I work in a medium sized startup as DevOps Engineer and we need to hire a security engineer. Since I have never done it, the company asked me to create an environment where the security engineer candidate should do his tasks as part of the selection process.
I know a bit about security, but I don't know what/how to set up the environment.
The requirement that the candidate should have are
- Penetration testing
- AWS security practise
- Demonstrated technical knowledge of security engineering, computer and network security, authentication and security protocols, and applied cryptography.
- Knowledge of the JVM and best security practices
- Broad knowledge of security toolsets, including IDS/IPS, SIEM
- Experience in CTF contests
What do you suggest? I mean do you suggest to set up IDS, honeypot, services to break and so on. What should be the tasks that the candidate should focus more?