We Pwn the Night: Growing & Leading an 31337 security research team
summary
Goal: hire >25% headcount and have every new researcher find zero days in 45 days. Process pairs attitude, aptitude, engagement screening with a C/C++ or Go take‑home, panel deep dives, then four weeks onboarding: read 5–10 past reports, install stacks and tools (including Semgrep and CodeQL, WeAudit), pick an internal IRAD target and get dedicated R&D time. Outcome: five 2025 hires all report real CVEs—NVIDIA Triton stack overflow (CVSS 9.8), Thermo Fisher/Ion Torrent RCEs (>9.0), Electron integrity bypass (6.3)—and the team builds SARIF Explorer and sustains impact.
AI-written summary · about
chapters (10)
- 0:00Introduction and welcome
- 1:43Talk overview and goals
- 3:45Hiring challenges for elite teams
- 10:24Hiring framework: attitude aptitude engagement
- 15:19Onboarding process and zero-day experiment
- 22:02Team culture and leadership mantra
- 26:13Staying technical as a leader
- 31:30Lessons learned and replicating success
- 35:00Future plans and closing remarks
- 37:07Q&A session
related talks
26mTopics of Interest: These are the Vulns You are Looking For: AppSec Champions & Jedi...
41mKeeping Up With The Joneses (CVEs)
58mThe Tactical Application Security Program: Getting Stuff Done
36mThe Road To Being Rugged
48mIt doesn't take much to be above average
17mTools & training for more secure software
23mHack Your Cybersecurity Career: Your Role in the Ecosystem
59mTeam of 30 million: Reducing Software Vulnerability at a Global Scale