Speaker 1: Welcome to the deep dive. So, if you've ever tried,
Speaker 1: you know, plotting a course for a cybersecurity career, you
Speaker 1: probably found it's less like a clear path and more
Speaker 1: like trying to navigate a maze that keeps changing shape.
Speaker 2: Yeah, it really does feel like that. Sometimes.
Speaker 1: Today we're going to try and cut through some of
Speaker 1: that confusion. We're drawing on insights from a CISO who's
Speaker 1: well been through it all to hopefully give you a
Speaker 1: more strategic way to think about it.
Speaker 2: And look, we really need that kind of strategy. Cybersecurity.
Speaker 2: It's still a pretty young field, isn't it.
Speaker 1: Definitely.
Speaker 2: I mean, unlike say engineering or law, we don't have
Speaker 2: those decades or centuries even of established professional standards. ORG
Speaker 2: structures are all over the place. Career letters seem like
Speaker 2: they're invented new in every company.
Speaker 1: Right, and you hear about how short the tenure is
Speaker 1: for leaders like CISOs. What is it two to four
Speaker 1: years on average?
Speaker 2: That's about right, And that fact alone just raises the
Speaker 2: stakes for every single move you make in your career.
Speaker 2: It puts pressure on things.
Speaker 1: Okay, so that short tenure really frames what we need
Speaker 1: to talk about today. Our goal isn't just about you know,
Speaker 1: how to get your foot in the door.
Speaker 2: No, it's much bigger than that.
Speaker 1: It's about building a foundation for a career that actually lasts,
Speaker 1: something sustainable, even if you're aiming for those really high
Speaker 1: perchure leadership spots. Eventually, we want to look at the
Speaker 1: common challenges, the questions people ask at well every stage
Speaker 1: and figure out not.
Speaker 2: Just what to do, but the why, the fundamental why
Speaker 2: behind it all.
Speaker 1: That's the key, exactly the why, And.
Speaker 2: Honestly figuring out that why is the first, and i'd argue,
Speaker 2: the most critical step you need to take. You know,
Speaker 2: the old advice was always just trial and error, hope
Speaker 2: for some good luck, work really.
Speaker 1: Hard, Yeah, the grit and luck model, right.
Speaker 2: But if you actually start with some deliberate thinking, some introspection,
Speaker 2: you take a lot of that luck element out of
Speaker 2: the equation, or at least you minimize it.
Speaker 1: So you've got to constantly ask yourself why security specifically
Speaker 1: all parts of the job actually give you energy? What
Speaker 1: motivates you deep down? Is it the learning, the paycheck, status.
Speaker 2: Helping people? You have to know that stuff because if
Speaker 2: your choices aren't anchored to what you genuinely value. Then
Speaker 2: every bump in the road, every challenge, it just feels
Speaker 2: ten times harder than it needs to be. Take the
Speaker 2: c IO whose experience were drawing on. She didn't actually
Speaker 2: set out to be insecurity. Initially, her core values were
Speaker 2: all about the tendability, predictability, reliability. She just needed things
Speaker 2: to work as planned.
Speaker 1: Okay, so that inherent need for order, How did that
Speaker 1: lead her to security?
Speaker 2: Well, think about major disruptions like nine to eleven or
Speaker 2: the big Northeast power outage years ago. Those events highlighted
Speaker 2: the need for solid disaster recovery for business continuity planning.
Speaker 1: Ah I see, so her personal need for reliability lined
Speaker 1: up perfectly with that kind of planning exactly.
Speaker 2: She found her motivation wasn't about you know, chasing hackers necessarily,
Speaker 2: but about ensuring things kept running smoothly operational stability.
Speaker 1: So the big takeaway there is constantly look for roles,
Speaker 1: look for projects, look for experiences that really resonate with
Speaker 1: your own core strengths and what you actually care about.
Speaker 2: Yeah, it's finding that sweet spot right where what the
Speaker 2: business needs overlaps with what genuinely motivates you.
Speaker 1: Okay, let's unpack this a bit for someone maybe just
Speaker 1: trying to break into the field. Now, security is I mean,
Speaker 1: it's obviously a tech heavy discipline. You need some baseline
Speaker 1: technical chops, right yeah, networking, maybe cloud, maybe some scripting.
