FIVE PRINCIPLES TO HELP YOU GET YOUR DREAM CYBERSECURITY JOB

Kip Boyle:

Hi everyone. This is Your Cyber Path, we are the podcast that helps you get your dream cybersecurity job. This is Kip Boyle, and I’m here with Wes Shriner, and we are experienced hiring managers of cybersecurity professionals.

And, listen, you can give us feedback on the show. All you got to do is go to the show page and that’s at anchor.fm/yourcyberpath. When you get there, you’re going to see a button, it’s going to say “message”, you click that button, you start talking, and then we will get your feedback. And we welcome your feedback. We’d love to hear from you.

Not only do we want to hear from you, but we think it’s important that you, folks in our audience, that it’s valuable for you to hear from other cybersecurity hiring managers. After all, every hiring manager does their job a little differently than the others. You’ve heard Kip’s take on it Wes’ take on it. Today, we’ve got a guest that we’re going to talk to so you can hear how somebody else does their job. What are they looking for? We hope you’re going to find this helpful.

Please welcome Jeff Jones.

Jeff Jones: 

Cheers! Amazing! Happiness!

Wes Shriner: 

Jeff, I’m so glad you’re joining us. It’s good to have you join us on the podcast, and good to have been friends for years in the marketplace. So, glad to have you here, man.

Jeff Jones: 

Yeah, absolutely, guys.

Thanks for inviting me. I appreciate the opportunity to contribute to the program.

Wes Shriner:

I wish I could see you in person, but we’re in this post-COVID, current-COVID environment, so we’ll have to catch up again in person as soon as we can.

Jeff Jones: 

I concur. We will definitely make that work.

Wes Shriner:

In the meantime, I’ve got to know, are you still riding bikes? Are you still in search of the lightest bicycle frame possible?

Jeff Jones: 

Well, the bike I ride is carbon fiber, but bicycling is a passion of mine. In the last couple of years I’ve gone out to New York for the Five Boroughs tour, and it’s not a race it’s really just a supported ride. It’s a lot of fun. The one in New York happens to be the largest one in the United States. It was canceled this year due to COVID, unfortunately, but I’m still putting the miles in here in the Pacific Northwest area.

Wes Shriner: 

I bet you are, even if you’re not commuting by bicycle.

Jeff Jones: 

No sir.

Wes Shriner: 

So where are you working now? What are you up to? What are you doing today? And tell us a little bit about what you’re doing.

Jeff Jones: 

Well currently I work for an actuarial firm called Millman, Millman, Inc, and I manage Millman’s global corporate services, information, security team.

Wes Shriner:

What does that mean?

Jeff Jones: 

Information security team or actuarial consulting?

Wes Shriner:

So I understand actuarial consulting, and, if I may think about that, that is actually the group of folks who set the insurance rates for large insurance providers.

Actuaries are some very highly paid mathematicians who pursue building the most strategic formula possible for ensuring that insurance can say solvent and make money as a business, right?

Jeff Jones: 

Yes.

Wes Shriner: 

And so when I think about that, that’s a very strategic industry to be in and, and the intellectual property available in that has got to be really high.

I’m guessing that you are responsible for enabling the Millman actuaries to protect their intellectual property, is that about right?

Jeff Jones: 

You nailed it, and yes, on a number of fronts. The team I manage is responsible for everything from vulnerability management, incident response, and security operations, just to name a few.

Wes Shriner:

Tremendous.

So you’ve got all the pieces, the defend, the protect, the contain, the respond, and the operate.

So that’s great. Jeff, can you tell us a little bit about… Are you hiring there? Have you hired people in the past, and what’s your hiring management story, history?

Jeff Jones: 

Let’s see. So what began as a staff of three, a few years ago, has strategically grown to a staff of 15 to meet the needs of the organization. Currently we have 10 Information Security members here in the US, and another five in India, who performed those key information-security functions that I mentioned.

Wes Shriner: 

Great.

And is this the first job that you’ve been hiring in, or have you been responsible for hiring, firing other roles as well?

Jeff Jones: 

No, I’ve been a hiring manager through several positions, or several positions over the course of my career.

