Vollständiges Transkript von How to Break Into GovTech Cybersecurity (What Nobody Tells You)

GovTech space it did very good to me. 03:48.700 --> 03:50.282 [SPEAKER_00]: A civil service was very good to me. 03:51.223 --> 03:55.787 [SPEAKER_00]: Got my master's degree, got lots of serts, got some amazing mission experience. 03:55.868 --> 04:00.472 [SPEAKER_00]: Went to CISA a few years ago at a great time in CISA, working some amazing people there. 04:00.993 --> 04:09.261 [SPEAKER_00]: And now I'm retired from civil service, and I'm having a blast as a government contractor. 04:10.507 --> 04:13.690 [SPEAKER_00]: So, it's been an amazing ride, God is very good. 04:14.291 --> 04:22.780 [SPEAKER_01]: Yeah, God is getting on the time, and I see you just relaxing there, you have a fun, I see you got the nice shirt on, a DevCon, that's a nice shirt by the way, so you enjoy time. 04:23.321 --> 04:34.833 [SPEAKER_00]: Well, it's come to intersection a couple of things, I spent four years out in Hawaii during my civil service career, and of course, DevCon's great in our field, so, well, when I saw it a well-haed DevCon shirt this year, DevCon, I've got it. 04:36.235 --> 04:38.117 [SPEAKER_01]: That's a nice shirt with DevCon. 04:38.097 --> 04:49.553 [SPEAKER_01]: So then like I've been working in the government with space for about five years I haven't worked 20 years, you know, that's a long time and who 25 actually is what he's writing back to. 04:49.573 --> 04:54.840 [SPEAKER_01]: Yeah, so so when our first was hearing about this space I just got into about accident. 04:54.860 --> 05:03.312 [SPEAKER_01]: I was a background investigator and didn't start investigating me for clearance and all this stuff but for your perspective, what is a DevTekDive? 05:04.372 --> 05:07.258 [SPEAKER_00]: Well, let me try to split this up. 05:07.880 --> 05:08.882 [SPEAKER_00]: What is a tech job? 05:08.962 --> 05:10.546 [SPEAKER_00]: Well, we use technology for everything. 05:10.606 --> 05:14.294 [SPEAKER_00]: And then, of course, government introduces some other aspects to it. 05:14.395 --> 05:16.700 [SPEAKER_00]: So, a gov tech job is the intersection of those two things. 05:17.401 --> 05:22.633 [SPEAKER_00]: And so, honestly, in the government, we use some of the same technologies everyone else uses. 05:22.613 --> 05:24.036 [SPEAKER_00]: So there's a lot of overlap. 05:24.076 --> 05:28.286 [SPEAKER_00]: I wouldn't think of gov tech jobs as being like a completely alien world. 05:29.027 --> 05:38.749 [SPEAKER_00]: Skills that you get from working outside of the government directly apply in fact it's critical that we get people that are technology experts working in the government, whether as a civilian or as a contractor. 05:38.729 --> 05:49.426 [SPEAKER_00]: But then there are some unique aspects to it's working for government agencies and And honestly, where the most unique aspects that's been wonderful for me over my career is the missions you get to be involved there. 05:49.446 --> 05:51.369 [SPEAKER_00]: I have had the privilege of it. 05:51.389 --> 05:54.574 [SPEAKER_00]: I look up at like, how in the world am I the guy working on something? 05:54.634 --> 05:55.856 [SPEAKER_00]: It's this important. 05:55.876 --> 05:57.058 [SPEAKER_00]: And so it's inspiring. 05:57.138 --> 05:59.462 [SPEAKER_00]: It's like really, you're like, wow, it's awesome to be a part of us. 05:59.562 --> 06:01.665 [SPEAKER_00]: I better work really hard and do this well. 06:02.320 --> 06:26.674 [SPEAKER_01]: Yeah, because it's a privilege to work in a go-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to-to- 06:26.992 --> 06:33.405 [SPEAKER_01]: So there, like, like, I know gut, gut will government technology is a different space. 06:33.425 --> 06:37.834 [SPEAKER_01]: It's not really alien space, but you do need different clearances and things like that. 06:38.395 --> 06:44.848 [SPEAKER_01]: I do know where, like, some I would be able to find a clearance or how would they, how would you navigate it if it, if you was willing to tell somebody I can't spare. 06:44.828 --> 06:59.551 [SPEAKER_00]: Yeah, you know, if I've mentored a lot of people that live in this area where there are a lot of given the jobs and there are a lot of clear jobs and I guess one thing I'd explain to people that aren't familiar with that world at all is that your clearance has to be sponsored by so you are not, you do not have a clearance. 06:59.651 --> 07:07.103 [SPEAKER_00]: Someone's sponsored your clerks and so has made really bad life choices and cannot get a clearance, you probably need to be looking for other lines of work. 07:07.123 --> 07:13.232 [SPEAKER_00]: But let's assume your person that is in fact clearable, then the question is, 07:13.212 --> 07:25.911 [SPEAKER_00]: And if your skills are compelling enough, just about anybody might want to sponsor you, but let's say you're entry level or whatever else, your best path might be, might be a dumb reposition, because that's certainly how I got my first clearance, was I got hired here in the government. 07:26.732 --> 07:34.783 [SPEAKER_00]: If I had taken my rather sad and limited resume and then tried to just get hired by a random government contractor right here, they would have said, you know the clearance? 07:35.164 --> 07:35.845 [SPEAKER_00]: No. 07:35.825 --> 07:43.800 [SPEAKER_00]: So that's what I'd say to people is essentially, you need to find that first job that gets you the clearance and then work from there. 07:44.181 --> 07:47.808 [SPEAKER_00]: And honestly, there's a lot of hiring going out of the government. 07:47.828 --> 07:50.032 [SPEAKER_00]: People like me retire in 2020. 07:50.513 --> 07:55.943 [SPEAKER_00]: And so there's a lot of hiring of venture-level people that's going to create some opportunities for

that next generation. 07:55.990 --> 08:03.339 [SPEAKER_01]: And I'm like that you said that like, hey, you could just apply for a government position because even with me, I don't want to apply for such as I don't, like, okay, I got a problem. 08:03.439 --> 08:04.521 [SPEAKER_01]: Is this straight car chart? 08:04.541 --> 08:08.486 [SPEAKER_01]: Because people just know you could, but you didn't still make the money as a government employee. 08:08.506 --> 08:23.685 [SPEAKER_00]: Yeah, you know, I realize it's been a, it's been a year with a lot of changes for, for, for government employees, for contractors, but I am frankly quite bullish on civil service, one 08:23.665 --> 08:53.453 [SPEAKER_00]: there's there's there's there's there's hiring going on right now and there will continue to be hiring uh... specialty for the central book and it is because one thing the government's never bit always struggle with is bringing in more mid-level or senior people uh... whereas if you get someone right at a college they they cost less the government may be able to offer other benefits and so so for those entry level candidates in particular i think the government creates tremendous opportunities i would be where i am today without 08:53.433 --> 09:04.303 [SPEAKER_01]: I'm not that uh, so uh, the one that I just wanted to clear up to is like, okay, we know it's a requirement to get the security bus But as and I know you hired many, many people this doesn't matter 09:05.262 --> 09:12.691 [SPEAKER_00]: So, so the broader question of certifications, um, so I have piles and piles of certifications. 09:12.711 --> 09:21.902 [SPEAKER_00]: So I have the maintenance fees to prove it, um, and it's not because I think that certifications are the end all and be all for being effective in our industry. 09:22.022 --> 09:28.570 [SPEAKER_00]: What I would say instead is, I personally think it's more about what you learn than actually having certifications. 09:28.550 --> 09:37.141 [SPEAKER_00]: Another thought, though, too, is with things like 8570 or 8140, there are certain positions that require that certification. 