1 00:00:20,170 --> 00:00:22,510 Welcome back to Hacking Career Village. 2 00:00:22,510 --> 00:00:26,270 It has been so great to listen to so many wonderful presentations. 3 00:00:26,350 --> 00:00:34,290 We have people who are in various different stages of their career, trying to figure out what to do next, if they want to do anything next. 4 00:00:34,290 --> 00:00:47,610 So I'm really excited that Amelie Curran decided to present to us the idea of being a tech executive and then coming from an individual contributor and then maybe going back again. 5 00:00:47,610 --> 00:00:51,790 So Amelie, take us on your journey and give us your best insight. 6 00:00:52,010 --> 00:00:52,690 Great. 7 00:00:52,690 --> 00:00:54,090 So yes, you guessed it. 8 00:00:54,090 --> 00:00:57,030 This is a Lord of the Rings hobbit-themed talk. 9 00:00:57,110 --> 00:01:04,030 While I'm not a Tolkien nerd, I am a firm believer in the hero's journey of story and character development seen in many forms of pop culture. 10 00:01:04,030 --> 00:01:12,050 My first ever keynote had a slide where I sufficiently stole the story wheel from Dan Harmon and Jester Roiland's Rick and Morty, but I didn't really tell anybody. 11 00:01:12,190 --> 00:01:19,330 For me, I'm 45 and I've had every job title and role I ever thought I wanted to have and work to do by this point in my life. 12 00:01:19,530 --> 00:01:22,090 I count my blessings and consider myself lucky. 13 00:01:22,290 --> 00:01:28,290 Along the way, I've had two marriages, several cats, a few cross-country moves, and even managed to transition genders. 14 00:01:28,290 --> 00:01:33,390 I didn't just get my cake and eat it too, I demolished the entire fucking bakery, croissants and all. 15 00:01:33,570 --> 00:01:38,450 But what does that mean to you, the lucky visitor to this digital corner of the world and audience member for my talk? 16 00:01:38,610 --> 00:01:48,390 Well, I know plenty of you are at various points along your life and career and I know no matter who you are, you're looking for answers to burning questions and even though I'm here talking to you, I seek them out myself. 17 00:01:48,790 --> 00:01:50,370 A brief background on me. 18 00:01:50,370 --> 00:01:58,190 My day job is essentially now that of a professional storyteller, but in tech parlance, they call me a technology advocate and I work for Splunk as of December 2019. 19 00:01:58,650 --> 00:02:08,790 Prior to that, I spent a little over a decade in public service for the federal government as a contractor, member of technical staff of an FRDC, and over nine years as a federal employee starting at the U.S. 20 00:02:08,790 --> 00:02:15,970 Department of the Interior, treasuring finally at HHS with a rotation working cybersecurity and IT modernization policy at the White House. 21 00:02:16,290 --> 00:02:28,550 All before that, I left college with a degree I was told that was useless in society as it stood, decision science, and started my career as a user interface designer and most of my classmates went directly into tech consulting. 22 00:02:28,550 --> 00:02:33,990 This was obvious during the dot-com boom and I decided to dot-com things just as it imploded. 23 00:02:34,250 --> 00:02:36,990 Do not count on me for reading economic trends, friends. 24 00:02:37,070 --> 00:02:50,590 I moved up during that time to a systems engineer and managed to get my first job involving security in 2000 and my first official title as such in 2003 working for a power company as part of a two-person security engineering team for a fortune 125 company. 25 00:02:50,750 --> 00:02:54,470 Ah yes, the good old days of slammer, hurricanes, and blackouts. 26 00:02:54,690 --> 00:03:01,910 During those three formative years, I transitioned from an individual contributor on a team to somebody who was leading teams of others. 27 00:03:01,910 --> 00:03:09,690 While the first team was small, about four people, when I left government last year, I led about 150 people of both federal employees and contractors. 28 00:03:09,890 --> 00:03:14,810 This is not always a growth curve and responsibility everybody here will desire, but some will. 29 00:03:14,930 --> 00:03:19,070 To each your own on this journey and that's what I'm here to speak about today. 30 00:03:19,450 --> 00:03:31,590 Back in the day, I was all idealistic thinking back to when I first was introduced to BBSs in the late 1980s and wondering that I may have put my dreams of being an astronaut or veterinarian on hold for chasing down this computer stuff. 31 00:03:31,730 --> 00:03:45,570 I mean, I doubt anybody then was going to expect we go from modems to high-speed direct-to-the-home fiber optics in less than 20 years and what was the domain of kids in their basements would end up being the most amazing invention of the 20th century or perhaps all of mankind. 32 00:03:45,970 --> 00:03:51,710 I hit college with an idea that yes, this technology thing is something, but what do I want to do? 33 00:03:51,710 --> 00:03:58,750 So I started as an electrical engineering and computer engineering major who sucked at coding and wanted to do something more applied. 