Wes Shriner: 

And I know that when I’ve worked you with you in the past, you really value the character of the person when you’re looking for who you want to work with. Character is before just about anything else is what I remember from Jeff from the past.

Does that still hold true, and is there anything you’d add to that?

Jeff Jones: 

Yeah, certainly, it’s certainly pertinent for candidates to be appropriately qualified, but character plays a part in how the company is represented both inside and outside of the organization.

Kip Boyle:

Yeah. Character is something that we’ve been talking a lot about in all of our episodes. Trustworthiness, because, geez, at the end of the day, we are in the trust business, and that’s trust between ourselves, and also trust with the people that we serve.

So, character and trust, man, those go together, and we’re going to dive into that a little bit in this episode.

So Jeff, when you and I were doing some prep and I was asking you, what do you want to share with the audience? And you said, “Well, there’s five principles that are relevant and would help our audience get their dream cybersecurity job”, which, and I love this, and I’m looking forward to going through these one at a time.

Jeff, what’s the first one?

Wes Shriner: 

Yeah, Kip, I just love the concept of finding your dream job, and I would say the first principle in obtaining your dream job starts with having some perspective.

There’s an old phrase that says, “Do something you love and you’ll never work another day in your life.” So the question I would pose to listeners is, do you really know what you love to do, or do you only think you do?

For instance, if your dream job is to develop video games and your only association with video games involves using a game controller, then that suggests that you lack proper perspective.

Having perspective means being brutally honest with yourself about the quality and depth of your skills, and having some insight as to whether utilizing those skills actually brings you happiness.

Kip Boyle: 

Yeah, this is a good time for me to confess that there have been different times in my career where I didn’t necessarily really realize it at the time, but I look back, and what I did realize was, is that sometimes I was chasing a job because of the prestige of the job, or the pay of the job, and it wasn’t so much because the job itself was intrinsically rewarding.

I didn’t know that yet, because I hadn’t gotten it, but I was in love with other aspects about having that job. And so I’ve had to learn the hard way of this principle that you’re talking about because it is pretty easy to get burnt out on a job, or lose your interest in a job that isn’t quite what you thought it was.

Wes Shriner:

Yeah, prestige is definitely a motivating factor.

I recall in my first job after college, I worked as a Software Development Engineer for IBM. I hit the ground running coding in C++, and I definitely found prestige and letting family and friends know I was working for Big Blue. I also received some excellent training while I was there, but I found myself wanting more satisfaction.

No matter what features were developed, there were always more features to implement or change, and bugs to fix it. Wasn’t IBM, ultimately I discovered that software development wasn’t necessarily my dream job, but I can tell you that the role itself was definitely a stepping stone for me to move on to other opportunities.

Kip Boyle: 

Well, it’s a great skill to have in your pocket as far as information security, cybersecurity.

I did some programming myself when I was in college and then first couple of years I was out of college, but then different things happened in my career that came to me, and I stepped away from programming also.

But I am very glad that I had the chance to do it for a little bit.

Wes Shriner: 

Outstanding.

Jeff, do you want to tell us… That’s a good first point, but I don’t want to miss the other four. So what’s the second one? What do we got?

Jeff Jones: 

The second principle, Wes, is being brutally honest with yourself about your qualifications.

For instance, if you’ve got a gap in skills, it’s not the end of the world, it simply means you have to work to do and prepare for your opportunity. If you’re committed to your dream job, then you have to be committed to investing in yourself. The technology, medical science industries often demand ongoing learning through certifications to evidence capabilities.

You may need to pick up a guidebook or enroll in some courses, a certification, or advanced degree may even be qualifying criteria just to get a entry level position, never mind your dream job, and that’s okay.

The point is, think about what’s required of the position, or the role that you are pursuing. In fact, I encourage researching it.

Kip Boyle:

Yeah, you got to do that because cybersecurity, information security is an unusual opportunity because depending on the size of the organization that you intend to work for, and the specific job title that you would like to pursue, you may or may not need a college degree.

That’s being de-emphasized by a lot of high-tech companies, such as Google and also the United States government. If you want a federal job, they’ve recently de-emphasized a bachelor’s degree in favor of experience.

So if you’re a highly-experienced person, without a college degree, that’s no longer a deal killer as it might have been in the past.

