Security is an interesting discipline – the threat landscape is always changing and we’re forced to keep up constantly. The simple reason behind that change is that security is ultimately a quality issue. What’s interesting about quality is that issues in product quality are heavily front-loaded – as a product matures, the number of newly discovered quality issues decreases. Thus, the security issues are almost always within the newest technologies.

This forces security professionals to be always conversant on the newest technologies. Imagine for a second that we had a time machine, and we brought three IT professionals from 1997 to the present: a Unix system administrator, a C programmer, and a security engineer.

The Unix system administrator’s knowledge of SunOS 2.6 would allow them to be functionally conversant on a modern *nix system. They’d have a few things to learn, but most of their fundamental knowledge (e.g. run levels, cron, syslog) would be useful today.

The C++ programmer would still be able to hack on code. Sure, there have been changes to the STL over that time and there are some new constructs. They might have to learn pair programming and agile methods. But their coding skills would be the same.

The security engineer would be…. well, lost. Functionally incompetent. They could expound on Smurf and Land attacks and ensuring that there were as few SUID binaries on your box as possible. But they couldn’t even use the basic technologies… Firewalls weren’t stateful. IDS was barely nascent. There was no such thing as spyware. SIEM, DLP, and anti-spyware would have been terms that made no sense. No wireless networks. Not to mention that “cloud” and “social network” would have garnered confused looks.

Five years from today, the Unix admin and the coder will still be conversant. And my examples that I used talking about the security professional will seem quaint and antiquated.

This is because the challenges for the security professional are always in the brand new technology – we don’t deal with issues in the IP stack because we handled them in 1997. And we moved on because the attackers found more fertile ground in the new technologies. And we will move on again – in five years, web app security will be old hat, as will “the cloud”. (”Remember when we were all worried about issues on Facebook and Google Apps?“, we’ll remenisce at Defcon 22…)

This makes it extremely difficult to create a long-term career in infosec – the moment you stop being conversant in the newest technologies is the moment that you’re functionally obsolete. So, we have to be willing to make a long-term commitment to our own growth and investment. We have to study. And we have to continue to grow every day lest we be left behind.

As I was reading your post from last week, something stated in “For Love or Money’s” question really struck a chord with me.  When they stated that “I work for one of those employers that is known for being a low payer, and can get away with it because of the coolness quotient associated with the opportunity,” I felt as if they were one of my co-workers.

Let me explain.  I work in a security research environment.  My team is full of smart peoole.  We have a great deal of freedom in our jobs.  If I do say so myself, we do produce some great results.  Security research is an important component of our company, however it is not our core business.   The downside is that we are not paid as well as our peers in other security research organizations.

During some informal work meetings, the subject of being underpaid comes up regularly.  I know first hand that for myself and other individuals, the low wages are making things difficult in our lives.  There are some members of the team that have not have increases for over 2 full years, not even cost of living. 

My current employer (the CEO) regularly reminds me and my peers that we are fortunate to have the jobs that we have, and to do the work that we are doing.   He also says that there are many people who would like to have these jobs, if we do not want them.   Statements like those, have made us all afraid to ask for additional salary, since we fear the consequences of becoming jobless.

However, recently we have been speaking about the ideal of coming to him, collectively, to let him know how we feel and our dissatisfaction with our compensations.   I have spearheaded the idea with my peers, and I feel like the leader.  As the end of the year approaches, it becomes a logical time to approach him with this – however I/we am not sure if this is the right move in the back drop of this economy.

Hoping for some help,

Signed,

“Paul Revere”

Dear “Paul Revere”:

This is a personal decision that has big consequences for everyone that could be involved.  I think that before you begin preparing for the revolution, you and your peers have to strongly consider the following factors: their feelings about their current employment, the importance of compensation, their ability to find suitable employment elsewhere (marketability), and the personal financial situations (which do not appear to be that solid).

I realize that you frame this question as a “revolution”, as an outsider it appear to be more akin to “unionizing” your workplace.   Many times when people attempt to “unionize,” management is forced to make some hard decisions either  give into the demands, appease the workers in the short term (until suitable replacements can be found) or fire everyone. 

