• Waraugh@lemmy.dbzer0.com
    link
    fedilink
    arrow-up
    0
    ·
    4 months ago

    The software and systems engineers in my field are responsible for ensuring systems comply with industry best practices, compliant with NIST, and STIG hardened. If they sign off on a systems design for production deployment their ass is most assuredly on the line. I will agree that the legal part is fuzzier since it’s ultimately the agency head that is legally responsible, which gets delegated to an authorizing official, who depends on a security compliance inspector, who evaluates the information system security engineers system/design. While generally lives are not currently on the line for most information systems, the buck does stop at the engineers desk in my line of work. For complex interconnected systems it is not uncommon to have a security architect responsible for the secure integration of disparate systems/components who relies on design documentation from the engineers. While not a perfectly compatible definition to a licensed engineer, it provides a logical framework that makes sense in the associated application and their is a perfectly clear enough division, currently, between careers that it doesn’t create confusion. A licensed professional engineer will most certainly be titled appropriately and clearly. An information systems engineer or software engineer will likely hold advanced certifications but will not be making false claims as a PE, no PE is going to accidentally apply to be a systems/software engineer. The whole discussion is a solution looking for a problem. A PE is distinguished well above an engineering job title by anybody that is anybody. Theirs a disappointing number of people that think everybody in the Air Force is a pilot, worrying about the uninformed portion of the population is pointless. Regulatory checks and balances exist. No information system/software engineer is going to be designing/approving a bridge that actually gets built without also being a PE. All that said, my boss is actually a PE certified systems architect with a CS degree who worked as an ISSE in his last role (we are in a CISA critical infrastructure sector).