Category: Career Advice

Like almost everything else in my life (e.g. marriage, fatherhood), I became a cybersecurity professional with little to no planning. I was happily plodding along with zero direction, and even less qualifications, when an employer required me to get an MCSE in Windows NT.

In a very short time I realised that if I was looking at a computer my boss thought I was working, so being lazy, IT was the career for me! However, I did get bored, so when I received a call about my resume on Monster.com from a start-up cybersecurity company, I jumped at the chance. A little homework showed that security was the place to be in IT, even then, especially when the company consisted almost entirely of incredibly smart ex-NSA types.

This was in 2000.

In the 16 subsequent years I have gone from firewall admin, to managed service manager, to consultant, to manager of consultants, to self-employed. I have loved [almost] every minute of it. The funny thing is though, I have no passion for security per se, I just love helping others fix broken stuff. Especially processes.

There is a LOT of work out there.

So my first piece of advice; decide why you want to be a cybersecurity professional in the first place. If it’s just for the money, move on to something else, you’re not welcome here. Having performed the Keirsey Temperament test on 30-odd security consultants across the globe, it was clear that certain characteristics are dominant in their type (ESTJ). Bottom line; they actually care, and they are:

  • Highly social and community minded;
  • Generous with their time and energy;
  • Hard working; and
  • Friendly and talk easily to others.

That’s not to say others can’t do well (I’m an INTJ for example), but you have to know yourself before you know what aspect of security would suit you best. Follow the money, or choose something for which you are not suited, and you will likely fail.

Then Bear These Things in Mind…

  1. Qualifications: A degree in cybersecurity should not be seen as a pre-requisite, as certifications are almost as much good, and neither of these things can trump experience. Regardless of your qualifications, you will start at the bottom, and there is no better place to learn. Make the most of it.
    o
  2. Specialise or Generalise: You’ll need to decide very quickly which you’re going to be; Specialist, or Generalist. You cannot be both, there are just too many aspects of cybersecurity. Medicine, law, engineering, and a whole host of other careers are the same, you must find what suits you best.
    o
  3. Learn the Basics: Jumping straight into a career in User and Entity Behavior Analytics (UEBA) or Intelligence-Driven Security Operations Center Orchestration Solutions (whatever the hell that is) may be tempting, but you are not doing your career, or more importantly, your clients, any favours. From Confidentiality, Integrity & Availability, to Risk Assessment, Asset Management, to Policy & Procedure, the basics have never, and will never change. Whenever you find yourself stuck, only the basics can give you a clear way forward.
    o
  4. Choose a Camp: Unfortunately most cybersecurity professionals tend to fall into one of two camps; 1) those focused primarily on Technology, and 2) those focused primarily on People and Process. These are two distinct skill-sets, so know which you are, and make sure you pair up with a counterpart.
    o
  5. Ask for Help: I got where I am without a mentor as such, but I most certainly didn’t get here without a LOT of help. Nor would I be able to stay here without the constant support of my peers. If there’s one thing I love about cybersecurity professionals it’s their generosity and desire to help. So join your local chapter of ISC2, ISACA and / or ISSA and start talking to people.
    Use mentors too if you can, as while I have few regrets in my career path, not having mentor is one of them.

Without question, a career in cybersecurity can be very rewarding, both in personal achievement and financial terms. It can also chew you up and spit you out if you’re not careful.

In the end, cybersecurity will give as much back as you put in, there are no shortcuts.

[If you liked this article, please share! Want more like it, subscribe!]

Anyone in the cybersecurity field who spends any time on LinkedIn will see numerous recruiters vying for your attention. You will also see numerous complaints from cybersecurity professionals about how those recruiters conduct their business. Unfortunately recruiting as a profession is becoming a stigma.

But why is this happening? The profession itself is a critical one, and done well is of tremendous value to any professional’s career. These partnerships can, and should, last a lifetime, yet the majority of recruiters I’m come across these days are nothing short of used car salesmen.

But if you can find a good one!… Who else can put so many opportunities in front of you when you’re too busy doing your dayjob? Who else can talk you up to the RIGHT people before they even see your CV? In other words, who else can help you in your career as much as really good recruiter? Even mentors rarely have as much influence.

