|
CloFan posted:I did infosec at a small-ish community bank for a couple of years. I enjoyed it, but it was pretty stressful at times. Annual audits / examinations are the norm. Because it was a small institution, I did a lot of other things like web banking admin, ACH tier 3 support, fraud analytics, debit card admin, etc. I was in charge of a team of 3 over Fraud, Security, and Web operations. Yeah, audits are a good point and I could see that getting rough. The position I'm looking at wouldn't be the head of security though, so at least I wouldn't have everything solely on my shoulders. Thanks for the post, very informative.
|
#
?
Nov 21, 2015 19:55
|
|
|
|
| # ? May 9, 2024 16:55 |
|
|
For the record, virtually all of my infosec experience has been MSSP, so I'm used to fast-paced, stressful day to day stuff. Like frontline break/fix and management for corporate security infrastructure, incident response, etc. Strict SLAs, intense on-call expectations, that sort of thing. I've also helped provide information for audits, so I know how that goes. Anything I go to will likely be a little more chill than a lot of my work in the past. I basically just don't want to run myself completely ragged.
|
|
#
?
Nov 21, 2015 20:01
|
|
|
Dreyvas posted:Anyone work or have worked IT in a bank? I'm looking at a possible security analyst position. Wonder if it'd be chill. Prepare for semi-annual (or quarterly) audits, depending on the charter. The entire company won't have much of an idea of what you "do", other than "make work harder for the rest of us with your rules and your policies". Your potential employer seems forward-thinking enough to get an analyst on-board. Prepare for questions and complaints revolving around other institutions or regulatory groups that require secure documents via insecure means, or for whom security is space-magic. "Encrypto-what? Look, just print our the account numbers and I'll take it from there."
|
|
#
?
Nov 21, 2015 20:09
|
|
|
I'm in a decent sized credit union, one of the largest in my state. We actually have a really good budget for IT because they understand how much it means to the end user experience. This means I work with blade servers, sans, ha firewalls, multiple routers, stacks of switches, all with active support contacts and purchased within the last 6 years. Having equipment reach end of support means we buy all new replacement stuff no matter the cost. The downside is that it's so loving slow. I handle maybe 3 phone calls a week if I'm 'busy'. Especially for security, changes are very rare and most changes are rejected due to stringent policies. Be prepared to be bored for long periods of time.
|
|
#
?
Nov 21, 2015 20:12
|
|
|
poo poo, I'd rather be bored for long periods if I'm allowed to keep myself busy.
|
|
#
?
Nov 21, 2015 21:03
|
|
|
Dreyvas posted:Anyone work or have worked IT in a bank? I'm looking at a possible security analyst position. Wonder if it'd be chill.
|
|
#
?
Nov 22, 2015 23:29
|
|
|
adorai posted:Suzie Teller failing a penetration test. 
|
|
#
?
Nov 23, 2015 01:24
|
|
|
Dreyvas posted:Anyone work or have worked IT in a bank? I'm looking at a possible security analyst position. Wonder if it'd be chill. Yes. I worked in the global security department for an international bank prior to my current job. Security analyst can be many things. Anything from working in a SOC and watching and reacting to blinky lights to actually doing gap analysis, incident response, post mortems and internal security assessments. One big thing I'd ask about, is how autonomous the security department is from IT. Where I worked we had basically our own security silos with a direct management line to the Chief Info Sec Officer (who in turn reported to the CEO and had a dotted line to the CTO). It makes a huge difference with security compliance.
|
|
#
?
Nov 23, 2015 01:50
|
|
|
adorai posted:be prepared to be held accountable for Suzie Teller failing a penetration test. Hate that poo poo. Auditors will go to branches under the guise of a customer and hand tellers an infected USB drive, claiming it has some important document or somesuch. We've got USB access disabled by GPO and through our endpoint control software, so they call into the helpdesk complaining that their USB ports don't work.  "I need this USB drive to work." "USB drives aren't allowed." "A customer gave it to me." "What... NO. Remove the drive and hand it back. It could have a virus." "I don't care, he says it has an important document."Meanwhile the auditor is laughing and taking notes. It's a finding every year. At least the tellers are on zero clients so it's not bootable.
|
|
#
?
