I Should Have Shared with My Younger Self
(aka a controlled hopefully humorous at times Cybersecurity rant)
A new year brings with it new resolutions and new opportunities for learning and growth. But miraculously enough, it can sometimes be fortuitous to look backwards as well.? Here are five things I would have liked to have shared with my younger cybersecurity self.? Following these would have made my journey that much more pleasant in some respects, if not at the cost of some excitement.? Yet as I near the close of my storied career in cybersecurity, I can’t help but reflect and hope this provides some value to some of you out there knocking at the door to be let in, or looking to hone your skills and career as you move deeper and further up in the ranks.
?
1.??????? Choose the companies you work for carefully.? I say companies here because the world has shifted from when I started nearly 30 years ago.? When I first entered the IT space in the mid-nineties, it was not uncommon for folks to spend their whole careers working at/for one company.? Names such as IBM, Sun, and Oracle were highly touted and often meant rewarding work that paid well throughout your extended career there.? Somewhere along the way, it became less so with job seekers moving on to greener (pun intended) pastures at least once if not many more times that paid them more and often required less work or monopolization of their many skills.? As an aside, how sad it is that organizations expect your skills to grow yet stagnate your salary increases to cost of living adjustments over the course of your career, when they’ll happily pay some new idiot fresh off the MBA circuit with 10 less years of tangible doing, 30-50K more for the same job?? So, it is today that you can and should expect to work for at least two to five organizations in your standard 20-year cybersecurity career.? You’ll need to just to be paid what you’re worth (more on that later in this article).?
There may be that rare albatross of an organization out there that still permits for 20+ years of service without interruption, but they are getting fewer each decade that passes.? As recently as last year, I know of several persons who were laid off after their having hit or surpassed their 20-year mark at the company where they worked.? So, what happened: Ageism? Poor performance? Forced attrition? Salary top-heavy? Equity top-heavy? Who knows for sure, other than those read in at the company?? But what’s important here is the fact that none of them work at that organization any longer.? Let that sink in, after 20+ years of service, none of them work there any longer.? No attempt to reassign, no chance to apply elsewhere internally.? Just gone.? What a huge loss for everyone – company and former staff.? All that brain trust and organizational knowledge gone in a flash.? And if I were a betting man, odds are favorable that not one of their managers was able to preserve even a modicum of know-how from those who were walking out the door if it was that sudden.? The managers probably had barely enough time to adjust their own initial reactions before the axe dropped on their staff.? What’s even more concerning is it’s not unheard of for that same company to ask you to interview or worse yet train your own replacement on the way out.? How’s that for gravitas?
At this point, you may be asking yourself why you should care, especially if you’re just looking to break into cybersecurity?? Isn’t it more on the front of good news for you – a la “out with the old, in with the new.”
Well yes and no.? The reality is those jobs will likely get recycled, relabeled, and reallocated so they open newer positions at a fraction of the personnel cost than they were paying the former staff in their established roles.? But the people who were let go don’t get repurposed or a second chance in these cases.? They are simply given a severance and sent on their merry way. One day this may and could happen to you.? Loyalty anywhere is a dying staple of American culture and business overall.? Again, when I first entered the market, it was all about “the customer is always right”, now it’s more “the customer is a raving lunatic” and “our business would be great if not for the customers!” Substitute customers here with employees, business partners, or whatever collective group of people is the thorn of the week, and you see the growing trend here.? Obviously, I’ve got tongue in cheek on this one slightly, but the core message is the same - this is not your grandfather’s, grandmother’s, or grandparent’s era any longer.? Heck, it’s not even mine and I haven’t hit 60 yet.? So why continue to feign that it is? Some things die a natural death, and others need to be helped along a little.? So let me toll the bell, loyalty in the workplace is dead. On both sides of the aisle.? No amount of Lazarus project on GitHub or anywhere else is going to resurrect it.? In the immortal words of Kenny Crandell – dishes are done, man![1]?