09:37.861 --> 09:43.488 [SPEAKER_00]: So if you've got that cert and you've got that clearance, you're going to make it through that initial review. 09:43.508 --> 09:44.169 [SPEAKER_00]: So hey, look at this. 09:44.229 --> 09:46.372 [SPEAKER_00]: It's a candidate that qualifies for the position. 09:46.892 --> 09:57.105 [SPEAKER_00]: And then you need to nail the interview and check all the other boxes, but it's a foot that can be a foot of the door, especially for those government positions that formally require the cert. 09:57.085 --> 10:11.105 [SPEAKER_00]: But I'll tell you this, that cert might get you past the initial screening by the recruiters or by HR, but when you walk into the interview with the actual mission owner or the hiring manager, don't crowd along about your sir. 10:11.866 --> 10:21.640 [SPEAKER_00]: They care about the mission, they care about what you actually know, so you are not qualified because your SCI's is peer-scree, plus you're qualified because you understand cybersecurity, the technology involved. 10:21.660 --> 10:22.341 [SPEAKER_00]: So talk about that. 10:22.621 --> 10:23.903 [SPEAKER_00]: Don't talk about your 10:24.085 --> 10:27.069 [SPEAKER_01]: Yeah, because I, I used to, why used to get a dollar. 10:27.089 --> 10:28.210 [SPEAKER_01]: He's already got a security bus. 10:28.791 --> 10:29.492 [SPEAKER_01]: And it's in his day. 10:29.512 --> 10:30.092 [SPEAKER_01]: It'll care. 10:30.112 --> 10:32.415 [SPEAKER_01]: It's in his day to don't care. 10:32.435 --> 10:32.856 [SPEAKER_01]: They don't care. 10:32.896 --> 10:34.798 [SPEAKER_01]: And a master's are going to get a security bus. 10:34.818 --> 10:35.779 [SPEAKER_01]: They don't look at it. 10:35.799 --> 10:36.240 [SPEAKER_00]: Right. 10:36.260 --> 10:37.682 [SPEAKER_00]: And this one's pretty important too. 10:38.242 --> 10:45.351 [SPEAKER_00]: Is if you do list anything on your resume, whether it's your security class or your eye till certified or this whatever else? 10:45.331 --> 10:48.134 [SPEAKER_00]: You had better be ready to answer basic questions about that. 10:48.174 --> 10:50.938 [SPEAKER_00]: If I say to you, what does I tell stand for? 10:51.558 --> 10:54.081 [SPEAKER_00]: And your I tell certified and your answer is, I don't know. 10:54.422 --> 10:55.563 [SPEAKER_00]: It's not a good way to start the air. 10:56.344 --> 10:59.407 [SPEAKER_01]: And what I've learned, too, is just don't put stuff on your resume, man. 11:00.188 --> 11:01.610 [SPEAKER_01]: I put, it should have never in this lesson. 11:01.670 --> 11:04.433 [SPEAKER_01]: I put red hat on my resume. 11:04.854 --> 11:09.900 [SPEAKER_01]: And I don't know none of our, the lady knitted to tell me I was still, I didn't take the job, but she was still going to move forward. 11:09.920 --> 11:13.684 [SPEAKER_01]: But she said, like lesson, don't put it on your resume, unless you can speak to 11:13.664 --> 11:29.181 [SPEAKER_00]: So, there are lots of different approaches to interviews, but a very common approach, honestly, one of my preferred approaches, is to just look at the person's resume and ask questions based on what they're claiming, because jobs, you know, the right fit for a job, I mean, like, different people can do jobs differently. 11:29.221 --> 11:37.351 [SPEAKER_00]: You're really looking for somebody who's going to bring some real skills at energy and enthusiasm and effectiveness of the job, and that can take many forms. 11:37.371 --> 11:40.414 [SPEAKER_00]: So, it's not like there's one right answer for the best candidate. 11:40.394 --> 11:44.459 [SPEAKER_00]: But when somebody walks in they say, here's who I am and they hand you that resume. 11:46.081 --> 11:50.466 [SPEAKER_00]: Oh my goodness, just a tip when you're thinking about what you might have to talk about in the interview. 11:50.867 --> 11:53.910 [SPEAKER_00]: Maybe the

piece of paper you handed them might be a clue. 11:54.331 --> 11:59.517 [SPEAKER_00]: Maybe anything you put on that paper should be a slow pitch over the plate that you're going to knock out of the park. 11:59.897 --> 12:05.524 [SPEAKER_00]: And if it's not either figure out what you're going to say or get healthy resume. 12:06.382 --> 12:24.002 [SPEAKER_01]: So then again, I keep high you hired so many people in your career and you worked in the federal space You worked in a civilian in the space too And if I'm a new person that's a client, what are you looking for in that resume and looking for an interview for somebody to get it out? 12:23.982 --> 12:28.572 [SPEAKER_00]: Yeah, you know, and there are lots of different formal processes for that. 12:28.612 --> 12:36.269 [SPEAKER_00]: They're just kind of zooming back and thinking about this in terms of what I've seen and what goes best for candidates. 12:36.289 --> 12:41.520 [SPEAKER_00]: I tend to think in terms of three things for candidates that are most likely to be successful, and then I'm most eager to hire. 12:41.561 --> 12:42.683 [SPEAKER_00]: And that is, 12:42.663 --> 12:44.106 [SPEAKER_00]: They haven't apt to do for the position. 12:44.647 --> 12:46.551 [SPEAKER_00]: Of course, they don't have the position on the nature of the position. 12:47.173 --> 12:54.529 [SPEAKER_00]: But do they, is there something in what they're saying or their history as I get to know them as a candidate that it's clear they have an aptitude for it? 12:54.629 --> 12:55.671 [SPEAKER_00]: Notice I say aptitude. 12:56.733 --> 12:59.760 [SPEAKER_00]: I've done a lot of hiring and fairly interlevel people. 13:02.187 --> 13:09.255 [SPEAKER_00]: that on the job is a great place to learn all the details, to become an experienced professional, you do that with by doing the job. 13:09.716 --> 13:13.260 [SPEAKER_00]: So aptitude is one of the goals, in interest. 13:13.680 --> 13:17.404 [SPEAKER_00]: If I describe a job that I think is the coolest thing in the world, you know what I'm gonna say? 13:17.484 --> 13:18.886 [SPEAKER_00]: I'm gonna do this amazing cyberwork, whatever else. 13:19.307 --> 13:22.650 [SPEAKER_00]: And the person who's like, well, if you want me to do that, you're gonna have to trade me, or I'm not sure. 13:22.670 --> 13:23.692 [SPEAKER_00]: That's not exactly what I do. 13:23.732 --> 13:26.074 [SPEAKER_00]: It's like, they don't, they don't seem that interested. 13:26.775 --> 13:27.997 [SPEAKER_00]: That's a huge red flag. 13:28.017 --> 13:31.941 [SPEAKER_00]: So aptitude, interest. 13:33.254 --> 13:36.979 [SPEAKER_00]: I haven't worked a lot of manual jobs, I unloaded trucks at Walmart. 13:36.999 --> 13:42.326 [SPEAKER_00]: I have made monkey chowd, a prenafina, I loaded trucks at UPS. 13:43.308 --> 13:50.577 [SPEAKER_00]: I've delivered a whole lot of pizzas, I did it back in the day when you had to do it with a flashlight and a paper mat, this little GPS is cheating. 13:50.898 --> 13:57.286