Nov 23, 2015 02:07
|
|
|
I figured after six months give or take it was time for an update. I was here posting six months ago as I was stuck in a very toxic position within a company that I had been working with for near a decade. I slept very little, I ate very little and I worked incredibly stupid hours. I put everything the company and its management was going through on my shoulders and made it my problem which put me under a great deal of stress. This continued despite threats and verbal abuse from the owner designed to ensure I would not leave the business without them allowing me to do so. I posted in this thread because at the time the job had taken an incredible toll on my physical and mental health. It had changed who I was as a person, I had no happiness in my life and I lived only to work. I no longer had a social life, it was taking a toll on my relationships, I had become in essence the stereotypical burned out IT guy. I stayed on despite the consequences because I cared for my coworkers and for the work I had done over the proceeding ten years. The toll it took on my own health seemed reasonable provided I was able to ensure my staff and coworkers did not suffer the same. I received much advice from this thread at the time, some of it calm and reasoned and some less so but it was all helpful. The basic gist was to get out of the well and stop digging which I resisted for some time believing that by doing so I was letting others down but in the end I managed to push myself across the line and leave. First thing I did was to deal with my health on which front I was apparently very lucky I decided to deal with it when I did. I had a massive ulcer which is currently still being treated at this time (almost healed!), I feel much better for it. Along with the ulcer and this is the front that I was lucky on, they removed a number of growths from me internally that had very bad cells in them apparently. Had I not come in when I did the outcome may well have been a lot different apparently. I was told I should consider myself very lucky that we caught it as early as we did. I will need to have two yearly scans now to make sure that what they were freaking out about does not return. Its been an interesting six months since, I have yet to return to work as I had saved more then enough money to take an extended break and I did so seeing as I had not had holidays in years. My doctors were all stressing that it was very important that I focus on trying to relax and calm myself while I healed. Apparently my insides looked like a "warzone" inside and no twenty seven year old should apparently look like that. Three months after leaving I was still still helping this company, no matter what I did I was obessed with the work being performed at a level I considered acceptable despite not being paid and no longer being there. I truely felt as though everything that remained was my fault or responsability and as such felt compelled to continue helping them. This along with issues I had been having at home for a long time flicked a lightbulb for my pysch and he started taking a different path in our meetings. I had held many behaviours for quite some time that I viewed as normal and I viewed those who did not engage in the same behaviours as lazy or incompetent. For reference even outside of my ability to never switch off work, to continually think my work was never good enough, to spend all my time trying to reach this idea of "perfection." I also had serious issues at home as well that had been long wearing me down. I could not stop tearing apart the house and reorganising it to "get a more efficient layout", I could not stop spending hours moving my monitor in single degrees up, down, left andright because "its not level", my three page house cleaning excel spreadsheet organised into five minute blocks for every last duty needing to be peformed, spending every spare moment I had cleaning because I would spot a single piece of dust on a cupboard, never being able to hand over money without counting it again and again and again despite knowing how much I had in my hands and so on. The worst came after I spent twelve hours a day for almost two weeks straight taking the same measurements in a room over and over again, even after writing them down because my brain kept telling me I had done something wrong and to take it again, I ended up in tears at the end of the stretch wondering if I had gone insane somehow because I could not break any of these behaviours no matter how much I tried. Everything I did felt like a life and death scenario and I felt inadequate for being able to keep up either in business or in life and I took it as confirmation that I am and always would be a fuckup. I had no idea how everyone else managed on a daily basis with this much stress. Turns out I have genuine OCD. Something I would have never seriously considered and had in fact snapped at people for "jokingly" having suggested in the past. Despite my denial of the diagnosis intially and the complications