrew: It's an operations position that deals with security from a network perspective and also does application security audits. They'll mainly be working on our intrusion detection infrastructure and doing application assessments.
Doug: This is stuff you're doing right now, isn't it?
Andrew: Yes.
Doug: Is there just too much?
Andrew: Yes. We have about 150 applications that we support.
Doug: 150 applications?
Andrew: Yes, including all the different gems and apps and those kinds of things. Since all of those are accessing customer information, we really need to beef up our security testing of our internal applications.
Doug: What about the third party ones?
Andrew: We are also working on a strategy for third party applications.
Doug: They're accessing customer data as well, right?
Andrew: Yeah. There's a lot of different ways to approach that. We don't really want to limit the creativity and the workflow of people that are developing apps so we don't want to impose too much overhead and red tape. We've gone through assessments trying to get Shopify apps into other ecosystems and it's really painful to try to jump through all of their hoops.
We want to try to find the balance between being able to have security of the data that we're giving them but also let them put up apps freely.
Doug: What's more important, network security or application security? Not in general but for this person to know.
Andrew: It's hard to say. As long as they're a person that can learn easily then I think if they have experience in security in general doing either network based security or application security then the other won't be that difficult to learn.
Doug: So they're more making sure people don't break into our shit, right?
Andrew: Yeah. They're making sure people don't break into our shit and that if someone does break in that we can detect it and respond to it and contain it as quickly as possible.
Doug: Right. We want to be like there was a breach and this is exactly what the problem was.
Andrew: Yeah. This is the data that was accessed, this data was not accessed. So we can decide what response is required. If someone gets access to a list of all the orders of one shop versus someone getting a list of all of the customers for every shop, then that would be two totally different things that we need to deal with.
Doug: Right. There's stopping people in the first place, there's detecting when there's a breach, and then there's actually knowing what the breach was in detail?
Andrew: Exactly.
Doug: Say I work in the government, like you used to, why would I want to come do this?
Andrew: The things that make this much more interesting than the government is that you're not just handed a role and told “here, do these exact things”. We're very open with people. We let people be creative in the solutions they come up with. We know the general issues we want to try to have somebody solve, but it's really up to the person who solves it as to how they do it and what tools they feel they can use to correct the problems.
We try to use standard tools as much as possible, but letting people have the creativity to come up with their own solutions is a big benefit that you don't get in government.
Doug: That's awesome. Given that we've got just under 50,000 stores right now, does that add an element of trickiness when it comes to security? I'm wondering, is this the show for security? If you're a security professional you're like I'm going with them.
Andrew: I don't think it's quite at that point. If you look at a social network like Twitter or Facebook, they have a billion users and we have like 50,000. We are a pretty unique environment for web security though. It's not just like we have user accounts that have some profile information. It's somebody's entire business that is depending on us for security.
Doug: So the stakes are high.
Andrew: Yeah. The stakes are high. Because we have so many different stores running on one unified platform, it only takes one store to get targeted and breached, which is likely a store that we didn't even know that we hosted, and then all of the other stores can be affected.
Doug: Ok, so what are you looking for?
Andrew: We're really looking for someone that has a passion for security outside of just having had a job working in security. There are a lot of different things you can do outside of your actual job that can show that you're passionate about the field.
Doug: Are you talking about Grey Hat shit, like some hacking?
Andrew: Well, White Hat shit would be good.
Doug: White Hat. Right.
Andrew: It would be interesting if people have participated in capture the flags before where they go into competitions trying to do application security breaches on purpose in ways that people have set up. Or if they have done responsible disclosure where people are casually browsing the Internet, they find a website, see something that looks a little bit off, and then they say that looks like something that could be an exploit. They're the kind of people who always have security at the forefront of their mind when they're going through stuff on the Internet. These are the kind of people we want.
Doug: People who are passionate about security?
Andrew: Yes. Not just I worked on a firewall for 10 years and installed network stuff. Having the variety. There are so many different areas in security so if you haven't found something that you really love then you're not in a field that you care about. You're not that interested. We want people that have a desire to learn more and enjoy taking on the challenge of security here, knowing that they can grow in many different directions at Shopify.
Doug: Great, thanks Andrew, I will get this transcribed and posted.
If you are interested in discussing this role in more detail, please apply directly on our careers site at http://www.shopify.com/careers and we'll be in touch. Please note: alternate title will be Security Operations Specialist if the successful candidate is not a registered Engineer.
How to apply
Please apply directly online on our careers site at http://www.shopify.com/careers