[SPEAKER_00]: So I've done a lot of like media work, it's okay to have those sins and resume. 13:57.306 --> 13:59.329 [SPEAKER_00]: In fact, I'm going to step further. 14:00.136 --> 14:02.379 [SPEAKER_00]: I, you should tell me a story. 14:02.479 --> 14:08.688 [SPEAKER_00]: I would like to hear how you have been successful in whatever it was that you were doing. 14:09.429 --> 14:19.683 [SPEAKER_00]: So like, if you were working in an Italian restaurant and they hired you to wipe the tables down and then you progress to where you're actually like, you know, leading the shift and doing other stuff. 14:20.044 --> 14:26.633 [SPEAKER_00]: When people, and when I see you've been successful in other contacts, that tells me you're the kind of person that's more likely to be successful in my context. 14:26.613 --> 14:34.384 [SPEAKER_00]: So, on one level, you have to go, what does unloading trucks of Walmart have to do with working insider-spirity? 14:34.965 --> 14:36.186 [SPEAKER_00]: Well, it's simple. 14:36.207 --> 14:43.857 [SPEAKER_00]: If you will throw yourself a bad job, which is exhausting work, you're probably more likely to throw yourself at your job at insider-spiries. 14:44.298 --> 14:55.033 [SPEAKER_00]: So, that history of success, aptitude, interest on the history of success or the two things I love to see in candidates, and you don't have to be working in the cybersecurity 14:55.385 --> 15:00.050 [SPEAKER_01]: Now you know, for myself, I worked at Walmart, I worked at Walmart. 15:00.370 --> 15:01.872 [SPEAKER_01]: Walmart, I tell you to this day. 15:02.492 --> 15:04.154 [SPEAKER_01]: People ask me what my most favorite job was. 15:04.454 --> 15:08.458 [SPEAKER_01]: I love working at cyber, but big plus tours with my favorite jobs at his day. 15:08.518 --> 15:09.279 [SPEAKER_01]: I still don't want to waste. 15:09.399 --> 15:11.321 [SPEAKER_01]: So I worked at Walmart back in the 90s. 15:11.341 --> 15:12.743 [SPEAKER_01]: Did you have to do the Walmart cheer? 15:13.023 --> 15:15.085 [SPEAKER_02]: Oh yeah, I don't do jeep. 15:15.105 --> 15:24.835 [SPEAKER_00]: Yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah, yeah 15:27.262 --> 15:28.865 [SPEAKER_01]: No, it's going to be squeaky. 15:28.885 --> 15:30.228 [SPEAKER_01]: I don't know where I went there. 15:30.248 --> 15:32.652 [SPEAKER_01]: Oh, I hope build a one. 15:32.712 --> 15:35.297 [SPEAKER_01]: I hope blow the whole warmer in the DC area. 15:35.377 --> 15:37.662 [SPEAKER_01]: Yeah, uh, was it called the one on Georgia Avenue? 15:38.423 --> 15:44.454 [SPEAKER_00]: But but it is much as that, you know, wasn't one of my favorite jobs and I was not getting paid very well worked. 15:44.474 --> 15:46.418 [SPEAKER_00]: I worked really hard at that job. 15:46.398 --> 15:56.432 [SPEAKER_00]: And on one level, I could say, oh my gosh, those years when I was in college and I was working on the side, what wasted time that I was unloading trucks, so I should have been building professional experience. 15:56.452 --> 15:59.656 [SPEAKER_00]: But it wasn't wasted time because I actually learned how to work hard. 16:00.237 --> 16:03.561 [SPEAKER_00]: I learned how to work for good supervisors and bad supervisors. 16:03.962 --> 16:05.203 [SPEAKER_00]: I learned how to work with others. 16:05.283 --> 16:13.114 [SPEAKER_00]: And so what I entered the government after having many years of not being professional jobs and just, you know, paying the bills and getting through college, 16:13.094 --> 16:36.132 [SPEAKER_00]: I entered with a set of experience that I had made some dumb mistakes in job for the stakes for a lover and I came in with a set of skills from from those jobs that actually helped me when I when I got that good professional job And so I hear that you say hey you can work out at your last stop you can get that do what you do there and just learn the basics for dealing with people special work at a side where you those basic fundamentals out 16:36.112 --> 16:48.036 [SPEAKER_00]: those soft skills are huge and so you know the cyber security and tech in general is filled with highly opinion, highly technical people who could stand to work on their soft skills and the professions is. 16:48.237 --> 16:56.854 [SPEAKER_01]: Yeah, I'm glad I did a podcast because I wouldn't even have those if I had to do this, but what I will say is like do you need experience? 16:57.020 --> 17:24.192 [SPEAKER_00]: to get it to get a job like straight up because like because right now is getting to the point where they ask people a lot of these job names for a lot of things yeah you know it's uh... i i almost i hesitate to to give two-click of an answer because i recognize the the job market is tougher out you know that though the promise of oh cyberskary it's where all the jobs are just show up seeking a cyber job and you'll get an employee uh... it's not not what not what we're looking at right now 17:24.172 --> 17:29.497 [SPEAKER_00]: I will say this though, even in a tighter job market, they're still hiring more. 17:29.517 --> 17:40.528 [SPEAKER_00]: And so what does that mean if you are trying to get into cyber, maybe you can't take the most direct half, maybe you have to make a job that's cyber adjacent, and you take a job that's just an IT job. 17:40.548 --> 17:54.162 [SPEAKER_00]: Maybe you take a job like I did, why couldn't you get an IT job, you take a job that uses a computer and you turn it into a job that builds IT skills. 17:54.142 --> 18:03.933 [SPEAKER_00]: Try to find that and obviously a job in the field that you're targeting is more important than the pay range as well. 18:04.013 --> 18:17.348 [SPEAKER_00]: So maybe you've got to take that job, it could

be something like help desk or just something that is like, you know, this is not the insane I had in mind, but if he gets you if it helps you tell that story, moves you on the path you're trying to go, that's very helpful. 18:17.648 --> 18:20.711 [SPEAKER_01]: Yeah, like, even with me, about what we saw now, I'll do IT. 18:20.851 --> 18:21.792 [SPEAKER_01]: Are we getting the IT? 18:21.932 --> 18:23.173 [SPEAKER_01]: I'm going to rent that. 18:23.193 --> 18:24.634 [SPEAKER_01]: Focus on rent half of some years. 18:24.694 --> 18:26.155 [SPEAKER_01]: I've been slowly getting to cyber. 18:26.415 --> 18:27.997 [SPEAKER_01]: Because, wait a minute, just a certain bit she made. 18:28.017 --> 18:28.837 [SPEAKER_01]: Very, very, very now. 18:29.158 --> 18:36.604 [SPEAKER_00]: Yeah, you know, I would say in that whole area is that it's really important as cyber professionals that we know what we know that we don't know. 18:37.225 --> 18:45.431 [SPEAKER_00]: And it's very helpful when somebody has an IT background because oftentimes the cyber professionals were looking at the IT folks and say, hey, you should do that differently. 18:45.572 --> 18:47.233 [SPEAKER_00]: Or, hey, why don't you do this? 18:47.213 --> 19:02.092 [SPEAKER_00]: Well, your advice is not going to be very good if you don't understand the technology you're telling them how to reconfigure or if they'd admit them, you don't even realize you don't understand the technology because what we really got to do is when you have that conversation you say, hey, you know what? 19:02.493 --> 19:05.837 [SPEAKER_00]: I don't like how your TLS is configured or you need to change this logging. 19:05.857 --> 19:07.459 [SPEAKER_00]: They're like, you don't know what you're talking about. 19:07.479 --> 19:08.901 [SPEAKER_00]: That's not going to work. 19:08.881 --> 19:27.118 [SPEAKER_00]: Well instead of like any defense of any say tell me more about that and let me describe the objective to you and make it more of a dialogue because the reality is that usually a cyber professionals whenever we're telling someone to change something the person we're talking to knows more than we do about the technology so that there's a key role for humility and being an effective cybersecurity profession. 19:27.639 --> 19:36.627 [SPEAKER_01]: So and then just to double down and the stakes people may know you gave a couple of them but what are the people making mistakes wise? 19:36.607 --> 19:38.069 [SPEAKER_01]: We're doing an interview right. 19:38.149 --> 19:40.233 [SPEAKER_01]: What are some of the stakes they're making? 19:40.774 --> 19:44.179 [SPEAKER_00]: You just want all the mistakes I have made, there's an ask to talk about it. 19:44.199 --> 20:02.648 [SPEAKER_00]: I mean, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, 20:03.235 --> 20:04.878 [SPEAKER_00]: that's okay. 20:04.898 --> 20:06.861 [SPEAKER_00]: And you can also assume it's some point. 20:07.061 --> 20:09.786 [SPEAKER_00]: I'm going to ask you a question, you don't know the answer to it. 20:09.806 --> 20:11.889 [SPEAKER_00]: That's also okay. 20:11.909 --> 20:16.878 [SPEAKER_00]: What's not okay is would you try to talk your way through it as if you know what you're talking to? 20:17.358 --> 20:20.624 [SPEAKER_00]: And the deeper you dig that hole, the less impressed that I am. 20:21.105 --> 20:24.450 [SPEAKER_00]: So I've had people do well in an interview, 20:24.430 --> 20:27.593 [SPEAKER_00]: When they hit that point, they're like, you know, that's like good question. 