So, I find it humorous if not downright preposterous to hear or read about all the company saber-rattling out there, and about how and what employees should do for the business and how RTO (return to office) and other archaic practices from that grand generation of long ago are still in play here.? Just because it was done one way and worked at that time doesn’t mean it always has to be done that way, or worse yet, never challenged.? The world did not come crashing down when most folks worked fully remotely during the pandemic.? So, if your job permits it, why force you to come back into an office all for a trumped up, over-tired argument that innovation only happens face-to-face? Horseshit.? Innovation happens when you hire solid talent, get the hell out of their way, enable them without all the bureaucratic nonsense and processes for processes’ sake, and then let them fail.? Innovation comes from inspiration and last time I checked no one is inspired around the coffee maker in the office at 7 AM on “donut day”.? It really makes no sense to me.? Especially in those cases where the “genius powers-that-be” now want to implement a shared bullpen type of work environment after RTO with no dedicated cubicles and hotel style work conditions for a revolving-rather-be-fully-mobile workforce.? Especially when these same organizations are answering the call with their posterizing gestures to let you know at every turn that they are fully committed to implement deeper cleaning procedures whatever the hell that means? Thirty seconds of Clorox wiping versus 15? Who knows?? Seriously, did these companies forget 2020 already? Covid was airborne and lingered on surfaces.? How is less shielding between people and communal workspaces even a viable thought let alone more than a psychotic break of an idea that should have been quashed immediately by the corporate brain trust?? I honestly don’t understand how reduced business overhead always trumps the well-being of your staff.? I would be happy to tell those same organizational leaders where they can gently place their half-height cubicles.? Better yet, put one of their rears in one of these cubicles and set an egg timer.? It won’t be the egg that boils first.? Guaranteed.
Yet let’s not end this segment on a bad note.? Let me instead share an example of a company that truly surprised me and touched my heart at one of the lower points in my life.? To be fair these folks do not work in the cybersecurity space, and they have their own issues/hangups.? But for me, they will always have a soft spot regardless of politics.? Back in 2012 my mother had an annoying cough at Thanksgiving time that I suggested she get checked out.? She passed from cancer that following May.? Those 6 months I had with her were spent going to and from doctor appointments and chemotherapy sessions.? If you’ve never been in the latter’s treatment areas, they are depressing to say the least.? Yet on every Tuesday when the treatment rooms were full of patients young and old, in would quietly parade the local Chik-Fil-A duo – one smiling man or woman, and one wonderful soul dressed fully in their famous cow costumer to spend time with the patients and their family members, friends, or whomever accompanied them to that day’s session.?
This duo would pass out free food and provide coupons for future free food at their location nearest the treatment facility or anywhere you wanted to use it to the best of my knowledge with no expiration date.? But it didn’t end there, they would stay and visit with each of the patients and provide much needed smiles and words of encouragement.? When words simply didn’t do, they just held hands or sat quietly.? They asked for nothing in return and left under no fanfare as they had entered.? While other organizations want to tell you how wonderful they are on social media at every turn, these Chik-Fil-A folks never once posted or leveraged this act of kindness as a marketing ploy.? They just gave. ?Generously and without expectation.?? There is a big difference between just doing, and doing so you can tell.? So, thank you to those exceptional men and women of Cedar Park’s Chik-Fil-A.? You showed me and my family kindness and empathy beyond what I received from my employer.? Tuesday appointments sucked less than all the others for that reason, and no, I never had the free food or used the coupons I took, but I appreciated the gesture none the less. ??
Advice to my younger self:? Learn early that business is transactional. Not personal.? Almost everything can be negotiable: from your hours to your compensation to your location to your job duties even.? But what isn’t negotiable is the company culture and how they treat staff. You will be stuck with both day one.? So, make sure it’s more Fred Rogers and less Jim Jones! Less idiot and more savant!? Do not get hung up or enticed by those dangled carrots alone or smooth-talking snake-charmers who tell you what they think will close the deal or what they want you to take away.? Know what the benefits are going into the job as well as the detractors; don’t just hire on solely for the benefits alone or because you’re offered the first job in your preferred field or specialty.? Just because that most important and trusted advisor in your life said you could do anything for a year doesn’t mean you should.? You will spend a vast majority of your time working for this organization and with the people in it, so take the time to find one that more closely matches your personal and professional beliefs and is in more alignment with your values, business style, and dare I say it … passion.? Study and research how they conduct themselves and do business and know where and when they are taken to task and where they shine.? Do they shed staff like a rain slicker, or do they soak them up like a sponge?? All these things are important, particularly when you’re looking and thinking longer term.? At this stage in your career, you should be there for the outcome not just the income.? NOTE: If you’re not sure how to get started or where on the research front, hit me up via DM or wait for an upcoming article that will address it in more detail.
