It's Not Me, It's You: How To Be A Better Hiring Manager or Rooting Out Excellent Candidates Despite Themselves

so we're moving on to our next presentation I'm going to introduce summer and Chris from guide point really want to thank guide point for being a continual sponsor here in higher ground I want to apologize publicly to guide point that the wrong presenters are in the brochure the non-technical person not able to handle the conference organizing platform it just wasn't that great for my technical ability so I'm going to let Chris and summer explain who they are and why they're here but they're it's a success story from last year's higher ground so take it away Chris and summer you all hear me okay never again so we have a lot to cover so let's just uh hop to the introduction so

we can get started so as mentioned my name is Chris Maddalena I'm a senior security consultant with guide point security working with you know Red Team assessments pen testings and tool developments and this is my colleague all right I'm Summerlee I'm a senior also senior security consultant for the threat and attack simulation team for guide point security I specialize in mostly social engineering so I do the remote and the on-site red team our social engineering I'm also the I'm pretty much like the success story for hiring grounds for guide points I came here last year I was actually in line to do my tech review for another company and I notice there are shiny things at the booth at the

guide points for you you see the shiny bottle openers they're bottled for nurse by the way but I ended up making my way over there and meeting AJ and when he told he we talked a little bit and I realized like oh this guy is pretty awesome he's in a director level position but he could run circles around me on anything pen testing and so we started talking I then met Victor here who's our manager for my team they took me downstairs gave me two interviews I did my tech interview with Victor and they bought me bourbon at the bar made me feel comfortable I was like alright I like this this company and I

totally just didn't even finish my other interview I just decided to go with guide point and they picked me up what that that Thursday I had to offer letter this is pretty awesome so that's my story basically we're gonna go over during our presentation we're gonna have a little different format Chris here is gonna go over the universe interviewers point of view I'm gonna go over the interviewees point of view through these talking points so I'll hand it back over to Chris yeah and I actually had a similar experience this summer last year here at besides Las Vegas I came in a little bit early for Def Con and ended up being brought in by a co-worker of

mine now at the time just a friend you have been as him as been he even introduced me to AJ via email and we got talking at the at kind of a you know after-hours happy hour you know here at Def Con Vizslas Las Vegas and she had talking to him like summer said you know able to kind of run circles around us you know technically there's a really good conversation he introduced me to one of our other managing consultants at Donahoe we talked for awhile you know and after a while you know that's 20 minute talk turned into you know we're talking about a couple hours and you know we kind of continued that

afterwards and ended up moving over to guy point you know within about a month after that so you know definitely you know a great team that we have as kind of in our experience of ones once we got talking to people and we were made comfortable and you know got discuss some of the opportunities it was it was an easy transition though as there we go yeah oh that's fine so you have a meeting in a few do I you have a presentation that's gonna go on right now we were disconnected from this document yeah I know there we go so that summer I mentioned you know I'm gonna talk a little bit about kind of for the hiring

manager side and then we'll we'll switch over to summer to talk about the interviewee and one of the things that's you know important for us when we're hiring someone is we want to make sure that the jobs that we're talking about that we're putting out there are well defined and we don't have any kind of nonsense in there and one of the things we often see made fun with in this industry are things like asking for a for what really once you dig into it it's basic financial level job or saying that you want 10 years experience or five years of experience of something this really only been around for a couple years so we want to make sure

that we while the interviewee as they're coming in that they're actually interested in the job that they actually want to apply for it because they understand it very well they know exactly that job is going to entail the jobs misprint is accurate and it's asking for reasonable things and one of the key things they're just making sure that whoever is writing that Job Description understands the rule very very well a can be HR it can be whoever normally does that as long as they understand the job oftentimes you know we have people get involved from those departments actually say you know here's really what we need here's what we're looking for and they help define that

role before we we put it out there all right I'm from the interviewees perspective you want to focus on the the description that they added are the the tools that they added in their description highlight that and if you you haven't worked with those tools spin up a lab try it out and then during your interview talk about the tools that are familiar that you have used that are similar to what they're currently using and also talk about the research that you have done now I can give you a little backstory to that when I was interviewing with guide point before then I had made a road change and so I went from being a pen tester to a full

