Crossing the Cybersecurity Staffing Chasm - Recorded live discussion

And you don't get to hide, by the way. This is going to be an interactive discussion, which means I'm going to be up here talking, but you all are all going to be asking questions and giving input and thoughts and perhaps even going, "No, that doesn't seem right." Let's have a discussion. This is your life. This is your career. How many people here are people going into the cybersecurity industry? Okay, I know you guys are. You just graduated, so you're either in or you're going in, right? Once you're in, you don't stay stagnant, so you keep going, you keep going, okay? So most of us are here, right? We're either at the first stage of our industry journey or we're, you know, well into it, right? Now I'm going to throw up some slides. We're going to be talking about stuff, but what really matters is what's going on in your head. What questions you have, the challenges or the fears of the challenges that you're gonna face. Some of them are absolutely real, tell you that right now. We're gonna talk about that. But what can help you the most is where you're throwing questions at me. How do I get noticed for that first job? Should I apply for this kind of position? How important is a certificate or experience or knowing people in the company? Those are all great questions. But you've got your own questions because you're on your own journey. We'll talk more about that. And I mean, we talk. If you don't ask any questions, I start asking questions of you. I am ruthless. I will pick on each and every one of you, just so you know. Are we all good? Okay, let's get started. All right, so what I want to talk about today is this chasm. We have, we have lots of problems in our industry, right? Right now, if you took a broad swag, there's about 600,000 open positions for cybersecurity here just in the US. When we talk about globally, you're talking 3 to 5 million, and again, those numbers are a little squishy because it's not just those frontline analysts. What constitutes a cybersecurity job? Gee, just about anything you can imagine. Architects, engineers, developers, security operations people, analysts, um, let's do security marketing people. Yeah, yeah, there's security marketing, project managers, program managers, you name it. If there's a discipline out there, there's probably something tied to security. If there's anything of value out there, there's there is likely a job, a role, or part of a role that ties in with security because wherever there's value, there's always somebody trying to scoop it up that shouldn't be and you need the defenders to be able to protect it. So our industry is not narrow. It is incredibly broad.

Okay?

I just got a question. So I do a lot of talking, keynotes and stuff like that. I also put out a series of videos because I go to different academic institutions and talk to people. I do these, it's like a TechEd series where people ask me questions. The last question they asked me was, and I published a video on it, you know, is there any intersection between AI and cybersecurity? Oh, yes, absolutely, absolutely yes. At every stage of that, yes, yes, yes. And when I talk with marketing folks, you know, hey, is there an intercept between marketing and cyber?

Yes.

And I get somebody going, you know, hey, I'm a I'm certified for project or program management. I'm really good. Is there a spot for me inside? Yes, come in, please. We need you. Every company out there needs, if they've got something to protect, somebody in cybersecurity at some level. So there's this tremendous need and you're thinking, hey, this is awesome, right? And it is, but There are also challenges, and we're going to talk about those because it's not as easy as you think, and it's a lot more convoluted. We're going to talk about it from your perspective, but in order to really understand the problem, we also have to kind of talk about it from the perspective of the hiring organizations and of the educational institutions out there. Okay, so that's what we're going to cover today. Maybe next slide. Okay, by the way, you're the one in the cape. The industry needs us, needs us desperately. Even though there are millions of open jobs, we're talking about potentially trillions of dollars of impact and loss because there are bad people out there that are doing bad things that are stealing and defrauding and, you know, ransoming, extorting, deleting, removing, altering, doing all sorts of different things from disinformation and misinformation to straight-out theft and embezzlement, hacking, you name it.

Okay?

So, we need people. And although there are great tools and technologies, amazing tools and technologies, cybersecurity starts and ends with people. Every single attack that you've seen, Ever started with somebody. They may have used a tool, they may have exploited a vulnerability, but there was a person that was behind that. And at the end of the day, there's probably going to be a person that's setting up tools or doing monitoring or handling investigations or incident management, whatever. The defenders also matter, and it is battle. It's not guns and bullets and standing in the mud, but it is a digital battlefield. But that's the game we play, and it's different than the IT world. How many of you started in IT or have a background in information technology? I see a couple of hands. Y'all aren't telling the truth. I know more of you You know, no IT. Okay. IT, the world of IT, is fundamentally different. In fact, we call it a single-faceted type of problems that you find in IT. If, for example, the power supply on your server goes out, what do you gotta do? Well, you'd have to go down to the data center and pull the server out of the rack and rip out the power supply, slap in a new one, reboot it, and you're good to go. Right? Pretty straightforward. It's a pain, and it's cold in there, and all that, but it's straightforward. In fact, it's scriptable. You could write down those instructions and hand it to anybody, and power supply goes out, they could go do it. But wait a second. You can also predict. There's mean time before failure rates. There's all these. So you can go, "Okay, power supplies only last 3 years." I'm gonna buy one, a spare one, and have it sitting there. So if it goes out, I can swap it out. And I know about every 3 years I'm gonna have to. Well, you know what? Well, why even do that? If I know it's gonna fail in 3 years, in 2 years and 11 months, I'm gonna proactively nicely shut it down. But it's all scriptable. And once you replace it, you're done. Emergency's over. In cybersecurity, it isn't that way. We consider it a multi-faceted environment. Because if somebody attacks you, you have to detect it, you have to try and block it. What are they gonna do? Do you think that attacker is gonna go, "Ah, darn, I give up, time for lunch." Uh-uh. They're gonna find a way up, over, around, or through whatever you did. It's not over. It's not over until they say it's over. Right? So they continually adapt, and then you adapt, and then they adapt. That is not very easily scriptable. It's not predictable. And it becomes very, very difficult. So that's kind of the mindset that we deal with. If you like the predictable, IT is great for you. If you like the unpredictable, potentially a little ambiguity, You want to wear the cape? You want to get that extra 30%? It's about that between an IT role and a cybersecurity role. It's about a 30% increase in, in pay. If you want, you get to wear the cape. It's not easy though, right? Every day is going to be different. So we do deal with technology very heavily, but at the end of the day, it's the people. That matter as part of that equation as well, okay? And that's you. And the employers, most of them, know that as well. So when they're looking to fill a role, it's looking for somebody who can work with technology, who can work with processes and communicate, do all these things to be able to defend their organization and their assets. Okay, next slide. Now keep in mind, I'm gonna post this out to my LinkedIn, so there's a lot of words. I normally don't have a lot of words, but we're gonna go through this here and you're gonna be asking questions, so it's gonna be great. But you'll have access to this, okay? And I want you to have access to this. Okay, so the overall cyber security staffing problem. First, that first bullet there is the demand for talent, right? They're estimating in the millions right now. That's going up. Even though so many more graduates are coming out of college, so many more people are getting into the industry, not keeping pace. It isn't. The demand grows every single year. So we've got a supply issue. Demand is high, supply is not where it needs to be. There are challenges for education and experience because in most cases employers want somebody to hit the ground running. They want somebody with experience. That's a problem. And it can be in many cases very unrealistic in what they're asking for. Employers struggle in articulating what they need. You would think a company would know, I know I need a security analyst, or I know I need a security architect, or I know—