Wes Shriner: 

I think some of the interview questions that we see today are also a little bit different than they used to be in the past. The practical questions about how would you help solve this problem, really take a person to a place where, “I’m not asking you how many degrees you have, I’m not asking you how many books you’ve read, I’m asking you how would you help me balance these priorities to solve a business problem together?”

Kip Boyle: 

Yeah, and so listeners, you should be prepared to have a practical interview as part of the sequence of interviews where, I know for me, I like to pitch problems at candidates, stand at a whiteboard, when that’s possible, and then go through it and collaborate a little bit and see what they’re bringing to the table.

Wes Shriner: 

Indeed.

Kip Boyle: 

Jeff, do you do something like that when you’re doing interviewing?

Jeff Jones: 

Yeah. Open-ended questions and, again, pre-COVID, standing at the white board, quite common, to just get a sense of how a candidate thinks.

Wes Shriner: 

What does that mean, how a candidate thinks?

Jeff Jones:

Well, how they go about decomposing a problem, how they might outline solving the problem, if they don’t have the answer right off the top of their head.

Kip Boyle: 

Their analytical engine, how do they approach things that they don’t necessarily know a lot about? Yeah.

Wes Shriner: 

Cause that happens all the time in information security, oh my God, all the time.

Jeff Jones: 

Google is your friend.

Kip Boyle: 

I’ve learned so much about so many things because I went over to the web development team and said, “What are you guys working on?” And they would pitch some acronym to me that I’d never heard of before or a new programming style that I hadn’t heard of before, and all of a sudden I’m thinking to myself, “I got to get up to speed with this, fast, otherwise, I’m not going to be able to help them do their job with security.”

So listen, folks in the audience, if you love finding yourself in a situation where you’ve got to pick up something fast, you’re going to get a lot of that in this kind of a career field.

So, all right. There’s two principles, Jeff, what’s number three?

Jeff Jones: 

Number three would be testing the waters.

Testing the waters is akin to dipping in your toe in the pool to determine the temperature. So, from there, you can decide whether to dive right in, or maybe just ease into it.

Kip Boyle: 

Or maybe find a different pool?

Jeff Jones: 

Yeah. With respect to your dream job, I would say testing the waters is really about having some experience in a role that’s a logical stepping stone to that dream job.

So, for instance, if your aspirations are to become a Chief Financial Officer, a logical precursor to that is to have some experience as a company controller.

Likewise, a stepping stone to becoming a controller is to have experience as an accountant or a CPA.

As an alternative, there are internships that provide entry-level and mid-tier roles that allow people to gauge whether their desire to work in a role is tepid or boiling.

Kip Boyle: 

Yeah, I love that. I love that principle. I love this idea that you can try something and that they’re stepping stones to get where you want to go. And with respect to cybersecurity, there’s a really great tool on the internet that I like people to know about and to check out, and if you go to cyberseek.org, so that C Y B E R S E E K.org. There’s a couple of tools up there, and one of them that I recommend is called the pathway, the “cybersecurity career pathway tool”, and it’s going to show you, depending on, there’s a bunch of little bubbles, and when you click on a bubble, it tells you what are the feeder roles to the role that you’re interested in, and then what are the growth opportunities, the common growth opportunities, the common pathways to develop yourself over the course of your career.

So amazing idea.

Jeff, you were talking to me about the different things that you’ve done in your past as you were moving along your stepping stones and you mentioned Banyan VINES.

Jeff Jones:

Yeah. Interesting.

Kip Boyle: 

I hadn’t heard that in a long, long time.

Jeff Jones:

I tell you what, interesting story behind that.

I had completed technical internships at Pacific Bell in Pacific Gas and Electric. Those companies were major utilities in the state of California in the eighties and nineties. I had developed software macros scripts for my assignments, but I was afforded the opportunity to learn about local and wide-area networking. Networking wasn’t my primary, or even my secondary, focus, but my manager had rather lamented the lack of resources for a systems administration task.

So I inquired about how I could help. He proceeded to provide me with a overview of LAN and WAN architecture, and he gave me my first primer on Banyan VINES.

And for those not familiar with it, it’s a network operating system developed Banyan Systems running AT&T’s UNIX.

