[00:20.170 --> 00:24.990] Welcome back to Hacking Career Village. It has been so great to listen to so many wonderful [00:24.990 --> 00:29.890] presentations. We have people who are in various different stages of their career, [00:29.890 --> 00:35.870] trying to figure out what to do next, if they want to do anything next. So I'm really excited [00:35.870 --> 00:43.070] that Amelie Curran decided to present to us the idea of being a tech executive and then [00:43.610 --> 00:48.410] coming from an individual contributor and then maybe going back again. So Amelie, [00:48.410 --> 00:51.790] take us on your journey and give us your best insight. [00:52.010 --> 00:57.890] Great. So yes, you guessed it. This is a Lord of the Rings hobbit-themed talk. While I'm not a [00:57.890 --> 01:01.990] Tolkien nerd, I am a firm believer in the hero's journey of story and character development seen [01:01.990 --> 01:06.950] in many forms of pop culture. My first ever keynote had a slide where I sufficiently stole [01:06.950 --> 01:11.270] the story wheel from Dan Harmon and Jester Roiland's Rick and Morty, but I didn't really [01:11.270 --> 01:16.890] tell anybody. For me, I'm 45 and I've had every job title and role I ever thought I wanted to have [01:16.890 --> 01:22.090] and work to do by this point in my life. I count my blessings and consider myself lucky. [01:22.290 --> 01:27.010] Along the way, I've had two marriages, several cats, a few cross-country moves, and even managed [01:27.010 --> 01:31.450] to transition genders. I didn't just get my cake and eat it too, I demolished the entire fucking [01:31.450 --> 01:35.990] bakery, croissants and all. But what does that mean to you, the lucky visitor to this digital [01:35.990 --> 01:40.370] corner of the world and audience member for my talk? Well, I know plenty of you are at various [01:40.370 --> 01:44.190] points along your life and career and I know no matter who you are, you're looking for answers [01:44.190 --> 01:48.390] to burning questions and even though I'm here talking to you, I seek them out myself. [01:48.790 --> 01:53.310] A brief background on me. My day job is essentially now that of a professional storyteller, [01:53.310 --> 01:58.190] but in tech parlance, they call me a technology advocate and I work for Splunk as of December 2019. [01:58.650 --> 02:01.810] Prior to that, I spent a little over a decade in public service for the federal government [02:01.810 --> 02:07.790] as a contractor, member of technical staff of an FRDC, and over nine years as a federal employee [02:07.790 --> 02:12.710] starting at the U.S. Department of the Interior, treasuring finally at HHS with a rotation working [02:12.710 --> 02:17.990] cybersecurity and IT modernization policy at the White House. All before that, I left college with [02:18.090 --> 02:24.210] a degree I was told that was useless in society as it stood, decision science, and started my career [02:24.210 --> 02:28.550] as a user interface designer and most of my classmates went directly into tech consulting. [02:28.550 --> 02:33.990] This was obvious during the dot-com boom and I decided to dot-com things just as it imploded. [02:34.250 --> 02:39.010] Do not count on me for reading economic trends, friends. I moved up during that time to a systems [02:39.010 --> 02:43.950] engineer and managed to get my first job involving security in 2000 and my first official title as [02:43.950 --> 02:48.990] such in 2003 working for a power company as part of a two-person security engineering team for a [02:48.990 --> 02:55.830] fortune 125 company. Ah yes, the good old days of slammer, hurricanes, and blackouts. During those [02:55.830 --> 03:00.370] three formative years, I transitioned from an individual contributor on a team to somebody who [03:00.370 --> 03:05.470] was leading teams of others. While the first team was small, about four people, when I left government [03:05.470 --> 03:11.170] last year, I led about 150 people of both federal employees and contractors. This is not always a [03:11.170 --> 03:16.190] growth curve and responsibility everybody here will desire, but some will. To each your own [03:16.190 --> 03:21.830] on this journey and that's what I'm here to speak about today. Back in the day, I was all idealistic [03:21.830 --> 03:26.430] thinking back to when I first was introduced to BBSs in the late 1980s and wondering that I may [03:26.430 --> 03:30.530] have put my dreams of being an astronaut or veterinarian on hold for chasing down this [03:30.530 --> 03:35.770] computer stuff. I mean, I doubt anybody then was going to expect we go from modems to high-speed [03:35.770 --> 03:40.590] direct-to-the-home fiber optics in less than 20 years and what was the domain of kids in their [03:40.590 --> 03:44.770] basements would end up being the most amazing invention of the 20th century or perhaps all of [03:44.770 --> 03:50.970] mankind. I hit college with an idea that yes, this technology thing is something, but