full social engineer so I was just calling people on the phone my technical skills then got put on hold this kind lacking in that area by that point and so I actually went in did some research I had my labs run up and so during my interview I let them know that hey I'm a little lacking on the technical skills right now but these are the things that I'm doing and that kind of and and we went through like the projects that I'm working on the research projects are working on things I'm building and that kind of helped me through the interview another thing too that I I wanted to bring up was also small as he speak

because a lot of times I've interviewed people before when I was in a management position and they'd just be sitting there and talking to me and they just got you know that very sad look on their face or very nervous and so on but if you smile then it sounds better coming across also if you're doing it over the phone remember to smile then so go ahead Chris so the other important thing is making sure you pick a location where you know your interview is going to be comfortable so kind of like in our stories early on you know we kind of walked into it we were meeting face to face and so there was kind of comes some

impromptu interviews there at least kind of you need to know each other in a comfortable location yeah we were kind of just here you know kind of having some drinks hanging out both sides being very comfortable able to you know read body language face to face and you know that can be very important a lot of people just default to using the phone but if you have a local candidate or someone who is local to that candidate who can come up and meet them or you're at a conference something like that where you're in a position to meet with them face to face you know feel free to suggest that to the interviewee and see

what they feel comfortable with because I can really help out you know you can you can see body language no one feels weird if there's you know keep you know we've all been on conference call or someone forgets to you know unmute themselves or they stay muted while they find that I'm ukee so they can respond and when you're the interview we can feel kind of awkward and weird when you say something or maybe try to crack a joke and there's just silence so you know trying to make sure that people are comfortable they understand what they're walking into so try to be considerate you know work with them find out what they're comfortable if they're comfortable phone

they don't want to meet you face-to-face yet go with the phone try to work with them rather than what works best for you now from the interviewee position I've been given the opportunity to pick my location Mike here I said hey let's go meet down by the bar so we can drink and do my tech review right feel comfortable there so when if they give you the option take it don't say oh yeah phone is fine you know you you probably want to meet them in person because that's gonna be your hiring manager most likely and you get a you you're able to read their body language when you ask them questions you can get a better feel for the company

because you're also in a way interviewing them as well as do I really want to work for this company so take the opportunity suggest your local hackerspace so I put that picture up there it's up there yeah okay so I take this sure of course you want to try to arrange a good interview so once you get the location and trying to message what the interview is gonna be like to the interviewee we definitely want to involve the team when we're interviewing someone so you know because like summer said you're kind of the interview he's kind of interviewing you to see if they're gonna be a good fit they like your company and it goes both ways so

involve the team because that's positive they're going to be working with involve some people from that department that team whatever it might be if they're available have them come in with their own questions so they can talk and and chitchat allow that time for them to kind of feel each other out both the interviewee and the team there might be working with because in the end if there's not a good fit there or you know there's not much chemistry of the interviewee you might you know be able to pick up on that and maybe they walk away or they really like the team and that can actually kind of energize them to interact more with the team and you

get more out of them you have a better interview and everyone's happy and more comfortable at the end so also when you're in when you're involving the team be prepared for both the team and the hiring manager if it's you what have you know everyone on that call or you know coming to that bar wherever you're gonna have the interview be prepared to answer some questions that might come up like questions about the team you know as the team was the team downsized recently is that why there's now openings with someone fired what something promoted are you expanding so you have more positions because all that really plays into from the interviewees side of depending in they want the job because

if you just fired someone they're gonna come in why were they fired why did they leave if they left for the unhappy or if they were promote it cools there's promotion opportunities if you're growing even better because that means there might be you know more positions opening up they're getting into you know something that will be bigger and cooler you know a year down the road okay for this like I've kind of when I do interviews I exercise my social engineer skills and so here you want to do some background research on the company I'm going to look at their core values because that's very important for a company I've realized as I've grown throughout my career you want