they don't.

Shh, they don't. In most cases, they're, "I need security. How do we bring somebody in to handle this?" Okay, well, what do you need them to do? "I don't know, I'm not a security person. What? Well, we just need them to stop the bad guys from doing bad things. I saw in the news that this company was breached. What does that mean? Get somebody to stop that." And that's how that discussion starts. And unless you have a CISO or an experienced security leader going, "I'll write the job "Job wreck, go back to your office, I'll take care of it." Or unless you have a really good HR person that knows, there are very few of them, that really knows, "Oh, I know what you need." Most organizations don't, and we can see that. We can see it in the job wrecks. Horrific, horrific job wrecks out there. But we'll talk a little bit more about that as well. Academia is challenged, right? You can, you can talk to the people in this room in getting the graduates to have those skills, right? You can talk about the CompTIA, you know, the skills have to constantly change. So their job is actually— there's several challenges. One, they need to attract people to be able to get in the program. Two, they have to make sure the program is competitive and gets them what they need. And three, they have to help people get those jobs, get in the industry. And it's not easy, not easy at all. But we'll talk a little bit more about that as well. And graduates, you It can be really tough to find that first job. Really tough. And you're thinking, wait a second, all these jobs opening and it's tough to get it? That doesn't seem right. We're going to talk about that because you need to understand. If you don't understand that, you're going to get frustrated. You really will. And I want you to succeed because I want all the brightest people possible to be in my industry. Okay, so it's good to set expectations and talk about reality. Some of it's fun, some of it not so much. Okay? All right. So let's talk again, small words. This is really for when you download it if you want it. Let's talk about it from a student's perspective. Hopefully this resonates with you. The uncertainty. You had to make a decision to go through this program or some other program to get a bachelor's degree in science somewhere or go through some other— Which one should you do? I get approached with that question a lot. I also talk even down to high schools and so forth. I actually get this as well, even from college graduates. Okay, what do I do now? Should I go get my master's in this? Should I go get a certification? What do I do? What do I do? And there is a lot of uncertainty, but it's a value calculation. And if you know what you want to be at the end of the day, you can start backtracking from that. If you're like, hey Matthew, I really want to be a CISO, I think that's a "Best job in the world." You know nothing. But anyway, um, okay, great. Let's backtrack from that because you're not going to be a CISO day one. Let's figure out that career path and what's your entry vector to be able to get to those jobs, to get to that dream role, right? If you know that path, this becomes a whole lot easier. But a lot of people don't know that yet, and the reality is that dream job may not even exist yet. Right, the world is changing so fast. Number 2 here is, is, is painful, right? Frustrated in getting hired, and in almost all cases being told you got to have experience, you got to have experience, we wanted somebody with experience, experience, experience, experience. You will hear this again and again and again. There's reasons for it, there's absolute reasons for it, okay? But we'll talk about how to overcome that, how to address that. And then lastly, finding that entry position. The sad state of affairs is if you go out and you look at job reqs for entry-level positions, you will find a vast range from, okay, no experience— there's not that many that say no experience, but there are some— to no, we want you to have 10 years of experience. Entry-level position, 10 years of experience. Are you kidding me? How is that an entry-level position? Colleagues of mine and HR people and so forth. Oh, question? Yes, yeah, first question, thank you.

More like a comment.