20:27.653 --> 20:28.374 [SPEAKER_00]: I Google that. 20:28.994 --> 20:32.718 [SPEAKER_00]: And I remember one person, he emails me back like the next day. 20:32.778 --> 20:34.480 [SPEAKER_00]: And it's like, I love that question you asked. 20:34.500 --> 20:35.961 [SPEAKER_00]: Here's what I found out when I researched it. 20:36.322 --> 20:37.623 [SPEAKER_00]: And thank you so much for your time there. 20:37.643 --> 20:39.985 [SPEAKER_00]: Because like, oh my gosh, somebody, somebody hired this guy right now. 20:41.267 --> 20:46.832 [SPEAKER_00]: So that's, that's one mistake people will make is they feel like to pass an interview. 20:46.932 --> 20:49.915 [SPEAKER_00]: It is your job to know the 20:49.895 --> 20:51.640 [SPEAKER_00]: And it's okay not to move the answer. 20:51.680 --> 20:52.743 [SPEAKER_00]: In fact, I expect you. 20:53.083 --> 21:01.706 [SPEAKER_00]: And if I'm interviewing somebody who seems to know a lot, I'll keep asking questions because I really want to know what happens when they get to something they don't know. 21:02.268 --> 21:05.777 [SPEAKER_00]: And I might be able to get you that point very quickly if you're very junior. 21:05.757 --> 21:13.887 [SPEAKER_00]: or if you're more experienced, I'm probably going to, you know, if it's the, if it's the, when we're going to interact in an interview format where I could just be fairly free wheeling like that. 21:14.067 --> 21:21.115 [SPEAKER_00]: One thing I would tend to do is just keep asking questions until the person doesn't know the answer, because I want to know how I handle that, because that's the nature in our industry. 21:21.936 --> 21:29.065 [SPEAKER_00]: You can't know everything, and part of being affected is knowing what you don't know, not just pretending we know everything. 21:29.298 --> 21:31.061 [SPEAKER_01]: And now double that on that like the meat. 21:31.121 --> 21:32.423 [SPEAKER_01]: My first job in cyber. 21:32.764 --> 21:47.247 [SPEAKER_01]: I was talking to my uh Lee hire me so I was doing the interview he hired me, but when I was doing the interview you can ask me what he's questions And I'm just saying listen to do

I don't know nothing what you're talking about I'm just told the straight out it hire me. 21:47.347 --> 21:50.351 [SPEAKER_01]: I will go do the job But I don't know nothing talk about that. 21:50.692 --> 21:53.837 [SPEAKER_01]: I you lied or stuff up on my resume made up some of this up 21:53.817 --> 21:54.859 [SPEAKER_01]: I'm just trying to get a job. 21:54.899 --> 21:56.481 [SPEAKER_01]: Next thing you know, it was hard to waste. 21:56.822 --> 21:59.927 [SPEAKER_01]: But when I got it to the people, it took me two years of murder to think. 21:59.967 --> 22:01.389 [SPEAKER_01]: Learn with Jordi when I can go. 22:01.449 --> 22:02.871 [SPEAKER_01]: But yeah, I've told you. 22:02.891 --> 22:05.035 [SPEAKER_00]: So I would say that would be another error. 22:05.135 --> 22:07.098 [SPEAKER_00]: Don't make things up for your hair rest. 22:07.338 --> 22:13.448 [SPEAKER_00]: Yeah, so I'm so, so, but, but when you get dressed, you're like, okay, that resonates way too thin for me to ever even get an interview. 22:13.969 --> 22:14.610 [SPEAKER_00]: Well, guess what? 22:15.873 --> 22:18.096 [SPEAKER_00]: figure out what should be on it and then make sure you know. 22:19.097 --> 22:20.639 [SPEAKER_00]: So really it gives you homework. 22:20.659 --> 22:22.962 [SPEAKER_00]: So I'm not saying you shouldn't have had to resume that you submitted. 22:23.022 --> 22:24.544 [SPEAKER_00]: I'm saying it was homeworks. 22:24.564 --> 22:25.866 [SPEAKER_00]: They were like, we're not so easy. 22:25.886 --> 22:28.690 [SPEAKER_00]: And also like, I had no idea how TCP works. 22:28.710 --> 22:33.916 [SPEAKER_00]: Well, probably you probably do need to do a TCP for this job and you better go figure that out. 22:34.317 --> 22:35.198 [SPEAKER_00]: I'm pan on your resume. 22:35.785 --> 22:39.090 [SPEAKER_01]: I'm sort of Jason D. I got a video and I said to Jason D. I like you say it. 22:39.150 --> 22:39.812 [SPEAKER_01]: That's not I didn't know. 22:39.972 --> 22:45.401 [SPEAKER_01]: Even if I put some or I make sure I know it and again, I know I don't put nothing It's not, but I try to know everything. 22:45.801 --> 22:50.810 [SPEAKER_00]: But sometimes really hyperscrupulous and honest people will fail on the other side of the spectrum. 22:50.830 --> 22:53.434 [SPEAKER_00]: They know all kinds of stuff, but they won't put it on their resume. 22:53.454 --> 22:58.903 [SPEAKER_00]: And it's like, dude, just because you put it on your resume does not mean you're clating to be a leading expert. 22:58.923 --> 23:00.325 [SPEAKER_00]: You would write a book on the stop. 23:00.305 --> 23:03.310 [SPEAKER_00]: It's okay to put it on there and say, I've used that tool. 23:03.671 --> 23:07.357 [SPEAKER_00]: I would describe myself as a novice, but I am in fact familiar with that. 23:07.637 --> 23:09.100 [SPEAKER_00]: Put it on the resume. 23:09.120 --> 23:11.845 [SPEAKER_00]: That's like, so you can err on either side of that. 23:12.926 --> 23:14.970 [SPEAKER_00]: There's a ditch on either side of that one. 23:14.990 --> 23:18.155 [SPEAKER_00]: You need to list the things that you're familiar with. 23:18.296 --> 23:21.802 [SPEAKER_00]: If you're not familiar at all, you better fix that or get it off your resume. 23:22.262 --> 23:25.047 [SPEAKER_00]: But don't think that you have to be an expert nerfieke or. 23:25.027 --> 23:34.696 [SPEAKER_01]: Yeah, I'm not actually a conscious person to answer or not, but that sounds like good, but let's guess, would you hire experienced person before beginner? 23:36.557 --> 23:40.160 [SPEAKER_01]: There you should not do your main for the same musician, okay. 23:40.180 --> 23:44.464 [SPEAKER_00]: So, what I, what I hire an experienced person before beginner. 23:46.166 --> 23:53.312 [SPEAKER_00]: I would attend the higher experience beginners for beginner positions, experience who if I had somebody that had like, 23:54.608 --> 23:59.095 [SPEAKER_00]: 20 years of experience, you know, like tremendous experience and they were going after an nature-level job. 23:59.817 --> 24:00.999 [SPEAKER_00]: I wouldn't exclude them for that. 24:01.059 --> 24:05.546 [SPEAKER_00]: I just want to understand, understand, doubly so the job market we're looking at right now. 24:05.566 --> 24:12.097 [SPEAKER_00]: There's some really skilled people that may have reached the point that they're like, I would take in a drill position. 24:12.117 --> 24:14.541 [SPEAKER_00]: So when I called that against them, oh my gosh, no. 24:14.521 --> 24:23.919 [SPEAKER_00]: So I'm going to hire the best candidate for physician regardless of, and I'm not currently carrying a hiring in the job I have right now. 24:24.039 --> 24:25.502 [SPEAKER_00]: It's not really my goal. 24:25.702 --> 24:27.165 [SPEAKER_00]: I'm more focused on designing things. 24:27.225 --> 24:37.525 [SPEAKER_00]: But what I've been in a position to hire, it's the end of the day, I have a set of candidates, I'm considering, and I'm going to hire the first of this. 24:38.315 --> 24:39.597 [SPEAKER_01]: Yeah, that's a good answer. 24:39.617 --> 24:40.378 [SPEAKER_01]: That was a great answer. 24:40.398 --> 24:42.921 [SPEAKER_01]: You never had a memory. 24:42.941 --> 24:43.042 [SPEAKER_01]: Yeah. 24:43.062 --> 24:45.385 [SPEAKER_01]: So then, so we talked about hiring. 24:45.465 --> 24:48.329 [SPEAKER_01]: We talked about what Doug said is, so this is the issue. 24:48.349 --> 24:51.293 [SPEAKER_01]: With new people getting all the experience teams, right? 24:51.734 --> 25:01.006 [SPEAKER_01]: So when I first started on the experience team, there reminded us new what they do and they had to report, there's so many of these terminology with security plus is popping up. 25:01.547 --> 25:05.132 [SPEAKER_01]: What would you advise someone as new to cyber as adapting to a new team? 25:06.968 --> 25:17.819 [SPEAKER_00]: Ah, gosh, a few things, um, one, no one expects you to know everything, um, enthusiasm and willingness to help this long way. 25:18.439 --> 25:30.130