Kip Boyle: 

So that was a forerunner to what has become something that’s highly standardized now, which, at the time, really wasn’t. But what, today, every computer can connect to an ethernet network running a TCPIP stack. But back when Banyan VINES was out, it was vulcanized.

If you ran VINES, you really couldn’t run anything else. Novell NetWare, as I recall, a competing product. There’s probably other ones too.

So, anyway, thanks for the trip down memory lane.

Wes Shriner:

Let’s save the history of corporate networking for another day, gents, shall we?

Kip Boyle: 

You’re just feeling awkward, Wes.

Wes Shriner: 

We got people who are hungry for their first dream cybersecurity job.

We have covered a little bit already. We said, “make sure you understand your big perspective, what’s really going on in the industry.”

And then, secondly, we said, “look in the mirror and be real with what you’re looking at, and grow yourself.”

And then we just heard, “dip your toe in.” Let’s find ways to get an internship, or a relationship, or get started in that industry, even in a light capacity to begin with, and that’s how you might move towards getting your dream job.

After you’ve got your toe in the water, and you’ve got your first opportunity, no matter how direct or indirectly related it is to your dream job.

Jeff, what do you tell us we need to do for step four?

Jeff Jones:

I think step four is the most critical one, Wes.

Wes Shriner: 

I think that too.

Jeff Jones: 

And that’s doing more than what’s expected, and its sounds so simple. It’s really the special few who do more than what’s expected. And, again, the audience may be saying to themselves, “well, what’s that got to do with your dream job?”

Well, look after you nailed that interview for the position you’ve been ogling over, a diligent employer is going to ask you for character and work references. And as a hiring manager, I can tell you, by doing more than what’s expected as a habit at every job you take on, you really give your employer something special to remember and appreciate as evaluations are written and references are provided.

In fact, just reflecting, again, on some of that time at PG&E at the end of all of that, I was provided with unsolicited letters of recommendation from both the technology and staff managers.

Wes Shriner: 

That’s tremendous. And we’ve talked about on the podcast before about leaving well. I would tie that together with leaving well. Always leave the place better than you found it, never burn the bridge on the way out.

Maybe in a related fashion, Jeff, do you mean that you want us to come in and work 60 hours a week? Are you asking us to work more than we’re paid for? Is that what you’re saying when you say do more than what’s expected?

Jeff Jones: 

Well, I would say certainly working with some effort, and sometimes that’s going to include additional hours, but I think it really has to do with looking beyond the scope of what you’ve been asked to do.

And that rather assumes that what you’ve been asked to do, you’ve done sufficiently or with proficiency.

Wes Shriner: 

I think I might add to that definition that it’s with your head in the game. You’ve got to have your full focus and your full attention at work when you are work, because you’re going to do your best work when you have all of your focus and attention here.

If you’re thinking about what you’re doing on Friday night, instead of thinking about what we’re doing here on Tuesday morning, then that’s going to be sensed and experienced and felt by those around you, and you’re not going to be exceeding expectations the way you want to.

Jeff Jones: 

That’s a great point.

Wes Shriner:

I would add one more thing to that, if I may, and this is a phrase “buy the t-shirt.”

If you’ve been to Disneyland, you remember you went to Disneyland because you bought the t-shirt while you were there. In the same way, for each work experience that we have along the way, whether it’s directly or indirectly related to what our dream job is, while you’re there be all in, be fully vested in what you’re doing and buy the t-shirt where you are at, because this season will not last forever, but if you’ve got the t-shirt, you’ve got it in the drawer and you have a set of skills and knowledge that you wouldn’t have had had you not been fully vested in work at that time, in that place.

Jeff Jones: 

Wes have you rummaging through my closet?

Wes Shriner: 

“Buy the t-shirt” is always a good rule, my friends, because that goes with you.

The skills you picked up, you take a three week rotation going to be smart hands in a data center. Well, in that process, you learn all about how data centers work, and you learn about HVAC and you learn about power and cooling limitations and you start to think, “Wow, there’s a lot more to the data center than just racking and stacking servers.”

And when you start to understand that, when you go back to whatever it was you’re doing before, you have a more well-rounded learning, if you paid attention while you were there.