?
2.??????? Choose the managers you work for even more carefully.? There are three types of managers you will have in your career – bosses, leaders, and heroes.? The heroes are the easiest to recognize.? They swoop in when times are especially rough and save the day.? They don’t wear capes though they probably should, and they don’t demand biblical restitution nor a pound of flesh nor your first born in the process.? They simply provide all-around protection, safety, learning, and stability, and ask nothing in return other than you do the job you were hired to do and ask when you need help (but they will likely know you need help before you do.) They garner instant respect. If you are lucky, you may have one or even two of these in your career.?
Next are the leaders.? These are more common than heroes, but still rare in that you may have a handful of these throughout your career and more than likely they may work in the upper echelon of the organization or in differing departments as well.? ?Leaders help to provide guidance and direction for you.? You can learn easily from them, and they are willing to share.? These managers are adroit and nimble on their feet and in their headspace often being able to think on multiple levels and address and resolve complex and critical issues without calling unnecessary attention to themselves.? Leaders lead.? They don’t have to announce they are leading.? It will and should be obvious when they do so.? Leaders will inspire and challenge you to be and do better. They earn your respect.
Then there are bosses.? Unfortunately, this group makes up the majority of the supervisors you will have in your career.? Bosses are plentiful and range from friendly to uneventful to downright offensive. Bosses push the company agenda in most cases and their own secondarily.? Bosses are easily distinguishable from other supervisors in that they will talk about themselves, tend toward to gravitate or focus on the core messages and project; they often talk at you more than listen.? Bosses will want to express what they are bringing to the table more frequently than other types of managers.? Bosses are akin to bulldozers – they operate well in one direction only, usually forward and usually in a “clear-cutting” style to remove everything from their path.? But if you ask a boss to pivot, turn or backup, the lack of finesse and polish shown by the other managers becomes very apparent.? Bosses also prefer to tear down rather than build up as they tend to be more reactive than other types of managers. Bosses demand respect.
Out of respect for leaving the skeletons where they are buried, I am consciously going to avoid sharing my personal experiences with the bosses I’ve encountered over the years.? To be fair, I don’t think most of you would believe the stories were I to share them with you anyhow.? There are some real doozies! But to be fair, I’ve had a couple heroes, and some great leaders interspersed along the way, so it’s not been all hate and discontent.
Advice to my younger self:? Learn to distinguish between the manager types as quickly as you can.? Pay more attention to the optics, situational awareness, and the unspoken. It can be more deafening than what actually occurs or is “spun” your way after the fact.? Don’t tolerate or expect to outlast the “bosses”.? And for the love of God get yourself out of any situation where the boss is a yeller.? No one needs to be subjected to that at any point.? The saying that people don’t leave companies they leave bosses is absolutely true.? Listen to it and your gut.? Job whac-a-mole[2] is still job whac-a-mole within an organization.? There’s no guarantee you won’t be hit over the head twice if you elect to stay by moving to a different role or department within the organization.? In some cases, you could even end up being placed under an even worse manager than the one you had before.? Horrible bosses are vindictive and often have long memories.? They may even work together by hiring their friends into other management roles.? So, recognize those horrible bosses earlier and get yourself out of that situation.?
Phrases like “we are a great team” and “we are just like family” will be paraded around and thrown your way as motivational weathervanes in the right situations, so just make sure you know what team and what family you are being asked to be a part of first as there’s an oceans-wide gap between the Waltons[3] and the Lord of the Flies[4].? Nobody wants to be Piggy to my knowledge.
?