[SPEAKER_00]: Um, it's all, it's very helpful if you have some looking out for you if there's someone in particular who's, and if no one's been assigned, so first of all, someone might be assigned to that role, but you have free outbreak with plays, that really their job or you just get assigned. 25:30.791 --> 25:36.857 [SPEAKER_00]: So you need to have some people on 25:37.057 --> 25:42.385 [SPEAKER_00]: Um, and, uh, it's not everyone else's job to get you plugged in. 25:42.505 --> 25:45.109 [SPEAKER_00]: Think of it in a natively, primarily as you, as your job. 25:45.549 --> 25:47.292 [SPEAKER_00]: Now, should they be doing that? 25:47.312 --> 25:47.873 [SPEAKER_00]: Yes, they should. 25:47.893 --> 25:51.658 [SPEAKER_00]: But whether they do it or not, the one person in this engagement, you control is you. 25:51.819 --> 25:54.262 [SPEAKER_00]: So, so you basically say, well, you know, what can I do? 25:54.282 --> 25:56.005 [SPEAKER_00]: Uh, what are some areas? 25:56.025 --> 25:57.567 [SPEAKER_00]: So, look around. 25:57.587 --> 25:59.931 [SPEAKER_00]: There may be a particular task that nobody wants to do. 26:00.552 --> 26:02.074 [SPEAKER_00]: And it's mainly just brute force. 26:02.154 --> 26:02.895 [SPEAKER_00]: Well, like, 26:02.875 --> 26:03.817 [SPEAKER_00]: happily do that. 26:04.177 --> 26:12.271 [SPEAKER_00]: So if you're the kind of person that is diving into the work is contributing, a lot of the things will sort themselves out because they're like, okay, this wasn't a mistake. 26:13.072 --> 26:14.114 [SPEAKER_00]: I like that new person. 26:14.134 --> 26:15.557 [SPEAKER_00]: There are hard worker. 26:15.937 --> 26:22.909 [SPEAKER_00]: They're learning the stuff and so so realize the same way you're trying to figure out that I make a mistake when I took this job. 26:22.889 --> 26:26.055 [SPEAKER_00]: There will convince you that, well, do we make a mistake when we hired this person? 26:26.456 --> 26:31.746 [SPEAKER_00]: And you'll quickly get past that if you're the sort of person that like empties the coffee maker. 26:32.347 --> 26:37.156 [SPEAKER_00]: Or like, does the medial cyber tasks that everybody rolls their eyes at? 26:37.496 --> 26:39.059 [SPEAKER_00]: You know, be here to volunteer. 26:39.340 --> 26:40.442 [SPEAKER_00]: So yes, volunteer. 26:41.063 --> 26:42.466 [SPEAKER_00]: Ask good questions, others. 26:43.287 --> 26:45.792 [SPEAKER_00]: Just that is all of that. 26:45.772 --> 26:56.107 [SPEAKER_01]: Now I understand, like, for example, in my new scene, we got a newer person, he's not new to cyber, but when he did, he took one of the class, and then really nobody really wanted to do, which was kind of like, steaks and focus on that. 26:56.367 --> 27:00.353 [SPEAKER_01]: I mean, I mean, it kind of is so good that they give him more and more and more. 27:00.393 --> 27:05.400 [SPEAKER_01]: So, you know, that's what you can, so you just basically say, I focus on one thing and just slowly build just so. 27:05.752 --> 27:20.031 [SPEAKER_00]: Yeah, yeah, I basically just say we look around and find some where we can make an immediate contribution and there's a lot of other stuff going on that maybe you can't, but there's usually there's usually some stuff that nobody wants to do, and if you say I'll do it, or be like, oh, I like this guy. 27:20.720 --> 27:26.886 [SPEAKER_00]: That's my guy, you are going to do that, that's awesome, thank you, get glad he's doing it. 27:27.087 --> 27:48.769 [SPEAKER_01]: So, what I was new like, I didn't really know who to talk to, it was hard because people was so his name, I put in the game, the later I get in my career, I was like, he's been really in no doubt, why should this had to open more time to me, you know, but how would you find mentorship within your team or somebody in the building, what would you do? 27:49.542 --> 27:56.893 [SPEAKER_00]: You're generating, you know, I will tend to hit it off the certain people, or it's starting to just kind of make some connections in terms of how you think and how you work. 27:57.694 --> 28:10.633 [SPEAKER_00]: One thing that I've always tried to do is I'm trying to spot my ways is, you can find your your posture syndrome flare, not your like, oh, I don't know any of this, and everyone else knows it. 28:10.753 --> 28:11.955 [SPEAKER_00]: Do I belong here? 28:12.087 --> 28:17.195 [SPEAKER_00]: Well, some of the answer is putting a lot of work into figuring things out outside of work. 28:17.276 --> 28:22.564 [SPEAKER_00]: I mean, like, early in my career, I've built out a home lab. 28:23.245 --> 28:29.636 [SPEAKER_00]: I was spending massive amounts of time outside of work trying to work all the things that everyone else see already know what I did. 28:30.217 --> 28:31.199 [SPEAKER_00]: So that's part of it. 28:31.219 --> 28:33.943 [SPEAKER_00]: But terms of mentors, 28:33.923 --> 28:39.796 [SPEAKER_00]: For me, it's always tend to happen somewhat naturally, as I got invested in the work. 28:40.096 --> 28:42.642 [SPEAKER_00]: You connect to certain people, you connect to certain leaders. 28:43.423 --> 28:46.229 [SPEAKER_00]: And, you know, people are often happy to share there. 28:46.390 --> 28:48.594 [SPEAKER_00]: But when you're like, like, what do you think? 28:48.895 --> 28:52.322 [SPEAKER_00]: You know, or you ask for someone's at, but people like to share their, share their thoughts. 28:52.343 --> 28:54.447 [SPEAKER_00]: So, it generally works out. 28:55.068 --> 29:05.160 [SPEAKER_01]: Now understand, and even myself, when I first started, I didn't know anything, so I invested a lot of you Demi for our map, you know, it's got a trade at pay for other people's training. 29:05.180 --> 29:15.612 [SPEAKER_01]: And if you need training, check out our map academy, you know, the IO, you know, it helped out with all the training, but, you know, it was just, it was just, that was the only part that was confusing for me. 29:15.632 --> 29:22.020 [SPEAKER_01]: As a person that had been

supervisor has been a manager, where are some things that you 29:23.063 --> 29:39.258 [SPEAKER_00]: making sense to a comfortable, you know, actually, most of my time, I've spent a little bit of time as a manager, most of my time has been more as a technical leader, but in terms of making people for a comfortable, my role is to tend to be to get people plugged into projects. 29:39.940 --> 29:42.405 [SPEAKER_00]: And so I'll... 29:42.385 --> 29:50.133 [SPEAKER_00]: give them a vision, you know, quite them to the resources, make myself available, maybe connect them to some other folks. 29:50.654 --> 29:55.819 [SPEAKER_00]: But, you know, just that general confidence of, I mean, you got this. 29:56.400 --> 29:57.541 [SPEAKER_00]: And it may lead off. 29:57.601 --> 30:01.345 [SPEAKER_00]: I've seen Pete very junior people dive into some really hard problems. 30:02.026 --> 30:05.129 [SPEAKER_00]: Problems that would have been challenging for anybody, even the more experienced folks. 30:05.669 --> 30:07.131 [SPEAKER_00]: But, but they called it off. 30:07.912 --> 30:10.114 [SPEAKER_00]: And so, 30:13.013 --> 30:13.614 [SPEAKER_01]: Yeah. 30:13.634 --> 30:14.976 [SPEAKER_01]: That's cool. 30:15.316 --> 30:18.681 [SPEAKER_01]: So, so I've been in another thing I want to ask too, like when I first started, right? 30:19.282 --> 30:23.548 [SPEAKER_01]: I was a new person and, you know, you have all these smart people that's in the building. 30:23.908 --> 30:24.890 [SPEAKER_01]: So, Charles, you get this thing. 30:24.910 --> 30:29.076 [SPEAKER_01]: We don't want to ask somebody questions because if you ask them down question, you're like, well, you said the email yesterday. 