to maybe look up their LinkedIn profile for your interviewers if they give you the names that you're interviewing interviewing with go ahead and look them up look up the research that they've done in the past blogs that they posted and so on so that I'll give you some something to talk to the interviewer about and if you can talk about something that they're interested in then that helps you build rapport and it'll make you feel comfortable as well as you're going through the interview also when you're interviewing with the team it's good to have questions about how they like working for the company I usually like to ask like what kind of snacks does the company provide I don't

know I like doing that so I can see what their reaction is like what kind of personalities they have because you're really going to be working with these guys especially in our industry in very close-knit groups and you want to be able to you enjoy working with them like a with guide point we talk to each other even off hours and we hang out with each other so it's it's a great cohesion so you want to look for something like that asks questions about the company and look up their core values that's really important for a guide point when I looked at their core values I really liked that they had no jerks right off

the bat and that was something that was really important to me especially in our industry you don't want to work with somebody a whole bunch of people who are they don't have their ego check per se and you're not gonna learn from them because they're going to keep their knowledge in their own little their own little box there and not share it with you so if you're looking to grow with somebody look for that go ahead the next point I think is at least at least for me is one of the most important of you know how to carry on a good interview as the hiring manager is making sure you manage and kind of keep in check your first

impressions of the candidate sometimes you can talk to people and they're they're very anxious maybe they're really excited about the job but they don't want to screw up or you know you just tripped him up on a question that they they had on the tip of their tongue and they've become really flustered or maybe they're just kind of awkward and they're not you know super used to talking to you know people a lot for for long periods of time whatever it might be you know try not to be a jerk keep that your first impression in check and keep in the back of your mind what they're actually interviewing for it certainly if someone's easily flustered

or really awkward you know that they have a hard time wording things maybe they aren't the best fit for a client facing or public facing role but if you're interviewing someone for like a technical kind of back office role or something where they're not gonna have to talk to people a lot you know other than outside of their team then you know the fact they're getting flustered or you know are being acting a little bit awkward doesn't really matter or if you are looking at a role that maybe they're not super you know a super good fit for in that way but you have other roles open that they wouldn't have to you know talk to people or and that wouldn't

become a problem keep those in the back of your mind so that later on you might suggest them if you decide not to go with them for the position they apply for there might be a similar position where just slightly different that they would be a good fit for and this is something we just we really try to do with our interviews and I really really like just making sure that you're not judging them too harshly on soft skills you hear that a lot with interviews you know recommendations for the interviewee work on your soft skills work on your soft skills you know practice practice practice but you know even some of the you know the people who do a lot of

practice leading up to the interview they talk to themselves in the mirror or whatever works for them they can still maybe fall apart or become flustered at some point one of the things that's you know one of our good tips for interviewing is we actually like having our wiki is if you notice that you know try to pick up on that so like we said don't be a jerk like summer mentioned you know pick up on that be conscientious of okay it looks like we've flustered them let's talk about something else talk about their interests you know some you know some project you saw they worked on on their resume whatever guide them away from

that to get them talking again and then go back to those technical subjects once they're kind of you know back in their zone and comfortable and really we like the last point here you know drives how I'm engaged in that genuine dialogue don't just rattle off a bunch of questions to them and you know expect that's you're both gonna have a good time and they're gonna come away with a good impression of you and the team the company if you just spent 45 minutes throwing questions at them and then you know thank them and hung up you know actually engage them in dialogue so you can judge that fit and they let the team talk to them I know

when I had my my second interview with guide point you know we had that team interview and I think 45 minutes of the one-hour interview was just nothing but me and had him like talking about password cracking and this AJ Victor we're like whatever just let's let's us go with it this is good and and it let them see you know was I can be a good fit for the team or my interests and maybe we just everyone had a good time and we were all pretty pretty happy you know at the end of it remember what first impressions it's also also they're making an impression on you I'm the kind of person that if you rattle off a whole

bunch of questions to me in succession and you don't sound very happy even if I know the answer I'm gonna get flustered just gonna pause get flustered I'm not gonna even if I know the answer I'm not going to be able to get that out and sometimes during interviews well I can say a lot of times there are interviews because I hate talking about myself I'll get flustered so just remember just take a breath it's okay you can still recover it's fine and like in it for an example like to reiterate what Chris had just went over I was with Victor in our tech review and I got a little flustered and he actually started talking about my gaming and so I