what do I want [03:50.970 --> 03:56.250] to do? So I started as an electrical engineering and computer engineering major who sucked at coding [03:56.250 --> 04:01.330] and wanted to do something more applied. At the time, computer security topics were just covered [04:01.330 --> 04:06.370] undergraduate programs of which my work-study job supported, the Information Networking Institute. [04:06.630 --> 04:11.250] I changed majors twice to basically survive, but I still wanted to seek applied computing, [04:11.250 --> 04:16.670] basically how folks used what we now have. This is what I call the start of a career. Granted, [04:16.670 --> 04:20.950] nowadays this is what can be had in high school, but then it's usually after an initial stint in [04:21.050 --> 04:25.390] a post-secondary education, whether it be a four-year college or university or trade schools [04:25.390 --> 04:31.350] or community colleges. What most of this progress process really teaches you is how to gather and [04:31.350 --> 04:35.770] organize your knowledge and thoughts to manage output. Yes, learning particular point skills, [04:35.770 --> 04:39.750] especially in security roles, is now available in what is typically makes up these degrees and [04:39.750 --> 04:43.930] certification programs, but as somebody who's hired quite a bit over the years, I value how [04:43.930 --> 04:49.870] people are curious and put their thoughts together. So starting out, unless you're literally starting [04:49.870 --> 04:53.810] your own company, dropping into the family business, or get literally recruited to be [04:53.810 --> 04:58.590] the manager or director out of college, well, commissioned military officers are a whole other [04:58.590 --> 05:03.510] story, you're going to be joining an organization as an individual contributor. What that means is [05:03.510 --> 05:08.450] that you were hired for an initial skill set an organization needed. This also doesn't mean that [05:08.450 --> 05:13.870] this is all you will ever do. They expect you to learn and contribute, but typically in their way [05:13.870 --> 05:18.570] of doing business aligned to their market or mission. This is not to say that this is not [05:18.570 --> 05:24.470] useful or non-transferable. No, just the peculiarity of the business. Oddly, these business processes [05:24.470 --> 05:29.510] and methods are often covered as trade secrets, and they do likely protect them. And many ways [05:29.510 --> 05:34.190] of doing that is keeping employees happy and content. Again, if you see a lawsuit proposed by [05:34.350 --> 05:39.390] a company because some high ranking or major category lead and left for another competitor, [05:39.390 --> 05:43.450] the lawsuit is not just there to be officious, but they're protecting those trade secrets and [05:43.450 --> 05:49.890] that that person may have. You are a valuable asset. Sadly, not all organizations see that worth [05:49.890 --> 05:55.730] and treat you as such. For me, early in my career, I was trying to find that niche, and I'm sure many [05:55.730 --> 06:01.270] of you or are still trying to find it. It may take a few places to figure that out, and fine, [06:01.270 --> 06:06.310] especially in the security arena. You could start in a sock working crazy or shitty hours, [06:06.310 --> 06:12.690] or make, like the variety, this could be your jam. Maybe pivot to IRIH work, then to forensics, [06:12.690 --> 06:18.850] maybe RE. The amazing part, at least this career, is it's got a lot to explore. And as I noted prior, [06:18.850 --> 06:24.850] if you're curious, it will serve you well. For me, as I started to think about leadership roles, [06:24.850 --> 06:29.530] whether it be a line manager or all the way to wondering if I'd ever be a C-level tech exec, [06:29.530 --> 06:34.530] I figured a broad background would serve me well. However, not everybody wants to move up [06:34.530 --> 06:38.530] in management. But unfortunately, the tech sector is still grappling with how to manage highly [06:38.530 --> 06:43.150] skilled and competent technical talent, and not to recognize that some wish to remain individual [06:43.150 --> 06:49.310] specialists and contributors, and not be a team or group lead, or even an exec. Not every high [06:49.310 --> 06:53.670] performer has the skills to lead people on projects. And it's another entirely different [06:53.670 --> 06:58.810] skill set from one from core competencies for some specialists. And this is where we approach [06:58.970 --> 07:04.350] a fork in the road. At the point at which the realization that you may or may not want to move [07:04.350 --> 07:08.810] into leadership or management will usually occur between the times you're considered junior, [07:08.810 --> 07:12.270] and where you can be considered a seasoned professional with a number of projects and [07:12.270 --> 07:17.070] deliverables under your proverbial belt. I know the quandary that many folks in the security [07:17.070 --> 07:21.330] community have