So What is a ‘Good Recruiter’?

While this is becoming more and more an oxymoron, it’s really quite simple from a candidate’s perspective:

  1. Do not approach me with a job in mind. At least not out of the gate. You have no idea what I’m looking for, or even if I’m open to conversations. The positions you’re trying to fill are your problem, not mine. Instead, approach me with a request to talk. If I’m not willing to talk I’ll let you know, politely, and waste no more of your time. If you don’t start the partnership with MY interests first and foremost, we’ll have little to discuss. Besides, to provide good service to your clients, you need to know if I’ll be a good fit. For example, trying to place me in a position that requires extreme tact and diplomacy will likely not go well;
  2. Do your HOMEWORK! There are few things more irritating than; “I read your LinkedIn profile and think you’d be a perfect fit for…” If you had actually read my profile, you would know that I’m not at the beginning of my career looking for a Security Analyst position in Abu Dhabi starting at AED140K. If you want to start handling more senior placements, don’t treat potential candidates with such discourtesy. You get one shot at this, if that;
  3. Assume you may never place me, but call me anyway. Recruiting, like sales, is all about relationships, and EVERY relationship pays off in some way. Maybe not directly, but going from one ‘kill’ to the next will set you up for eventual failure. Deservedly so. Senior candidates may place infrequently, but they usually know lots of other people. Recruiting is as much about networking as it is direct contact. That’s why I call this a partnership, I can help you too;
  4.  Stay in touch. Any recruiter who stops calling / emailing me just because a job placement falls through, will not get a second chance. And any recruiter (or employer for that matter) who stops calling hoping you’ll ‘get the hint’ is a coward and extraordinarily unprofessional. Communicate, Hell, over-communicate, but keep your candidates in the loop, there’s always a next time; and
  5. Be proud of what you do. How many people have you LinkedIn with who have titles like ‘Security Consultant’ who turn out to be recruiters? At least half of the invites I receive from recruiters are hidden behind some other title. In Peter Smith’s; “Why do we hate (our own) sales people?“, he used an excellent phrase; “If a person is worried about having sales in their job title, then they probably do not have the right DNA.” This applies every bit as much to recruiters. Take pride in your profession, you are needed.

The Challenge

I now throw down the gauntlet to all recruiters specialising in senior cybersecurity placements. While I am not actively looking for a move, I am open to any conversation. I have my own business, so short/long-term contract work is best, but I will not disregard full-time gigs if the opportunity is right. Feel free to reach out.

But what I’m really looking for is great recruiters. I have a hard time believing that there is a such a deficit of cybersecurity talent, I just don’t think employers are asking the right questions. There are many junior security folk out there who need help, I am going to make it one of my goals to put them in touch with recruiters I trust and respect.

First I have to find them.

To end this blog on a crappy analogy; In Jerry McGuire there are two types of sports agent; 1) scumbag agent Bob, who cares nothing for anyone and 2) equally slick, but with a heart of gold Jerry.

Be Jerry.

[If you liked this article, please share! Want more like it, subscribe!]

In “What’s the CEO Equivalent of The Peter Principle?” I posited that there are 3 kinds of CEO:

  1. Those good at starting a company;
  2. Those good at building start-ups to the point they can go public, or be acquired; and
  3. Those good at leading a company for the long-haul.

…with the theory being that unless the CEO knows which s/he is, s/he’ll eventually run a company into the ground. No CEO is really good at more than one, and I’ve met too many who aren’t good at any of them.

The CISO role is no different, and if you’re looking for one, you had better ask the right questions of your candidates. However, if you are a CISO or want to be one, then you must know which kind you are or you’re setting yourself up for failure.