Generally speaking, management does not respond well when they are foced to do anything.

Here are two thoughts that you may find helpful:

The first thing that I think you should all do is figure out a risk/reward scenario for your potential actions. 

I would think that the largest amount of increase (best case scenario) that your company can stomach would between 5-10K per person.  At the end of the year, that amount equals somewhere between $100-$200 per week/ per person – before taxes.  Generally speaking, that kind of money is not going to change any one’s lives dramatically, although there is no doubt that it could make things easier.    

The worst case scenario, is that your management decides to fire either one of your team’s members, or all of your team.   If they choose to fire all of you, then at least you are all in the same boat, and have learned your lesson together  (Although this is not good, but there is something to be said for solidarity). 

What could possibly happen is that your management decides to fire one of your team’s members (most likely the least productive one) and then divides their salary amongst the remaining team members.  If that happens, all but one of you will have accomplished your goal (getting more money), but at the expense of one of your team members losing their job.   If this does occur,  you all may feel a sense of obligation to that fired team member (since it is a result of a collective effort)  and each of you should contribute to a team created “severence fund” (until they locate employment) – therefore negating the compensation increase.

The second thing that you should do is to come to grips with the fact that your company’s attitude toward compensation is not going to change.  

Your CEO has made it clear tha they are not going to pay you any more money.  They have even gone as far to say, that you should be grateful to work there.  Since that is the prevailing attitude, toward you and your team,  you should begin to polish your resumes, and begin to search for an employer that places a higher value on your talent and contributions.    

One thing you may try to do, is to market yourself as a “team” – and approach companies collectively.  Given the nature of your work, there could be a few companies out there that are looking to establish or enhance their information security research function.   If you do decide to package yourselves as one unit, make sure that you all are realistic in your compensation expectations and that these potential employers understand that you come as a unit – that they can not hire one, without the other.   This way, they will fully understand the total cost associated with your hiring, and will know very quickly if they have the budget to absorb you and your team.

Having had some experience with recruiting teams, I can tell you that it is human nature for people to look out for their own self-interests and careers during this process.  I have seen some of the best teams deteriorate, when they have competing self-interests.   

Please remember that everyone’s career is unique to them – and what is good for one person is not necessarily good for the other.    Your intentions to mobilize the team are honorable.  However, they can turn out to be quite complicated and more than you originally bargained for.

Hope this helps,

Lee and Mike

The first chapter had a line that forced me to write here, though. In the middle of a discussion about how women are still underpaid in America, this quote appeared (pg. 45):

“Over the first fifteen years of their careers, women work fewer hours than men, 52 per week versus 58. Over fifteen years, that six-hour difference adds up to six months’ less experience”

These are the average working hours for MBAs that graduated from the University of Chicago. (Original Paper Here)

This is something that applies to me. Early in my career, I had no social life. I spent all of my time working on computing projects through college and the first 4 years of my career. I ported a version of Gnome to OpenBSD for fun because I wanted it to run on my laptop. I figured out how to run my home firewall with the OS unbooted. We found the first remote vuln in Windows 2000. And I worked at crazy startups non-stop. I worked 70, 80, 90 hour weeks for years.

And it gave me a huge advantage. After 3 years, I was doing what people who had been in the business for 5 were doing. After 5 years, I was doing what the 10 year people were doing.

I always felt like hard work was the biggest advantage. I’m excited to see it in an academic paper (and in Super Freakonomics.

And I realize that I’m an extreme example. But you don’t have to be so extreme. How many of your peers work 35-40 hour work-weeks? If you average a 58-hour week (like the majority of the male MBAs in the study), after 5 years, you’ll be six months ahead of them. After a decade: a full year.

While we often counsel people on their careers and give advice on resumes, interviewing, career planning, etc., I think the best advice I can give is simple:

Love what you do and work hard. The more you love it, the harder you’ll work. And the harder you work, the more successful you’ll be in the long-term.

Not quite Tim Ferriss. But definitely true.