34 00:03:58,950 --> 00:04:06,370 At the time, computer security topics were just covered undergraduate programs of which my work-study job supported, the Information Networking Institute. 35 00:04:06,630 --> 00:04:14,050 I changed majors twice to basically survive, but I still wanted to seek applied computing, basically how folks used what we now have. 36 00:04:14,270 --> 00:04:16,390 This is what I call the start of a career. 37 00:04:16,390 --> 00:04:27,030 Granted, nowadays this is what can be had in high school, but then it's usually after an initial stint in a post-secondary education, whether it be a four-year college or university or trade schools or community colleges. 38 00:04:27,050 --> 00:04:34,010 What most of this progress process really teaches you is how to gather and organize your knowledge and thoughts to manage output. 39 00:04:34,010 --> 00:04:46,230 Yes, learning particular point skills, especially in security roles, is now available in what is typically makes up these degrees and certification programs, but as somebody who's hired quite a bit over the years, I value how people are curious and put their thoughts together. 40 00:04:46,810 --> 00:05:02,670 So starting out, unless you're literally starting your own company, dropping into the family business, or get literally recruited to be the manager or director out of college, well, commissioned military officers are a whole other story, you're going to be joining an organization as an individual contributor. 41 00:05:02,690 --> 00:05:07,170 What that means is that you were hired for an initial skill set an organization needed. 42 00:05:07,230 --> 00:05:10,290 This also doesn't mean that this is all you will ever do. 43 00:05:10,330 --> 00:05:16,790 They expect you to learn and contribute, but typically in their way of doing business aligned to their market or mission. 44 00:05:16,850 --> 00:05:20,110 This is not to say that this is not useful or non-transferable. 45 00:05:20,110 --> 00:05:23,010 No, just the peculiarity of the business. 46 00:05:23,010 --> 00:05:28,810 Oddly, these business processes and methods are often covered as trade secrets, and they do likely protect them. 47 00:05:28,830 --> 00:05:32,070 And many ways of doing that is keeping employees happy and content. 48 00:05:32,070 --> 00:05:45,270 Again, if you see a lawsuit proposed by a company because some high ranking or major category lead and left for another competitor, the lawsuit is not just there to be officious, but they're protecting those trade secrets and that that person may have. 49 00:05:45,410 --> 00:05:47,630 You are a valuable asset. 50 00:05:47,850 --> 00:05:51,330 Sadly, not all organizations see that worth and treat you as such. 51 00:05:51,790 --> 00:05:58,310 For me, early in my career, I was trying to find that niche, and I'm sure many of you or are still trying to find it. 52 00:05:58,310 --> 00:06:02,910 It may take a few places to figure that out, and fine, especially in the security arena. 53 00:06:03,130 --> 00:06:09,950 You could start in a sock working crazy or shitty hours, or make, like the variety, this could be your jam. 54 00:06:10,070 --> 00:06:13,730 Maybe pivot to IRIH work, then to forensics, maybe RE. 55 00:06:13,730 --> 00:06:17,910 The amazing part, at least this career, is it's got a lot to explore. 56 00:06:17,910 --> 00:06:21,230 And as I noted prior, if you're curious, it will serve you well. 57 00:06:21,870 --> 00:06:32,610 For me, as I started to think about leadership roles, whether it be a line manager or all the way to wondering if I'd ever be a C-level tech exec, I figured a broad background would serve me well. 58 00:06:32,610 --> 00:06:35,470 However, not everybody wants to move up in management. 59 00:06:35,470 --> 00:06:48,170 But unfortunately, the tech sector is still grappling with how to manage highly skilled and competent technical talent, and not to recognize that some wish to remain individual specialists and contributors, and not be a team or group lead, or even an exec. 60 00:06:48,510 --> 00:06:51,990 Not every high performer has the skills to lead people on projects. 61 00:06:51,990 --> 00:06:57,490 And it's another entirely different skill set from one from core competencies for some specialists. 62 00:06:57,490 --> 00:07:00,130 And this is where we approach a fork in the road. 63 00:07:00,410 --> 00:07:14,510 At the point at which the realization that you may or may not want to move into leadership or management will usually occur between the times you're considered junior, and where you can be considered a seasoned professional with a number of projects and deliverables under your proverbial belt. 64 00:07:15,030 --> 00:07:22,650 I know the quandary that many folks in the security community have when trying to sell the value of an information security program to non-technical leaders and executives. 65 00:07:22,750 --> 00:07:24,510 It's selling the value of zero. 66 00:07:24,550 --> 00:07:28,750 I gave a talk on the concepts of zeros in organizations a few years ago for all day DevOps. 