3.??????? Learn to ignore the noise. Ignoring the things you cannot control, or influence was and perhaps still is the hardest lesson for me in my career.? You often cannot predict nor determine how a given situation, relationship, or business exchange is going to work out. And while I don’t believe anyone truly walks into any transaction, situation, or opportunity with the intent to blow it all to hell, sometimes, it happens. So, knowing how to process that outcome at an optimal level and more importantly, navigate it productively can be the biggest takeaway for your physical and mental well-being and your career.? Not sure what I’m talking about? Let me try to state it a different way.? Most folks in technology tend toward introverted rather than extroverted personalities.? As such, there may be moments of strained or awkward conversations, unintended silence, or uncomfortable business exchanges especially when working outside the IT or cybersecurity sectors, or even with other departments where personalities may skew toward extroversion.? This is normal.? Yet it can also be heightened further if you happen to be one of the rarer introverted types like an INTJ or INFJ[5] and have to deal with statements about being “too passionate” or “taking things too personally”.? These statements are never productive and can have a meaningful or profound impact on you if you’re not well-equipped to ignore the noise factor of them and focus instead on getting through to the deliverables and meeting the true objectives.
I remember a particularly difficult project I was asked to undertake where I had to deploy several dozen security appliances within a short months-long timespan across multiple locations and time zones.? Given the company’s internal operations and red tape, that deployment timeframe was quite unrealistic and something several managers above my level had failed to do themselves successfully leading to those appliances sitting idle in a warehouse for the better part of a year.? Yet it fell to me and my team to have them placed and operational.? We were able to do so and actually exceeded the timeline, but not without constant chatter and pressure from the overarching project manager who was so short on empathy that they actually called me in the middle of a family member’s funeral.
That “noise” stuck with me for a long while and was difficult to overcome.? Needless to say, some years later when I encountered this same person again, they asked me if I remembered them and I played it off casually in my response.? I did not have the heart nor the desire to tell them just how indelible their insensitivity at that difficult time in my life was.? I found myself conflicted when they had called – in the midst of grieving yet still worried about the status of the project as if it was somehow and, in some way, as important as my then situation.? The reality is it was just noise and something that should have been filtered out. I had a hard time accepting as much, and to this day still do given my investment in all I do.
Advice to my younger self:? Filtering out the noise is your albatross.? Others will see you as they want to see you and project upon you as you project upon them.? The best of plans and intentions are likely to go awry at times and you cannot always plan for it, and it may coincide with other down periods in your life.? Recognize that at its core, work life is stranger than any fiction and your imagination cannot even begin to comprehend nor create the situations and the level of “noise” you may find yourself in while working throughout your career.? Try to stay true to your beliefs and values, retain your sense of humor at all costs, and for all that’s holy, hang on to your integrity and don’t sacrifice it for anyone or anything.? As once that’s gone, there really is nothing to be done to reclaim it.? Both reputations and trust are hard-earned.? So, continue to focus on what you do best, continue to learn and grow and try to filter out the crap, the noise, and the cacophony of nay-sayers, nay-doers, and dare we say it … assholes you will encounter along the way. ?Remember you do not have your father’s faith nor his conviction in Phillipians 4:13[6] but that is all right.? How unfulfilling would life be if everyone shared the same faith or ideology?? So again, find that conviction within or external to yourself that works best for you and power through it.? If there is true will, there is true way.
?
4.??????? Recognize when it is time to go.? There has been an over-abundance of discussion and opinion on quiet quitting, return to office (RTO), remote collaboration, the erosion of job satisfaction, skilled staff shortages, ridiculous career entry requirements, and reduction in overall benefits to name just a few of the topics percolating at the morning coffee klatch or making the rounds on job networking-based social media.? So much so that it may be hard to see the forest for the trees through all the “noise” that was mentioned earlier and that accompanies a typical day-to-day.? But what happens when you can see keenly or when you have those moments of epiphany in your career? You know the ones that stand up and refuse to be brushed aside without further introspection.? Are you one to listen to yourself and your gut, or do you “suck it up” and push through the anxiety and the FUD (fear, uncertainty, and doubt)??
Emotions are powerful signals and can be precursors or indicators a cautionary approach, adjustment for well-being, or self-preservation mode may be needed at a given point in time or for a particular occasion to persevere.? Emotions should be analyzed and not ignored, or worst yet, shunned, especially by those who manage you.? Carl Jung is often attributed to the paraphrased saying “the world will ask you who you are and if you can’t answer, the world will tell you.”? So too will the cybersecurity industry or any other field we enter and spend our careers in, and those managers within it, so to deny what our body is telling us is at potential great peril to oneself.