30:29.096 --> 30:30.117 [SPEAKER_01]: It has said this. 30:31.539 --> 30:35.305 [SPEAKER_01]: How do you do to put somebody's battling that? 30:35.645 --> 30:36.406 [SPEAKER_00]: Oh, well, okay. 30:36.566 --> 30:40.873 [SPEAKER_00]: So, you find yourself at that moment. 30:40.933 --> 30:42.615 [SPEAKER_00]: You're sitting in a meeting. 30:42.916 --> 30:52.975 [SPEAKER_00]: and they're all using words, and you recognize all the words, but you have no idea what anyone is actually saying. 30:54.257 --> 31:04.316 [SPEAKER_00]: It was quite a breakthrough the day that I realized what if nobody's making any sense, not because I'm not following and I don't belong here, what if no one's making sense? 31:04.917 --> 31:06.460 [SPEAKER_00]: Because no one's making sense. 31:07.165 --> 31:12.734 [SPEAKER_00]: And so you just raise your head and you ask the really dumb question and the room goes silent. 31:13.114 --> 31:14.296 [SPEAKER_00]: I said, wasn't a dumb question. 31:14.697 --> 31:17.621 [SPEAKER_00]: Everybody was using these words, but they weren't really sure what they were saying. 31:17.761 --> 31:33.946 [SPEAKER_00]: So, when you have that nagging feeling that you're not tracking what's going on, it may be that the entire room is just sort of feeding off each other and that dumb question

you're thinking is not a dumb question at all, it gets to the root of the confusion that's going on in the room. 31:33.966 --> 31:35.248 [SPEAKER_00]: So, don't. 31:36.292 --> 31:39.376 [SPEAKER_00]: Take the risk of asking the dumb question, we'll want to get that. 31:39.397 --> 31:40.458 [SPEAKER_01]: No, I agree. 31:40.478 --> 31:48.009 [SPEAKER_01]: 100% like, even on the back has, I know I'm doing a toneology talking, but sometimes what somebody's listening, like, what are they really talking about? 31:48.410 --> 31:51.654 [SPEAKER_01]: Sometimes if you ask them, they might not even know the essence of the question. 31:51.995 --> 31:53.217 [SPEAKER_01]: So that's a quick thing. 31:54.979 --> 32:00.788 [SPEAKER_00]: Well, and honestly, anybody can take a complex topic and make it work in place. 32:01.389 --> 32:04.493 [SPEAKER_00]: Understanding comes from taking a complex topic and making it more simple. 32:04.895 --> 32:15.284 [SPEAKER_01]: Yeah, okay, okay, so in this, this will probably be the last, in this section, like for a new person and again they're new, they're doing their thing, you kind of are discussed all of that. 32:15.624 --> 32:25.053 [SPEAKER_01]: What is one last thing you would suggest for a new person to start in the space with experience team, what would you suggest they do to succeed even from, even beyond that team? 32:27.135 --> 32:31.719 [SPEAKER_00]: Um, you know, attitude is, it's so critical. 32:31.799 --> 32:33.400 [SPEAKER_00]: The people that are successful, 32:34.544 --> 32:50.747 [SPEAKER_00]: They own their own success, and so, and then that's not just just people shouldn't help them, but ultimately, when you find yourself in that position, then you're asking basic questions like, well, what is my job, work, and I contribute, how do I engage with this? 32:51.128 --> 32:59.861 [SPEAKER_00]: What can I personally do to fill these gaps that I feel as opposed to, well, you know, some of them who've missed this and this, I'll be able to do this job, it's not fair. 33:00.622 --> 33:01.463 [SPEAKER_00]: So, 33:01.443 --> 33:20.952 [SPEAKER_00]: I guess I would just say throw yourself at it, and that's not a very elegant answer, but that's how I've turned to approach personally, and the most successful I've seen, you're like, okay, this person is all in, and don't get tripped up trying to pretend you know anything. 33:21.192 --> 33:23.175 [SPEAKER_00]: You know, admit that you don't know things. 33:23.415 --> 33:24.497 [SPEAKER_00]: Ask them questions. 33:24.477 --> 33:32.968 [SPEAKER_00]: Wow, have I asked some dumb questions of my career, but I worked with smart, kind people who even when I asked them dumb questions, they didn't tell me how dumb it was. 33:33.409 --> 33:36.212 [SPEAKER_00]: They gave me good answers to my dumb work piece. 33:36.232 --> 33:45.424 [SPEAKER_00]: And the only thing dumber that I've done that a really dumb question and I've trust me, I've asked them dumb questions is not asking them because then you're real not making borrowers. 33:45.444 --> 33:47.447 [SPEAKER_01]: And I agree, sometimes you're gonna ask. 33:47.427 --> 33:55.920 [SPEAKER_01]: Dell, if you can't explain anything because uh... you were my, my, my, my, my, my, my, my, my, I'll be talking about certain topics and just show, ask me something to get it going. 33:55.940 --> 34:15.932 [SPEAKER_01]: But I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, I ain't, 34:16.705 --> 34:21.350 [SPEAKER_01]: Okay, sometimes I don't know what people talk about it like is a good thing, you make a lot of money. 34:21.370 --> 34:28.299 [SPEAKER_01]: It doesn't matter what you do, you are, you are going to make some money in the garbage speciality in the area, but like, what is the reality of working in this space? 34:28.379 --> 34:32.103 [SPEAKER_01]: Like, can you explain, like, how is mission based and this thing you're going to experience? 34:32.123 --> 34:32.784 [SPEAKER_01]: Yes, it's a experience. 34:32.824 --> 34:43.437 [SPEAKER_00]: So I thought some working in this space, um, like I've seen earlier, it's kind of the an interesting intersection of the technology that everyone uses in, in a unique mission space. 34:43.457 --> 34:43.877 [SPEAKER_00]: So, 34:43.857 --> 34:53.277 [SPEAKER_00]: So whatever government agency organization you're working for, there's some government organization for the very unique missions that you're only going to get to do those if you're working there. 34:53.919 --> 34:59.571 [SPEAKER_00]: And so that's the positive side is working with technology doing interesting missions. 34:59.551 --> 35:04.600 [SPEAKER_00]: And then you do have just the general challenges of large organizations. 35:04.640 --> 35:05.922 [SPEAKER_00]: And that's not anything unique to God. 35:06.002 --> 35:11.912 [SPEAKER_00]: I mean, there's lots of layers of bureaucracies and large corporations as well as with that Don't work. 35:12.633 --> 35:24.293 [SPEAKER_00]: And so, what I've always tried to do over the course of my career, because if you zoom out and you look at the big picture and everything that's broken and everything that could be fixed in the universe, it's a bit overwhelming. 35:24.273 --> 35:26.916 [SPEAKER_00]: tend to focus on the things that are rather than my spirit influence. 35:27.377 --> 35:28.378 [SPEAKER_00]: What can I do? 35:28.818 --> 35:32.242 [SPEAKER_00]: What is directly reachable by me that I can make better? 35:32.663 --> 35:49.102 [SPEAKER_00]: And you start solving things that you that are within your sphere of influence, and you try not to feel the things that you don't control, because there's a lot going on, whether you're an