Okay. My mom also kind of has the same issue, kind of in reverse. So she works in accounting. Oh, okay. She has about 20 to 25 years of experience, but she's finding it very hard to get a job in just accounting. And the only reason is not because she has the experience. She only has an associate's degree. Uh-huh. And most of the companies that she's trying to like get a position at are like, you need a bachelor's. Yeah, so I've kind of, I've kind of seen that happen in like a different part of the corporate world as well. And we see that in very established, you know, kind of job channels where there is very, very formal training. You need to have X, Y, and Z, you know, we need this. Cybersecurity is not that way. It changes. All right, I was actually part of the group under National Science Foundation under NICE. So it was the government group that helped define what it would take to create a cyber degree. And this is what the universities are now using. They're using these standards. And we said, we outlined right in the beginning, by the way, this is going to change drastically. We will put the framework in, we will fill it out for today, but you— it has to continually evolve. When I hired people at Intel, whether it was for a frontline analyst or a supervisor or an architect or developer, I would always sit down with them. And I would say whatever you're doing on day 1, I guarantee it will fundamentally change within 12 to 18 months. Fundamentally change. Might be your job description, might be who you're reporting to, it might be the team you're on, it might be your goals and objectives, it might be the primary tool you're using. But it's gonna change. The only thing consistent in cybersecurity is the ambiguity and the chaos. Okay, so if you are not comfortable in that environment, this, this industry is gonna be tough for you. If you find that exciting, going, I kind of know what I'm gonna do today, but a whole bunch of crazy stuff's probably gonna happen, and you're okay with that as you're drinking your coffee on your way to work, then you're going to be just fine. It is a continual learning process and there is always an opportunity to get better and to do more. Always. So it is good. Thank you for that comment. Good, good, good. Okay, let's talk about it a little bit deeper in the academic institutions here, right? In finding the curriculum. Curriculum tends to be the toughest. And again, I'm on the advisory board for, you know, University of Phoenix, Brandis University, Dominican here on the West Coast, just north of San Francisco. But I also work with other academic institutions. So figuring out, okay, what are we going to teach them? Because again, everything is changing every 6 to 12 months and somebody's in like that master's degree. And they're gonna be there for 6 years, well, what I taught them the first 4 years, is that gonna be completely worthless? Maybe. You know, you're gonna have to start thinking through this. And how do we weight the back end of that to give them the skills that they need? Academic institutions are really challenged to show the value proposition. Normally they will start off by saying the same thing that I said. There's lots of jobs out there. They pay a 30% premium, right? Okay, that might start to hook people in. But there's also, again, that ambiguity, that chaos that can create friction and tension. There's difficulty in getting into the field. There is a tremendous amount of expectations, and that can lead to stress and burnout, right? There are some other things, and the academic institutions have to lure you, the candidates from other institutions that you might instead go to. So there's competition there, but the competition in this case actually works for you. Most academic institutions, for most of their degrees, they don't have to change it much. They really don't. In cybersecurity, they do. To be competitive, to show that value, because they want their graduates to be able to get those jobs. And if they're teaching stale information— last year's, 3 years ago, whatever— right, it's not going to work out well. Last one here for academic institutions is the ability to extend those studies, to partner with internships, and to handle placements. And we talked a little bit about it's tough to get that first job, and it is. I guarantee you, it is. You may luck out, awesome, but a lot of people struggle with getting that first job. So the academic institutions are now moving to help cross that chasm, and they can do it a couple of ways. So they can partner with different organizations out there, businesses, and help establish a long channel because they know this these large companies are going to continue to hire every year. Okay, great, we'll partner with you. We will even tailor our, our training to help place these people in your company. It becomes a good partnership. Academic institutions can also work to establish internships.

Why?

Experience. Again, almost all the hiring organizations really, really value experience. Even with entry-level people. So the academic institutions that can do that gives their applicants and their students a leg up. So there's lots of things that they can do. Continuing studies is another one of them. Just because you get into that first job— congratulations, you're having fun— you're probably not going to want to stay in that, just that one job. You're— you've got a path. You want to go to the next role and maybe over here. I started as an analyst, but I'm really liking some of this engineering stuff. Oh, I'm in the engineering, but I really like this AI stuff.

Great.

Because the academic institutions, career advancement, they can help support that. So there are things that they can do, but there are also challenges to make sure that they have the resources to do it and it's effective. Okay, the employer is my favorite one. You love them and you hate them. Simple put, right? You love them because you're hoping they're going to give you that first job, that opportunity, or when you're in there, they're gonna— it's gonna be a good company to work for and they're gonna help you on whatever career path you want. You're also gonna hate them because a lot of times they're not gonna give you that first job, or maybe it's not the right fit for where you want to get up and go to work in the morning. That's okay, that's life. But we have to look at it from their perspective. First one's most important. They need cybersecurity talent. They may not exactly know what they need, right? They'll put something down on paper. In fact, what they're actually going to do is they're gonna go do a search for some other company who might have a role like that. They're gonna copy-paste and say, okay, this is now our job req. That's all great and fine, but the problem is going back about 15 years, nobody knew how to write a job req for anything in cybersecurity. So there were some very ambitious people going, "Well, what certifications are there out there?" And they just grabbed them and slapped them on, not even knowing, right? Well, how much experience does somebody need in finance? Well, I mean, bachelor's degree, well, that's, you know, 4 years. But 4 years?

What?