when trying to sell the value of an information security program to non-technical [07:21.330 --> 07:26.370] leaders and executives. It's selling the value of zero. I gave a talk on the concepts of zeros in [07:26.370 --> 07:31.550] organizations a few years ago for all day DevOps. Most security work is to work towards zero [07:31.550 --> 07:36.730] occurrence of an event or get close to zero, while many other roles seek to maximize your roles [07:36.730 --> 07:41.990] than to minimize. This is also seen in safety roles. And similarly, public perceived value [07:41.990 --> 07:46.490] is difficult to quantify and qualify because the lack of being in the news is beneficial. [07:46.490 --> 07:50.870] This can strangely be seen by a challenge that healthcare and other public safety officials have [07:50.870 --> 07:56.930] had to deal with during the pandemic. It's also hard to put a review that you've prevented a lot [07:56.930 --> 08:01.270] of stuff from happening. Since documenting it proves challenging and having to quantify [08:01.890 --> 08:07.310] what the impacts could have been in hypotheticals is a tough game to play and can lead folks to a [08:07.310 --> 08:12.870] challenge. Challenging your estimates and hyperbole is really kind of a no-win situation. [08:13.690 --> 08:19.490] So what are you to do to advance your career? Well, first off, don't get dismayed. The folks [08:19.490 --> 08:23.090] who can see the value work rather than just tabulate numbers will be the places where you [08:23.090 --> 08:27.490] want to work. However, those are a bit harder to come by, but things are getting better. [08:28.750 --> 08:34.030] Another tactic is finding a raft of good peers. This is your fellowship. This doesn't mean that [08:34.030 --> 08:37.950] you have to bounce onto a new role when they do, but this is some informal parallel between [08:37.950 --> 08:43.950] mentorship and support. I've kept in touch with a lot of former co-workers and such both let them [08:43.950 --> 08:49.770] hear to vent and like to hear from them and share my problems in kind. Share the challenges and [08:49.770 --> 08:55.590] successes I've had as well as share in those in kind as well. Sometimes when you need a hand [08:55.590 --> 09:00.530] sideways or a hand up they may be able to help you as well. This is more of an informal form [09:00.530 --> 09:05.530] of networking but just as useful as more formalized online sites and professional networking groups. [09:06.110 --> 09:10.910] So back to skills development for a moment. Say you're at three to five years in your [09:10.910 --> 09:16.050] professional career and you're finally deciding that what you may want to specialize in. First [09:16.050 --> 09:22.230] off I'm sure you'll like wait three to five years in? Yeah. Your first one to two years will [09:22.230 --> 09:26.550] probably be figuring out how to work in an organization, feeling out what like the culture [09:26.550 --> 09:31.430] is like, learning how to work within the processes and structure. I mean I had non-pro jobs while in [09:31.430 --> 09:35.590] high school working at a convenience store and a pizza delivery which had their own rules and [09:35.590 --> 09:39.350] culture but I wasn't anywhere to the point of calling them a career any more than they were [09:39.350 --> 09:44.150] pickup jobs during my pre-adulthood. But the two to five years is where you start to build up that [09:44.150 --> 09:50.150] launching pad of skills. The core knowledge you will expand upon. This doesn't need to be formalized [09:50.150 --> 09:54.670] either. In fact my work as a hobby got me the practical skills that formed the basis for my [09:54.670 --> 09:59.770] security career. All unpaid, all essentially unsponsored, but that extracurricular skills [09:59.770 --> 10:05.830] development is useful. About the third year in your company if you are on that first or fifth [10:05.830 --> 10:11.010] will have programs hopefully for training and other skills building. Take them up on those offers. [10:11.010 --> 10:15.110] Those are usually the first to go when the budget belt tightening occurs unless it is literally [10:15.110 --> 10:20.390] built into an audible benefit that they offer. When it's not formalized and I can tell you as [10:20.510 --> 10:24.730] a manager for many years a good boss will fight to carve out training expenses for their teams [10:24.730 --> 10:30.070] and see the value of professional development. I've gone to the carpet many many times to ensure [10:30.070 --> 10:34.750] my team has had at least one to two training experiences even if some may be non-technical. [10:34.790 --> 10:40.290] They can still network with peers. Fostering continuous education will be the greatest asset [10:40.290 --> 10:45.230] to your career regardless of which path you choose to take. Realizing that skills are not [10:45.230 --> 10:49.370] evergreen and require refreshing is another. Knowing that you will need to adapt to the [10:49.370 --> 10:53.910] changing face of business and environments you will operate will ensure that you will continue [10:53.910 --> 10:58.690] to be able to call a career as you inevitably age. But this isn't saying that you can't carve [10:58.690 --> 11:03.110] out a corner and specialize but you have to ensure that you're also innovating in the right way and [11:03.110 --> 11:08.270] being useful as a resource. As much as some cockles that get raised when somebody raises [11:08.270 --> 11:13.790] the spectra of a rock star or a luminary, either they will be a momentary flash in the pan or they'll [11:13.790 --> 11:18.410] be required to constantly reinvent themselves. Continuous learning ensures that you can always [11:18.410 --> 11:24.450] build on what you have and not be that one-hit wonder or rock star. So let's broach the rock star [11:24.450 --> 11:29.930] discussion for a moment. Like most rock stars it seems, and I've met a few, the actual musician [11:29.930 --> 11:34.910] rock stars, they may lack a little bit in the soft skills department because they've often hyper [11:34.910 --> 11:38.850] focused on the skills development of their core work but haven't worked on the soft skills that [11:38.850 --> 11:44.870] make them interact with people as a human. There's plenty examples of those infosec rock stars being, [11:44.870 --> 11:50.510] to put it lightly, assholes. Particularly to the new people in the career space. There are exceptions [11:50.510 --> 11:54.530] and those are the good ones. They often forget that they were not all born with what they have [11:54.530 --> 11:59.170] and remembering that helps you get a career progression. Ego is not something that people [11:59.170 --> 12:04.510] will suffer well and it's easy to break. As I've said in other talks, when hiring people [12:04.510 --> 12:09.310] I much prefer the reliable and skilled roadies and sidemen than the star or front men of a band [12:09.310 --> 12:14.670] because they show up every day, do their job, and because their employment is based on how well they [12:14.670 --> 12:19.910] do their job, usually have a vested interest in the outcomes. It's hard to think that some jobs [12:19.910 --> 12:25.510] are so at will as such but the best combatant against that is being an exceptional contributor. [12:25.730 --> 12:30.410] It's also a case of balancing and not getting abused by a boss or a peer and that's the next [12:30.410 --> 12:36.330] piece in the career to plan for. Again, I've been in the show for over 20 years and I've had [12:36.330 --> 12:41.410] the opportunity to walk away and to be honest, the idea has crossed my mind more than a few times. [12:41.590 --> 12:47.190] Just light a match, burn it all down. The flip side of worrying about what's next is also [12:47.190 --> 12:52.210] something that hangs over as a cloud. Often those thinking of making a radical change or a leap to [12:52.210 --> 12:56.430] something different burn a candle at both ends. A day gig and then the build-up of the next thing, [12:56.430 --> 13:02.770] be your own boss or a new venture. It's trying, it's stressful and it's not for everybody. [13:02.770 --> 13:07.510] But this is another route to use your experience to be a leader. Even if the goal is to flesh out [13:07.510 --> 13:11.950] and build out an idea with a goal of being later acquired, the opportunity exists to stretch your [13:11.950 --> 13:17.190] legs and see if you can cut it. At best, you can go back to being an individual contributor, [13:17.190 --> 13:21.990] go further into management or cash out and live other dreams. You're writing your own story. [13:22.370 --> 13:26.050] So that's all well and good for those who are less risk averse. You mentioned that you were [13:26.050 --> 13:30.370] all over the map. Yeah, I was. And it seemed like working for a lot of well-established [13:30.370 --> 13:35.670] organizations, especially the government. What about that? Well, I'm glad you asked. [13:35.690 --> 13:39.410] And to say that this wasn't a route I valued for my own needs would be disingenuous. [13:39.430 --> 13:43.930] I had and still have a lot going on in my life where I value the rough sense of some bankable [13:43.930 --> 13:48.750] security. Technically, public service is one of the few places that rarely sees layoffs. And if [13:48.750 --> 13:53.070] they do a reduction in force, known in the private and public sector as a riff, there's a lot more [13:53.070 --> 13:58.710] justification for seeing the door than on a whim, especially if you're a high performer. Safety, [13:58.710 --> 14:04.150] or the perception of it, is a good thing if you're trying to do a lot. The fact that there's [14:04.150 --> 14:09.330] something tangible and reliable there is good. This is why folks may call it the daily grind, [14:09.330 --> 14:13.170] but it's what others will base an entire career doing, and it often affords them a lot of [14:13.170 --> 14:18.170] intangibles. This is not to say a smaller