[DEPRECATED] Promotion process, roles and responsibilities #3
Replies: 8 comments 8 replies
-
|
Part of the process should verify that the candidate is already performing at the next level, so we're not only just looking at quantitative data like how many audits they have completed. For example, when going from Intermediate Apprentice to Security Researcher, the candidate could be assessed on things like:
The candidate shouldn't be expected to have all the next level skills. Perhaps the required skills to assess could be categorized as |
Beta Was this translation helpful? Give feedback.
-
|
Excellent point. What would you suggest to assess such skills? |
Beta Was this translation helpful? Give feedback.
-
|
Should Spearbit have some kind of knowledge archive for each of the points in the requirements to allow someone willing to pursue the promotion being able to get the required knowledge? Sometimes it's difficult to find the high-level resources (articles, videos, books, CTFs, example, exercises and so on) to master those skills. |
Beta Was this translation helpful? Give feedback.
-
|
Interesting point. We did consider a knowledge archive. It can definitely be created with the help of the community. |
Beta Was this translation helpful? Give feedback.
-
|
Did anything ever get started for this knowledge archive? |
Beta Was this translation helpful? Give feedback.
-
|
Is the knowledge archive still a thing? |
Beta Was this translation helpful? Give feedback.
-
|
Currently not, but the Armory may become it in the future |
Beta Was this translation helpful? Give feedback.
-
|
LSR role is a crucial one, and it can happen that in an audit there's the need of just one LSR. Would make sense to have a period of 1/2 audit where the SR promoted will be paired with an experienced LSR that can prepare him for the role when eventually he/she will be alone? During this period, the SR would act as a LSR and the LSR paired with him/her would also focus on training him/her. |
Beta Was this translation helpful? Give feedback.
-
|
Agreed. Added. |
Beta Was this translation helpful? Give feedback.
-
|
I got to say I kind of like it. It is a bit long and in some cases very descriptive when in other cases a bit concise, but still it is quite thorough and transparent. So far the only comprehensive list I was aware of was https://github.com/razzorsec/AuditorsRoadmap and now both can complement each other. Referring to those concise skills items, I also do kind of agree with some comments on discord(forum) that some areas are very wide (e.g. Web2 Security), listed in a generic way and it can take like months to acquire those skills, whether others are very detailed and can be achieved way quicker. Unless I overestimated the confidence level. Anyway, I guess it's a matter of communication whether some items should be considered like mandatory (hard requirement) or rather like a good to have bonus from prior experience/job. After all each audit is a team work and it's for sure beneficial to match people with prior exp in e.g. development, others in sysadmin, others in Web2 web app/infra IT sec etc. or according to the project's needs as they can differ as well. Best situation is like when some knowledge overlaps when other auditors complement each other, but I'm also just wondering what the path should look like for a person who has just started in Web3 security and might not have that prior exp. Should it be like such person should get a job as sysadmin/info sec consultant/developer first? In the end, I'm also not entirely sure which approach is better - pushing people in many directions or more narrow specialisations. It's always difficult in IT Sec both Web2 & Web3. As I assumed 'ideal knowledge' means that each has to decide on his/her own as both paths are useful in various cases. Referring also to the comment regarding critical/important skills as it kind of touches the similar area, I think that maybe it would be a good idea leaving it as it is for now to not make it too complex and over time add some labels/tags for some skills (or add new skills items) depending on the demand, to help prioritise stuff to learn and to up-skill people in the right direction. Anyway, great job to see it progressing :) I'm looking forward to more audits, SEAL/SEAL-X and how promotions go and this process is implemented in practice. |
Beta Was this translation helpful? Give feedback.
-
Suggestion: Introducing new role naming conventionTitles are important and we aim to give our community their deserved respect. Therefore we propose a new role naming convention. Please do vote in favor or against for these changes to be applied across the DAO. - Apprentice
+ Junior Security Researcher
- Intermediate Apprentice
+ ???
+ Security Researcher
+ Lead Security Researcher
|
Beta Was this translation helpful? Give feedback.
-
|
Lets us discuss and see what we can do. Although i like the new scheme, i get the feeling that we are not understanding the depth of all potential issues this change may introduce. Motivation for the name change: This change should be rather straightforward and introduce no issues: - Apprentice
+ Junior Security ResearcherThis change shifts perception and the implications are not fully understood: - Intermediate Security Researcher
+ Security Researcher
- Security Researcher
+ Senior Security ResearcherExample of some issues: thoughts? 🤔 |
Beta Was this translation helpful? Give feedback.
-
|
Implemented - Apprentice
+ Junior Security Researcher
- Intermediate Apprentice
+ Associate Security Researcher |
Beta Was this translation helpful? Give feedback.
-
|
In reference to the following text
imho the requirement for the |
Beta Was this translation helpful? Give feedback.
-
|
How do I apply to join the Spearbit as a Junior security researcher |
Beta Was this translation helpful? Give feedback.
-
|
NOTE
Remember that Spearbit is the industry leading network of elite Security Researchers. Best of lucks! |
Beta Was this translation helpful? Give feedback.
-
About the Spearbit Promotion Process, roles and responsibilities.
The goal of this document is to outline Spearbit’s promotion process, define roles and responsibilities, and guide transparency.
Introduction
For Spearbit’s community of security researchers and the general web3 security ecosystem to thrive, it is key to acknowledge and support auditors’ growth during their professional career. Therefore, it is our responsibility that we clearly document and clarify the promotion process flow in an effort to encourage auditors career pursuits in alignment with what we consider to be the required skill set for each step of their professional development according to Spearbit’s role design.
