house
[Music]
so a fun fact
GPT does not do PowerPoint presentations
I've been conceptualizing this
this talk for three months since Michael
and I first had our conversation about
this uh however did make it a PowerPoint
reality until this morning when I woke
up with a a light hungover after a
flight in thinking okay like I need to
put this on paper
um let's make this a presentation so the
first thing I went to was open AI
website and tried to make it a reality
and it for all the good that it does uh
we're not quite there from a PowerPoint
presentation perspective so there's
definitely some work to do
um
put your hands who
likes the idea of becoming a CSO
less than I thought yeah you'd probably
a few smarter people in this room
um anyone thought about
how they're going to get there
show of hands if you've thought about it
okay
cool I think there is a Romanticism
about taking the top job and a lot of
people think that
it's a fairly linear path to get there
um something that I've realized after
working in the space that I'm in is
there is no straight line and the goal
posts are continually moving so
put this presentation together that
doesn't seem to want to work anymore
there we go I'll put this presentation
together to really kind of think about
from a reverse engineering standpoint
where you're at today and how to get to
that top job so
who is Stuart Mitchell uh over 50 50
slide PowerPoint presentation that I
discussed with my therapist uh on a
completely different note but
um essentially I run a cyber security
search firm I've been working in the
recruiting space in the US for 10 years
I think why that number's relevant is
the people that I spoke to five ten
years ago now are the people who have
have made that Journey from sock
analysts from you know Junior engineers
and I now look around there you know
around their room and they've they've
made that jump and now they're running
programs for some of the most
interesting companies on the planet
um you know grateful to have had the
opportunity to work with some of the
best companies uh in the US and around
the world uh I've helped build cyber
security teams you know open AI in their
early days Reddit rivian MasterCard and
and plenty of others so
I've seen some of the common trends that
people tend to look for when it comes to
hiring Security leaders
um some very
strange commonalities but also some you
know very different backgrounds as an
example you know one of the highest
security Executives at serviced now
trained to be an executive chef one of
the highest security Executives uh at
Sony media
was a trained actor now I will say
leopards don't lose their spots and
don't go out to dinner with an executive
trained Chef it is one of the most
embarrassing things that you can do if
you don't know how to eat cordially but
uh his expertise now is is in the cyber
security space so you know just because
you come from a background that might
not be typical doesn't mean that there
isn't a pathway to to get to that job
whether it's
you know whether it's a CSO or or
whatever that Journey that you want to
go on is
so
I think it's an easy thing to say but
start with the end in mind
um this graphic is fantastic let's go
backwards okay that doesn't want to work
essentially start with the end in mind
you know when you're reverse engineering
a situation
you look at you look at where you're at
which is hey today I am a security
engineer a sock analyst a GRC manager
whatever it may be
um
what what am I doing and how do I need
to get there and I think I wanted to
make clear you know there are other
examples rather than just hey I want to
be a CSO there were probably a a few
less hands than I expected to be shown
um but whether that's ahead of research
whether that's a CEO whether that's a VP
or a director
start with that in mind and then it's
really easy to understand okay what are
my knowledge gaps what are my experience
gaps and how can I get there and I think
the the biggest thing to realize is this
is probably a non-linear path because
you know what's relevant and what's
important today if you if you draw a
path of your next five years like if we
look back and and we'll dive into this
in a bit more detail but if we look at
what was relevant in cyber security five
years ago we've probably blown past that
now so if you if you create a linear
pathway and you know five years ago
you're you've just started your shift
left Journey or you know you've just
started creating a proactive detection
and response model
um you may find yourself behind so I
think having an end goal in mind but
knowing that the path isn't straight is
something that's that's super important
I think starting to identify the skills
Gap is important so how do how do you do
that right it's knowing where you need
to get to is great but how do you
identify that so I think
early in your career I think it's
important to find Role Models mentors
people that you would quite like to be
again doesn't have to be linear on you
know year one it could be somebody year
three it could be somebody else
um but compare your experiences to
where they you know where they were and
what they did to get there