What Are The 3 Types of CISO?

o

  1. The Planner: – The p-CISO comes in at the beginning of an engagement, before an organisation even knows what it actually needs. Their job is to design a security program that does the only thing it’s supposed to; support / enable the company’s business goals. The p-CISO must also write the Governance Charter, get the CEO to sign it, then implement the Governance Committee. 99% of all security programs fail at this stage, so this is perhaps the most difficult task of all.
    o
    Of the 3 types, this is the most creative, but also the least detailed oriented, which is why they probably should not try to run the program long-term.
    o
  2. The Executor: e-CISOs get things done. They take the hand-off from the p-CISO and put the agreed plan into action. While this may seem more like project management, there is a lot more to it than that. Putting a security program in place takes a shift in an organisation’s entire culture. Installing a firewall is easy, getting the CEO to accept full accountability for the ISMS is a Herculean task.
    o
    This type has the rare ability to focus on enormous amounts of detail, but is political enough to bring the people components together.
    o
  3. The Optimiser: o-CISOs are in it for the long-haul. These are the folks that take the still raw security program, and make sure it get fully instilled in the company culture and business as usual processes. They will also likely Chair or Co-Chair the Governance committee.
    o
    The most political of the 3 types, and it is the o-CISO’s incredibly difficult task to ensure that IT, IT Security, AND the business side all do their part. The depth and breadth of the position makes it one of the most difficult jobs imaginable.

Ignorance of these 3 types certainly goes a long way to explain why CISOs last less than 2 years on average. Organisations ask the wrong questions, and prospective CISOs have little concept of their own limitations.

I’m not saying that there is no overlap in these roles, there is. I’m also not saying that a single individual can’t be fairly good at more than one, they can. What I am saying is that, in practice, the skill-set required to be REALLY good at these roles is mutually exclusive. e.g. I have never met someone who thrives on creating something from scratch (p-CISO), have any interest whatsoever in baby-sitting something for the long-haul (o-CISO).

And that’s OK, you don’t just have one kind of doctor, or lawyer, why should a CISO be any different?

Unfortunately, too often the CISO role is seen as the ultimate goal in the career of a cybersecurity expert. But the fact remains that this role suits very few people long-term. Both p- and e–CISOs are senior level consultants, only the o-CISO is a long-term employee.

And let’s not forget; Make the CSO Role a Board Appointment, or Don’t Bother Having One, the CISO is no different.

I’d be very interested to hear what actual CISOs think of this theory?

[If you liked this article, please share! Want more like it, subscribe!]

[OK, so you shouldn’t hate anyone, but; “Don’t Have Significant Issues With…” is nowhere near as catchy.]

In an otherwise spot-on article by Peter Smith; “Why do we hate (our own) sales people?“, he made what I believe is a fundamental error. Especially given his premise.

He says of salespeople that they are the “…life blood of the company…”, that; “If they don’t sell, the rest of the company doesn’t work.“, and finally that “These are your top performers.“. It’s that many salespeople actually see themselves this way that causes a lot of the resentment or even hatred.

There is absolutely no questions that sales is a critical function in any organisation, but it’s not the most important. There is no such thing as a most important department. It’s like saying the heart is the most important organ in body, just try living without your liver.

Who makes the products or services they sell? Who delivers them? Who arranges all the financing etc? Who ensures the contracts are in order? Without any one of these things no company can survive. A real salesperson is only ever as good as the things they sell, and the teams around them.

I say a ‘real’ salesperson because they are the ones with both the integrity to only sell what the client needs (not asks for), and to use his/her entire support team in the process to ensure mutual benefit.

From my experience, the majority of my issues with salespeople fall into three main categories:

  1. Lack of Product/Service Knowledge: We’ve all met salespeople like this, all smiles and no substance. This is not a salesperson, this is a clown, a real salesperson is extremely well versed in his/her wares. They may not be an expert in the overarching subject (cybersecurity for example), but they know who is, and whom to bring to the table when required to answer the prospect’s questions. The best salespeople I’ve worked with are facilitators who piece together solutions by putting the right people in front of each other;
    o
  2. Selling to Their Quota: I use the word hate way too often, but I REALLY hate the American way of selling. The quota system is ridiculous, and forces salespeople into a never ending spiral of price compression and end-of-quarter discounts. You sell my time as a consultant for half what it’s worth just to reach your target and we’ll having a very short conversation. Words like ‘fired’ and ‘incompetent’ will be used liberally;
    o
  3. Selling Outside of Their Skill-Set: To me there are two types of salesperson:
    o
    Hunters     – Very aggressive, easily bored, hates detail, DESPISES paperwork. Basically, these folks want to get in, get the deal signed, and move on to the next ‘battle’; and
    o
    Growers – Less aggressive, and tend to prefer to relate to the client on a more personal level. These are the folks who will take the initial sale and turn it into years of up-sells / cross-sells though their deepening understanding of a) the client’s business b) the client’s people, and c) the state of their security program.
    o
    Selling outside of your skill-set is a sure way to mess the whole thing up for everyone.