company, startup, or even deciding to pull up roots and [14:18.170 --> 14:24.110] become an expat or go on a sabbatical isn't going to offer benefits either. They will, but it's up [14:24.110 --> 14:31.390] to you to evaluate what your needs are. Well, how do I evaluate my needs? This is essentially where [14:31.390 --> 14:36.650] the rubber hits the road. This is where you need to do a little planning. This isn't locked in, [14:36.650 --> 14:41.810] carved in stone, but an idea, given your experiences and desires and dreams, about where you want to be [14:41.810 --> 14:46.970] or see yourself being in a few years. It can have a timeline or can just be an endpoint with no [14:46.970 --> 14:51.230] planned speed. For me, I had hoped to possibly become a C-level techie and at some point in my [14:51.230 --> 14:55.930] career I just wasn't expecting that opportunity, even if it was for a smaller org, by the time I [14:55.930 --> 15:00.750] turned 45. Your timeline or desires may be different, possibly even fueled by your experience with [15:00.750 --> 15:06.570] working for and with individuals you may have a role that you desire. This is where we get to the [15:06.570 --> 15:11.930] one ring part of the story. Sometimes this overall exposure to what some can term the brass ring [15:11.930 --> 15:16.890] can be toxic, much like Smeagol and Gollum, and the exposure to the dog-eat-dog boiling [15:16.890 --> 15:21.510] crab pot of the corporate and even public sector world of ladder climbing can cause significant [15:21.510 --> 15:27.270] change in who you may be. The desire for more, greater and perceived better, can change a person [15:27.270 --> 15:31.910] if they drive themselves too hard thinking that the next rung is going to make them happy along [15:31.910 --> 15:38.750] with perceived success. They will step and crush on whoever seems an impediment to that path, [15:38.750 --> 15:42.550] break relationships and go through the world with a single-minded purpose at the expense of [15:42.550 --> 15:46.690] nearly everything that doesn't generate forward movement. All I have to say is, [15:46.690 --> 15:52.750] you can't take it with you. For a lot of us, and as I noted earlier, is that our curiosity fuels [15:52.750 --> 15:58.150] our passions for this job or career that we chose to have. Nobody forced us into it. Well, [15:58.150 --> 16:02.390] maybe a parent wondering if this is better than being a doctor. So we're here by our own free [16:02.390 --> 16:06.570] will, so why not enjoy the journey? I mean, typically if you're working from the age of 18 [16:06.570 --> 16:12.210] to 20 to 65 to 67 years old, perhaps longer, that's 45 or so years of hopefully gainful [16:12.210 --> 16:16.670] employment in doing something that you love to do. It's really not a dash and more hopefully [16:16.870 --> 16:21.010] a leisurely stroll or hike, a marathon if you're really trying to torture the metaphor for the [16:21.010 --> 16:27.070] runners. Smell the flowers, enjoy the scenery. Granted, there's some externalities here which I [16:27.070 --> 16:32.230] may gloss over, which is the bias, even though illegal in many forms, towards race, gender, [16:32.230 --> 16:36.470] sexuality, disability and other characteristics which really shouldn't have any bearing on how [16:36.470 --> 16:41.070] good you are for a given role or opportunity. This particularly comes in play for minorities [16:41.070 --> 16:47.150] within a given field, whether it be gender, race, socioeconomic background, or LGBTQ status. And [16:47.150 --> 16:53.030] when you stack them, it becomes even a bit more complex. And while I won't go into the discussion [16:53.030 --> 16:58.150] about how much about diversity here, I want to make a point of the fact that this seriously [16:58.150 --> 17:02.530] changes the calculus for many in their careers. And this is something serious to consider both as [17:02.530 --> 17:07.250] one in the career and those who are in charge of hiring and leading those teams and efforts. [17:07.330 --> 17:11.010] There are plenty of other better talks on this than I can give at this moment, [17:11.010 --> 17:14.810] so I wanted to at least bring this up to your attention and note that this is still very much [17:14.930 --> 17:21.110] a going concern. Once you've walked the path for a while here, looking at your preferred end role or [17:21.110 --> 17:27.670] state, you're considered a senior level material. And this is what can be construed with a few more [17:27.670 --> 17:33.970] lines and occasional less than natural colored hair of gray. Then you may get plucked to be asked [17:33.970 --> 17:39.690] the question, would you like to be a manager? And this may give some folks pause. One, they didn't [17:39.690 --> 17:45.870] ask to see the manager unless you're the person asking was a Chad or Karen, so double check. But [17:45.870 --> 17:50.310] what they asked is, you have the possibility demonstrated enough leadership qualities in [17:50.310 --> 17:54.830] order to be considered a good candidate, not just to be an individual contributor to a team or [17:54.830 --> 17:59.610] project, but to actually lead it. Granted, you could be asked this sooner if you displayed an [17:59.610 --> 18:03.890] early aptitude for it. But usually after you found your way with what you want to do, got the ropes [18:03.890 --> 18:08.610] of an organization or two, and I've had some history to point on for some successes and yes, [18:08.610 --> 18:15.770] failures. For some, this comes with an exclamation of cool, or awesome, or even maybe a dance in your [18:15.770 --> 18:21.830] cube. Others, it may be an oh shit moment. Because this potentially ends the comfort of isolation [18:21.830 --> 18:26.090] or just being part of a team, or better yet, not being responsible for anything other than your own [18:26.090 --> 18:30.990] work. However, for those that are in the crux of this decision point, there's hope if you play it [18:30.990 --> 18:36.050] right. Some come to this point worrying if they will be able to maintain their technical focus [18:36.050 --> 18:41.270] and chops if they decide to become a leader or manager. The short answer is yes, but it comes [18:41.270 --> 18:46.370] with some caveats. The further you move up the leadership chain, the more divorced by design you [18:46.370 --> 18:51.610] will become from the day-to-day minutia. If you think you can go back and pull every oar and steer [18:51.610 --> 18:56.870] every rudder of your fleet of ships, disabuse yourself of that idea entirely. The same aspects [18:56.870 --> 19:02.810] of managers you hated who may have been dictatorial or micromanaging in their roles, you just adopt it. [19:02.810 --> 19:07.670] Just don't. Your job is to find and raise up trusted lieutenants, and by that I don't mean [19:07.670 --> 19:12.110] sycophants, but find the right talent to raise up and effectively fill the gap you and others may [19:12.110 --> 19:16.610] leave when they progress to the professional development life cycle. [19:17.810 --> 19:22.010] Essentially, you also inherit the role of talent scout, and when I mentioned before about taking [19:22.010 --> 19:26.390] advantage of training opportunities you had early on to keep you sharp, you are now directing that [19:26.390 --> 19:31.070] role, so I hope you learned something then. This doesn't sound like maintaining my technical job, [19:31.070 --> 19:36.250] she's saying, but you're just leveling up. I know folks like to code, work hands-on with hardware, [19:36.250 --> 19:41.570] and so forth. I get it, I miss the chase of IRIH work and building up a network of network defense [19:41.570 --> 19:46.130] systems. However, I feel that the benefit from being a senior level individual is the experience [19:46.130 --> 19:51.070] and lessons learned that you can impart to others. My own jump from engineer to architect [19:51.070 --> 19:55.750] worked that way as it gave me a broader view of the mission and business we were doing. I got to [19:55.750 --> 19:59.930] work with a lot of other people with other skills and help bridge the gaps in understanding and [19:59.930 --> 20:05.190] communication across various teams and business units. The key point is not to be cynical about [20:05.190 --> 20:10.550] the fact that you're possibly now in charge and that as much as all the crap that may roll up to [20:10.550 --> 20:14.970] you, the accolades may also be the first to hit you. How you balance it is where you start to [20:14.970 --> 20:19.630] succeed as a leader. This is about the time where I started to broaden out my own background. [20:19.630 --> 20:24.050] As I noted, I did the system engineering and started into architecture, but I also started [20:24.050 --> 20:27.790] into compliance policy work. I figured if the compliance people were going to grade me on my [20:27.790 --> 20:32.190] engineering and architecture skills, it may be about time for me to walk a mile or so in their [20:32.190 --> 20:36.590] shoes. It gets you to re-examine your approaches and how and why you do your work. And because it's [20:36.690 --> 20:39.910] a different layer and working with different types of people, it delivers some skills you [20:39.910 --> 20:44.950] wouldn't normally get if you hyper-specialized. As much as folks will push the red, blue, and purple [20:44.950 --> 20:49.210] team and any other color that's in vogue right now as a way to run multiple angles of learning [20:49.210 --> 20:54.310] about offensive and defensive sides of operational security, the policy arena is also a way to take [20:54.310 --> 20:59.030] the tabletop or live fire aspects to another level. I know many will think that policy is [20:59.030 --> 21:03.810] merely just coming up with ways to be more efficient. However, a good policy people will [21:03.810 --> 21:07.670] examine things from every angle they can, thinking about scenarios the same way a defensive or [21:07.670 --> 21:13.690] offensive team