industry or a endeavourment, and you can be overwhelming if you zoom out, you look at every imaginable challenge. 35:50.064 --> 35:52.947 [SPEAKER_00]: I can only 35:53.298 --> 35:55.945 [SPEAKER_01]: Now understand, and I agree with you 100%. 35:56.707 --> 35:58.833 [SPEAKER_01]: There's something that I experience that I didn't understand. 35:58.853 --> 35:59.956 [SPEAKER_01]: This is mission-based. 35:59.996 --> 36:02.022 [SPEAKER_01]: Sometimes the mission could be very critical, right? 36:02.443 --> 36:03.707 [SPEAKER_01]: So sometimes you might have to come in. 36:04.008 --> 36:05.492 [SPEAKER_01]: Sometimes you're working on the weekends. 36:05.552 --> 36:07.236 [SPEAKER_01]: Is there something that some people go experience? 36:07.397 --> 36:09.282 [SPEAKER_01]: Sometimes, or they just kind of just me? 36:09.262 --> 36:11.405 [SPEAKER_00]: Well, you know, it depends on what you're working. 36:12.247 --> 36:21.541 [SPEAKER_00]: There are portions of the government, whether civilian or contractor, where the demands placed on you are as high as the demands anywhere. 36:22.062 --> 36:27.650 [SPEAKER_00]: And then there are other places where it could be quite laid back and it's pretty easy to take lead. 36:27.690 --> 36:30.274 [SPEAKER_00]: So it's really going to depend on companies. 36:30.254 --> 36:35.679 [SPEAKER_01]: Yeah, and then too, as you said, and it's the thing about we're going to govern me a lot of this stuff. 36:35.699 --> 36:39.442 [SPEAKER_01]: You can't really tell it's an apartment, you know, so that's a big thing to with you. 36:39.883 --> 36:41.004 [SPEAKER_00]: Well, you know, but it depends. 36:41.044 --> 36:46.489 [SPEAKER_00]: Some government organizations literally, it's their job to interface from the public, it's all about being public. 36:46.969 --> 36:57.018 [SPEAKER_00]: And that if you're in more of the military, you know, do you be context or whatever, then there could be some very sensitive missions that depend upon not having them to to everyone. 36:57.398 --> 37:00.261 [SPEAKER_01]: And so, so it depends. 37:00.241 --> 37:04.790 [SPEAKER_01]: So, what we're going to say is someone like the Merge Technologies, especially the Garra Space. 37:04.810 --> 37:06.513 [SPEAKER_01]: There's a lot of neat things changing now. 37:06.814 --> 37:09.218 [SPEAKER_01]: I know what's talked about GRC Engineering. 37:09.378 --> 37:10.661 [SPEAKER_01]: I don't know if we want to touch on that. 37:11.142 --> 37:13.506 [SPEAKER_01]: I just, some of the Merge Technologies in the gun techs week. 37:13.526 --> 37:14.188 [SPEAKER_01]: Which is not clear. 37:14.468 --> 37:15.150 [SPEAKER_01]: It's older. 37:15.330 --> 37:19.077 [SPEAKER_01]: I mean, you know, the Garra Miss is a little older, but, you know, it's newer to the 37:19.225 --> 37:31.553 [SPEAKER_00]: Yeah, you know, I spent my career involved in cyber security, whether it's doing penetration testing, where when I was a pen tester, I used to look at and go, why did people

build such bad things? 37:31.573 --> 37:33.297 [SPEAKER_00]: And then I became the security engineer. 37:33.838 --> 37:36.845 [SPEAKER_00]: And I looked up on him and like, how did they get the bad things built at all? 37:36.946 --> 37:38.449 [SPEAKER_00]: It's hard to build anything. 37:38.429 --> 37:44.842 [SPEAKER_00]: So, and then I moved on, and I got myself doing security operations, and I had to defend all the things. 37:44.922 --> 37:48.669 [SPEAKER_00]: And so, so basically, everything can be quite challenging. 37:49.130 --> 37:52.717 [SPEAKER_00]: And then as we look at, you know, our risk management objectives. 37:53.339 --> 37:57.186 [SPEAKER_00]: How do you take a really large complex enterprise? 37:57.888 --> 38:00.032 [SPEAKER_00]: How do you even know what it is? 38:00.215 --> 38:02.498 [SPEAKER_00]: And then how do you know the risks? 38:03.159 --> 38:04.521 [SPEAKER_00]: And how do you reduce those risks? 38:04.561 --> 38:12.291 [SPEAKER_00]: Get those risks to a point where given the threats that you're facing, you believe that you're sufficiently mitigating them. 38:12.311 --> 38:14.494 [SPEAKER_00]: All of those things are really challenging. 38:14.514 --> 38:19.701 [SPEAKER_00]: And one of those reasons that it's challenging, too, is we're trying to build on a rot and a foundation. 38:20.161 --> 38:28.332 [SPEAKER_00]: The operating systems, the applications, the protocols, the all the things that we use to do our mission, 38:28.312 --> 38:37.100 [SPEAKER_00]: They are largely driven by functionality and they are largely driven by being more complex and doing more, which is very much intentional with our security goals. 38:37.581 --> 38:43.026 [SPEAKER_00]: And so security is just what of many goals that all these products we use every day are trying to eat. 38:43.046 --> 38:56.479 [SPEAKER_00]: And so the challenge for a security engineer or the security architect is how you take all these into the dual components, none of which are up to the level of trust we want to put in them and actually achieve your security goals. 38:56.459 --> 38:57.981 [SPEAKER_00]: and how do you measure that? 38:58.001 --> 39:05.870 [SPEAKER_00]: And there are lots of frameworks and there are not some methodologies to do that and we can easily get distracted by all the frameworks and methodologies and miss the big picture. 39:07.311 --> 39:17.423 [SPEAKER_00]: And so in the area of St. like GRC and RMF, a lot of what happens in the name of the RMF is essentially security theater. 39:19.585 --> 39:26.213 [SPEAKER_00]: I've got 39:27.020 --> 39:28.382 [SPEAKER_00]: a control is a big concept. 39:28.562 --> 39:32.708 [SPEAKER_00]: You can assess a control of the mutation, which consists of a bunch of different mechanisms. 39:33.269 --> 39:34.491 [SPEAKER_00]: But it control itself. 39:34.852 --> 39:38.557 [SPEAKER_00]: That's like, it's just a big concept. 39:39.038 --> 39:52.538 [SPEAKER_00]: And so we have to go for all these different frameworks,

the layers of abstraction, and then figure out what is actually going on in the environment, and how do we ensure that it's up to the task to address tomorrow's attacks? 39:53.159 --> 40:06.797 [SPEAKER_00]: that's really hard and so anyone who tells you and I do I do a lot of zero trust work and I believe in zero trust architecture but anyone who tells you that they have an easy solution for cyber security is probably trying to sell you so. 40:07.199 --> 40:11.183 [SPEAKER_01]: Yeah, I've been talking to a lot of software companies recently. 40:11.203 --> 40:15.748 [SPEAKER_01]: Just to kind of, they have a lot of things they had coming for the RMS and things. 40:15.768 --> 40:18.871 [SPEAKER_01]: But what I'm learning is, you know, they have a lot of good solutions. 40:18.931 --> 40:22.075 [SPEAKER_01]: They do have a lot of great things, but it's not going to be easy. 40:22.375 --> 40:26.119 [SPEAKER_01]: I mean, sometimes it can be painted that way, but it's always some limitations. 40:26.640 --> 40:33.527 [SPEAKER_00]: You know, one of the key challenges we face is that we're trying to, in addition to all the 40:33.507 --> 40:36.310 [SPEAKER_00]: questions of the products themselves are not secured by design. 40:38.592 --> 40:44.717 [SPEAKER_00]: We're trying to manage all these components in this entire enterprise using manual processes. 40:45.898 --> 40:47.159 [SPEAKER_00]: And that's not going to work. 40:47.179 --> 40:52.644 [SPEAKER_00]: You take about something that says flexible and agile and mission enabling as cloud services. 40:53.285 --> 41:01.472 [SPEAKER_00]: Can you think of anything more ridiculous than have this dynamic cloud infrastructure 41:01.452 --> 41:23.460 [SPEAKER_00]: I mean really that that's kind of ridiculous and so if you're going to have something as dynamic as cloud resources or even your own primary sources, he probably need to use the same engineering processes that you're using to deliver the IT capabilities need to also be delivery your the measurement and enforcement and continues measurement of your security rules. 41:23.947 --> 41:27.591 [SPEAKER_00]: Yeah, so you say that automation is going to be a big thing to those of you kind of saying. 41:28.232 --> 41:33.377 [SPEAKER_00]: Yeah, so automation is a big thing, but one of our challenges you can automate, you only automate it. 41:33.397 --> 41:34.038 [SPEAKER_00]: You figure it out. 41:34.338 --> 41:37.722 [SPEAKER_00]: And there's so many things that people have to figure it out how to do manually very well. 41:38.043 --> 41:48.094 [SPEAKER_00]: So the answer is not to take our current RMF practices, especially at their worst or their more security theater, and then to throw automation on top of the fail process. 41:48.794 --> 41:51.237 [SPEAKER_00]: Automating a failed process just makes failure faster. 41:51.436 --> 41:53.260 [SPEAKER_01]: Yeah. 41:53.280 --> 41:54.743 [SPEAKER_01]: That's a bar. 41:54.763 --> 41:56.066 [SPEAKER_01]: That's a bar.