Speaker 2: Oh absolutely, that's the table stakes, the prerequisite. But here's
Speaker 2: the really fascinating part. The paradox almost go on. Mentors
Speaker 2: in this field consistently say that people very rarely ask
Speaker 2: them how to do the technical stuff.
Speaker 1: Wait, really, what do they ask? Then?
Speaker 2: The overwhelming majority of questions are about navigating the organization,
Speaker 2: how to deal with difficult personalities, how to understand the
Speaker 2: political landscape, how the company structure actually works or doesn't work.
Speaker 1: So it's the soft skills those are the real differentiators.
Speaker 2: Then, bingo. You hear hiring managers say it all the time.
Speaker 2: I can teach someone the specific tech we use here,
Speaker 2: but I can't easily teach them how to communicate effectively
Speaker 2: or work well with others.
Speaker 1: Okay, so let's focus on those non technical areas. You
Speaker 1: flagged three key ones that seem to make or break
Speaker 1: a career in security.
Speaker 2: Yeah, free, big ones. Number one. Communication, and this isn't
Speaker 2: just about writing good technical reports though, that's important too.
Speaker 2: It's about being able to answer questions from management succinctly,
Speaker 2: get to the point, don't bury the lead and drug in,
Speaker 2: and crucially, learn to use business cases. Frame your arguments
Speaker 2: in terms of the business understands.
Speaker 1: Translate risk into dollars and cents or competitive advantage precisely.
Speaker 2: If you can't do that translation, your brilliant technical idea
Speaker 2: of dies on the mind because nobody with budget authority
Speaker 2: understands why they should care makes sense?
Speaker 1: Okay, what's number two?
Speaker 2: Number two is emotional intelligence EI or EQ. Honestly, this
Speaker 2: one is almost about survival and security.
Speaker 1: Survival that sullds dramatic.
Speaker 2: Well, think about that piece of feedback we saw. You
Speaker 2: might be right, but you're not being effective.
Speaker 1: Yeah, that's blunt.
Speaker 2: It's incredibly powerful, though, isn't. It gets right to the
Speaker 2: heart of the issue. Security folks often have to tell smart,
Speaker 2: driven people that they can't do something the quick or
Speaker 2: easy way HEI EI. Knowing yourself, managing your reactions, having empathy.
Speaker 2: That's what lets you navigate those conversations without just alienating everyone.
Speaker 1: So even if you have the technically correct answer, if
Speaker 1: you deliver it badly, you lose.
Speaker 2: You lose effectiveness. Absolutely, you might win the argument but
Speaker 2: lose the war, so to speak.
Speaker 1: How does someone who's maybe naturally focused on rules and
Speaker 1: logic learn to well manage their ego or approach in
Speaker 1: those moments.
Speaker 2: A lot of it comes down to empathy, really trying
Speaker 2: to understand the other person's perspective, which ties directly into
Speaker 2: the third skill partnership.
Speaker 1: Partnership.
Speaker 2: Okay, this isn't just about doing your assigned tasks. It's
Speaker 2: about actively looking for ways to make processes better, especially
Speaker 2: processes that involve multiple teams. It means trying to see
Speaker 2: the world through your partner's eyes. What are their goals,
Speaker 2: what are their pressures.
Speaker 1: And figuring out how security can help them achieve their goals,
Speaker 1: not just block them exactly.
Speaker 2: If you can frame security as an enabler for their success,
Speaker 2: you become so much more valuable, so much more effective
Speaker 2: than someone who just sits in their silo and enforces rules.
Speaker 1: Okay, that's a great framework communication EI partnership. Let's shift
Speaker 1: gears slightly to mindset. Especially for people starting out, there's
Speaker 1: this huge pressure I think, this feeling you have to
Speaker 1: be perfect, know everything.
Speaker 2: Oh, definitely, and job postings don't help right, They.
Speaker 1: List this impossible combination of skills nobody actually has.