would, to ensure it's the best way to apply and govern a policy. In other cases, you, [21:13.690 --> 21:18.470] if you end up doing policy work, may be on the front lines of a new technology proposal or action [21:18.470 --> 21:23.270] or other event and need to quickly react and develop a working framework for how to handle [21:23.270 --> 21:28.210] everything. It requires a nimble mind with a deep background and experience in the topics of policy [21:28.210 --> 21:33.910] is to cover, and then some. You'd be surprised, but some of those policy wonks are pretty awesome [21:33.910 --> 21:39.230] people and really interesting way to expand their applied skills when you may feel a little bit of [21:39.230 --> 21:43.810] techie burnout. Given all of this, you'd think you'd be nearing an end, and yeah, it's kind of [21:43.810 --> 21:48.610] near there. By this point, you probably have touched about every little aspect of this career [21:48.610 --> 21:53.010] space and even getting to speak at conferences like this and others, potential volunteering and [21:53.010 --> 21:58.830] giving a little back, but you're now about to decide, do I stay or do I go? And by that, I mean [21:58.830 --> 22:04.450] being a leader is a lot of work, a lot of paperwork, emotional labor, and a lot of time. You need to [22:04.450 --> 22:08.810] essentially still find those balance points in order to not burn or flame out. Say you've been [22:08.890 --> 22:13.430] a senior leader for a time, it's okay to go back to an individual contributor role like from when [22:13.430 --> 22:19.310] you started. The answer is a resounding yes. In fact, it should almost be standard practice. For me, I'd [22:19.310 --> 22:24.170] been a manager again for about five years before I realized I needed a break from the stress and [22:24.170 --> 22:29.630] the politics. That stuff I mentioned before, especially the emotional labor, will wreck you if [22:29.630 --> 22:35.270] you give a hoot about your staff and your work. I know a lot of folks will say to try to separate [22:35.270 --> 22:39.990] work from the people, but when you're doing things that has a good mission and a potential, [22:40.430 --> 22:45.690] it's a very hard thing to do, even when you think you can easily do it. As a leader, the relationships [22:45.690 --> 22:50.530] you developed are useful in order to get things done, but as part of building trust, people will [22:50.530 --> 22:56.910] open up to you and get invested. In a way, you can say that this is the I care too much issue, but it [22:56.910 --> 23:02.270] happens. Then again, besides all that, you may want to take a break, try something new, that continuous [23:02.270 --> 23:06.710] learning stuff, and build a skill set that you don't have or feel you may need to advance even [23:06.710 --> 23:12.170] further if you are a senior leader or executive. For me, when I started as a deputy CIO for a federal [23:12.170 --> 23:16.810] agency component, I was thrown into areas I had no formal training in, including budgeting, human [23:16.810 --> 23:21.830] resources, and more formalized project management. I had people who had PMP certifications working for [23:21.830 --> 23:26.150] me. I ended up hiring a budget officer to help with our budget management and procurements and [23:26.150 --> 23:31.430] contracts. Well, this may sound like a cop-out as to why don't you do it yourself? Well, the answer [23:31.430 --> 23:35.950] is I try. I worked with these folks, but I also knew that they knew way more than me and did a [23:35.950 --> 23:40.150] better job of it. This is the sign of a good leader, which is to know where your expertise [23:40.150 --> 23:46.270] and quality ends and somebody else's begins. It's not ego. In fact, it's humbling. [23:46.270 --> 23:51.850] Know when to ask for help. Know when to delegate. Know when to hold them. Know when to fold them. [23:51.850 --> 23:57.130] It's an important skill that many CTOs, CIOs, and CISOs I know definitely do not do, but could also [23:57.130 --> 24:00.870] ease their lives if they admitted that they can't do it all. This is a bit of the Type A [24:00.870 --> 24:05.070] control freak personality type that draws some people to leadership, but they will also fizzle [24:05.070 --> 24:10.570] out over time or move on and create a potential other disaster. As I moved on, I realized I needed [24:10.570 --> 24:14.330] to learn better communication skills. The last few positions I had for the federal government had [24:14.330 --> 24:19.870] yearly reviews that constantly harped on this. I was also always eager to go and speak, work on [24:19.870 --> 24:24.970] those skills in a more public forum. You obviously hear me here and see me now, so part of this is [24:24.970 --> 24:30.270] working out. However, one of these experiences I didn't have in my career, and especially in a [24:30.270 --> 24:34.470] particular sector, was working for a vendor. And as such, in a role that is now strangely [24:34.470 --> 