Post #4470086

We’ve all heard of a RGEs [Resume Generating Events] which are bad. May I present the inverse: - CSEs [Capital Saving Events]. If you find, contain, and mitigate breaches before they become major, they should be documented. - MCSEs [MAJOR Capital Savings Events] are also the next step up. Securing and saving the business against a major intrusion event, or saving it by doing DFIR by yourself without consulting a third-party DFIR team, these should be highlighted. Estimated cost savings to the business, for both MCSEs and CSEs, should be documented on yearly evaluations. If leadership won’t adjust your pay to compensate for savings, it’s the same as not paying a big bounty. Walk away. Criteria require finding gaping holes, vulnerabilities, or processes which cause harm or introduce significant risk. SOC analysts must find these without automated alerting, they must be found by doing deep-dive investigations, and cannot be self-setups. Finding significant insider threats to protected data types also count.