At one company I worked for, I was putting in exceptionally long work weeks and I was asked by my direct supervisor to only put down 40 hours on my timesheet despite constantly working 60 or 70 hours in a week because he did not want to have to answer for why I was working so many hours in spite of it being a salaried position where the hours I worked did not have a direct bearing on my pay.? I remember him getting rather heated under the collar when I let him know I would put down the hours that I worked and that if he then wanted to adjust those numbers that would be something he could do.? I did not hear anything further on the matter for the remainder of my tenure with him.? Again, to be fair, at that time I did not mind the long hours as I found the work fulfilling and important and while I was tired, my body was not yet telling me no more.? However, around this same time, elsewhere within my division, I also remember hearing the story from one of the higher up managers where she was in an elevator with a colleague who had been working similar hours as mine and he ended up passing out in the elevator with her present.? Needless to say, there was a lot of company talk about hours and protecting one’s health at the time of occurrence.? Yet that went on for about a month before company expectations crept back up that you should be putting in long hours and working hard or you should be looking for another job. ??How unfortunate it is that the folks touting the long hours and extended work weeks the most vocally are often the most highly compensated individuals in the upper echelon. Thirty million a year makes a seven-day work week a lot more palatable than a company logoed shirt and one hundred fifty thousand does.
领英推荐
So again, how do you know when it may be time for you to go? Do you really need to pass out in an elevator on the way home from your work week to know you’re burning it at both ends too much and your health is at serious risk?? And what of the company and the management you keep? There is almost never any discussion around protection policies for staff to ensure people don’t “go off the rails” along with runaway or untenable processes.? For every manager who forces you to take time off to rest and recharge, I’ll show you ten more who want you to take your laptop with you when you go on vacation/PTO and will literally look up at the clock when you leave for the day, though interestingly enough they’re never there when you arrive two hours before everyone else does.
Is it when what you’re feeling or experiencing is not just another down day or a disagreement or heated exchange of contrarian ideas in an otherwise routine and positive experience but more an everyday experience? Does it start to creep in on Sunday when you start thinking about having to return to the office on Monday and you already know who’s going to show up and who isn’t?
Just the other day I remember reading a LinkedIn post about an individual who had quit his $500k cybersecurity job at Netflix to take on a job outside that was more to his liking.? Several of the comments were filled with individuals telling this person he should have been so lucky, and how dare he walk away from that kind of money.? I understand both sides of that post.? There are days when you couldn’t pay me enough to perform my job for another minute longer, and other days when I felt like I should be paying for the opportunity and experience I was having.? So how do you know when it truly is time to go?
Unfortunately, there is no one answer that fits all occasions, and different persons will have different thresholds, triggers, tolerances, and so on.? In some cases, there may be no big event or catalyst for change, it could be a peppering of smaller experiences or events that simply add up over time.? But one thing is for certain, do not confuse boredom, envy, or underachievement in yourself or others with a resume generating event.? They are different detractors all together.? Your body and mind will tell you truly and firmly when the time is right for you to move on, especially as you progress and mature throughout your career.? Just be certain you know how to receive the message or messages they send.? Cybersecurity is very demanding yet also very rewarding, and like any other career field it too has its patterns and cyclical approaches.? Recognizing them and knowing what is and what isn’t tolerable will serve you dividends in the long run.
Advice to my younger self:? Know thy self.? Determine what your tolerances and thresholds are early and adjust them as you progress.? What is tolerable 10 years into your career will be less so at 20 or 30 in most cases.? Learn to say no more often.? Be careful in what you sign up for and choose only those opportunities that are presented to you righteously.? Your purpose is not to solve an egregious oversight or lack of vision/planning on your management’s behalf. Your emergency should not be at the behest of their crisis.?
Know your worth.? Learn what you bring to the table and what makes you unique as compared to your colleagues and then lean into it.? Heavily.? If someone with less experience and less knowledge comes in above you, give them the benefit of the doubt, but swing for the fences when they show you their true character/colors.? It’s laughable and downright absurd for a boss to demand your respect if they show you none in return.? If your management does not recognize your skills and strengths, and more to the point simply refuses to ask or find out, it is most definitely time to leave.? You are not valued there; plain and simple.? You can remain positive while looking for a viable exit and continue to be a champion for change and wish that things will get better, but take heed from Burgess Meredith’s character in Grumpy Old Men.? His words of wisdom[7] ring ever so true.