But that's the mindset, and that's what those original recs were out there. And guess what? Everybody after that started grabbing those. I still see horrific job recs that are completely away from reality. I had one, and this— I was still at Intel, and I was looking at it., and it had asked for, it was, it was a certain analyst, risk analyst, so on and so forth, and they were asking, hey, you know, you have to have these certifications, you have to have experience in these risk methodologies, one of which was Tara, Threat Agent Risk Assessment, and it said you needed to have 6 years in, in Tara, and I thought it was a little odd, so I actually called them up and said, I noticed in your job rec you have all these requirements. Yeah, absolutely, right? I'm talking to the HR people. Absolutely. I said, well, you know, can you, can I talk with a hiring manager or something? And they said, okay, fine. So we're talking and I said, you know, I'm noticing you needed so many years. And I think it was, I think it was 5 years, 5 or 6 years. I think it was 5 actually. Um, you know, in Tara. And I said, yeah, I'm familiar with it. And he says, no, absolutely. I need somebody with at least 6 years in this. And I said, you know, I, I, I don't think you're gonna find anybody that has 6 years experience in this risk methodology. Oh no, no, no, no, we have, we've got other applicants. I said, wow, that's impressive seeing as how I was the one that created it and I only created it 5 years ago. So if you've got somebody that says that they have experience in something a year earlier than I created it and published it, that'd be pretty impressive. And I said, you just grabbed stuff and you threw it down there. This is a pervasive problem. We're gonna talk about how to overcome that. And I've got partners in the industry that are actually working very hard to overcome that, and I'll mention some of them. I'll mention Daydream when we, when we get to the right slide. Okay, so that leads us to the next one. They've really helped need help in understanding what they need. Now, if they've got a CISO, an experienced CISO, that CISO is going to tell them, okay, I need this, this is what I need, and they're going to help them write a good rec, especially if they've been in the industry for a while and they understand what's available and everything else. And you'll be able to differentiate those good recs from ones that just have everything and the kitchen sink, randomness, and a long list of randomness. It's impressive. Right, how long the wrecks can be. So a lot of them really need help, and that from your position, you're not gonna be able to help them, but you can go through agencies that do help them, right? And don't take it, don't take it for granted. The last one, 60 available talent channels. If you're an employer, especially a large employer, right, I worked for Intel, 23, 25, actually, contractor first year. But they needed a constant stream. Heck, just me and my department, I needed a constant stream of people. So finding that when the rates are high, the number of available qualified candidates are low, it's tough. It's frustrating. Sometimes you give up and you're like, I'll just go hire one of my software engineers and try and train them. Right, it gets very, very frustrating, but it's an important point because the employers are struggling to get it done too. So we do have great talent and ambitious, smart people that want to come in the industry, but there's this chasm between that and the employers that really need those smart, ambitious people. We don't have the right communication. We don't have the right expectations. So we have to bridge that, and that's what it's really about. If we can do that, that's how we win. That's, that's how we get a chance at winning. Bad guys still have the advantage. Okay, so let's go to the next slide. So here's my recommendations to you. I think I've got a total of 6. The first one Narrow down your interests. How many of you know exactly what you want to do in cybersecurity? Raise your hand. 1, 2, 3, 4. You guys are awesome. 5. That's actually probably the most I've ever seen in any talk. I still don't know what I want to do when I grow up, honestly. There's something new and exciting every day, every week. They're going, hey, maybe I'll go do a little of that, right? It's gonna change. You guys know what? You have an advantage. A lot of the people that I talk to, they're like, I love cybersecurity, I love the concept, the idea, the all, all the things. Well, what do you want to do? I don't know, there's so much. Okay, well, there is so much. The first thing you need to do is at least eliminate things that you know you don't want to do. Narrow that field down. You don't have to pinpoint exactly what you want to be. But narrow the field down, right? Instead of 1,000 different jobs, narrow it down to a couple of hundred. But if you can do that, you can start using tools out there and start looking up those jobs. Remember we talked about, okay, dream job and work backwards? There's tools out there that will help you do this. Cyberseek.org is one of them. It's, it's paid for by the US government. I think it's run by one of their contractors um, but on there it shows a couple of things. How many jobs are available in each state, which is great, but the feature that I like the best, and it's free to use, is you can look at different job descriptions and it'll tell you, okay, kind of what they do, what they make, what they're making in each state and all that. But it'll show you different career paths to get to that. And everybody's going to take a different path. You don't have to take the same path as him or her or whatever.. But you can see that and go, okay, now I kind of get it. I can see some of the steps. And it doesn't mean you're, you're tied in and you have to follow those steps, because you may get into your first job, your second job, and go, yeah, that would— I thought that's where I wanted, but no, it's really over here. This is what it— awesome, you have that flexibility. But to get in, you want to start on the right foot. So using tools like that can really, really help you. The other one is CyberSN. This is a Deidre Diamond site, and her and I have been talking about this problem, by the way, for almost a decade now. She actually started up a site, and she's a— it's like a recruiter, it's like a, you know, a job placement thing. But one of the things that she did, and she was one of the first, is she started creating profiles Cybersecurity analyst, right? Describe what the job is. Describe the average pay. Describe what their daily activities are. Describe what skills they need, hard skills and soft skills. Describe what degrees and certifications will help this person, right? It's like a roadmap. And again, it's all free. You can go in there, register for free, and take a look at all these different job roles. I think she's probably up to 40 or 50 by now. But it's a great resource for you. So again, the end goal is to kind of narrow it down. Don't have to exactly pinpoint, but at least narrow it down some and start to understand, because that will help you in deciding, do I stay and get another certification or a degree, or do I jump in right now? What do I do? You got to make that decision. These kinds of resources can help you. The other thing Deidre started doing, and she's again fantastic, is when businesses, employers would come and say, yeah, I think we need an analyst, and they would give her a, you know, a job req, and it would say 5 years of experience here, and she'd hand it back and go, nope, that is not an entry-level position. And she would actually work with them. So she has templates for employers. Oh, you need a cybersecurity architect, software developer architect? No problem. I've got these 3 templates here and you can look at it and maybe tweak it, but this is what you want to post, right? This is what is going to go up on the site. And it removes a lot of that ambiguity and all that, you know, unreasonable kind of fodder that filters into some of these job reqs. The other thing she will tell you, and I will tell you as well, it's probably on the next page, but I'll tell you right now. If you're not sure, you're looking at a req and it says you need something and you don't have it, apply anyway. Again, we already know the employer doesn't really know what the heck they're talking about. It doesn't hurt you in applying.