67 00:07:29,110 --> 00:07:38,490 Most security work is to work towards zero occurrence of an event or get close to zero, while many other roles seek to maximize your roles than to minimize. 68 00:07:38,670 --> 00:07:40,490 This is also seen in safety roles. 69 00:07:40,490 --> 00:07:46,490 And similarly, public perceived value is difficult to quantify and qualify because the lack of being in the news is beneficial. 70 00:07:46,490 --> 00:07:53,790 This can strangely be seen by a challenge that healthcare and other public safety officials have had to deal with during the pandemic. 71 00:07:53,790 --> 00:07:58,770 It's also hard to put a review that you've prevented a lot of stuff from happening. 72 00:07:58,770 --> 00:08:07,490 Since documenting it proves challenging and having to quantify what the impacts could have been in hypotheticals is a tough game to play and can lead folks to a challenge . 73 00:08:07,490 --> 00:08:12,130 Challenging your estimates and hyperbole is really kind of a no-win situation. 74 00:08:12,650 --> 00:08:16,110 So what are you to do to advance your career? 75 00:08:16,330 --> 00:08:18,790 Well, first off, don't get dismayed. 76 00:08:18,850 --> 00:08:23,930 The folks who can see the value work rather than just tabulate numbers will be the places where you want to work. 77 00:08:23,930 --> 00:08:27,490 However, those are a bit harder to come by, but things are getting better. 78 00:08:28,750 --> 00:08:31,390 Another tactic is finding a raft of good peers. 79 00:08:31,390 --> 00:08:32,730 This is your fellowship. 80 00:08:33,070 --> 00:08:39,330 This doesn't mean that you have to bounce onto a new role when they do, but this is some informal parallel between mentorship and support. 81 00:08:39,370 --> 00:08:48,430 I've kept in touch with a lot of former co-workers and such both let them hear to vent and like to hear from them and share my problems in kind. 82 00:08:48,770 --> 00:08:53,770 Share the challenges and successes I've had as well as share in those in kind as well. 83 00:08:53,950 --> 00:08:58,530 Sometimes when you need a hand sideways or a hand up they may be able to help you as well. 84 00:08:58,650 --> 00:09:05,530 This is more of an informal form of networking but just as useful as more formalized online sites and professional networking groups. 85 00:09:06,110 --> 00:09:08,350 So back to skills development for a moment. 86 00:09:08,890 --> 00:09:15,490 Say you're at three to five years in your professional career and you're finally deciding that what you may want to specialize in. 87 00:09:15,770 --> 00:09:19,890 First off I'm sure you'll like wait three to five years in? 88 00:09:20,130 --> 00:09:20,630 Yeah. 89 00:09:20,930 --> 00:09:29,450 Your first one to two years will probably be figuring out how to work in an organization, feeling out what like the culture is like, learning how to work within the processes and structure. 90 00:09:29,450 --> 00:09:41,670 I mean I had non-pro jobs while in high school working at a convenience store and a pizza delivery which had their own rules and culture but I wasn't anywhere to the point of calling them a career any more than they were pickup jobs during my pre-adulthood. 91 00:09:41,710 --> 00:09:45,630 But the two to five years is where you start to build up that launching pad of skills. 92 00:09:45,690 --> 00:09:48,130 The core knowledge you will expand upon. 93 00:09:48,710 --> 00:09:50,730 This doesn't need to be formalized either. 94 00:09:50,730 --> 00:09:55,510 In fact my work as a hobby got me the practical skills that formed the basis for my security career. 95 00:09:55,510 --> 00:10:01,050 All unpaid, all essentially unsponsored, but that extracurricular skills development is useful. 96 00:10:01,650 --> 00:10:09,330 About the third year in your company if you are on that first or fifth will have programs hopefully for training and other skills building. 97 00:10:09,390 --> 00:10:11,010 Take them up on those offers. 98 00:10:11,010 --> 00:10:17,890 Those are usually the first to go when the budget belt tightening occurs unless it is literally built into an audible benefit that they offer. 99 00:10:18,030 --> 00:10:27,290 When it's not formalized and I can tell you as a manager for many years a good boss will fight to carve out training expenses for their teams and see the value of professional development. 100 00:10:27,530 --> 00:10:34,750 I've gone to the carpet many many times to ensure my team has had at least one to two training experiences even if some may be non-technical. 101 00:10:34,790 --> 00:10:36,530 They can still network with peers. 102 00:10:37,690 --> 00:10:43,610 Fostering continuous education will be the greatest asset to your career regardless of which path you choose to take. 103 00:10:43,970 --> 00:10:47,570 Realizing that skills are not evergreen and require refreshing is another. 