it caused I have now been medicated and engaged in CBT therapy for it for about three months and I am doing much better then I had been for a very long time. It is not cured by any stretch of the imagination but I have ways of coping now and just understanding the thoughts and behaviours that go through my head has gone a long way in helping me deal with everything. Its still very hard for me to break out of obessive behaviours and its difficult at times to try and laugh at the compulsive thoughts that enter my mind but I am in a much better place then when I thought I was simply going insane and would never recover. At the very least since undergoing both treatment methods I was able to stop performing free work for a company that did not deserve it, it was very difficult for me to stop but I did it. I am attempting to return to the work force now, I have gone for only one interview where despite being a fit technically I was told that I was unsuitable due to be "too nervous" and to be fair to them they were right, I was very nervous. They say nervous, I say that I simply lacked the confidence to really push myself because I always doubt my ability. At any rate while I look for work I have turned my focus instead to getting up to date with RHCE7 (At the time of my leaving most of what we had was still 5/6) and spending a lot of time playing with puppet. It keeps me busy and should ensure I have no real problems going back to work. Hopefully I should return to work again soon. TL;DR ====== Toxic job, would not leave. Was sick. Goons yelled at me, I left, find out I have have OCD but am learning to manage it, life is getting better, A+ would leave again. I must thank all of those who gave me advice, even those who gave it quite harshly. It was the push I needed to get my poo poo sorted and I hate to think of where I would be now had I remained in my goon well digging deeper and deeper. I hope to work for a company again soon where I can flex my strengths without ending up in the same position.
|
|
#
?
Nov 23, 2015 02:17
|
|
|
Lord Dudeguy posted:
However it should be considered a perfectly reasonable request, it is frankly white knighting a terrible OS.
|
|
#
?
Nov 23, 2015 02:48
|
|
|
Lord Dudeguy posted:
"And this is why USB drives aren't allowed. Have a good day." *click*
|
|
#
?
Nov 23, 2015 02:50
|
|
|
insidius posted:Goon got himself out the well. Grats. Now, go gently caress bitches, get paid.
|
|
#
?
Nov 23, 2015 02:52
|
|
|
Lord Dudeguy posted:Hate that poo poo. Auditors will go to branches under the guise of a customer and hand tellers an infected USB drive, claiming it has some important document or somesuch. I guess it depends on the standards, but that sounds like a success story. Even when an employee follows procedure so poorly that he or she is actively attempting to subvert security policy, no breach can occur. I think if I was auditing security, I'd be curious to see what would happen if she was able to badger a technician into making an exception. Who gets email alerts etc.
|
|
#
?
Nov 23, 2015 03:37
|
|
|
People are always the weakest link in security; social engineering is painfully easy and is a never-ending bulletpoint on an audit.
|
|
#
?
Nov 23, 2015 05:13
|
|
|
CloFan posted:People are always the weakest link in security; social engineering is painfully easy and is a never-ending bulletpoint on an audit. In a lot of cases you do not even need to expose these people to social engineering. I was put in charge of a team at one point of guys providing "3rd level support" I guess you could call it for Linux machines. One of the first things I asked them to do was just go about their day as they normally would so I could watch how they worked just to get a feel for how they went about their business. Every single one of them was operating purely on pasting long rear end terminal commands they had found on the internet. When I asked if they knew what even a single one of the commands was in what they had copy and pasted the answer from all of them was "Nah, but we always do this so I think its alright." Now to be fair they did not break anything on that exact day but the thought that people would just blindly apply fixes or tweaks to a system with no actual idea of what it was doing because some guy on the internet "said so" scared the hell out of me. Worse still was when I tried to explain why it was a concern and was asked in return if I had "become one of the pencil pushers". Some people just do not understand the consequences such actions can have, they do not think that far ahead.
|
|
#
?
Nov 23, 2015 05:45
|
|
|
insidius posted:"3rd level support" 
|
|
#
?
Nov 23, 2015 06:06
|
|
|
CloFan posted:People are always the weakest link in security; social engineering is painfully easy and is a never-ending bulletpoint on an audit. Yep. I like to look at it as job security, but I haven't worked with end users in years, fortunately.
|
|
#
?
Nov 23, 2015 06:47
|
|
|
poo poo dude. Glad you're getting the help you need and are back on track. Good luck.
|
|
#
?