The readers of this document are encouraged to leave feedback and suggestions.
About Promotions
It is not obvious how a fair and transparent promotion process must work within a security DAO when the risk of promoting someone without the adequate skill can result in harm being done to third parties in the industry and therefore, Spearbits' reputation.
Instead of driving and micromanaging each step the applicant is subject to, the core team should have minimum involvement.
It is therefore the intention to design a fair and quasi-automated process which satisfies applicant demands yet still complies with Spearbits' quality control mechanisms and expectations.
When companies and projects are hiring for developers, security consultants and security engineers (i.e. auditors) they take into consideration the credentials of these individuals and teams of experts. In regards to Spearbit, these credentials preceded our reputation, and allow for the opportunity of working with top tier projects to assist in improving their security posture.
For this reason, Spearbit cannot take an internal promotion process lightly knowing that such credentials carry reputational weight and will be accepted across the web3 industry as the new standard.
The fairest way to approach promotions is by making it as easy as possible for others to evaluate someone else's skill set and expertise.
Spearbit Roles
Auditors in the Spearbit community have a wide range of experience and skill sets. Roles are applied based on an individual’s verifiable track record, this includes both technical and soft skills. These are mostly evaluated during the cultural and technical interview process while complementary data is collected from each engagement performance, social media profiles, references, contributions to the space, etc.
Auditors engaging in Spearbit audits are compensated according to their role within the community. Currently, the following formalized roles that exist are Junior Security Researcher (JSR), Associate Security Researcher (ASR), Security Researcher (SR) and Lead Security Researcher (LSR).
It must be noted that a standardized, industry wide definition for each one of the abovementioned roles does not exist yet, and it is purely based on resume. Therefore, one of the secondary objectives of this document is to define and measure each one of the roles to standardize them.
We proceed to define and describe each role as follows.
Junior Security Researcher
Junior personnel with less than one year of web3 security experience and IT background. Must be guided by SR's and LSR's.
Technical skills and ideal knowledge to have:
Soft Skills
Responsibilities
Associate Security Researcher
Junior to mid tier personnel with more experience than a regular Junior Security Researcher.
Technical skills and ideal knowledge to have:
Builds on top of the Junior Security Researcher's mentioned above with deeper knowledge of each topic.
Soft Skills
Responsibilities
Security Researcher
Professional personnel with more than one year of experience in web3 security and InfoSec or Software Engineering background. Must not be guided.
Technical skills and ideal knowledge to have
assembly{}blocks.Soft Skills
Responsibilities
Lead Security Researcher:
Senior personnel with more than four years of experience in web3 security, InfoSec, IT and / or solid web3 background. Guides others.
Technical skills and ideal knowledge to have
assembly{}blocks without major misses.Soft Skills
Responsibilities
Promotion Flow
The above diagram shows the promotion process from a high level perspective including several components which are described down below:
Spearbit auditors portfolio. The best way to evaluate auditors expertise is by having them craft their own web3 security portfolio.
Applicants can maintain and submit a free format portfolio with content that should include:
We aim to introduce it as a means of reducing evaluators cognitive load during assessment time. An updated portfolio also has multiple benefits for the person creating it. Therefore, we believe this method is beneficial to everyone, both regarding promotions and on a personal / professional level.
SEAL engagements. A classic, collaborative Spearbit audit led by LSRs who pose questions and challenges during the audit in order to test and evaluate Junior Security Researchers and Associate Security Researchers skills.
Performance is measured subjectively. See example of table below:
SEALs are introduced as Spearbit's response to the need of upskilling Junior Security Researchers into Security Researchers by offering guided audits.
Participating in SEAL engagements require that the average Junior Security Researcher and Associate Security Researcher rate of 3k/week and 6,25k /week must be lowered in order to fit the clients budget.
SEAL-X engagement: Competitive, individual audit where auditors try to find the maximum amount of issues on their own using different tools and resources. Issues are submitted to SRs and LSRs for reviewing and objective evaluation.
See an example of an evaluation template below.
LSR council. For Security Researchers to become LSRs, 3/5 LSRs + 2 core team members must vote in favour of the applicant. A Spearbit portfolio must also be submitted for evaluation.
Junior Security Researcher to Associate Security Researcher
Fixed Requirements:
Junior Security Researcher submits portfolio proving he has reached an Associate Security Researcher level after 3 Spearbit audits.
The Spearbit core team will evaluate such portfolio with the help of an SR and LSR. If the applicant's portfolio proves notable experience in blockchain security over that of a Junior Security Researcher, a new freelance contract applying the new rate and highlighting new responsibilities will be sent for the applicant to sign.
Responsibilities at this level include those of an Junior Security Researcher plus client bug fix reviews.
Associate Security Researcher to Security Researcher
A notable skill gap exists between Junior Security Researchers / Associate Security Researchers and Security Researchers. It is imperative that skills and knowledge are evaluated as objectively as possible.
Security Researcher to Lead Security Researcher
Evaluating a Security Researcher's skills is a hard task. It is therefore that part of this process is directly outsourced to LSRs who must vote in favour or against an applicant's promotion request.
A council of LSRs (preferably made out of those who have previously participated in audits with the applicant) will review the applicants portfolio, track record, skillset, etc.., and will reach a decision if the applicant is ready to perform as, and take the same responsibilities a Lead Security Researcher has.
FAQs
Because of a provable track record.
To build a provable track record and gather data.
You can apply every quarter.
Change Log
Incorporating community feedback.
Junior Security Researcher to Associate Security Researcher:
Associate Security Researcher to Security Researcher:
Beta Was this translation helpful? Give feedback.
All reactions