104 00:10:47,790 --> 00:10:57,090 Knowing that you will need to adapt to the changing face of business and environments you will operate will ensure that you will continue to be able to call a career as you inevitably age. 105 00:10:57,130 --> 00:11:05,010 But this isn't saying that you can't carve out a corner and specialize but you have to ensure that you're also innovating in the right way and being useful as a resource. 106 00:11:05,490 --> 00:11:16,410 As much as some cockles that get raised when somebody raises the spectra of a rock star or a luminary, either they will be a momentary flash in the pan or they'll be required to constantly reinvent themselves. 107 00:11:16,410 --> 00:11:22,210 Continuous learning ensures that you can always build on what you have and not be that one-hit wonder or rock star. 108 00:11:22,790 --> 00:11:25,950 So let's broach the rock star discussion for a moment. 109 00:11:25,950 --> 00:11:41,510 Like most rock stars it seems, and I've met a few, the actual musician rock stars, they may lack a little bit in the soft skills department because they've often hyper focused on the skills development of their core work but haven't worked on the soft skills that make them interact with people as a human. 110 00:11:41,550 --> 00:11:47,130 There's plenty examples of those infosec rock stars being, to put it lightly, assholes. 111 00:11:47,410 --> 00:11:49,710 Particularly to the new people in the career space. 112 00:11:49,910 --> 00:11:51,870 There are exceptions and those are the good ones. 113 00:11:51,870 --> 00:11:57,410 They often forget that they were not all born with what they have and remembering that helps you get a career progression. 114 00:11:57,770 --> 00:12:02,210 Ego is not something that people will suffer well and it's easy to break. 115 00:12:02,270 --> 00:12:15,630 As I've said in other talks, when hiring people I much prefer the reliable and skilled roadies and sidemen than the star or front men of a band because they show up every day, do their job, and because their employment is based on how well they do their job, 116 00:12:15,630 --> 00:12:18,070 usually have a vested interest in the outcomes. 117 00:12:18,110 --> 00:12:25,510 It's hard to think that some jobs are so at will as such but the best combatant against that is being an exceptional contributor. 118 00:12:25,730 --> 00:12:32,170 It's also a case of balancing and not getting abused by a boss or a peer and that's the next piece in the career to plan for. 119 00:12:32,270 --> 00:12:41,410 Again, I've been in the show for over 20 years and I've had the opportunity to walk away and to be honest, the idea has crossed my mind more than a few times. 120 00:12:41,590 --> 00:12:43,990 Just light a match, burn it all down. 121 00:12:44,170 --> 00:12:49,110 The flip side of worrying about what's next is also something that hangs over as a cloud. 122 00:12:49,490 --> 00:12:54,410 Often those thinking of making a radical change or a leap to something different burn a candle at both ends. 123 00:12:54,410 --> 00:12:59,390 A day gig and then the build-up of the next thing, be your own boss or a new venture. 124 00:12:59,390 --> 00:13:02,770 It's trying, it's stressful and it's not for everybody. 125 00:13:02,770 --> 00:13:05,830 But this is another route to use your experience to be a leader. 126 00:13:05,970 --> 00:13:14,110 Even if the goal is to flesh out and build out an idea with a goal of being later acquired, the opportunity exists to stretch your legs and see if you can cut it. 127 00:13:14,150 --> 00:13:20,310 At best, you can go back to being an individual contributor, go further into management or cash out and live other dreams. 128 00:13:20,310 --> 00:13:21,990 You're writing your own story. 129 00:13:22,370 --> 00:13:25,090 So that's all well and good for those who are less risk averse. 130 00:13:25,090 --> 00:13:27,090 You mentioned that you were all over the map. 131 00:13:27,190 --> 00:13:28,370 Yeah, I was. 132 00:13:28,450 --> 00:13:32,870 And it seemed like working for a lot of well-established organizations, especially the government. 133 00:13:32,870 --> 00:13:34,050 What about that? 134 00:13:34,090 --> 00:13:35,670 Well, I'm glad you asked. 135 00:13:35,690 --> 00:13:39,410 And to say that this wasn't a route I valued for my own needs would be disingenuous. 136 00:13:39,430 --> 00:13:44,790 I had and still have a lot going on in my life where I value the rough sense of some bankable security. 137 00:13:45,210 --> 00:13:48,530 Technically, public service is one of the few places that rarely sees layoffs. 138 00:13:48,530 --> 00:13:57,770 And if they do a reduction in force, known in the private and public sector as a riff, there's a lot more justification for seeing the door than on a whim, especially if you're a high performer. 139 00:13:58,070 --> 00:14:02,630 Safety, or the perception of it, is a good thing if you're trying to do a lot. 140 00:14:03,110 --> 00:14:06,230 The fact that there's something tangible and reliable there is good. 141 00:14:06,230 --> 00:14:14,090 This is why folks may call it the daily grind, but it's what others will base an entire career doing, and it often affords them a lot of intangibles. 