Try.

Okay, okay. So, uh, oh, the other thing you can do is you can Google, right, list of cybersecurity jobs. If you want a very long exhaustive list, you can go do that. And that list changes all the time. Every new technology that comes out, there's a new security job, right? Uh, Gen AI, there's already a handful of jobs, security, cybersecurity jobs just around Gen AI. All right, quantum. As that comes out, there's going to be another whole slew of jobs just for that. Every new technology, we will see new roles, new expectations, and that's part of the chaos in our world. Those expectations are changing. Okay, second tip: follow and learn from others. Once you kind of narrow down, okay, maybe these 5 or 10 or 20 or however many it rules I'm kind of interested in. Go out to LinkedIn, which you all should already have an account, right? Because that's how professionals present themselves. And by the way, every single person I hired, I would go out to their LinkedIn account and take a look. I want to know what are they posting, what's their experience, even if they didn't have any formal experience. What are they posting? How do they communicate with them, with their industry or other people? Right. What activities have they been doing that mattered? That is essentially a living part of your resume. And I would go see what are they posting? What kind of comments are they listing? Are they doing anything in the industry, doing research, going to, you know, hackathons? Doing whatever. That shows initiative. Very, very valuable. So, okay, so we've got LinkedIn. You want to go find people in those roles. Maybe you want to be a CISO someday. Great. Follow me and a whole bunch of other CISOs. A couple of reasons why: you're making contacts, but more important, You're seeing how that job views problems. Cybersecurity news comes out every day. It's almost all bad news, but comes out every day, right? You may have a certain perspective on a problem. What you want is you want the perspective of the job that you want. You want those people, the best in the industry. How do they see that problem? Somebody pick a cybersecurity incident you've seen in the news in the last few days.

Yes.

This one actually kind of happened to me personally. So Vans, the VF Corp, got hacked recently while I was still working there. That was a very interesting situation to be in. It is! Especially when you wanted to go into cybersecurity. I'm like, "Oh, I'm on the other end of this." So you've got a company that gets hacked.

Right?

What— and you want to be a CISO, or you want to be a security architect. A security architect is going to have a different perspective than the CISO or the security marketing folks who's trying to do spin control. They will view the problem differently, and you need to get into their mindset. You can learn so much. And when you start getting into that mindset, now you can contribute. You should be jumping into those posts and 23andMe got hacked the other day, right? And I won't get into 23andMe too much, but essentially they got hacked, right? Their customers lost some sensitive data and they sued the company, and the company came out and said, it's not our fault, it's the user's fault. So it's, it's an interesting situation. Now, when you look at it from the CISO's perspective versus the security architect's perspective versus, you know, the CEO's perspective or whatever, it kind of changes. But you need to be able to— if that's the role you want, you need to be able to sympathize or empathize with that position. You may not agree with it, but at least understand how that person is thinking, what's important, how do they view the problem. So following others, you can learn from them. You can also join the conversations and ask a question. I see it all the time and I respond. So you can become part of that discussion. By the way, that also looks really good when somebody looks up your LinkedIn account and and you've been talking with one of the top CISOs or security architects in the industry and having a discussion.

Wow.

Wow. Right? Makes a difference. You'll learn a lot. The next— this is real important— look for real-world experience. Sometimes it's internships or fellowships. Sometimes it's just volunteering. Sometimes it's just going out and doing hackathons, doing a cyber lab. Many of these things are free. In some cases, you can go out and get free copies of tools. There's a whole bunch of open-source tools anyway. Go out, learn, play, break, do stuff legally, right? There are cyber ranges to go off and do all sorts of things. I know the guy that started way back when the Arizona Cyber Range. And I think it's still running. You know, it was free. They had actual classes you could do, but basically everyone was welcome to log in anonymously. He didn't want to know who was there, and he would give you a safe place to blow stuff up. Take your favorite malware, take your suspected, you know, bad code or bad attachment you got in email or a bad link, drop it in, see what happens.

Right?

That gets you experience. Now, some of those things you can put on your resume, you can put on your LinkedIn. Others still give you that experience because at some point you're gonna be sitting down with a hiring manager and they're gonna be talking, oh, this got hacked, that got hacked, and you will be able to say, yeah, I use that tool. I went and used it on this cyber range and blew this up and it let I've got these things and— wow, that's impressive. As a hiring manager, that's impressive. Somebody that on their own initiative went out and started playing and breaking with stuff. I want that person.

All right?