Currently I am faced with a career decision to make and I would like for your guidance. 

Here is my situation – I have been working for my employer for a little more than a year.  I like my job, my manager, and the people that I work with.   All that being said, my compensation is something to be desired.  My employer is known for being a “low payer”, and they can get away with this because of the “coolness” quotient associated with the opportunity.

I have recently been approached by an industry peer about working with him at his current consulting company.  It is a good company, and reputable.   The job offers about 15% more pay, and considerably better benefits.  However, the job is going to reduce my overall quality of life – due to commute and travel.  In addition, I am not confident that I will be working with the same caliber of people that comprise my current team.  Also, I am not sure that the technical components of the position will provide me with the same level of enjoyment as my current responsibilities.

In the background of this is the economy.  I am the sole bread winner in my family and times are a bit tight.  The extra money (around 15-20K) would make a huge difference to me and my family.  There is not doubt that I am feeling the pressure at home.

I am really torn in making this decision.   Can you give me some guidance on this.

Regards,

“Security Sell-Out?”

Dear “Potential Sell-Out”:

Money is clearly a core reason for working and could be the determining factor in changing positions.  It appears that you have some growing responsibilities at home, and people who count on you for providing for them.   That is a huge undertaking and should not be taken lightly.  Next to your own happiness and satisfaction, the people at home are the ones that matter most.

15% more income is a good amount of money and could make a significant difference in your financial happiness,  but it may take a greater personal toll.  Let me explain:

First, the position appears to take you away from an environment that you enjoy, people you like working with, and technical information security challenges that keep you motivated and focuses.   In the new position, you may develop different skills, but they may not give you the same level of intellectual satisfaction.   Conversely, it is possible that if you are exposed to these new opportunities, you may respond well to them, and they can open your eyes to something that may be more challenging and rewarding. 

Simply put, you need to figure out if you will find happiness and satisfaction in your new role.

Second, is the impact on your quality of life.  I am not sure where you are located but unexpected travel and extensive commuting can be both physically and emotionally draining.    Also, this additional time away from home can cause strain on your personal relationships, especially if you (and your family) have never been exposed to this type of work environment.  This can greatly effect your happiness on a daily basis, and the only saving grace will be that more money is deposited in your account every 2 weeks.

As a side note, the cost of divorce is much greater than 15-20K.

One of the ways to figure out how much travel you will ultimately do, is to ask your potential new peers about the travel demands they have faced over the past 12 months – this should provide you with a good indication of what you could  be getting yourself into.

You have to be real honest with yourself about this, and figure out if your relationships at home can adjust to this life change.

In closing, I think that you need to sit down with yourself first, and figure out if the increase in compensation is fair value for the sacrifice and change that you are going to make.  You have to weigh the reward of money – with the risk of losing job satisfaction.   

If the answer to that question is “yes”, you then need to explain to your spouse what the extra demands of the role will be, and the sacrifice that your family will be making by not having you “around as much.”  You need to make sure that you have their full support and understanding before moving forward.

After this, reflect again.  Think about your career and your financial future (Yes – they are intertwined).  Make your decision.  Once you have made it, be prepared to stick by it, before you share it with anyone.  Move Forward – Full Speed Ahead.

Let us know what you decide, and how this turns out.

Sincerely,

Lee and Mike

I was just recently involved in an interview process for a desirable information security position.  I will admit that the position itself was a stretch, but I felt that it was the next logical step in my career.  I interviewed well, aced the technical component,  connected with the hiring manager, and made it to the final interview.

At the end, the human resource representative informed me that I was the second choice for the role.  From the feedback that I was provided, it led me to believe that the other candidate had more relevant information security experience.

Is there a way that I can overcome this, if I pursue a similar opportunity?

Signed,

“First Runner Up”

Dear “First Runner Up”:

From your question, it appears that you have learned some valuable things from your interview experience, although you were not selected.  This is a good thing,  We are big believers that you learn more from your failures than your successes  It is good to reflect on your interview performance, and discover what you did well and where you can improve.