When it is definitely time to move on, be certain you have saved up enough to allow you the opportunity to move jobs or be out of work for a small period until you can find that right fit.? It is always easier to find a job when you already have one so do not be rash.? Yet know there may be times when you must simply GTFO for your own sanity’s sake, and for those times, be certain you have a reserve fund you can fall back on to get you through the transition.
Lastly, try not to take yourself too seriously.? This one can be difficult to do, especially when you’re male, as men tend to wrap their identity up more concretely in what their job is than women do.? You don’t seem to tend toward this as much as some others do, but there have been times when you could have just as easily side-stepped versus plowing straight ahead.? So, remember, you can and should continue to embrace and employ your sense of humor more. ?It can save you from a lot.?
5.??????? Get it in writing. Always. I would like to think that most people are honorable and keep their commitments without additional prompting.? For this reason, I often look for and seek out those individuals who still perform handshake deals and are persons of their word.? It’s much easier when everything and everyone is above board and speaks from a place of truth.? Unfortunately, it doesn’t work that way when there is competition, rivalry, and/or politics involved, and it certainly isn’t the smart person who expects every situation to magically sort itself out to align with the universe.? If you are a dreamer, learn to become a pragmatist quickly.?
When it comes to you and your career in cybersecurity, get everything in writing and preferably signed format.? Sure, it’s nice to be told you will be rewarded with x if you do y.? But unless you have that statement in written form, good luck being able to bank on it, literally or figuratively.
Companies and managers are always going to want you to do more and often without additional compensation.? It’s just part of the ever-growing list of job duties you have. It’s not like a trade career where you will get compensated for both your work (labor) and all the parts or components you need to put into the equation to make it work.? Unfortunately, companies and managers in cybersecurity are going to want to use all your skills regardless of whether they compensate you for them.
Case in point, I did a stint in fraud and forensics investigation.? I was successful at it and did well in that field. Several years later I was seeking employment as a penetration tester and the hiring manager kept referring to my fraud and investigations background and telling me I would, under no circumstances, be performing fraud and investigations work and was I okay with that? After several rounds of discussion and emphatic reassurances on my part that I was and that I would not be unhappy with a focus limited to penetration testing alone, I was hired on to be a penetration tester.? The first week into my employment with this company, I was sent off-site to perform a forensic investigation.?
Did I care? Not really. I like forensics and investigations, and my skills were still fresh.? But was I compensated at the forensics and investigations consultant rate, or was this written into my job description that the company also signed when I hired on? No. Did I make this clear to them at the time? No, but I should have.
Advice to my younger self:? Know your worth and value to an organization.? Be cautious of those companies and managers who want to tell you you are fortunate to have a job.? If you are smart, skilled, and competent, it really is the other way around – they are fortunate to have you.? When it comes to anything promotion, raise, or monetary – be it equity, stock options, etc. – always, always, always ask for those commitments in writing and have them secured before you agree to move to a new role, take on more responsibilities, or do something you don’t relish because it benefits the company more.? As the saying in security goes: trust but verify. This is especially crucial when you’re dealing with individuals who can directly influence your career and impact your bottom line.
Do not give away your expertise or skills for free.? It’s wonderful to want to give back and contribute above and beyond, but more often, it is the person giving freely who is the one who pays the most.? Learn to recognize and always know when the “juice is worth the squeeze”.[8]?? For example, if you offer to train or mentor someone for free, be prepared that the recipient may take it and run without even a simple thanks.? Instead, make them invest a little as well so you have a more simpatico arrangement.? When it comes to paid employment, know again what your boundaries are and say no when the lines continue to be crossed. No one owns you. No one is entitled to more of you or your time without additional consideration regardless of what they might believe or how much they try to persuade you otherwise.
If you’ve made it this far, thank you for putting in the time to read this post.? I hope it was and will be of value to you in your own endeavors and over the course of your career in cybersecurity.?
If you’d care to do so, please reach out and connect over social media or share your own thoughts and input on the above or anything else I’ve written.? I really would like to keep the conversation going.
[5] https://www.mindfulnessmuse.com/individual-differences/myers-briggs-8-introverted-personality-types
Looking back is always a good exercise for perspective and growth, especially in a field as dynamic as cybersecurity ??. Sharing these insights is a great way to help others navigate their careers and avoid some common pitfalls.