What attackers learn from your job adverts

A job advert for a security engineer that lists your SIEM, your EDR, your cloud provider and your identity platform is a map. Attackers read them.

What's in there

Technology stack, often down to the version. Team size, from the number of similar roles. Gaps, from what you're hiring for. Organisational structure, from who the role reports to. Sometimes the name of the hiring manager, which becomes the sender of a phishing email to the people who'd report to them.

None of this is secret. All of it is useful to someone planning an intrusion, because it tells them which tools they need to evade and which ones you don't have.

What I'd change

• Describe outcomes, not products. "Experience operating enterprise detection platforms" instead of the brand.
• Keep the stack for the interview. The right candidate will ask, and you can tell them.
• Watch the aggregate. One advert is harmless. Twenty over a year, read together, describe the whole programme.

The wider habit

Job adverts are one source. Conference talks, vendor case studies with your logo, staff profiles listing their certifications on specific products, and the acknowledgements in a press release all add up. This is open-source intelligence, and the people doing it against you are patient.

The exercise worth running once a year: ask someone to build a picture of your security programme using only public sources, then compare it to reality. The gap between the two is what you're giving away.

If you'd like that exercise done properly, with the results turned into fixes rather than a scary report, that's something I can help with.

Explore: More on threat intelligence and OSINT · Work with me