41:56.086 --> 41:58.250 [SPEAKER_01]: But Mower I get what you're saying. 41:58.270 --> 42:00.294 [SPEAKER_01]: Like, would talk about offline. 42:00.795 --> 42:02.880 [SPEAKER_01]: If you don't understand your own environment. 42:02.900 --> 42:04.122 [SPEAKER_01]: And a lot of the times we don't. 42:04.703 --> 42:06.968 [SPEAKER_01]: As it so's engineered, the world engineer should. 42:07.008 --> 42:09.934 [SPEAKER_01]: But a lot of people don't know what's going on. 42:09.914 --> 42:20.669 [SPEAKER_00]: Right, well, that is one of the challenges we face is that the adversaries are effective because they're invested in knowing your environment, finding the vulnerabilities, moving through it, and achieving their objectives. 42:21.610 --> 42:25.115 [SPEAKER_00]: And it's kind of ridiculous that the adversary would know our environment that well. 42:25.896 --> 42:29.241 [SPEAKER_00]: When it's our environment, where did that position or environment they are? 42:29.301 --> 42:37.573 [SPEAKER_00]: So everybody's like, you know, on what level I get it, oh my gosh, these APTs, the adversaries are so powerful, they're so affected, how will we ever survive the onslaught? 42:37.713 --> 42:39.195 [SPEAKER_00]: Let's look that around. 42:39.513 --> 42:42.100 [SPEAKER_00]: Who's in a matter of position to control an O that environment? 42:43.905 --> 42:45.831 [SPEAKER_00]: The folks that run that environment. 42:46.252 --> 42:53.252 [SPEAKER_00]: And so let's not be too dismissive of the advantage that we have on the defensive side to really control an O that environment. 42:53.367 --> 43:10.257 [SPEAKER_00]: So I do believe that we can actually achieve our security goals but takes a tremendous amount of work, especially given the fact that we're trying to defend an environment that the individual component level, every one of those components has a lot of vulnerabilities, configuration issues, and so it's daunting. 43:10.618 --> 43:12.401 [SPEAKER_00]: Cyber security is hard. 43:12.421 --> 43:14.565 [SPEAKER_01]: Yes, it's hard, it's not. 43:14.545 --> 43:24.620 [SPEAKER_01]: I get people saying, get, you know, this money, you know, but it takes a lot of years, a lot of sleep, it's, well, sometimes, you know, sleep, sometimes sleep this night, it's sometimes a lot of work. 43:24.640 --> 43:35.195 [SPEAKER_01]: So I understand what you just said about the enemy, knowing everybody anymore, I just want to put it in the biblical says, the devil knows more about the Bible than some believers, you know? 43:35.736 --> 43:38.319 [SPEAKER_01]: So that's the same thing you could put it in there here. 43:38.740 --> 43:44.248 [SPEAKER_01]: So you got to know your stuff better than what, you know, you got to know your older 43:44.617 --> 43:54.487 [SPEAKER_01]: So yeah, you make it and you you said a lot of good things, but this is a this is a great power guy It's man like I appreciate you for coming on Where did the audience find you? 43:55.848 --> 43:57.210 [SPEAKER_00]: So you can find now LinkedIn. 43:57.730 --> 44:01.594 [SPEAKER_00]: I'm trying to stay reacted on LinkedIn That's right the best place. 44:01.994 --> 44:02.195 [SPEAKER_01]: Okay. 44:02.215 --> 44:02.895 [SPEAKER_01]: I think okay. 44:03.676 --> 44:10.523 [SPEAKER_01]: Is there anything you want to need an audience with or is it called a Sent in a sense in a speech anything you want to need an audience with 44:10.891 --> 44:34.249 [SPEAKER_00]: Yeah, you know a couple of thoughts if you're listening to a podcast like this you're probably very invested in your career You're trying to either get a job or you're trying to grow your career and I like to give you something else Bipping about and I and I will we're first you'll quote from Jack quotes Jack Welch The sentence he said work by falcons is a myth There are work-life choices and then there are consequences those stresses 44:34.229 --> 44:54.550 [SPEAKER_00]: uh... and i'm not going to do it you know jackwell said welch is a conflict contrary to the figure but i think he nailed it with that quote and what what i mean is there's only one do and when you choose to work late when you choose to work on that certain when you choose to to go after that job that's going to evolve a lot more hours 44:55.762 --> 44:56.964 [SPEAKER_00]: That didn't come from anywhere. 44:57.745 --> 45:02.232 [SPEAKER_00]: If you have a family, if you have kids, you may not be at your kid's soccer game. 45:02.272 --> 45:03.535 [SPEAKER_00]: You may not be there for your wife. 45:04.176 --> 45:10.265 [SPEAKER_00]: And so what I would suggest you is that the goal is to have your choices aligned with your values. 45:10.386 --> 45:15.053 [SPEAKER_00]: The goal should not necessarily be be all in under career. 45:15.033 --> 45:19.700 [SPEAKER_00]: So just recognize that, so I don't scale, there's only one me. 45:20.401 --> 45:24.106 [SPEAKER_00]: I have to choose where my time goes, and you should do the same thing. 45:24.146 --> 45:31.778 [SPEAKER_00]: So ask yourself, what do I value what's important to me, and make sure your choice is aligned with that. 45:31.998 --> 45:33.841 [SPEAKER_00]: And then it's 2026. 45:34.321 --> 45:44.837 [SPEAKER_00]: It's been a challenging year for many of us, with changes in the federal workforce, within the contracting space. 45:44.817 --> 45:53.889 [SPEAKER_00]: And I would suggest to you that job security is not something your job can get. 45:53.909 --> 45:56.994 [SPEAKER_00]: Job security is something that you have to get yourself. 45:57.755 --> 46:02.321 [SPEAKER_00]: I was a GS15 technical side or person working at Sissa. 46:02.982 --> 46:06.527 [SPEAKER_00]: I looked up one day and I was unexpected to retire from a gatherer. 46:07.188 --> 46:11.213 [SPEAKER_00]: I didn't have job security as a civil servant in that context. 46:11.193 --> 46:40.525 [SPEAKER_00]: So, what I would suggest to you is that job security is really more about what you bring to the table, your

professional network, your reputation, because when I found myself at this point a year ago actively looking for what I was going to do at my postgraduate career, it was frankly, it was amazing, all the people that are reaching out to me who had enjoyed working with me in the past and who actively wanted to either bring me under their team, all wanted to refer me to somebody else who had opportunities, 46:42.682 --> 46:47.251 [SPEAKER_00]: So, um, yeah. 46:47.271 --> 46:53.983 [SPEAKER_00]: Job security, um, it's not, uh, not something you're getting from position. 46:54.043 --> 46:56.067 [SPEAKER_00]: Don't know, go looking for a junk by it for you. 46:57.093 --> 47:06.731 [SPEAKER_01]: That's a good thing that you, and I've not the audience web, like you said, basically job security is not always going to be up to job and just go to the things. 47:07.091 --> 47:10.938 [SPEAKER_01]: Outside of work, that you could value most, like your family, other things. 47:11.620 --> 47:16.689 [SPEAKER_01]: And that's what I'm learning, because I always thought like, okay, you got to give it all to the wind you're trying to build. 47:17.210 --> 47:19.033 [SPEAKER_01]: And over time, you know, 47:19.013 --> 47:32.888 [SPEAKER_01]: And the end of the day when your job is your job that your family is your family do you want your family to say hey you was never with my game so you never went at this and around that your loved ones at home lonely you know and the end of the day the job for me the job is just need a job in your job 47:33.442 --> 47:53.610 [SPEAKER_00]: Over the course of my career, I've done some crazy stuff where I volunteered for deployments or things that were really demanding from work standpoint, but there have also been times I would talk to my wife and I said, hey, here's what I'm thinking of doing issues like it's not a good time, I really need you here for the kids and so I will back to work and I said, this was not me, you have to find somebody else. 47:53.590 --> 48:02.583 [SPEAKER_00]: So just own those choices and recognize when you choose work, work, work, work every time, it may benefit your career, but it comes to other consequences. 48:02.944 --> 48:05.347 [SPEAKER_00]: And it's okay to say no to some more things. 48:05.407 --> 48:13.379 [SPEAKER_00]: It's okay not to take the job that is maybe an advancement in your career, but we'll be back for your family or we'll be bad for whatever else we've got. 48:13.399 --> 48:15.362 [SPEAKER_00]: And then that's a bar. 48:15.342 --> 48:18.787 [SPEAKER_01]: I'm making sure y'all hit that because that's a real life thing, man. 48:19.769 --> 48:23.074 [SPEAKER_01]: And Dad's not working in this expert reward for this science security space. 48:23.435 --> 48:26.720 [SPEAKER_01]: He's working for a long time, so he, I mean, sure y'all listen to that. 48:27.501 --> 48:30.406 [SPEAKER_01]: So, Dan, thank you for coming on this podcast today, my way. 48:30.987 --> 48:31.327 [SPEAKER_01]: Thank you. 48:31.488 --> 48:32.429 [SPEAKER_01]: Thank you so much for inviting me. 48:32.509 --> 48:32.970 [SPEAKER_01]: It was awesome. 48:32.990 --> 48:34.853 [SPEAKER_01]: We're part of no problem, so. 48:34.833 --> 48:40.460 [SPEAKER_01]: Remember, everybody, if you're watching on YouTube, like the video, subscribe to the channel, share the video if you like it. 48:40.500 --> 48:43.043 [SPEAKER_01]: Comment down below if you have any thoughts or any opinions. 48:43.503 --> 48:44.765 [SPEAKER_01]: And also, remember, everybody. 48:45.065 --> 48:48.189 [SPEAKER_01]: So, I'm going to armappacademy.io, who will learn about risk management. 48:48.770 --> 48:54.396 [SPEAKER_01]: The things that you need to know about testicotros, ohms, and everything you need to know about arm yourself. 48:54.717 --> 48:56.659 [SPEAKER_01]: Remember, everybody, get 1% better every day. 48:57.019 --> 48:57.560 [SPEAKER_01]: Peace out. 48:57.580 --> 48:58.461 [SPEAKER_01]: I'll see you on next one.