It makes a difference. Okay? So seek as much real-world, hands-dirty experience. And I've had people, you know, students from various different programs go to companies in their, in their community and go, you know, hey, I see you're part of this industry, they're getting hacked, data breaches, I'm a cybersecurity student, I'd love to volunteer a couple hours a week just, just helping out on the security stuff. Okay, it's not a bad idea either. All right, next slide. So the recommendation number 4, build your professional brand. This is— unfortunately, we're all friends here, we're all colleagues, we're all in the same industry, industry, and we all compete with each other, and that's a good thing. It drives the very best out of all of us. But understand, take advantage of what you can, and building your professional reputation and brand sets you apart. And again, anything you can put on your LinkedIn account, that's going to differentiate you. Anything you can put on your resume, if they read it, that's going to help you. Anything that you can discuss intelligently with those recruiters, more importantly with the hiring managers, that really differentiates you. Okay, but that takes work. That's not just, I got my certification, that's interesting, what else you got? Okay, certifications, degrees get you in the front door to get that interview, right? A lot of other people get weeded out. So that gets you past one barrier, but that doesn't necessarily get you a signed contract. There's more work, and that's going to be true not only for your first job but your second, your third, on and on and on. So always look to build your professional brand and reputation. Be careful what you're saying on social media as well, especially on something like LinkedIn where they're going to look that up. If you're saying something unprofessional, people will go, whoa, this person's a liability. I don't necessarily want this person in my company. I've seen that a lot. Okay, so you are a whole package, and they have to look at that because of liability and customer issues and all sorts of stuff. So the more professional you can be in everything that you do, especially online That's gonna help you. Next one, build your professional network. You can follow anybody on LinkedIn. The other thing you can do is you can connect with them, and there's actually a limit on the number of people you can connect with, so it's a little more exclusive, and normally it's people you've met and you've worked with, you have a professional relationship with, things like that. But as you start following and connecting, right, you go out on LinkedIn and you see somebody, you know, a security architect, and you want to be a security— they were posting on something, you join that conversation and you were asking questions and going back and forth, and maybe you even provided some of your insights. Well, you know, hey, I kind of view it this way, right? That's a prime opportunity after that to then connect with them. And every connection you make helps you in your career. And you think, well, of course, right? Because when I'm looking for my first job, I'm going to be using these people or reaching out, and they're going to be able— when I post something, they're gonna see it, right? Of course they're gonna help me on, on day one, or get to day one. In actuality, I use my connections now when I run into an interesting problem. And again, chaos and ambiguity rules, so all the problems have not been answered. We don't even know all the problems yet. So leveraging your connections is huge. When I run into a problem, it's great because I can go out to the top 5 minds in my industry on on cybersecurity metrics or whatever and go, hey guys, hey, what's going on with this? You know, this is what I think. And we will banter back and forth. We will jump on a Zoom call and go, what do you think? And we will just hammer stuff out. That resource again makes you better, makes you Superman or Superwoman because now you have the strength and intellect of all those other people in your connections, right? Helps you further in the career and helps you for whatever organization you're trying to protect. So building your professional network is a superpower. That's your cape. You still get the jammies you wear outside and the funny boots and all that, but that's important. And lastly, don't be discouraged. You're gonna run across reqs that are so far away from reality, it's absurd. You're gonna run into employers that say we want this, but they really want that. You're gonna take job and they say, okay, we want you to be an analyst, and then on the first day they're like, huh, actually it's an architect job. What? What? It's just the way it is. And you may get into that awesome job, oh, I wanted to be an analyst, I'm an analyst, and when 6 months, everything's changed, right? Your favorite tool they're no longer using, you've got different priorities and objectives, management has come down, ah! Love it, hate it, it is the reality. I love it. I have a passion for it. But don't be discouraged, and especially going after that first job. Man, I don't fit any of these reqs. I don't have every single thing that they're asking for. Apply, apply, apply, and apply. And write out in that cover letter why you think you are going to be good for that organization, because that's what it's about. Right, how are you going to help them? And if you've done everything else here, right, and it's— oh, you said you had worked for a company and they got breached. Yeah, right. If you're filing because they suddenly open up a job position because they were— their data was breached and you're applying for that job and you have all these other knowledge and, you know, experience that you've worked on, as part of that cover letter you should be going, yeah, I specialize in protecting data from breaches. Yes. Yes, I have worked with different groups and I've contributed to these different things, especially with companies that are just starting out their data protection teams, right? But Taylor, you will have a lot of resources here. You have to make the best that you can with what you have. Alright, let's go to the next one. Actually, let's, let's go back. Any questions? Let's go back one more slide. I want to hear from you guys before we get the last couple of slides. Any concerns or issues with kind of narrowing down your interests, learning from others, or gaining real-world experience? Yes, sir.

So I tried connecting with people on LinkedIn. Yes. Like not commenting, but like messaging them for advice on how to get started in cybersecurity, and I've got like nothing, any kind of response. But then I'm thinking too, hold on, I'm trying to start in cybersecurity and I'm messaging people who are already in the field for like, I don't know how many experience. I know how their mindset works and they're probably thinking I'm some kind of attacker or fake account or something like that. But in reality, I'm just like, can I actually help, man? You mean something, you mean what is IFAW?

Okay, so on LinkedIn, just like Facebook and Twitter or X or whatever you want to call it, there is a profusion of fake accounts. How many people get fake account requests? Or, or everybody should have your hand up. If not, you're not a security person, right? We all get them. I get them a lot. One of the things that as a security professional you're gonna have to do, you don't ever want to be the victim. It makes you look really bad. This is your field, you should know better. Right? So you tend to have to vet them with a little bit more scrutiny. So if you try and connect to me, right? I pull up— because I do— I pull up your profile and it says you just created this in the last year, you don't have any posts, you commented once or twice, you have 16 followers and 47 connections.