Nov 23, 2015 12:19
|
|
|
I've been dealing with obsessive-compulsive traits (not full-blown OCD) since I was a kid. It kind of co-presents as ADHD, depending on what the situation is. It sucks, but once you become aware of how it shows up in certain situations, it becomes a lot easier to get a handle on. Glad to hear you're getting the help you need and you're feeling and doing better for it!
|
|
#
?
Nov 23, 2015 14:33
|
|
|
insidius posted:I figured after six months give or take it was time for an update. 
|
|
#
?
Nov 23, 2015 16:38
|
|
|
Day one of being the only IT staff in this company save for the IT manager who does more business stuff than IT stuff these days. Sure is a lot busier.
|
|
#
?
Nov 23, 2015 17:30
|
|
|
Can you come look at my computer. It's slow.
|
|
#
?
Nov 23, 2015 17:31
|
|
|
Dick Trauma posted:Can you come look at my computer. It's slow. Just got asked by someone to install GoToMyPC on their laptop when they don't have anything but the laptop.
|
|
#
?
Nov 23, 2015 17:36
|
|
|
Dreyvas posted:Anyone work or have worked IT in a bank? I'm looking at a possible security analyst position. Wonder if it'd be chill. I'm in this exact position at a Credit Union in Canada. So I can't speak to the American side of things, but here's my take. We do a lot of fraud management, RSA Adaptive Authentication is our big tool right now. It tracks e-transfers and bill payments and we monitor anything that meets 'potential fraud' criteria - out of province transfers, logins from new devices, multiple failed challenge questions, that sort of thing. We do the usual IDS stuff too, firewall logging, security analytics. Lots and lots of going over logs, every day. It can be kind of boring. I deal with our PKI, managing IPSec, user access, wireless access through RADIUS, unblocking websites. There's a lot of SQL right now for reports. The big push this coming year(s) is going to be PCI compliance. Which is going to be ...interesting. The worst part of my job is dealing with the Board of Directors, since they somehow got dropped on us for support. They have secure access to sharepoint through a separate VPN that's certificate authenticated and that's just a nightmare. Trying to explain certificate authentication to an 83 year old woman that doesn't understand the difference between right and left click and makes more in one meeting than you do in a year is something I wouldn't wish on anyone.
|
|
#
?
Nov 23, 2015 17:52
|
|
|
Kashuno posted:Just got asked by someone to install GoToMyPC on their laptop when they don't have anything but the laptop. I just wanna go to my PC man, why does IT always have to be loving me over 
|
|
#
?
Nov 23, 2015 18:21
|
|
|
So a local business wants me to help out with some projects as a consultant. Most of the time I do stuff like this it's quick, under the table type deals where the conversation starts of as "I'll give you $X to help out with this." As for this one, I have no idea how to price myself. Anyone have any pointers on the sort of things to consider when coming up with a number?
|
|
#
?
Nov 23, 2015 20:34
|
|
|
Orcs and Ostriches posted:So a local business wants me to help out with some projects as a consultant. Most of the time I do stuff like this it's quick, under the table type deals where the conversation starts of as "I'll give you $X to help out with this." As for this one, I have no idea how to price myself. Anyone have any pointers on the sort of things to consider when coming up with a number? Bidding piecemeal will gently caress you usually, don't bid an entire project. Bid part as static with a certain number of hours attached, like, 80 hours for $6,000 (this number is usually going rate in your area, complexity of the project, etc) and then hours over initial estimate billed at $100/hr If you finish under the bulk, good for you, extra time. If you don't, good for you, extra money.
|
|
#
?
Nov 23, 2015 20:45
|
|
|
I think people in here say twice your normal hourly rate, for the trouble of dealing with your own taxes and it not being stable work. E: I have never been in that position, though.
|
|
#
?