um there's also comparing that skill set
to you know job listings of of your
target roles again using the CSO as an
example you know hey I don't have X
experience whether that's a technical
skill set whether that's a managerial
skill set whether that's a industry as
an example that's something that you
know you have to work towards so you
know I think it's it's important for you
to to understand that and to chase that
and to use that as a framework
um talk to recruiters I know we can be
hit or miss but if you find
knowledgeable folks in your field and
you can find somebody who is honest and
has been in this space for a long time
they can give you a they can give you a
roadmap they can tell you you know
classes that you need to take or
certifications to follow or you know
somebody to be men mentored by they they
can give you that and look where
possible and I know this is this is
difficult but apply an interview to
roles that maybe aren't aren't who you
are today but who you want to be
tomorrow you know worst case you you get
an interview and and best case who knows
maybe you maybe you do the Richard
Branson thing right maybe you you get
the job you want and you figure it out
on the Fly I don't think there's there's
too much to lose for kind of shooting
for the moon so
um
understanding that you know ultimately
there are there are opportunities for
you to apply to it don't be afraid of
the rejection but definitely put
yourself out there and you know some
examples of skill gaps you know you may
not have management skills I think what
you can do there is
it isn't easy but and people don't often
want to do this anymore but ask for more
responsibility at work ask to run the
next project ask to run the next
implementation take on more and ask for
more I think sometimes it is
it is something that we forget about but
looking internally for more opportunity
is is a good way to Fast Track that so
you know other things that you can do
from a skills gaps perspective
certifications look again
hit and miss there are certain ones that
are more relevant than others I think
from an executive perspective look I
mentioned undergrad to some extent once
you're in the door probably not going to
play as big of a role from an executive
standpoint
the higher up the chain you go the more
an MBA is actually something worth
pursuing uh probably the one
most common degree in security
Executives I I would say and that's
because it becomes a business we're all
right you become somebody who's focused
on Opex focused on capex and you know
play a true role in driving the business
forward so that MBA is is probably the
one most common educational you know
tool that you can add to your belt that
can really push you forward but that's
more specific to an executive uh again
you know from a from a technical skill
set perspective there are always ways to
learn even if you're not getting this
opportunity in your workplace you know
contribute to the open source Community
Home labs
again I say it so many times but classes
certifications you know they are ways
that can really move things forward
never stop building your Professional
Network
there are so many people that shortcut
their career by being known uh I think
it is you know I look at folks on on
LinkedIn and on Twitter and that speaker
events and and are involved in owasp and
Cloud sac and and other such communities
if people know you and they know your
name they know your brand and
unfortunately that's probably you know
from a societal perspective
people are a brand and that's just where
we are nowadays if people know who you
are and and try you know they trust a
brand so I think you know never stop
that networking piece this is obviously
something that everybody here is
committed to given they are you know
spending their time traveling in to to
connect with like-minded folks to to
learn more about security and tooling
and and meet new people
it's it's never going to be a bad thing
to know more people in the industry so I
think LinkedIn is a really good way to
Fast Track that
um there is a huge community
Twitter may not be that anymore uh maybe
12 months ago you know we see
like disruption is happening in the
social media industry I know Mastodon
has a fairly fairly strong presence but
there are you know plenty of
opportunities to to continue to network
and to continue to grow and if you
continue to move that forward your life
becomes a lot easier when you can walk
into interviews and say shake hands with
somebody that you're familiar with or
you know so I think ultimately the more
you do that the better you set yourself
up for success
staying on top of Industry Trends
regardless of what you're trying to do
and who you're trying to be you know if
we look at some of the the biggest
trends that have shifted over the last
five years
almost every business has some form of
cloud presence now
um that everybody's talked about
shifting left for a number of years you
know huge emphasis on proactive
detection and response and also a fairly
large element of of privacy has really
played a you know a core component and
growing Security Programs the US and