142 00:14:14,230 --> 00:14:22,710 This is not to say a smaller company, startup, or even deciding to pull up roots and become an expat or go on a sabbatical isn't going to offer benefits either. 143 00:14:22,890 --> 00:14:26,110 They will, but it's up to you to evaluate what your needs are. 144 00:14:26,730 --> 00:14:29,770 Well, how do I evaluate my needs? 145 00:14:30,230 --> 00:14:32,470 This is essentially where the rubber hits the road. 146 00:14:32,470 --> 00:14:35,570 This is where you need to do a little planning. 147 00:14:35,630 --> 00:14:43,970 This isn't locked in, carved in stone, but an idea, given your experiences and desires and dreams, about where you want to be or see yourself being in a few years. 148 00:14:44,750 --> 00:14:47,970 It can have a timeline or can just be an endpoint with no planned speed. 149 00:14:47,970 --> 00:14:56,890 For me, I had hoped to possibly become a C-level techie and at some point in my career I just wasn't expecting that opportunity, even if it was for a smaller org, by the time I turned 45. 150 00:14:57,050 --> 00:15:04,990 Your timeline or desires may be different, possibly even fueled by your experience with working for and with individuals you may have a role that you desire. 151 00:15:05,470 --> 00:15:08,150 This is where we get to the one ring part of the story. 152 00:15:08,150 --> 00:15:23,870 Sometimes this overall exposure to what some can term the brass ring can be toxic, much like Smeagol and Gollum, and the exposure to the dog-eat-dog boiling crab pot of the corporate and even public sector world of ladder climbing can cause significant change in who you may be. 153 00:15:23,870 --> 00:15:33,370 The desire for more, greater and perceived better, can change a person if they drive themselves too hard thinking that the next rung is going to make them happy along with perceived success. 154 00:15:33,370 --> 00:15:45,410 They will step and crush on whoever seems an impediment to that path, break relationships and go through the world with a single-minded purpose at the expense of nearly everything that doesn't generate forward movement. 155 00:15:45,410 --> 00:15:48,230 All I have to say is, you can't take it with you. 156 00:15:48,810 --> 00:15:55,750 For a lot of us, and as I noted earlier, is that our curiosity fuels our passions for this job or career that we chose to have. 157 00:15:56,150 --> 00:15:57,690 Nobody forced us into it. 158 00:15:57,690 --> 00:16:00,930 Well, maybe a parent wondering if this is better than being a doctor. 159 00:16:01,190 --> 00:16:04,290 So we're here by our own free will, so why not enjoy the journey? 160 00:16:04,310 --> 00:16:14,790 I mean, typically if you're working from the age of 18 to 20 to 65 to 67 years old, perhaps longer, that's 45 or so years of hopefully gainful employment in doing something that you love to do. 161 00:16:14,930 --> 00:16:21,770 It's really not a dash and more hopefully a leisurely stroll or hike, a marathon if you're really trying to torture the metaphor for the runners. 162 00:16:21,810 --> 00:16:24,090 Smell the flowers, enjoy the scenery. 163 00:16:24,650 --> 00:16:38,690 Granted, there's some externalities here which I may gloss over, which is the bias, even though illegal in many forms, towards race, gender, sexuality, disability and other characteristics which really shouldn't have any bearing on how good you are for a given role or opportunity. 164 00:16:39,190 --> 00:16:46,810 This particularly comes in play for minorities within a given field, whether it be gender, race, socioeconomic background, or LGBTQ status. 165 00:16:47,030 --> 00:16:50,550 And when you stack them, it becomes even a bit more complex. 166 00:16:51,130 --> 00:17:00,230 And while I won't go into the discussion about how much about diversity here, I want to make a point of the fact that this seriously changes the calculus for many in their careers. 167 00:17:00,230 --> 00:17:07,250 And this is something serious to consider both as one in the career and those who are in charge of hiring and leading those teams and efforts. 168 00:17:07,330 --> 00:17:15,910 There are plenty of other better talks on this than I can give at this moment, so I wanted to at least bring this up to your attention and note that this is still very much a going concern. 169 00:17:17,290 --> 00:17:24,010 Once you've walked the path for a while here, looking at your preferred end role or state, you're considered a senior level material. 170 00:17:24,790 --> 00:17:32,190 And this is what can be construed with a few more lines and occasional less than natural colored hair of gray. 171 00:17:32,750 --> 00:17:36,290 Then you may get plucked to be asked the question, would you like to be a manager? 172 00:17:36,810 --> 00:17:38,470 And this may give some folks pause. 173 00:17:38,470 --> 00:17:45,290 One, they didn't ask to see the manager unless you're the person asking was a Chad or Karen, so double check. 