Nov 23, 2015 20:46
|
|
|
Orcs and Ostriches posted:So a local business wants me to help out with some projects as a consultant. Most of the time I do stuff like this it's quick, under the table type deals where the conversation starts of as "I'll give you $X to help out with this." As for this one, I have no idea how to price myself. Anyone have any pointers on the sort of things to consider when coming up with a number? I've been making this transition myself recently. First off you are going to have charge more than you are used to due to taxes. At least increase your pricing by 1/3. Secondly you'll want to draw up some sort of written agreement on the scope and timeline of your work. Third decide how you want to charge, hourly, on a monthly retainer for x hours, piecemeal by job, however you want to do it. Then just make sure you do a good job keeping track of your expenses and invoices for tax time.
|
|
#
?
Nov 23, 2015 20:49
|
|
|
Hey guys, I need some advice. I work for a large company in the UK, and until eighteen months ago I was just doing your average admin work and had no IT experience at all (formal experience, I mean; I am 'good with computers'  ). Then, the company rolled out two million pounds' worth of Windows laptops to its field agents and grabbed a few people off admin for what they thought would be a temporary role. Six months later, I had done the entire admin process for the pilot scheme all on my lonesome to simulate how it would all eventually work once rolled out and automated, spent several months on a testing team to get the software ready for roll-out and to make sure it all plugged into various other bits of software and online services we use, and set up the user profiles on a thousand laptops and shipped the lot out inside of a month.Since then, for the past year I have been basically the sole guy in a multi-million pound company keeping the supply of laptops rolling for a thousand users - processing returns, troubleshooting and recovering busted units (as far as we can without sending them for repairs, but we've gotten better and better at working out solutions for ourselves), profiling replacement units and shipping them out, prepping batches of new tablets for trainees, tracking users, builds, shipping consignments, etc. All kinds of good stuff like that. I have a garage full of laptops, minimal oversight from management and an admin password that I absolutely shouldn't have and everyone quietly ignores me having. Truly, I am king of the medium sized room that I occupy. Now that it's approaching Christmas and starting to quiet down at work, I've been able to take stock and have noted that despite all this, I have no formal training or qualifications in anything particularly useful (I don't think a media degree counts for much, or indeed anything), do not have any career prospects to speak of and am still on godawful admin pay (I'm still classed as sales support staff, despite no-one having any expectations any more that I ever actually do any). I should probably do something about this, and I reckon you guys would be the best to give me an idea of what I might want to be doing next; it strikes me that I've fallen into some useful experience that I could make something good out of but have no idea what to do with it.
|
|
#
?
Nov 24, 2015 00:51
|
|
|
You need to get your line manager to clear an hour of their time and talk about this with them. Give yourself a couple of evenings or a weekend to think about what you want the outcome of that meeting to be, and then put it in terms of the added value to the business of you getting those things.
|
|
#
?
Nov 24, 2015 00:56
|
|
|
Vulture Culture posted:I've been dealing with obsessive-compulsive traits (not full-blown OCD) since I was a kid. It kind of co-presents as ADHD, depending on what the situation is. It sucks, but once you become aware of how it shows up in certain situations, it becomes a lot easier to get a handle on. Glad to hear you're getting the help you need and you're feeling and doing better for it! Yeah the pysch thinks that is half the issue, the ADHD treatment going back to childhood largely overshadowed the OCD and given that I liked to clamp up regarding my problems it remained hidden despite the warning signs that were there. In the end the only reason it was recognised is because after three months of having left my position I ended up in my pyschs office in tears because I could not stop working and it went from there. If I had not posted in this thread I would have convinced myself yet again that it was my duty to stay at that company and not leave until they were in a healthy position because that is what I did time after time again. I always ended up believing the companies position was due to me not having worked hard enough and if I just worked harder and learned more technologies at an expert level the company would recover. The swift kick in the rear end I received here made me realise that if I did not pull the trigger now I would be resigning myself to repeating the same actions that had landed me here in the first place. I would have let my health and personal relationships continue to decline while I worked harder and harder in search of something that was impossible to achieve, aka I would have really hosed up. I was so messed up back when I was posting here that outside of posting to this thread I spent most of my time in despair and randomly bursting into tears. I would wake up everyday and my only thought would be "I cant do this for another 30, 20 or even 10 years, I cant take this anymore I can understand why I am supposed to want to keep living, I cant do this forever". Of course I kept these things largely to myself so that again, no one thought I was insane. I stayed away from this thread and SA for a long time because it has been difficult somewhat dealing with this without impacting on others while I learn to deal with it correctly and I did not want to be one of those internet people with a mental illness who lets it define who they are. I did however appreciate all the advice at the time, even that which was given in a somewhat harsher tone then I may have been used too. Its hard for me to post without ranting, I do apologise.
|
|
#
?
