An effective interview includes 🕘 for the applicant to ask questions.
A few to consider if you're interviewing: 1. What are the big problems you're solving this year? 2. One year from now this person has been successful. What did they do?
3. Conversely, six months from now it didn't work out. What happened? 4. How do you measure performance? What's the cadence? 5. What's the typical tenure for this role? 6. Is the team growing or is this hire a backfill? If backfill: can you talk about the employee's new role?
7. Will we have weekly 1:1s. If so, what's a typical agenda? 8. How many direct reports do you have? 9. What's a typical day look like?
If you're unclear on the traits and skills the hiring manager is seeking, ask!
"What are the traits and skills you're seeking for this role?"
Also, with interview panels it's easy to lose sight of who you'll report into. Don't lose sight of this!
You may love the team but your (potential) new manager will be a big part of your employee experience.
Learn their background, experience, how they think about management.
Positive signs:
- Great interview experience. It was a conversation not an interrogation!
- Crisp mission/vision/goals
- Heard the phrase "servant leader"
- Weekly 1:1s. "It's your time!"
- Quarterly performance reviews
- Clear understanding of skills/traits they're seeking
Warning signs:
- Interview experience was bad. More interrogation than conversation.
- No 🕘 for you to ask questions
- Unclear on the skills/traits they're seeking
- A ton of turnover
- You don't hear the terms "coaching, delegation, feedback"
- Cryptic on performance mgmt
An effective interview process is likely to address all of these questions in great details without you needing to probe.
If for someone reason they're not, ask!
And watch out for the warning signs.
Hiring is the most important thing we do as managers.
The care/attention to the hiring process can be a proxy towards understanding how a manager takes care of the team.
Was it an interrogation or conversation?
Were they transparent?
Were your expectations managed?
🤔
• • •
Missing some Tweet in this thread? You can try to
force a refresh
1. ISO 2859-1 (#AQL) to determine sample size 2. #Python#Jupyter notebook to perform random selection 3. Check sheet to spot defects 4. Process runs every 24 hrs 5. (Digestible) #Metrics to improve
How'd we get there? Story in /thread
I'll break the thread down into four key points:
1. What we're solving for 2. Guiding principles 3. Our (current) solution 4. Quick recap
My goal is to share what's working for us and how we get there. But I'd love to hear from others. What's working for you?
What we're solving for: All work is high quality, not just incidents.
On a typical day in our #SOC we'll:
- Process Ms of alerts w/ detection engine
- Send 100s to analysts for human judgement
Those 100s of alerts result in:
- Tens of investigations
- Handful of incidents
Highlights from chasing an attacker in #AWS this week:
Initial lead: custom alert using #CloudTrail
- SSH keygen from weird source
IP enrichment helped
Historical context for IAM user, "this isn't normal" #GuardDuty was not initial lead
- Did have LOW sev high vol alerts
Attacker tradecraft:
- Made ingress rules on sec groups that allowed any access to anything in VPC
- Interesting API calls: > 300 AuthorizeSecurityGroupIngress calls
- Spun up new ec2 instance likely to persist
- Mostly recon - "What policy permissions does this IAM user have?"
Investigations:
Orchestration was super helpful. We bring our own.
For any AWS alert we auto acquire:
- Interesting API calls (anything that isn't Get*, List*, Describe*)
- List of assumed roles (+ failures)
- AWS services touched user user/role
- Gave us answers, fast