Speaker 2: It's often an aspirational wish list. The key thing to
Speaker 2: remember if you're applying is not do I meet every
Speaker 2: single bullet point, but rather, do I genuinely believe I
Speaker 2: can learn and do this job effectively. Focus on your
Speaker 2: potential and your ability to learn.
Speaker 1: What about certifications, that's always a big question.
Speaker 2: Do you need Yeah, certifications, it's nuanced. Look need a
Speaker 2: specific certification to actually do the day to day work well,
Speaker 2: but you might very well need them to get the
Speaker 2: interview in the first place. They act as filters, especially
Speaker 2: for automated HR systems. They prove you have at least
Speaker 2: a baseline level of knowledge in a certain area, so
Speaker 2: needed for the job. Maybe not needed to get the
Speaker 2: job quite possibly.
Speaker 1: Okay. That clarifies things and for building momentum once you're
Speaker 1: in a role. What's the advice there?
Speaker 2: Two main things. First, never stop being curious. You never
Speaker 2: arrive in security. Things change constantly. You have to invest time,
Speaker 2: often your own time outside of work, just keeping up
Speaker 2: learning about new threats, new technologies. And the second thing,
Speaker 2: don't jump rolls too quickly, especially early on. It's tempting.
Speaker 2: I know, recruiters are always calling. Yeah, but you need
Speaker 2: to stay in a role long enough to actually see
Speaker 2: things through, to understand the real impact of your work
Speaker 2: over a couple of business cycles. We're talking maybe a
Speaker 2: year or two minimum. Why is that so important Because
Speaker 2: if you leave every six or nine months, you only
Speaker 2: ever experience the immediate crisis, the fire droll of the moment.
Speaker 2: You don't get the chance to learn the deeper strategy
Speaker 2: to build those partnerships we talked about, or to see
Speaker 2: the results of longer term projects. You just get surface
Speaker 2: level exposure, right.
Speaker 1: You need that time to actually gain deep skills, not
Speaker 1: just a collection of brief experiences. Okay, So, assuming someone's
Speaker 1: navigated the entry path, maybe their mid career, Yeah, let's
Speaker 1: talk about where things often get really tough. Stress and conflict.
Speaker 2: Yeah. Security work carries a pretty unique kind of stress,
Speaker 2: doesn't it, And it changes shape over your career. When
Speaker 2: you're junior, the stress is often internal, Do I know enough?
Speaker 2: Can I handle this workload?
Speaker 1: And poster syndrome?
Speaker 2: Maybe exactly, But later on, as you get more senior,
Speaker 2: the stress tends to become more external. It's about organizational conflict.
Speaker 1: What's the root of that conflict.
Speaker 2: Typically, it often boils down to a fundamental difference in
Speaker 2: perspective security pros. We tend to be evangelists. We see
Speaker 2: security controls policies as essential as strategic enablers for the
Speaker 2: business long term.
Speaker 1: But other people in the business they often.
Speaker 2: See those same controls as as annoying speed bumps, friction,
Speaker 2: things that slow them down from hitting their targets, launching
Speaker 2: their products.
Speaker 1: And that gap, that disconnect leads to.
Speaker 2: Leads to security constantly being called in late, often in
Speaker 2: firefighting mode, trying to fix problems that could have been avoided,
Speaker 2: and that constant reactive cycle is just exhausting. It leads
Speaker 2: to burnout.
Speaker 1: Okay, So if that's the core conflict, managing the stress
Speaker 1: means actively trying to bridge that gap. Right, Oh, how
Speaker 1: do you manage that disconnect strategically?
Speaker 2: There are a few key strategies. First, you have to
Speaker 2: teach them, but not using the old fud tactics fear,
Speaker 2: uncertainty and doubt that often backfires.
Speaker 1: So how do you teach effectively?
Speaker 2: You explain how security enables their success. Assume they have
Speaker 2: positive intent, that they want to do the right thing,
Speaker 2: but just don't understand the risks or the benefits. Show
Speaker 2: them here's how this control helps ensure the system they
Speaker 2: rely on stays of a fail. Or here's how following
Speaker 2: this process helps us avoid millions in fines connected to
Speaker 2: their world.