Kip Boyle: 

Some of the best experiences I ever had that were really helpful to me in my future came from these kinds of side trips into other related areas. Like Jeff, what you were talking about a moment ago when you were doing programming, but then all of a sudden due to a need, you were brought into to work on local area networks, and so I think that’s the kind of thing that we’re talking about here.

But, don’t do that at the price of taking your eye off the ball for what you’ve actually been asked to come and to do what your primary purpose is.

Jeff Jones:

Precisely. Your first priority is, definitely, meeting the requirements of what you’ve been assigned, and from there you can really look beyond that and oft times a inquiry about, “Hey, what else can I do to help help the business move along or improve this particular process? Or even just sharing ideas?”

Kip Boyle: 

I’m going to add one other thought to this before we move on to the fifth, and final point, which is some of the people that have worked for me have really impressed me in this way when they could actually anticipate my need as the team’s supervisor.

If you can figure out what it is that your supervisors is struggling with, or how is your supervisor being measured? And if you can figure out a way to ease your supervisor’s struggle in that way, then that’s super valuable. And I’m not recommending that as a form of brown nosing or anything like that, I’m just simply saying that when we get hired for a job, it’s because there is a bigger responsibility that’s trying to be met, and we’re playing one part of that, and anything you can do to help your supervisor is just going to be welcome.

Wes Shriner:

So we’ve done our best. We’ve done our best in the place that we are, we have gathered the skills and the technologies that we can in the current place, and now it’s time for us to pop our head up and look around a little bit. What advice would you give the person who is ready for moving closer to that dream job?

Jeff Jones: 

Principle number five, and that would be to market yourself, and really that comes down to networking, and how you actually represent yourself on the internet.

When I graduated with my Bachelor of Science and in Computer Science and Engineering, I had four jobs waiting for me, but what landed me my dream job is understanding that you’re always marketing, let me repeat, always.

So think of it this way. Are you marketing yourself for the job that you have, or the job that you want? Over the years, I’ve managed software development teams, IT operations, help desks, cybersecurity assessment, and I’ve been afforded some opportunities to travel across the country and internationally. And among the questions I get asked at every stop is, “why do you dress so professionally?”

And I would note on most days, and you guys can attest to this, you’ll typically find Jeff in some combination of shirt, tie, dress slacks, and shoes. And my response is always the same, “I’m not dressed for the job that I have, I dress for the job that I want.”

Now, admittedly, COVID-19 has changed the work environment.

Wes Shriner: 

Yep.

Jeff Jones: 

But, again, the new work environment I would submit is video calls. It’s not uncommon to see coworkers on video calls in t-shirts, and I would tell the audience, don’t do this.

If you’re going to be on a video call, at least have a collared shirt on, and be cognizant of noise in the vicinity, and your chosen background. I know that Minecraft video game background may be cute on a video call with your friends, but doesn’t set the tone of professionalism you want when you’re talking with your coworkers, supervisor, or that potential employer with whom you’re interviewing,

Kip Boyle: 

You know, Jeff, that part of what you’re saying is, as far as always marketing yourself, that wasn’t so hard for me to pick up, in part, I think, because when I graduated from college, I went into the Air Force, and the Air Force, like all military services, is very big on appearance and having a pressed shirt, shined shoes, and that sort of thing.

So that was pretty easy for me to pick up. But, the part that I really struggled with, and I’d love to hear your thoughts about this, is some of the other ways that you can market yourself. Like just all these extra things that you can do, or maybe things that you do that you don’t realize is sending a message to other people about who you are, these interpersonal relationships, and that sort of thing, and even social media. So there’s so much more to it than just the way you look. It isn’t that true?

Jeff Jones: 

Absolutely, Kip. And, in fact, I would tell the audience that you need to be astutely aware of your personal brand, and by personal brand I mean, again, how you present yourself on the internet. Effectively, any information your potential employer can discover through a basic internet search, including how you present yourself on social media platforms, can enhance or jeopardize your campaign for that dream job.

That includes LinkedIn, Facebook, Instagram, take your pick.

Kip Boyle: 

Have you ever, ever had any experiences with job candidates and seeing things you wish you had never seen?

