Introducing Chronicle, a new Alphabet business dedicated to cybersecurity

Based on my experience, there is a huge talent shortage, especially outside of the Bay Area. I'm not a security person myself, but my team tried to hire a security person multiple times.

You'll often find people that have experience running automated scans, filling up compliance paperwork, setting up firewalls and SIEM tools, etc. but don't know how to deal with source code or mitigation. At the other end of the spectrum, there's a small number of people who can review code and write tools, exploits, etc. but hate the bureaucratic work. In the middle, which is the kind of person that a startup or small company would want to hire, there is an even tinier number of candidates.

The kinds of things you are doing sound great. Perhaps try to participate in bug bounties, too. One reason you don't see a ton of job postings is that many companies don't know yet they need them. :-) Also, a lot of recruiting might just happen through word-of-mouth or in an outbound fashion. In my limited interactions, I found that the security community can sometimes work like a club or a society, more than in other tech circles.

I don't know of any security talent with moderate people skills that has trouble getting a job. However, there does seem to be a huge misunderstanding on how to best break into the "security industry", which is just too generic and really the wrong question to ask. What specifically do you want to do? Then you can identify the most efficient way to get there. Most people I know found their way in through other careers as developers, sysadmins, or network admins..focusing on security where they were first. Things will grow from there.

Hypothetically, if you have solid experience as a full stack web developer then I would suggest finding a way to pivot off that expertise (web application security, infrastructure, etc) rather than diving into the Shellcoders Handbook, x86, and K&R, which are going to be more tailored towards reverse engineering and vulnerability research.

I have a few thoughts on why you "don't see a ton of job postings" for security. First of all, would you notice one if you saw it? For example, my posting on the "Ask HN: Who is hiring? (January 2018)" thread is this:

https://news.ycombinator.com/item?id=16057016

Note that I describe the sorts of skills we seek. (you don't need to have them all) The word "security" doesn't appear because that isn't too interesting or useful. Lots of good people come from an embedded RTOS background. Somebody who just runs a port scanner would not have the right skills.

Second of all, are you looking in the right places, online or physically? On reddit, try /r/netsec or /r/reverseengineering or similar. Be willing to consider the southeastern states.

Making yourself look good to hire is mainly about showing that you have the skills. We hired somebody who had a great story about hacking an overly-fancy parking meter to run code from the tokens. We hired another person who got invited to talk at a conference about hacking a router. Solving some of the DEFCON CTF challenges would look good; they are considered difficult. Contributing to a project like Wine or Qemu or MAME would look good, particularly if you deal with something undocumented.

> Mainly asking because I see statements like the above regarding the shortage of security talent all the time, yet I can't find a lot of guidance either for exactly how one can get started in this field.

Ask HN: How can I learn computer security?

https://news.ycombinator.com/item?id=15986100

My own experience here - I am based in London. There is a huge talent shortage and huge skill gap. So not only there are not enough people to cover every single role out there but there is also lack of skill and solid understandings of security and technology in general. Of course, there are plenty of smart people in this industry but this number is small compared to the demand.

If you are serious about security try to get a job in a security consultancy that does penetration testing, APT and that sort of stuff. They often hire people at a junior level too and build them up. I've seen quite a few people progressing from basic level to advanced using this approach.

Apart from HN "Who's Hiring" post I can also recommend the quarterly hiring threads on r/netsec: https://www.reddit.com/r/netsec/

maybe they had some more radical project, and this was the only commercializable thing to come out of it?

Not everything has to look "sexy". If it will reduce time to detect computer infections from months to days, like they're implying, it may be a big thing.

Mike Wiacek was the manager of the Google team that worked on APT and nation state attacks in the wake of Aurora. Think of the Gmail notices about state-sponsored attacks on your account, which required new detection tools and technologies. I doubt you'll find many groups with the same experience and expertise.

Apart from this, it's also strange that:

1) It's not a part of core enterprise GSuite / GCP offerings.

2) It's announced on Medium, and not on usual Alphabet channels.

It’s possible that they launched without doing any market research or competitive analysis but doesn’t it seem more likely that the minimal information available now isn’t the sum total of what they’re planning?

Does Elasticbeam only do API security? Because there's a lot more to security than API security.

If you're in a large enterprise you can easily be generating hundreds of thousands of events per second (both in terms of network actions and system events) and you need something to make that manageable and able to generate alerts so that your Incident Response team can respond to actual problems.

No idea really, since all the articles about Chronicle are really vague, but it reads more like a Threat Intelligence Platform + a Threat Analytics Platform.

That’s like saying it was a fad to “apply software to your existing business” or “move business you already have to the web”.

Sure, that was in vogue at times and some people wasted a lot of money but that over-summarization doesn’t give you an accurate understanding of what actually happened.

Google loves protection rackets. "It's too bad your competitor down the road is buying your trademarked business name in AdWords, so now all your idiot customers are driving to his business because their phone told them to. All you really have to do to fix this is bid more for your name than he's bidding, every day from now on."

> Wouldn't selling protection from unknown threats IRL classify as something neither ethical nor legal?...

Hiring private security or bodyguards is not considered unethical or illegal. Installing alarm systems is not unethical. Am I misunderstanding this?

Google already sells consulting to cloud customers, this seems perfectly natural and I'm not sure how you avoid it.

> "It seems like you have some security issues, it's great that I have this friend who can fix them for you before you get hacked" Isn't that some sort of conflict of interest for any other industry?

Quite the opposite, that's how most consulting & professional service companies do business.

Cloud services & security consulting are complimentary.

Conflict of interest would be if Google was doing the hacking and the securing.