u/Bulky_Connection8608

We have several repos, all Clojure. I need SAST coverage for secure code review, but nothing mainstream (Semgrep, CodeQL) supports Clojure properly. Even clj-holmes the one Clojure-specific tool isn’t a real solution; the maintainer told me himself it’s not in good shape.

I’m leaning toward an AI agent for code review, since LLMs are actually decent at reading Clojure. Has anyone gone the AI route for SAST on a niche language? How well did it hold up?

I’m starting soon as an InfoSec Engineer at a small but growing financial services company.

The role is hands-on and fairly broad: security tooling, IAM/access reviews, endpoint security, audit readiness, vendor risk, incident response, working with IT/MSP, and partnering with engineering on secure SDLC/CI/CD.I’ll be one of the first dedicated InfoSec hires, so part of the job is bringing structure without slowing the business down.

For anyone who has been in a similar environment, especially small fintech, or first-security-hire situations:

What would you focus on in the first 30/60/90 days?

I’m thinking about starting with asset/access inventory, risk register cleanup, control ownership, audit evidence habits, endpoint/IAM basics, and building trust with IT/engineering before pushing heavier process.

Would appreciate any practical advice, mistakes to avoid, or resources/playbooks worth reading.

Bonjour,

Je suis au Québec et je révise un contrat d’emploi temps plein 100 % remote avec une compagnie basée en Ontario. Le contrat dit qu’il est régi par les lois du Québec, mais certaines clauses mentionnent aussi l’« ESA », qui semble être une référence ontarienne. Est-ce que je devrais demander une correction pour clarifier que la Loi sur les normes du travail du Québec s’applique?

Mes principales préoccupations :

1. Le contrat exige 1 mois de préavis si je démissionne. Est-ce raisonnable de demander plutôt 1 semaine, ou 3 semaines des deux côtés?
2. Il y a une clause de mise à pied temporaire pour raisons économiques ou opérationnelles. La CNESST dit qu’une mise à pied suspend temporairement le contrat de travail et que le lien d’emploi est maintenu, mais un avis est requis si la mise à pied est prévue pour plus de 6 mois. Comme mon salaire serait ma seule source de revenu, est-ce raisonnable de demander de retirer cette clause?
3. Le contrat semble limiter les paiements en cas de fin d’emploi aux minimums légaux. Est-ce commun au Québec?

Est-ce que ces demandes sont raisonnables avant de signer, ou est-ce que ça serait perçu comme inhabituel?

Merci!

Hi everyone,

I’m in Quebec and reviewing a 100% remote full-time employment contract with a company in Ontario before signing. I’m not asking for a full contract review, just wondering whether these clauses are normal and whether my proposed changes are fair.

The contract is governed by Quebec law, but some sections mention “ESA,” which I understand is usually Ontario terminology. Should I ask HR to correct this to the Quebec Act Respecting Labour Standards?

The clauses I’m most concerned about are:

1. Employee resignation notice: the contract requires me to give 1 month of notice if I resign. Would it be reasonable to ask for either:
   • 1 week of notice from the employee, or
   • 3 weeks of notice from both sides, employee and employer?
2. Temporary layoff: the contract says the employer can place me on temporary layoff for economic or business reasons, and that it will not be considered termination or constructive dismissal if done legally. I understand CNESST says a layoff temporarily suspends the employment contract and the employment relationship remains maintained, and that notice/indemnity rules apply for a layoff of more than 6 months. Since my salary would be my only source of income, this clause creates a major financial and psychological risk for me. Would it be fair to ask them to remove this clause ?
3. Termination / minimum entitlements: the contract seems to limit termination payments to the statutory minimums and waive other rights if permitted. Is this common in Quebec employment contracts?

Are these reasonable things to negotiate before signing, or would asking for them be seen as unusual?

Thanks. I’m trying to be careful before signing while staying professional with the employer.

Salut tout le monde,

Je suis actuellement consultant en cybersécurité dans un Big4, avec environ 3 ans d’expérience, un Bac en génie logiciel et une maîtrise en cybersécurité.

Poste actuel :

• Je travail avec des Clients de grande taille au Canada et aux États-Unis
• Bon réseau et très bonne expérience jusqu’à maintenant
• Mode hybride
• Environ 40h/semaine en général, parfois 50h quand c’est plus intense
• Environ 78K$ de rémunération totale, je vais être promus dans un mois donc une augumentation vers a peu prés 88K TC.

Je viens de recevoir une offre :

• Entreprise fintech/crypto bien établie, avec moins de 100 employés
• Je serais le premier Security Engineer, je vais travail directement avec le CTO
• Construction du programme de sécurité pratiquement from scratch
• Environnement style startup
• 120K$ de base + 20% de bonus, donc environ 144K$ total comp
• PTO illimité
• 100% remote / possibilité de travailler de n’importe où

Ma question : est-ce que ce serait un bon choix de carrière à long terme, ou est-ce trop risqué ?

Est-ce que certains d’entre vous ont déjà fait un move similaire, en passant d’une grande organisation vers une plus petite entreprise ?

Est-ce que ça en valait la peine ? Est-ce que ça a aidé ou nui à votre CV/carrière sur le long terme ?

Je suis aussi en team matching pour un poste chez Google L3 Security Engineer, mais ça fait environ 9 mois, donc honnêtement j’ai presque abandonné cette option.

Hi everyone,

I’m looking for advice from people who have moved from a large organisations into a smaller company.

I’m currently in Big4 cybersecurity consulting. The role is stable, hybrid, decent experience for consulting, and gives me exposure to large enterprise clients and mature security environments.

I recently received an offer from a well-established fintech/crypto company with fewer than 100 employees. I would be their first dedicated security engineer, working directly with the CTO and building the security program from the ground up.

The tradeoff is basically:

• Current role: Big4 brand, large clients, stable environment, structured growth, Hybrid, 40hrs/week.
• New role: much more ownership, higher compensation, fully remote, unlimited PTO.
• Current comp: around $78K, likely $85K after promotion in few months
• New comp: $120K base + 20% bonus (144K TC)

For people who made a similar move from consulting or a large organization into a smaller company, How was it?

Did being the first security/security engineering hire help your long-term career, or did the lack of structure make it harder?

I’m mostly trying to understand the career risk vs. upside.

NOTE : I’m also in team matching for a Google L3 Security Engineer role, but it’s been around 9 months, so I’ve almost gave up.

Hi everyone,

I’m looking for advice from people who have moved from a large organisations into a smaller company.

I’m currently in Big4 cybersecurity consulting. The role is stable, hybrid, decent experience for consulting, and gives me exposure to large enterprise clients and mature security environments.

I recently received an offer from a well-established fintech/crypto company with fewer than 100 employees. I would be their first dedicated security engineer, working directly with the CTO and building the security program from the ground up.

The tradeoff is basically:

• Current role: Big4 brand, large clients, stable environment, structured growth, 40hrs/week.
• New role: much more ownership, higher compensation, fully remote, unlimited PTO.
• Current comp: around $78K, likely $85K after promotion in few months
• New comp: $120K base + 20% bonus (144K TC)

For people who made a similar move from consulting or a large organization into a smaller company, How was it?

Did being the first security/security engineering hire help your long-term career, or did the lack of structure make it harder?

I’m mostly trying to understand the career risk vs. upside.

NOTE : I’m also in team matching for a Google L3 Security Engineer role, but it’s been around 9 months, so I’ve almost gave up.