OTC CatchUp #269 Summary

When competing for projects, consulting firms (including Big 4 companies) showcase their team’s credentials.

Companies highlight how many OSCP-certified or CEH-certified professionals they have to demonstrate expertise to potential clients.

This portfolio of certifications helps firms win projects, which is why companies are often willing to pay for employee certifications.

For coding positions, companies typically give coding tasks (like LeetCode problems) where they can observe thought process, methodology, and coding skills directly.

In cybersecurity, the interview process is more complex due to multiple sub-domains (Vulnerability Assessment and Penetration Testing (VAPT), Governance, Risk, and Compliance (GRC), Threat Detection Engineering, etc.).

For VAPT roles, setting up vulnerable infrastructure for technical interviews requires significant maintenance and management overhead.

For GRC roles, there’s often no technical component to assess, making it harder to evaluate candidates.

For specialized roles like Threat Detection Engineering, setting up interview infrastructure would be prohibitively expensive and complex.

The hiring process should start with resume-based analysis of 6-7 candidates, followed by interviews.

If multiple candidates perform equally well, certifications can serve as a differentiator.