Speaker 1: Okay, teach them their language. What's next?
Speaker 2: Second, find common causes. Stop framing everything purely in security terms.
Speaker 2: Tailor your message. Does your business partner care most about
Speaker 2: saving money, reducing time to market, improving the customer experience?
Speaker 1: Find their goal and show how security aligns with it.
Speaker 2: Precisely, We saw that great example where implementing a security
Speaker 2: framework actually helped the network team reclaim unused IP addresses
Speaker 2: that saved them time and complexity, something they cared about deeply,
Speaker 2: probably more than the abstract idea of governance.
Speaker 1: Find the win win got it, and the third strategy.
Speaker 2: Third, and this is especially crucial as you become more
Speaker 2: senior advice, then let them decide. You have to recognize
Speaker 2: that actually implementing a control or funding a security initiative
Speaker 2: is almost always a business decision based on risk appetite.
Speaker 1: So your job is to provide the best possible advice exactly.
Speaker 2: Provide clear, unbiased advice about the risks the options, the
Speaker 2: potential impacts, but then you have to let the business
Speaker 2: owner make the call, and critically, you need to separate
Speaker 2: your personal feelings, your professional pride from that final outcome.
Speaker 1: That sounds hard, It is.
Speaker 2: Incredibly hard, but it's vital. Your value lies in giving
Speaker 2: sound advice. Whether they take it or not is ultimately
Speaker 2: their responsibility based on the business context. Getting too personally
Speaker 2: invested in every single decision is a fast track to
Speaker 2: burn out.
Speaker 1: That need to kind of separate yourself or align yourself
Speaker 1: correctly seems to link directly to the idea of culture
Speaker 1: fit too.
Speaker 2: Absolutely, it's just too draining to go to work every
Speaker 2: day feeling like you have to put on a mask
Speaker 2: to constantly bend your personality to fit in with the
Speaker 2: company culture.
Speaker 1: So aligning your personal why, your values with the culture
Speaker 1: and the specific type of security work you do is
Speaker 1: really important for long term sustainability.
Speaker 2: Massively important, and this is where thinking about those security
Speaker 2: personas can be quite helpful. There are archetypes, of course,
Speaker 2: not boxes, but they can give you clues about what
Speaker 2: kind of roles might fit you best.
Speaker 1: Okay, let's run through them. What's the first one?
Speaker 2: First is the protector This is someone motivated by a
Speaker 2: sense of duty, community service, maybe even national defense. They're
Speaker 2: drawn to roles where they're actively defending. Think Blue Team,
Speaker 2: operational defense, incident response. They're the ones running towards the fire.
Speaker 1: Okay, the protector. Who's next?
Speaker 2: Then you have the puzzler. This person is driven by
Speaker 2: intellectual curiosity, by complex challenges. They love taking things apart,
Speaker 2: figuring out how they work, solving intricate problems.
Speaker 1: Roles like penetration testing, reverse engineering, strategic planning exactly.
Speaker 2: Deep subject matter experts often fit here. Think Red Team
Speaker 2: or specialized security architecture roles.
Speaker 1: Got it.
Speaker 2: Third PERSONA third is the moral crusader. Their core drive
Speaker 2: is around ethics, fairness, doing things the right way. They
Speaker 2: believe in rules and ensuring they're followed.
Speaker 1: Ah So, Governance, Risk and Compliance GRC DRC.
Speaker 2: Is a natural home for them. Yes, they're the rule
Speaker 2: makers and the rule followers. Ensuring the organization operates with
Speaker 2: integrity and trustworthiness absolutely essential. In the last one, finally,
Speaker 2: the change agent. This person thrives on novelty, on new challenges.
Speaker 2: They see themselves as fixers, problem solvers. They love jumping
Speaker 2: into a new situation, sorting it out and then moving
Speaker 2: on to the next thing.
Speaker 1: They get bored easily with routine, very easily.
Speaker 2: They excel in project based work, maybe consulting, or roles
Speaker 2: where they're constantly tackling different kinds of problems. Now, like
Speaker 2: I said, few people are purely one type.
Speaker 1: Most people are a mix.
