A friend wants to work for a security consulting company, he's doing appsec at a large company in India. Any advice for getting hired?