Beyond
um whereas five years ago these are
things that were maybe not at the tip of
everybody's mind and you know as we
continue to move forwards I think
regardless of where you go the trends
that you're going to need to to stay on
top of is I mean
the role of AI and security is probably
going to be the only thing we talk about
for
however long we're allowed to talks for
uh before that that does the talking for
us you know API security is something
that you know we see the growth of these
large companies but it's something that
every business is worried about and you
know continuous steps forwards in in
compliance both the traditional
Frameworks but you know we see Congress
is is really pushing you know firmer
cyber security bills people are going to
have to stay on top of this and from a
leadership perspective if you aren't
staying on top of these trends
like even if you're the hottest
commodity in what you're doing today if
you don't move that forward in five
years people will forget about you and
the industry does forget about people
who aren't aren't interested in moving
that that knowledge knowledge base
forwards
look
in conclusion look
where do you want to get to what do you
need to do to get there
keep building the network stay on top of
current trends and and just continue to
to take more responsibility and continue
to grow the more you lean into that
the better you will be and and the
shorter this journey is right there's
you know where hackers are at heart
there are plenty of ways to to hack your
career and move things forward uh and
these are ones that I've consistently
seen regardless of backgrounds you know
folks coming from the military folks
coming from you know comp side
backgrounds folks coming from Network
folks not even coming from it that have
found themselves in very high profile
jobs these are the core things that I've
seen at the heart of what they're
looking to do that the reality is
it's never the green line right like
it's always the Blue Line in terms of of
moving forward you'll take 10 steps
forward you'll take 15 Steps back but as
long as you keep pushing in that
direction like there's absolutely every
opportunity out there for you to to hit
that end goal
I think I have plenty of time left so
I'm open to any questions if any folks
have any
go ahead
yeah and I look I I think there's always
a
a mindset of how can I get there quicker
how can I get there faster and there's
there's no better metaphor I think than
in cyber security reverse engineering
that and getting it
we love instant gratification as well
right so the sooner we get there the
better
any other questions
sure
yeah
look I I do I think
a direct Community or an introduction is
great I think
what we probably don't appreciate is
people are maybe better than we give
credit for and if you reach out to
somebody who you respect or like or
would like to be either directly or but
ways of introduction
people are very generous with their time
and I think it's it's easy to look at
somebody you know in a high profile CSO
role or a CEO of a company and
you know people do say yes a lot more
than they say no so I think be pretty
direct around it if you can by ways of
introduction if you know somebody but
Reach Out email shoot a message on
LinkedIn people are people are nicer
than we think
I didn't quite hear that sorry
that's a that's a good question right
because it's not a
it's not a night and day situation but I
think ultimately
a steer into the technical skill set
right I think if you're a technical
person if you're a technical leader own
a technical program first own an
engineering program a security
operations program lean into that
strength I think if you go all the way I
think it's a very difficult situation I
also think
once you do it maybe some people don't
don't love it and don't want it but you
get to continue to do what you want to
do
um but I think
something that I learned as someone who
wasn't initially a people manager that
became a people manager is sick outside
expertise who maybe aren't relevant to
to your skill set so get either if you
can get your company to pay for it do it
but if you can get a leadership coach
obviously reading is is something that
we take for granted but read and
understand
like what type of leader you want to be
I think a lot of that will come from
external coaching and from reading but
definitely
lean in initially to that technical
skill set that can get you to that
leadership level
uh just one or how many misconceptions
um
look I I think the biggest misconception
at the early stage
is everybody wants to be a pen tester
and I know you know that but everybody
wants to be a pen tester and there are
so there is so much more to cyber
security than that I think there's a
couple of other big ones which is
the being a CSO is a great job uh I know
a lot of csos who are
constantly stressed you know can never
really take a vacation phone doesn't go
off at Thanksgiving phone doesn't go off
at Christmas because
you can never switch off
um and so that's that's another big
misconception is that the top job is the
best job
great
all right well thank you folks
foreign
[Music]