Speaker 2: Yeah, usually have a dominant trait and maybe pieces of
Speaker 2: the others. But understanding your primary driver, that main persona
Speaker 2: can really help you target roles in environments where you're
Speaker 2: more likely to feel engaged and frankly happy.
Speaker 1: So pulling this all together, it seems success in this
Speaker 1: really complex cybersecurity field comes down to a few key things.
Speaker 1: Really knowing your why, prioritizing those crucial professional skills like
Speaker 1: EI communication, and then learning how to manage that inevitable
Speaker 1: organizational stress by being seen as a partner not just
Speaker 1: the no police.
Speaker 2: That sums it up pretty well. Know yourself, build your
Speaker 2: professional skills, and learn to navigate the human side of
Speaker 2: the organization.
Speaker 1: And for you listening right now, if you're out there
Speaker 1: applying for jobs, maybe you're getting interviews, but you keep
Speaker 1: falling short at the final hurdle, not getting the offer.
Speaker 1: Our source material had a really specific piece of advice
Speaker 1: on that.
Speaker 2: Yeah, this is a common frustration. If you're consistently getting interviews.
Speaker 2: It usually means your technical skills, your resume on paper,
Speaker 2: it's good enough. They see the potential.
Speaker 1: So the problem isn't the skills.
Speaker 2: The failure is likely happening in the interview. It's probably
Speaker 2: about articulation. You might not be clearly explaining why you
Speaker 2: want this specific role at this specific.
Speaker 1: Company, connecting your story to their needs exactly.
Speaker 2: You need to sharpen how you talk about your background,
Speaker 2: your motivations, your personal why and directly link it to
Speaker 2: the job description, to the company's MISSI show them you
Speaker 2: understand what they need and how you specifically can help
Speaker 2: them achieve it. Don't just give generic answers.
Speaker 1: That's really actionable advice. Okay, let's wrap up with the
Speaker 1: final thought, something a bit provocative. Maybe that ties back
Speaker 1: to that CSO tenure issue we mentioned right at the start.
Speaker 2: Yeah, that average tenure of just twenty four to forty
Speaker 2: eight months. It's shockingly short, isn't it, And it means
Speaker 2: very few security leaders actually get to leave a deep,
Speaker 2: truly lasting legacy within an organization.
Speaker 1: So what's a provocative part Well, we talked.
Speaker 2: About managing stress and conflict, but think about structural success.
Speaker 2: Imagine a CISO builds a fantastic, high performing team, then
Speaker 2: they leave and within a year or so that team
Speaker 2: gets broken up. Maybe its functions get absorbed by other departments.
Speaker 1: Yeah, you hear about that happening.
Speaker 2: The provocative thought is that often that dissolution isn't just
Speaker 2: bad luck or changing priorities. It might actually be a
Speaker 2: failure of the previous leader. How So, a failure to
Speaker 2: effectively manage stakeholders up and outwards, to embed the security
Speaker 2: function so deeply and demonstrate its value so clearly across
Speaker 2: the organization that its mission and structure continue even after
Speaker 2: the leader departs. Their efforts weren't sticky enough.
Speaker 1: Wow. Okay, So the ultimate challenge for a leader isn't
Speaker 1: just building the team, but making its work indispensable and
Speaker 1: understood by the rest of the organization.
Speaker 2: Exactly, ensuring its value proposition is clear and integrated.
Speaker 1: So, if you are a security leader now, or you
Speaker 1: aspire to be one, maybe the real mission isn't just
Speaker 1: about your own tenure. It's about building a structure, a team,
Speaker 1: a set of processes, maybe even a succession plan that's
Speaker 1: so robust, so well integrated, that the mission survives your
Speaker 1: inevitable exit.
Speaker 2: That's the challenge.
Speaker 1: Our final question to you, then, is this, what are
Speaker 1: you going to do starting today to make sure your work,
Speaker 1: your team's work, becomes truly institutionalized, truly sticky enough to
Speaker 1: endure long after you've moved on.
Speaker 2: Think about the sustainability of your impact. Something to chew on.
Speaker 2: Will see you on the next deep dive.