Done.

Done.

In fact, the chances that that profile is bad is really, really high, right? The ones that I get have a lot more followers because they have bots that automatically follow them and cross-pollinate everything. So I'm used to the ones that, okay, I've got 1,000 followers, and I'm like, oh, that's a fake picture, that's this, that's this, and I can look them up. By the way, if you ever want to work on your skills, do that. Yeah, I'll do that on a weekend sometimes in between stuff that I'm doing. I'll pull up and I'll grab some of them and go, let's really find, right? Is this person real? Is it not? Is the company real? Is it not? And again, at my level, I get a lot of executives. Hey, I'm vice president of this or that. Well, let me, let me go check on the website and see if you're listed. You're not, right? Let me go check here. Oh, the image there, I'm gonna do a reverse image check. Oh, okay. Oh, you say, you know, you've got— it's a great exercise. But the challenge, back to what you're saying, If you do establish a reputation, and it takes a little while, right? When I go out and I look at your webpage or your LinkedIn page, it's gonna show, hey, you've posted something, right? Maybe it's an article that you wrote or a paper that you wrote or a project that you did. Post. That differentiates you from just a fake account. Yeah, it really does. And the more that you can interact, especially when you're commenting, because on LinkedIn not only can I see posts, there's a little button right next to it that says comments, and I'll click on that. And if all the comments are good job, okay, that's awesome, congrats, that's not contributing to the industry. That's not somebody that's actively engaged or contributing to the discussion at hand. So think about what you're commenting. Make it worthwhile. And when I see that, okay, so be more active, be more active, be more authentic, right? And get involved more. And it takes a little while, it does. There are videos out there to say, okay, how to change your image, how to change title, do you this, do that. You want to fill in what you can, but again, if you're at the start of your career, you may not have a lot of the education or hardcore experience or whatnot. So where you can add is the things that you're choosing to do. Hey, I went out to the, you know, Cyber Warfare site and took these classes, or blew this up, or hey, I grabbed this latest malware that came out and was tinkering with that, or hey, I reviewed this product. You know, I downloaded their demo version of it and played with it, and this is what I think. I think it's good here and bad here, so on and so forth. Drop a couple screenshots in. You are showing your skills, both hard skills as well as soft skills, your ability to communicate. How many people think the ability to communicate is important in cybersecurity? I love this. Yes! One of the most important soft skills, in fact. Act for cybersecurity. I was down at University of Georgia and talking with their faculty there, and the head technologist, he's an engineer that runs the entire cybersecurity program, comes up to me and says, okay, hey, here's our curriculum. And I had done a keynote, and afterwards he's like, okay, here's our curriculum. These are all the technical, you know, and it was all, it was 95% all technical skills. He says, okay, so what do we need? What else do we need, right? Do we need another layer of encryption, you know, another deep dive in that, or in quantum, or whatever? I said, where's your communication? He looked at me. I said, the reality is one person doesn't solve the problem. Whoever I hire has to be able to work with an entire team of people. Some not even in their organization. They have to be able to communicate up to management and down to others, right, wherever they're at. And they have to be able to convince others to help them. If you don't have the communication skills— and I've made that decision. I've had two applicants, one who had absolutely superior technical skills, And another one, skills weren't as technical, anywhere near as technical, but they had excellent communication skills. You know which one I hired? I hired the other one. And when the technical person— because I love giving feedback— and they said, hey, I've got all these degrees and certifications and I can read hex off the line, right? And he could. He could. I mean, and I said, that's great, and for the problems that you can solve all by yourself, you would be awesome. But 95% of the problems that I'm dealing with takes a team effort. There is compartmentalization, there are security controls. You will not just be given the keys to every program and software and administrative system. It's got to be separate, which means you have to be able to communicate and work with other people. And you don't have those skills. And he sat there and just quiet, which again, I said, see, you're not even communicating with me, right? You know, work on those skills and you can be outstanding. A lot of people that first came into cybersecurity, they thought, hey, this is gonna be awesome because I'm never gonna have to talk to anybody. I can just sit in front of a PC and, and go after the attackers. It's gonna be awesome. I'm sorry, I don't know what movie you saw, but it is not that way. It is a team sport. And you may have a single superstar on your soccer team, baseball team, basketball team, or football team, but if they're not working with everyone else and everyone else is not supporting, they will not win. It is a team effort. So yeah, and for your profile, work on it. It will force you to go out and do these other things and learn, and then have to be able to learn how do I communicate that back.

And I heard about hackathons as well, right?

Hackathons are great. I love hackathons.

So do you— is there like a specific date and time for like times of the year to do a hackathon, or is it just kind of like—

go out there and they have them all over the world. So, and some of them are online. There's bug bounty programs that are available. I know some people that love security, but they love, you know, they're really really good with Windows or they're really good with this particular app and they do pen tests and they'll do those. They actually make a lot of money off of it too, but they get to then discuss that on their profile and it's hugely powerful. Hugely.

Yeah. So I want to look, I was recommended a bug bounty program, but I was not able to find any kind of like work on that site.