174 00:17:45,610 --> 00:17:56,730 But what they asked is, you have the possibility demonstrated enough leadership qualities in order to be considered a good candidate, not just to be an individual contributor to a team or project, but to actually lead it. 175 00:17:56,870 --> 00:18:00,850 Granted, you could be asked this sooner if you displayed an early aptitude for it. 176 00:18:00,850 --> 00:18:09,390 But usually after you found your way with what you want to do, got the ropes of an organization or two, and I've had some history to point on for some successes and yes, failures. 177 00:18:09,990 --> 00:18:16,510 For some, this comes with an exclamation of cool, or awesome, or even maybe a dance in your cube. 178 00:18:16,670 --> 00:18:19,370 Others, it may be an oh shit moment. 179 00:18:19,490 --> 00:18:26,730 Because this potentially ends the comfort of isolation or just being part of a team, or better yet, not being responsible for anything other than your own work. 180 00:18:26,970 --> 00:18:31,570 However, for those that are in the crux of this decision point, there's hope if you play it right. 181 00:18:32,370 --> 00:18:39,190 Some come to this point worrying if they will be able to maintain their technical focus and chops if they decide to become a leader or manager. 182 00:18:39,230 --> 00:18:42,430 The short answer is yes, but it comes with some caveats. 183 00:18:42,630 --> 00:18:48,150 The further you move up the leadership chain, the more divorced by design you will become from the day-to-day minutia. 184 00:18:48,450 --> 00:18:55,870 If you think you can go back and pull every oar and steer every rudder of your fleet of ships, disabuse yourself of that idea entirely. 185 00:18:56,050 --> 00:19:02,810 The same aspects of managers you hated who may have been dictatorial or micromanaging in their roles, you just adopt it. 186 00:19:02,810 --> 00:19:03,810 Just don't. 187 00:19:04,410 --> 00:19:16,610 Your job is to find and raise up trusted lieutenants, and by that I don't mean sycophants, but find the right talent to raise up and effectively fill the gap you and others may leave when they progress to the professional development life cycle. 188 00:19:17,810 --> 00:19:28,350 Essentially, you also inherit the role of talent scout, and when I mentioned before about taking advantage of training opportunities you had early on to keep you sharp, you are now directing that role, so I hope you learned something then. 189 00:19:28,950 --> 00:19:33,650 This doesn't sound like maintaining my technical job, she's saying, but you're just leveling up. 190 00:19:33,770 --> 00:19:37,150 I know folks like to code, work hands-on with hardware, and so forth. 191 00:19:37,150 --> 00:19:41,930 I get it, I miss the chase of IRIH work and building up a network of network defense systems. 192 00:19:41,930 --> 00:19:49,430 However, I feel that the benefit from being a senior level individual is the experience and lessons learned that you can impart to others. 193 00:19:49,430 --> 00:19:55,250 My own jump from engineer to architect worked that way as it gave me a broader view of the mission and business we were doing. 194 00:19:55,250 --> 00:20:02,910 I got to work with a lot of other people with other skills and help bridge the gaps in understanding and communication across various teams and business units. 195 00:20:03,210 --> 00:20:13,350 The key point is not to be cynical about the fact that you're possibly now in charge and that as much as all the crap that may roll up to you, the accolades may also be the first to hit you. 196 00:20:13,450 --> 00:20:16,070 How you balance it is where you start to succeed as a leader. 197 00:20:16,590 --> 00:20:19,630 This is about the time where I started to broaden out my own background. 198 00:20:19,630 --> 00:20:25,690 As I noted, I did the system engineering and started into architecture, but I also started into compliance policy work. 199 00:20:25,690 --> 00:20:32,890 I figured if the compliance people were going to grade me on my engineering and architecture skills, it may be about time for me to walk a mile or so in their shoes. 200 00:20:33,150 --> 00:20:36,050 It gets you to re-examine your approaches and how and why you do your work. 201 00:20:36,050 --> 00:20:42,010 And because it's a different layer and working with different types of people, it delivers some skills you wouldn't normally get if you hyper-specialized. 202 00:20:42,590 --> 00:20:57,270 As much as folks will push the red, blue, and purple team and any other color that's in vogue right now as a way to run multiple angles of learning about offensive and defensive sides of operational security, the policy arena is also a way to take the tabletop or live fire aspects to another level. 203 00:20:57,510 --> 00:21:01,590 I know many will think that policy is merely just coming up with ways to be more efficient. 204 00:21:01,910 --> 00:21:12,130 However, a good policy people will examine things from every angle they can, thinking about scenarios the same way a defensive or offensive team would, to ensure it's the best way to apply and govern a policy. 