Nov 24, 2015 01:28
|
|
|
We all thought you'd left the thread because a lawyer advised you to shut up and you were to busy sipping Piña coladas on the beach. This is an okay thread to talk about life in IT, you're probably not the only person in your situation, there are a LOT of lurkers and who knows who you're helping by being open about your struggles?
|
|
#
?
Nov 24, 2015 02:25
|
|
|
insidius posted:Yeah the pysch thinks that is half the issue, the ADHD treatment going back to childhood largely overshadowed the OCD and given that I liked to clamp up regarding my problems it remained hidden despite the warning signs that were there. Dude, you are forgetting the firs rule of Awful Club. 
|
|
#
?
Nov 24, 2015 02:26
|
|
|
Dr. Arbitrary posted:We all thought you'd left the thread because a lawyer advised you to shut up and you were to busy sipping Piña coladas on the beach. Yeah that was the hope at the time, to be fair I thought I was done for and would never recover and just sort of hoped to stop others going down that path before it reaches that point. Other than providing a roof over your head and a means to provide for you and your family a job should never be allowed to gain such control over your life that it becomes your everything at the detriment of the rest of your life. I have been speaking to people who escaped at the same time as I did and they have been saying that they work with people like us now that also came from hosting who seem just as messed up, they come in after hiring with an almost strange sort of "IT Shellshock" that ends up wearing off when they realise they are no longer in the kind of environment that they were and that there are better jobs out there that will not attempt to work them to death. My old coworker/friend went from working eighteen hour shifts throwing up into a bucket to being forced off his machine at closing time and told to go home. Quite a difference in the whole "work life" balance to what he previously had. It helps to know that workplaces like the one we worked for are the minority, not the majority. There are employers who will value your contributions, pay you accordingly and ensure you have a healthy work/life balance without taking advantage of their employees and promoting that unhealthy balance. If you are working for someone that does not display such qualities it is best not to hang around for too long hoping "it will all get better" and instead leaving while you still have all your marbles and work somewhere both you and your work are respected.
|
|
#
?
Nov 24, 2015 02:39
|
|
|
I was in your position one time. Tiny company, 60 - 80 hour weeks, enormous responsibilities, company going downhill. When the company finally went under I felt a enormous weight lift off of my shoulders. I got a new job within 3 months and now I refuse to work a minute over 40 hours a week. It pains me to see other goons working overtime for free. If you aren't being compensated for your overtime the. DONT WORK OVERTIME.
|
|
#
?
Nov 24, 2015 02:40
|
|
|
It'd be different if you were pulling in 200K a year for your devotion, but I doubt that's the case. If you're doing 80 hour weeks, you should be getting rich, not making wages on par with other people in your field.
|
|
#
?
Nov 24, 2015 02:50
|
|
|
Dr. Arbitrary posted:It'd be different if you were pulling in 200K a year for your devotion, but I doubt that's the case. If you're doing 80 hour weeks, you should be getting rich, not making wages on par with other people in your field. I was 40% below market value, but drat it we were going to build that business!
|
|
#
?
Nov 24, 2015 02:52
|
|
|
|
| # ? May 9, 2024 16:55 |
|
|
Working in academia on the Tuesday before Thanksgiving is nice. Faculty don't come in, which means their support staff don't come in, which means I have ??? to work on. I shall be studying for CCNA basically all day, except for a few annoying Bitlocker issues that have been coming up this morning.
|
|
#
?
Nov 24, 2015 16:12
|
|
