I want to feel stupid

I spent a bit over 3 years in my last job. That was the first time I ever spent more than a full year at any company (lol). I think most of the reason behind that was that it was basically impossible to find a higher paying job in Brazil. Once I moved to HK, I started having more options. I also generally enjoyed working there for most of the time, and I think some of my colleagues were really smart.

I think spending that much time at a single place made me forget about what I really value in a workplace, and changing jobs made me have that kind of vision again. I was talking to a friend that asked how my new job was going and I said that it was going well but I was bothered that I was feeling “too smart” - they were surprised and asked “isn’t that a good thing?”. I think it really depends on what your “goals” are at work. I’ve been cursed with the “I have to like my job to do any work” curse, which makes me not able to perform according to what they want from me at all, and if I’m not feeling it, I just don’t work. This makes fulfilling KPIs and that kind of thing extremely hard as they are pretty much objectively bullshit that you do to please management, and turns out that is not an activity that I find much joy in doing.

Honestly, I think the main thing I look for in a workplace is to be able to do stuff that I cannot do by myself. I can’t spin up a 300k/mo k8s cluster on AWS just to see how it works. I have literally zero scenarios in my life where I would even touch kubernetes or istio or any of these technologies. I really like learning how things work, and having a job is a pretty cool way of learning how these companies and big systems are doing stuff behind the scenes without all the burden of illegally hacking into them (I have never ever ever hacked into systems illegally, that’s illegal!!!).

In the process of learning how things work, I like to talk to people that know what they are talking about, and unfortunately I feel like this is getting harder every day. I think this has been a semi-struggle almost everywhere I’ve worked at before, and its not different this time: I hate being the “senior” guy that gets asked about stuff - I want to be the stupid one that asks about stuff.

I don’t really know if these places are really that common, I’d guess it’s probably the top 1% - or even less - of companies that will have most employees with deep interest or knowledge about what they do. Obviously caused by the “it pays the bills” mindset, which to be fair is totally ok and is not really their fault, but… it’s quite sad. Maybe I’m not grateful enough for my liking-what-i-do situation. Most companies end up punishing you for giving a fuck about stuff.

So what now? I don’t know if I’ll be able to stay in my current job for much more than a year. I think I am still chasing this “perfect workplace/team” image that I have in my head that might not even exist. I’m still a believer that there must be places that do reward you for giving a fuck, and I might just have been unlucky so far. I’ve been wondering if that’s partially because of my career choices: being a “pen-tester” or “appsec guy” is quite cool if you do it right: I love threat modeling (not in the STRIDE way) because its literally a mental exercise on how much you understand about the thing you are testing, and pentesting is just the complimentary piece for that. Maybe the bad part is that there are too many pentesters, and most of them are pretty bad. Companies need “security people” because of compliance and not really because they care about security, which creates this environment that does not reward you for caring about anything. It’s just a “check the box” thing.

I might start trying to pivot into areas that are less prone to this type of situation, which had me thinking about what makes an environment/industry that forces people to be competent. I think teams that have this trait are all either doing “high-accountability work” in which most people that are not capable of doing the job can still judge the quality very easily, or are doing deeply technical work that outsiders are not even capable of comprehending. The hard part about pen-testing, red-teaming, etc is that its “simple enough” that people understand what it’s about but it only looks important to them when you find stuff and demonstrate impact. The other 90% of the time you look like you are doing nothing (even if you are still providing value doing stuff like threat modeling, creating internal tools and wiring them up, etc) - this 90% is only valued by the technical people in the chain, and unfortunately it’s statistically unlikely that the chain is fully technical.

Examples of things that I think I would enjoy doing that are “highly unlikely to be shitty work environments” are:

• Quant Development: This is pretty simple, you are working on a money-making machine. If your technical value is not providing real returns, the numbers go down and that’s obviously bad (e.g. lower latency is a very measurable way of measuring “optimizations”, i don’t need to explain why if algorithm go faster money go higher to any finance bro).
• Journalism: As a journalist, you simply have to find interesting stuff to showcase to the world. If you do it in a shitty or biased way, people will know. There’s also space for that I guess, but as a non-journalist it’s pretty clear to me that outlets such as 404media know what they are talking about.
• Security Research: Specifically the very specialized stuff. The final product of exploit research (exploits) have real world market value. It’s also almost impossible for someone to pretend to know how low level stuff such as memory corruption attacks work, which means management must be technical for the business to function properly.

I still have hopes of finding a place that falls out of the mean and that values my work for what it is, without necessarily having to pivot into something new (I still enjoy doing what I do, just wish most people around me also enjoyed it as well, not only one out of every ten). I’m not sure of what I want yet and I still have time to figure that out. I really want to feel stupid again.