A real  salesperson does none of these things, and I have met some truly exceptional salespeople whom I am also honoured to call friends.

So if you hate salespeople, you either have a company full of bad ones, or you have no idea what they do. Selling is difficult, VERY difficult, and a good salesperson has a skill-set most of us cannot even hope to duplicate. As an introvert, the very thought of doing what they do every day gives me the willies. And that is just the tip of the iceberg. From research on prospective customers, to getting the first meeting lined up, to pitching an appropriate statement of work, the amount of work that goes into a sale is enormous.

From the other side, and as Peter Smith said very eloquently; “If a person is worried about having sales in their job title, then they probably do not have the right DNA.“.

Salespeople are necessary, they are NOT a necessary evil. But if you think you have what it takes to be one, try it for 6 months, 99% of you will beg for your old job back.

I know I would.

[If you liked this article, please share! Want more like it, subscribe!]

I’ve been reading a lot recently about how Boards of Directors (BoD) are starting to take cybersecurity more seriously. While I applaud this, and believe the trend can only be a good thing, in practice this is little more than lip-service.

Example scenario – Let’s assume a scenario where the CEO is not actually on the BoD:

Step 1: The Chairman, after receiving the requisite vote, will task the CEO with establishing a CISO position;

Step 2: The CEO tasks the senior IT person in the company (usually the CTO) with finding a suitable candidate, and;

Step 3: The CTO hires someone who ends up reporting directly to them.

Any one of these step by itself is a mistake, but all three combined will result in the CISO role being nothing more than smoke and mirrors, or an empty suit. Having a CISO in this scenario may look good on paper, but they will be utterly ineffectual.

Per Steps 1 & 2 – Instead, if the BoD make themselves accountable for the CISO role, they will have no choice but to do some homework. They won’t know the right questions to ask, so they have to find someone(s) who can. Few people I have seen who make it to the BoD level don’t have significant networks and/or support teams to tap into. They should use them.

The added benefit of having the BoD take such an active role in the CISO selection is they will have a much better understanding of what the person filling the role will actually be doing! Watching CISOs ask for budget from BoDs is a painful experience at best, and with just a little background the BoD can begin to speak the same language. The right CISO will already be familiar with the conversation in the other direction.

Per Step 3 – Having a CISO report to a CTO is as much use as hubcaps on a tractor, even reporting to the CEO has its limitations. While there is no way the BoD would/should take an active day-to-day role in the running of the company, having the CISO dotted-line into them gives them the authority to perform their function properly. Anyone who can be fired out of hand for saying things the CEO doesn’t like will likely say very little. And let’s be clear, an ‘open-seat’ CISO will have a LOT to say.

In effect, the CISO role is very similar to Internal Audit. They are certainly answerable to the CEO for the majority of their function, but their jobs are not [necessarily] at risk if the findings are not what the CEO wants to hear. The dotted-line into the BoD makes all the difference in the world.

All that said, the CISO role is a very attractive one for most security professionals. It’s often seen as the ultimate goal, which is why new CISOs have a VERY short life expectancy in their first few gigs; THEY don’t ask the right questions.

As things currently exist, there are only 3 questions a good CISO can ask before joining an organisation:

  1. Can I talk to the CEO? – [If No, walk away.]
  2. To whom will I be reporting? – [If anyone lower than the CEO, walk away.]
  3. Does IT Security have its own budget? – [If No you’ll likely spend most of your time begging for resources. Proceed at your own peril.]

Much like the CTO, a good CISO can be one of an organisation’s ultimate enablers, assuming they have not been hamstrung before they’ve even started.

[If you liked this article, please share! Want more like it, subscribe!]