205 00:21:12,390 --> 00:21:24,150 In other cases, you, if you end up doing policy work, may be on the front lines of a new technology proposal or action or other event and need to quickly react and develop a working framework for how to handle everything. 206 00:21:24,210 --> 00:21:30,630 It requires a nimble mind with a deep background and experience in the topics of policy is to cover, and then some. 207 00:21:31,050 --> 00:21:40,270 You'd be surprised, but some of those policy wonks are pretty awesome people and really interesting way to expand their applied skills when you may feel a little bit of techie burnout. 208 00:21:40,730 --> 00:21:44,510 Given all of this, you'd think you'd be nearing an end, and yeah, it's kind of near there. 209 00:21:44,930 --> 00:21:57,370 By this point, you probably have touched about every little aspect of this career space and even getting to speak at conferences like this and others, potential volunteering and giving a little back, but you're now about to decide, do I stay or do I go? 210 00:21:57,470 --> 00:22:03,630 And by that, I mean being a leader is a lot of work, a lot of paperwork, emotional labor, and a lot of time. 211 00:22:04,030 --> 00:22:08,110 You need to essentially still find those balance points in order to not burn or flame out. 212 00:22:08,310 --> 00:22:14,270 Say you've been a senior leader for a time, it's okay to go back to an individual contributor role like from when you started. 213 00:22:14,350 --> 00:22:16,170 The answer is a resounding yes. 214 00:22:16,230 --> 00:22:18,450 In fact, it should almost be standard practice. 215 00:22:18,690 --> 00:22:25,170 For me, I'd been a manager again for about five years before I realized I needed a break from the stress and the politics. 216 00:22:25,170 --> 00:22:32,290 That stuff I mentioned before, especially the emotional labor, will wreck you if you give a hoot about your staff and your work. 217 00:22:32,330 --> 00:22:44,030 I know a lot of folks will say to try to separate work from the people, but when you're doing things that has a good mission and a potential, it's a very hard thing to do, even when you think you can easily do it. 218 00:22:44,490 --> 00:22:52,170 As a leader, the relationships you developed are useful in order to get things done, but as part of building trust, people will open up to you and get invested. 219 00:22:52,570 --> 00:22:57,730 In a way, you can say that this is the I care too much issue, but it happens. 220 00:22:58,050 --> 00:23:09,090 Then again, besides all that, you may want to take a break, try something new, that continuous learning stuff, and build a skill set that you don't have or feel you may need to advance even further if you are a senior leader or executive. 221 00:23:09,330 --> 00:23:19,310 For me, when I started as a deputy CIO for a federal agency component, I was thrown into areas I had no formal training in, including budgeting, human resources, and more formalized project management. 222 00:23:19,310 --> 00:23:22,290 I had people who had PMP certifications working for me. 223 00:23:22,290 --> 00:23:26,990 I ended up hiring a budget officer to help with our budget management and procurements and contracts. 224 00:23:26,990 --> 00:23:30,950 Well, this may sound like a cop-out as to why don't you do it yourself? 225 00:23:31,050 --> 00:23:32,330 Well, the answer is I try. 226 00:23:32,330 --> 00:23:36,850 I worked with these folks, but I also knew that they knew way more than me and did a better job of it. 227 00:23:37,030 --> 00:23:43,330 This is the sign of a good leader, which is to know where your expertise and quality ends and somebody else's begins. 228 00:23:43,430 --> 00:23:44,210 It's not ego. 229 00:23:44,210 --> 00:23:45,310 In fact, it's humbling. 230 00:23:46,170 --> 00:23:48,170 Know when to ask for help. 231 00:23:48,230 --> 00:23:49,290 Know when to delegate. 232 00:23:49,470 --> 00:23:50,170 Know when to hold them. 233 00:23:50,170 --> 00:23:51,310 Know when to fold them. 234 00:23:51,490 --> 00:23:59,890 It's an important skill that many CTOs, CIOs, and CISOs I know definitely do not do, but could also ease their lives if they admitted that they can't do it all. 235 00:23:59,930 --> 00:24:08,090 This is a bit of the Type A control freak personality type that draws some people to leadership, but they will also fizzle out over time or move on and create a potential other disaster. 236 00:24:08,310 --> 00:24:12,310 As I moved on, I realized I needed to learn better communication skills. 237 00:24:12,310 --> 00:24:16,690 The last few positions I had for the federal government had yearly reviews that constantly harped on this. 238 00:24:16,950 --> 00:24:21,690 I was also always eager to go and speak, work on those skills in a more public forum. 239 00:24:21,970 --> 00:24:25,810 You obviously hear me here and see me now, so part of this is working out. 240 00:24:26,190 --> 00:24:32,050 However, one of these experiences I didn't have in my career, and especially in a particular sector, was working for a vendor. 241 00:24:32,050 --> 00:24:37,230 And as such, in a role that is now strangely considered part of marketing, is that of an advocate. 