was like all right so we started getting into that came back around and then we were good to go at that point and so even if I was like stuck and I kind of looked like that panda up there we recovered we made it through and I'm I'm working for guide points so go ahead Chris don't don't make it feel like you're sitting through an exam yeah and you know when it comes down to it too is if if they're doing that to you and they know that your fluster and they just keep pushing you and pushing you and pushing you me may not want to work for that and that's the room carrying manager future hiring manager you may

not want to work for that company that's kind of a red flag there so go ahead yeah so a little bit in summary these are the guy point core values that that summer mentioned earlier you know when she went and she looked up guy points values these are the ones that we have on our website is the ones that we mean we put out there and you know they really encompass everything we do as a team and you know that the company does as a whole you know just the idea of like taking ownership of things we actually congratulate people we have the kind of a weekly thing where we talk about you know so it was a little nominate the

person who is previously nominated nominate someone for fulfilling these values and you know taking ownership of you know projects you know really running with things making sure that they get completed and not trying to pass the buck on to other people it's something we really value you know and we've kind of mentioned this with the you know belong the interviewee you know that's what we want to do we want to Wow even just internally working with each other trying to be considerate you know not being jerks and just always making sure that we you know kind of rise to the challenge sounds a little bit cheesy but you know if something's going on that we you know are step in we help

each other all of those values are very important to us and something that helps us function as a team so it's not even just so much things that we would like to see it's stuff that we need to actually work well together and we constantly like summer said we know we talk to each other after hours we hang out we play games together but we're constantly you know chattering back and forth during the day you know pretty much we work on the pentesting team you know we're on a pen test we're doing a red team you know there's been you know summer and I worked on red team assessments we're on site somewhere and we think we have a shells and we'd have

to just hit up someone else on our team but can someone just help us out right now we know it's like 7 o'clock at night but we can't get to a laptop right now can someone see if this worked or sick and someone start taking this somewhere and there's usually someone that says yeah you know what I'll do that I'll jump on this project even though it's not mine it's not my responsibility let me help out and we get kind of excited about that and and help each other and you know fulfill these values you have anything good no you pretty much covered it I mean having these core values and it sounds cheesy when you read the core

values but like we actually do operate at this level like everybody really gets along when we're pushing for writing our reports and so on we're always like oh we really want to the client take care of them do our best give them that value add and we like that where we like working for a company and so all these things basically apply on a daily basis for us it's something that's always in my mind as I'm working so can I put you on the spot there sure so you found your job through being here at a con but obviously being at a con it wasn't really about job search it was just being at the con and networking and

stuff so what are the one two things that everyone should think about if they're going to a con and realize I might get a job out of this or I might piss off a future employer what are sort of the things to think about as you're navigating in a con about job search well I mean the last part of settings a future employer I usually go by the daily mantra of one of our core values just don't be a jerk be open to the people that you meet don't feel like oh this person's a newbie doesn't know just be open to everyone that you meet also take advantage of opportunities when they pop up like I said I could have walked away

from the shiny booth there and I wouldn't have been a part of guide point and totally happy with everything everything worked out for me I think networking with other people talking to them like you in Austin we also have like a very small community everybody gets along everybody's nice to each other and everybody takes care of each other that's kind of like our InfoSec community overall don't you think and so I really she ate that higher groundz actually adds a space for us to go out there and actually and and what was actually really funny as you there's the resume writing portion is after this write or resume help write we dishonor Liril do something okay I'm

sorry well anyhow they asked me for my resume I didn't have my resume prepared so I interviewed with them and then I ran over and I was like hey they want my resume can you help me like fix my resume so it's better so they helped me fix my resume ran back over handed it to them so it all worked out so I would say like take advantage of this opportunity guys it's don't pass it up I have a piggyback question on your earlier slide talked about how to prepare for the interview you research you probably don't have that time if you're here so how would you suggest handling not being as familiar with the company before you're

