Established companies vs. hipster startups?
Having worked in a non-security position for large companies, but having lots of IT security friends, the difference is the type of employee termed "security professional." In established companies, these people are the ones responsible for "real" security like PII, PCI, etc. for companies with millions of customers. They're the ones who get fired when the company has to give out free credit monitoring for a year in exchange for not improving their security. In hipster startups, they're the ones maintaining whatever crazy federated identity management solution their cloud providers have chosen. Either that, or their startup is producing the latest security "single pane of glass" mashup that they're trying to sell to big companies' IT security professionals. Either way, the pay is lower for startup employees -- in many cases they're playing the IPO lottery.
Biting the hand that feeds IT