Jeff Jones: 

I have.

Kip Boyle: 

Care to tell us a story?

Jeff Jones: 

Yeah, I will tell the clean version.

So a gentleman’s applying for a technical position on my team. And, again, I I’ll preface by saying, I’m not a prude, but he chose to include a URL to his blog on his resume. So fair game.

So I go to the blog, check it out. There’s, again, I’m not a prude, there’s profanity, there’s political stuff there, much of which I actually agree. Some of which I don’t agree, but the thing that stuck out in my head was, well, this doesn’t really enhance your candidacy, and it wasn’t relevant in any capacity to the job that he was applying for.

So I had to question the judgment of why include the link at all, if that was the case?

Kip Boyle: 

Yeah. Well did you ask him that?

Jeff Jones:

I did.

Kip Boyle: 

Oh, I can’t wait to hear the answer.

Jeff Jones: 

And that’s where, fine people, I don’t know if I can clean that one up.

Kip Boyle: 

Well, my guess is that that could have been a form of him to checking team fit. Like this is who I am, and if these guys see it and don’t like it, then that’s going to save me hassle as a job candidate, of joining a team that really isn’t going to want to hear from me on these topics on a regular basis.

Wes Shriner: 

If you’re going to weed yourself out like that, then do your homework ahead of time. Don’t make your employer do that, or your perspective employer. It’s not helping you, it’s not helping your reputation, and that’s just not how we’re going to want to conduct business.

Kip Boyle: 

No.

You know what I’d rather see somebody do, is put their GitHub link in there.

Jeff Jones: 

There you go.

Kip Boyle: 

So I can go see what you’ve been doing. Show me your passion.

Jeff Jones: 

What sort of development have you been doing? What have you been building over time?

Kip Boyle: 

And maybe you’re not that technical, but maybe you are pitching in with an open-source product or project, and you are helping with documentation, or maybe you’ve designed a really nice logo for them or something like that, or a website or something.

You can show your passion in more ways than just participating in a bug bounty or something like that. But anyway, whatever you share with us, be thoughtful, would you?

Wes Shriner: 

Very much so. That’s the right answer is, think about what you’re presenting because you’re representing the team and the management every time you make a decision once you’ve moved into that team.

So, represent well. Represent yourself well, and then represent the team and the management well when you’re there.

Jeff Jones: 

Yeah. That’s a great summary, Wes.

Kip Boyle: 

Okay. So, we’re almost at the end of the episode.

So, Jeff, thank you so much for sharing those five principles with us. And I just wanted to ask if there’s anything else you’d like to share, Jeff?

Jeff Jones: 

Well, I’m going to have to change out up my Mickey Mouse shirts, now, since Wes has been through my closet.

Kip Boyle: 

Jeff Jones, you’ve never worn a Mickey Mouse shirt in your life.

Wes Shriner: 

You are dressed to the nines. I’m guessed you’re dressed to the nines for this call today, even though we have no video on this one.

Kip Boyle: 

If there was video, you’d be making it. You’d be making us look so bad.

Jeff Jones: 

Oh, you guys are too kind.

Wes Shriner: 

Jeff, you’re a sharp dresser. You’re even more sharp information, security, professional. I’ve enjoyed working with you in the past. I look forward to our paths crossing again in the future soon.

Thank you for coming on with us today, because your insight and wisdom is always appreciated. Thank you.

Jeff Jones:

Likewise. Thanks for having me.

Kip Boyle:

Yeah, you’re welcome.

Okay, everybody, if you liked this episode, heck listen to it again. There’s so much information in there. But if you want to take it even further, you should consider signing up for our masterclass. It’s called How to get Your Dream Cybersecurity Job, As Told by Hiring Managers, and you’re going to get a lot of the kind of wisdom that you heard in the podcast here. And if you want to check out a story of somebody who came to our class and did really well, actually got his dream cybersecurity job before he even finished all the lessons, you can read about his story at yourcyberpath.com/Steve. You can even listen to him talk about it when we were guests on the Insecurity podcast, which is published by Cylance Blackberry.

But, in any event, thanks for being here. Until next time, I do want you to remember you’re just one path away from your dream cybersecurity job.

See you later.