It appears that you have learned that their is some steep competition for good information security roles and that many information security professionals have similar career paths.   During an interview process, it is unlikely that you will have a glimpse into your competitors – but it is possible that they can be more experienced, more technical, better communicators, and better business skills.  When you interview – you have to assume that they have all of the above, so you need to prepare yourself to compete.

In the Information Security employment market place of the future, in order to be selected for the the most desirable information security career opportunities, you not only will have to be good; you will need to be better!

I would use this interview process as a chance to evaluate your skills and figure out where your true deficiencies are, that could possibly place you at a competitive disadvantage for these types of roles   Be honest with yourself when you go through this exercise.   Upon conclusion, select one or two areas that you believe are most critical, and make a conscious effort to develop them through career investments that can help separate you from your competition.

I know that you raised your primary concern regarding your amount of experience.   There are some hiring managers that hold this as their chief criteria for making decisions.  If this is the case, you will always lose out (until you acquire more experience).  However, if the hiring manger is using talent and skill as their primary criteria, solid career investments that differentiate you from others and demonstrate your aptitude and passion, could compensate for your lack of experience.

Hopefully, the next time you will get the job and “wear the crown!”

Hope this helps,

Lee and Mike

Dear Lee and Mike,

Thanks,
Ops Guy

Dear Ops Guy,

Where to start. First, by my rudimentary math skills, you’re 26 years old. If you’re typecast at 26, we’re all in very deep trouble. Mike’s father started his first business in his mid-50s, so I think there’s hope for you yet.

That said, you’re coming up against problems that many security professionals face on a daily basis: you’re doing work that doesn’t fit what you want to do, and you don’t know how to transition out of that. You don’t fit the profile for most of the consulting firms that you’re talking to and you’re not sure what to do to fit the profile.

First things first: many, many consultants come from an ops background. Mike is one himself – his first jobs were system administration jobs (you can even find articles he wrote in the early part of the decade in the “Sys Admin Magazine”) and he transitioned in to consultant roles.

The majority of this issue comes down to a branding problem: we talked in our recent Search Security column about the steps that you can take to enhance and build your personal brand. In this case, you need to seek out others who have done what you’re trying to do and figure out how they did it. You know what you want to be known for and where you want to end up – now it’s just a matter of working to create the brand that you want.

Additionally, it seems like you might be having trouble interviewing, but that’s a subject for another week.

Mike & Lee

As always, feel free to ask us any questions you have about personal branding.

Also: we’re going to be doing a special question and answer session in our SearchSecurity column next month: if you want to end up in the column, feel free to mail the editors.

I have recently found myself looking back at my career and find myself to be dissatisfied with the way that things have been turning out.  I have 15 years of overall IT experience, and have been with my current employer for about 7 years.   Although the pay has been good, I feel that my advancement and professional development has stalled.  I believe that there are some opportunities within my current company that would enable me to build the information security skills that I am seeking to develop, but because I am doing a “good job” in my current role, my manager is reluctant to let me pursue these other opportunities.

I like my company, and do not want to jeopardize my employment in this economy, but I fear that my window of opportunity for advancement is quickly closing an my skills are growing stale, and I am basically running in place.   

Can you provide me with some guidance on how to better my situation?

Signed,

“Stuck on the Treadmill”

Dear “Stuck on the Treadmill,”

Before we answer your question, I want to bring to light the importance of development of a written career plan.  Your personal situation is not unlike many others, who settle into a comfort zone, excel at their position, and become a victim of your own success.   The development of a career plan, that will map out skill and professional milestones, and intermediate  steps for overall goal attainment is critical to preventing the situation that you currently find yourself in. 

All that being said, all is not lost.  The fact that you have recognized this at the midpoint of your career is a step in the right direction.  Here is some guidance for your current situation:

First, I would try to figure out what you would believe would be the next step in your career and the right opportunity for you at this time.  When determining this, I would keep in mind the information security skills that you could best leverage from your current role, to attain this next position. 

After you determine this next position, I would attempt to see if there was an internal opportunity at your current employer that would enable you to accomplish your goals.  If these opportunities do exist, I would sit down with your manager and have a candid discussion with them.  (For your own protection this meeting should be documented.)  