24:39.330] considered part of marketing, is that of an advocate. Now, many will look at such roles [24:39.330 --> 24:43.910] and think, well, that's just a pitch man or pitch woman, and it's no better than sales, [24:43.910 --> 24:48.250] but it's really not. In fact, many of the senior folks here, goons, speakers, and such, [24:48.250 --> 24:52.170] actually have roles similar to mine. It's an educational role as much as a customer-facing [24:52.170 --> 24:56.310] and interaction role that not only requires being able to speak intelligently about a topic, [24:56.310 --> 25:01.670] but also listening. Listening is a very underutilized skill among techies at times. [25:01.970 --> 25:06.310] Obviously, you're here and listening to me, but actively listening in order to synthesize a useful [25:06.310 --> 25:10.890] interaction with a customer or teammate or executive is a very useful skill to develop. [25:11.070 --> 25:15.730] Much like critical thinking is as much an innate skill for people and important in navigating [25:15.910 --> 25:19.030] a career development, the refinement of communication and listening skills are the [25:19.030 --> 25:23.910] ones that will mature over time as well. As an advocate, I get to touch many parts of our [25:23.910 --> 25:28.490] organization. I get to develop strategies for all sorts of things for a very broad viewpoint, [25:28.490 --> 25:33.350] but also get to dig into some passion areas. It's outward and inward facing. If it wasn't [25:33.350 --> 25:36.330] for the pandemic, I'd have been on the road for a significant part of the time, [25:36.330 --> 25:40.410] which is something new and interesting for me. I can freely admit that some of it was [25:40.410 --> 25:43.890] possibly to build up some frequent flyer and hotel points for eventual time off, [25:43.890 --> 25:48.590] but those are some things, the fringe items you consider when making changes like that. [25:48.590 --> 25:52.150] I'm about eight months into slipping back into individual contributor role. It's drastically [25:52.150 --> 25:56.370] different from my prior C-level role, but also somewhat similar because I'm looking at interactions [25:56.370 --> 26:00.590] with people at my former level from a different perspective. Conversely, I'm getting time to [26:00.590 --> 26:05.230] explore a few things I wasn't allowed to do or have the time or resources to pursue. There's a [26:05.230 --> 26:09.490] lot of these considerations for changes. My boss says, be comfortable being uncomfortable, which [26:09.490 --> 26:13.770] is actually a really good bit of guidance. We are typically kind of risk adverse in our roles [26:13.770 --> 26:17.590] and lives, and we value the basic needs of housing, food, and sleep, maybe a good hot [26:17.590 --> 26:22.230] shower on occasion. So we tend to sit there until we have to move. This is a skill while [26:22.230 --> 26:26.870] you have your day-to-day is encouraging to walk the knife edge and explore new things and new [26:26.870 --> 26:32.090] ways of looking at it. To be honest, it's one of the best moves I've made. However, my desire is [26:32.090 --> 26:36.530] still to go back into leadership. I figure that the skills I develop here will support what it [26:36.530 --> 26:41.090] needed to be to be a more effective executive when I hopefully return to those ranks, or with [26:41.090 --> 26:44.770] the time and experience afforded to me to do something different from my day-to-day, possibly [26:44.770 --> 26:49.470] strike out on my own and start something new. I already did my own hobby-like startup for a [26:49.470 --> 26:54.130] decade and a half, and it ended up in the black, barely, and was sold when I lost the time to [26:54.130 --> 26:58.490] actively participate in a way that I wanted. If I start my own thing, it will be from skills acquired [26:58.490 --> 27:03.290] through doing everything. I think it's the best kind of skill sets to do this. It will help me [27:03.290 --> 27:08.290] with those I plan to hire, as well as learn what I need to take to make it in the marketplace. [27:08.290 --> 27:12.050] I'd have the budget, purchasing, management, sales and marketing, development, engineering, [27:12.050 --> 27:15.930] policy, and even some legal background in order to make a good go at it. The path is [27:15.930 --> 27:21.670] mine and yours to choose. This is the journey. This is your quest. Good luck and best wishes. [27:21.670 --> 27:26.390] Again, thanks to DEF CON, the new Career Hacking Village, and the staff and volunteers who helped [27:26.390 --> 27:32.330] with all of this. Such an amazing story. Really great inspiration. Thank you so much, Amelie, [27:32.330 --> 27:39.430] for sharing your story and your tips on how people can get from individual contributor to leader to [27:39.430 --> 27:45.830] individual career contributor, but also making sure that they're getting a fulfilled life and a [27:45.830 --> 27:48.210] life that they can give back. Thank you so much.