So how's the, so the bug bounty programs like HackerOne and Bugcrowd and things of that that sort. You go out to the site, you normally have to register, and then they've got certain— basically companies come to them and say, I've got a product, whatever, I don't have my own pen tester, or maybe I do, but I want other pen testers, so I am gonna put down a chunk of money and say if somebody can hack this with these parameters, right, then they get the, they get the money, right? So it becomes a catalog for these bug bounty programs to say, hey, we've got all these different software applications or hardware devices, and if you can hack them, this is what you get. So you can go out and you can take a look at those, and sometimes they're web pages or services or whatever, but each one's a little bit different. Some of them you can actually submit anonymously to, other ones you have to have a whole profile. There's one out there that you actually have to be vetted, you have to be recommended by somebody else to even get in.

So what would the hacker want, right?

Um, yeah, I— oh, What's the CER? I've had conversations with the CEO of HackerOne, uh, really good guy, uh, and he was one of the first that started it when we needed it. Um, but yeah, I would go out to his site, but go out to all of them. Nothing limits you. Yeah, right, because they are looking. It's a crowdsourced model, so they're looking for bright and ambitious people to go out there and break things.

Yeah, cuz my friend recommended me HackerOne as a bug bounty program. I wanted to get into cybersecurity. This is, uh, I was not able to work that site the way I wanted to because I was trying to find how to apply.

If you can't figure it out, send them an email. Yeah, send them an email because they'll have a supporter and ask, right? Or they will have a Discord channel, or they will have a Twitter and ask, right? Again, we're looking for people that when they come up on problems, let's get creative, right? And let's figure this out somehow. And you may be able to figure it out yourself, you may you just figure out who knows how to figure it out, and now you found that path, right? There was another question over here. Yes, sir.

Going back to what you said earlier, what's an example of something unprofessional we should avoid on LinkedIn?

How about inappropriate racial remarks? That'd be good. Yeah, you know, I say that, everyone laughs, you know, but yeah, I see I've seen it. I have, I have, uh, unfortunately, right? And, you know, people think, ah, you know, it's no big deal, it's just a post, whatever. Yeah, yeah, somebody reads that. Yeah.

So you said like, you know, LinkedIn, right? But you also regarded other social medias, right? So one of the more up-and-coming social medias is Discord. Yes. Discord stuff. So would that also be looked into?

It can, um, especially in the technical fields, right? Discord is big, especially with engineers and coders and so forth, and that's where they share a lot of that information that they're working on. I've had people in cybersecurity, they developed projects or code and put it out there, you know, put it out on their Git account or whatnot, GitHub, uh, and talk about it on Discord and help others, right? So yeah, it becomes more and more relevant relevant for the communities that use that social account.

Okay.

And if you're trying to get a job as a software architect, you're probably going to be interviewed by not only the hiring manager but a few of the other ones, right? So if you're on some of the same Discord channels and, and you've had conversations and you've established a rapport with them, and maybe you've even connected with them on LinkedIn, you have an advantage. If they know of you because you're on Discord and you've said some things that are not appropriate or posted things that are not appropriate, they'll remember you then And that's a very quick— just cross off the line, I don't need to meet him. Red flag, done. So yes, you know, using profanity, that would be another one. The— where you people start to get into trouble sometimes is about micro inequities. You can, you can look that up, there's classes and there's, you know, online, and it's just understanding that sometimes when we've make comments, whether it's culturally, right, or how you grew up or whatever, it can offend people. And that's not what you want to do, right? You want to be seen as the team player. You want to be seen as the person, hey, I'm gonna work with everybody in the group. You may not be liked. We're in security, we don't always get liked. Understand that. Normally when somebody gets a call from somebody in security, they're thinking, this is not gonna be good. Right, but with the people that you work with, you want to be able to, to show professionalism, right? Because our job is tough and you want to work with a professional. You don't want to work with some yahoo that's just going to disrupt things or offend people, right? Let's get the job done. We have an opposition. That's who we need to be worried about. Great question, by the way. Was there another question back there? Okay, next slide. How am I doing on time? Okay, great. All right, so any questions on this slide, right? Purposefully building your brand, building your professional network, and not giving up, not being discouraged.

Yes. So it comes to professional brand, right? So you are pretty much your own advertisement. So what would you recommend, like, to try and build your reputation in the industry?

Start by filling out that, that LinkedIn, right? It really comes down to it. It's, and it's, it's odd because it's, there's really no competitor to it. Yeah, it's been around so long, and there's videos, there's blogs, there's articles, there's comments, there's all these things. It's tied into employment history as well as education and certifications and all that. So, and I work with the LinkedIn team a lot So they've intentionally done that to be able to make your personal brand. And if you can publish things externally, right, you write a good paper. How many people have written a great paper or an article and submitted it to a magazine? Oh, I have. You know, I get turned down a lot. I do. But it just takes once, and guess what? You're a published author. Doesn't hurt. Kind of looks nice, don't you think?

Yeah. And another one, right, building professional. So I heard hackathons are a great way of making connections with people that are in the industry. Is that true?

Absolutely, absolutely. Any type of activity that you do with other people in the industry is good, right? If you ignore them or you don't connect with them or you're not, then, you know, it kind of peters out. But yes, that's good. Okay, let's go to the next slide real quick. I'm here today because me and the world needs you. You are the next generation with, with the cape, right? So there is a demand out there, and it's crucial that we get people in the industry. So part of what I do is I do volunteer my time and, and help people, help organizations, and especially when there's a community of people you know, take that step forward.