242 00:24:37,370 --> 00:24:44,710 Now, many will look at such roles and think, well, that's just a pitch man or pitch woman, and it's no better than sales, but it's really not. 243 00:24:44,710 --> 00:24:49,830 In fact, many of the senior folks here, goons, speakers, and such, actually have roles similar to mine. 244 00:24:49,850 --> 00:24:57,310 It's an educational role as much as a customer-facing and interaction role that not only requires being able to speak intelligently about a topic, but also listening. 245 00:24:58,270 --> 00:25:01,670 Listening is a very underutilized skill among techies at times. 246 00:25:01,970 --> 00:25:10,890 Obviously, you're here and listening to me, but actively listening in order to synthesize a useful interaction with a customer or teammate or executive is a very useful skill to develop. 247 00:25:11,070 --> 00:25:21,490 Much like critical thinking is as much an innate skill for people and important in navigating a career development, the refinement of communication and listening skills are the ones that will mature over time as well. 248 00:25:21,510 --> 00:25:24,790 As an advocate, I get to touch many parts of our organization. 249 00:25:24,790 --> 00:25:30,690 I get to develop strategies for all sorts of things for a very broad viewpoint, but also get to dig into some passion areas. 250 00:25:31,130 --> 00:25:32,890 It's outward and inward facing. 251 00:25:32,890 --> 00:25:38,410 If it wasn't for the pandemic, I'd have been on the road for a significant part of the time, which is something new and interesting for me. 252 00:25:38,530 --> 00:25:48,590 I can freely admit that some of it was possibly to build up some frequent flyer and hotel points for eventual time off, but those are some things, the fringe items you consider when making changes like that. 253 00:25:48,590 --> 00:25:51,750 I'm about eight months into slipping back into individual contributor role. 254 00:25:51,750 --> 00:25:59,110 It's drastically different from my prior C-level role, but also somewhat similar because I'm looking at interactions with people at my former level from a different perspective. 255 00:25:59,390 --> 00:26:04,410 Conversely, I'm getting time to explore a few things I wasn't allowed to do or have the time or resources to pursue. 256 00:26:04,570 --> 00:26:06,930 There's a lot of these considerations for changes. 257 00:26:06,930 --> 00:26:11,530 My boss says, be comfortable being uncomfortable, which is actually a really good bit of guidance. 258 00:26:11,690 --> 00:26:18,590 We are typically kind of risk adverse in our roles and lives, and we value the basic needs of housing, food, and sleep, maybe a good hot shower on occasion. 259 00:26:18,590 --> 00:26:21,230 So we tend to sit there until we have to move. 260 00:26:21,230 --> 00:26:28,090 This is a skill while you have your day-to-day is encouraging to walk the knife edge and explore new things and new ways of looking at it. 261 00:26:28,110 --> 00:26:30,630 To be honest, it's one of the best moves I've made. 262 00:26:30,830 --> 00:26:33,570 However, my desire is still to go back into leadership. 263 00:26:33,710 --> 00:26:47,210 I figure that the skills I develop here will support what it needed to be to be a more effective executive when I hopefully return to those ranks, or with the time and experience afforded to me to do something different from my day-to-day, possibly strike out on my own and start something new. 264 00:26:47,230 --> 00:26:55,870 I already did my own hobby-like startup for a decade and a half, and it ended up in the black, barely, and was sold when I lost the time to actively participate in a way that I wanted. 265 00:26:55,970 --> 00:26:59,470 If I start my own thing, it will be from skills acquired through doing everything. 266 00:26:59,650 --> 00:27:01,930 I think it's the best kind of skill sets to do this. 267 00:27:01,930 --> 00:27:07,490 It will help me with those I plan to hire, as well as learn what I need to take to make it in the marketplace. 268 00:27:07,890 --> 00:27:15,350 I'd have the budget, purchasing, management, sales and marketing, development, engineering, policy, and even some legal background in order to make a good go at it. 269 00:27:15,350 --> 00:27:17,490 The path is mine and yours to choose. 270 00:27:17,490 --> 00:27:18,650 This is the journey. 271 00:27:18,770 --> 00:27:20,030 This is your quest. 272 00:27:20,250 --> 00:27:21,670 Good luck and best wishes. 273 00:27:21,670 --> 00:27:27,430 Again, thanks to DEF CON, the new Career Hacking Village, and the staff and volunteers who helped with all of this. 274 00:27:27,430 --> 00:27:29,310 Such an amazing story. 275 00:27:29,310 --> 00:27:31,150 Really great inspiration. 276 00:27:31,150 --> 00:27:47,050 Thank you so much, Amelie, for sharing your story and your tips on how people can get from individual contributor to leader to individual career contributor, but also making sure that they're getting a fulfilled life and a life that they can give back. 277 00:27:47,050 --> 00:27:48,210 Thank you so much.