This discussion should include both your appreciation for your current opportunity and your desire to remain with the company.  You should also express your interest in career growth.  At the conclusion of this meeting, I would ask for their permission to pursue these opportunities – while providing them with assurance that, if selected for this role, you will not leave them in a bind. 

I would hope that at the conclusion of the meeting, they will give you their blessing to pursue these opportunities.  In the event that they do not, I would immediately (possibly concurrently)  set up a meeting with your human resources team, make them aware of the situation, and ask them the proper internal process to apply for this role.  Keep in mind, if you have to go down this path, your manager will most likely will not be happy, and could possible hold this against you. (You should understand that this is possibly risky- and you should weigh the consequences before going through with this.)

Simultaneously, I would begin an external search process, and prepare a resume that would be targeted at the role that you would like to pursue.  I would seek out opportunities that fit the description of the information security role that would enable you to move your career on your desired path. Undertaking an external job search, may shed some light on your current skills and the value that you could bring to an external entity.   Independent of the result, you should come away with a better benchmark on your marketability and qualifications for this type of role. 

Hopefully, this advice will get you off the “treadmill” and lead you “off and running” in the direction of your desired career goal.

Hope this help,

Lee and Mike

I would like some advice on my future career as an Information Security professional (which has yet to officially begin).

Here is some background, I am 22, just finished a CS degree, hold 3 information security related certifications, and have recently began a masters degree program.  I also write a blog and contribute to the open source community.   In addition, I have built a home “lab” environment which I use on a daily basis.

I was thinking that  when I graduate the Masters program, I will not have any real world experience to support my academic and self directed information security pursuits.  Do you foresee this as being a big problem as I approach the job market, and officially begin my professional career?

Signed,

“Future InfoSec Leader”

Dear “Future InfoSec Leader”:

The first thing that I will tell you is that you appear to be doing everything correctly to get your career started down the right path.  You have received formal education, you have attained relevant certifications, and you are contributing to the community (blog, open source projects).  In addition, you are running a lab environment that is providing you with some hands-on experience (albeit at a much different scale).

The second thing that I can tell is that you have some of the intangibles that employers are looking for, commitment and passion.  It appears that from your efforts you are able to demonstrate to information security hiring managers that you are going to be a dedicated employee, and that you have a drive to take on responsibility and are willing to work hard (once you get a job).

All that being said, I do agree that you are falling short on a key component that could hinder you in landing your first full time information security role, formal work experience.  Please understand that work experience does not have to come in the form of a full-time job.  It can take the form of internships (which you may be able to get through the university), part-time work (potentially in the university’s computer lab/IT environment) or through donating your time to charitable causes (who need security skills). 

I think that if you pursue these types of opportunites, and find a way to garner some “real world” experience, you will offer an employer the “complete package” and skill matrix that most will search for in an entry level information security employee.  Most importantly, the cumulative result of all of your activities (and experiences) will place you at a competitive advantage to your peers (and competition) for these roles.

In closing, you are doing the right things and are off to a good start.  If you keep working hard at your career, your future should be quite bright.  Please keep us posted. 

Hope this helps,

Mike and Lee

Nervous Student

Hi Nervous,

Hold on a second while we pull out our crystal ball.

Okay. We’re now looking far in to the future… and we see… degrees… everywhere.

Enough being flip. Information security is a very young industry and, as such, hasn’t really developed a significant formal education structure. Most of the programs that exist today are less than 5 years old.

But that formal education is in demand – we need an industry of people who started to get real training on information assurance, risk management and other security concepts at a younger age. And we’re starting to see more and more of that type of program build up.

You’re right that it’s not a requirement yet – mostly, that’s a supply and demand issue. If that was a requirement for most jobs, it would severely limit the candidate pool. However, it will provide you an advantage when you go in for some jobs.

Our crystal ball says that this will start to be a requirement more and more over the coming few years.

No need to be nervous: you’re ahead of the game.

Mike & Lee