able to sit down and have that conversation not being well I I honestly can't really hold it against you right yeah I honestly like looked up guide point on my phone and looked at their LinkedIn profiles and looked at where where they were where they were I think if you're not prepared at least ask them questions about the company like what are your core values things like that yeah yeah I would I would say similarly when when I went out and I was first talking to like AJ and Edie last year I was asking them questions about just well what do you do and I was I was curious because I was already working in pentesting I was already

doing a lot of the same work that I do now but what caused me to want to switch was I said well you know I was here so well here's what I do now how is this differ from what you do how do you guys do this how do you do that and I really was like like I was liking some of the processes he was describing they were they were sounding you know really I liked their their workflow everything about it we just kind of talking more and more about guide point and it was only later that AJ approached me about the idea of applying for a job or was i interested so by then I already had a

good idea of what kite was and and I would say that you know just I I like to walk around and I know people try to tend away you know from from the vendor boots or things like backs they don't want the sales pitch they want to deal with it I kind of like going up and talk to them and saying you know what uh what do you have going on like you know I'll even act like real like West I was you know I was walking around and one of their one of their people engaged me and we I talking about a conversation he said he actually know what hang on a second he went and grabbed one of his

other guys it was just like walking around he grabbed him and we had a cool 20 minute conversation about you know about you know endpoint protection and things like that there was totally unrelated to the booth I got to know more about like what they do some of that guy's opinions on things and we talked for a bit and it was it was good you know a pretty good time that's what I like to do walking around here so I would say go up this place you have talked to them engage them in conversation and should a job opportunity come out of it maybe you're a bit more prepared or have some ideas you can come up on the spot of questions

to ask and and to kind of go back to the early one mostly just to echo what summer said is yeah I would say when you're going around a conference whether it's you know a larger conference like this or you know a smaller b-sides and local area or just a local security group meet up yeah don't be a jerk it's a really good just a really good value to carry around with you because yeah because I mean if you're if you're doing your best not to like just be a jerk to people and you know you're kind of nice and you just communicate well and if you don't want to talk to someone just you know gracefully leave

what have you you know don't be you know ruffle anyone's feathers and you don't really have to worry about the idea that someone's gonna hate you because they remember you from a conference where you you kicked them off earlier but you know the same wise if you're talking to someone and you realize that's you know I would say keep your own record of who you talk to and what you think of those companies because oftentimes you'll run into those same people it's a small world you can find those people at new companies or things like that and you might have a general idea of oh you talk to them when they were at a previous

company what were they like did you like them is there someone you would like would like to work with or for so just you know being open to the opportunity and and just generally being nice and engaging people on an actual personal level having genuine conversations yeah definitely engage each other especially at these conferences I found that everyone is like open to talk like if you randomly walk up to a person introduce myself and then we'll hit off a conversation it's it's great don't be shy I mean it I know the first time I was kind of intimidated and I was a little afraid to talk to people but as soon as I got up and I started talking

to people I made like relationships that have been years long now where we just communicate on Twitter anytime I need help I know someone can help me I just reach out to them via Twitter or email whatever and they're always happy to to share their knowledge so if you're just entering into the InfoSec community like don't be afraid to like approach people and ask questions and just to add to that to is you know just in general it's almost a little bit off-topic but it is applicable is you know when you're talking to people we go up to introduce and introduce yourself whether you're talking to someone at a booth you know and you have kind of a

start you know a seed of a conversation there because they're ATS you know the guy point we front caribou whatever you can talk to them about that don't don't end up playing conference chit chat bingo where have you seen any cool talks where you you know try to talk to them engage them an actual conversation talking of follow those threads of one of their interests you know what what do they do what do they do for work you know what do they do for their hobbies of the working on equal projects and you might end up with the Alec Somerset like a cool new friend or someone you know at least that you are familiar with you see at conferences you

say hi and hang out have good conversations rather than more you know immaterial connections or you just learn what talks they like to go to or things like that kind of actually make it can actually make a friend yes exactly they have hobbies that aren't sitting at booths I mean any other question that was yeah we kind of do we have any questions for our Chris or summer it's three o'clock and everyone's looking for the the brownies just what that is Curtis summer thank you thank you so much for all of your out