Set expectations for a successful a security career

Are you reacting to incidents in your security career? Or are you responding? And what is the difference? Michael Santarcangelo explains why security professionals need to understand the distinction

Being in control of your life and having realistic expectations about your day-to-day challenges are the keys to stress management, which is perhaps the most important ingredient to living a happy, healthy and rewarding life. — Marilu Henner

For most security professionals — especially those in more technical and operational roles — the daily grind is a series of interruptions punctuated with the occasional crisis (or appearance of a crisis).

The result is a state of constant reaction.

Many wear this as a badge of courage — a demonstration of importance and the ability to operate in a "harsh, demanding" environment.

Also see: Are you dressing the part for your security career?

The reality is that operating in a constant state of reaction is a failure to manage expectations— not just for others, but also on us. It leads to frustration for everyone involved and often results in derailed or failed efforts.

There is a distinction between reacting and responding.

Reactions ruin careers

Always reacting leads to fatigue, frustration and burn out. Worse, it complicates the ability to manage risk more effectively, hampers the ability to build a robust security program and hurts the opportunity to grow a strong and successful security career.

Consider the role expectations play in performance and satisfaction — ours as well as others. If we are not realistic on our expectations for ourselves, we are less likely to be successful with others.

Stop reacting. Start setting expectations.

Successful security professionals need the ability to skillfully respond to events — expected and unexpected. Our ability to set, manage and communicate expectations about our performance and what is needed of others is paramount to our success.

The challenge is that expectations are complicated.

A belief of what will happen, based on experience, feelings and a variety of other inputs, expectations are a form of anticipation. They are attitudes.

While not always accurate or free from bias, expectations are vital in measurement (how we measure ourselves, others and the tasks we take on).

Expectations are nuanced: how we establish and communicate expectations with others is often dependent on context.

  • Set expectations too high, and wind up "over promising and under-delivering." Over time, this stalls careers due to a perception of inability to get the job done.
  • Set expectations too low, and get branded as someone who doesn't understand the task or worse, as someone without ambition.

Here are three ways to set realistic expectations for yourself, and therefore for others:

1. Press pause: Break the cycle of immediate reaction, step back, take a deep breath and consider the event. What expectations are already set, and what is realistic for the situation? Taking a moment to collect thoughts, ideas and reflect on experience is a strong first step in setting, communicating and managing expectations more effectively.Refine outcomes: Be clear with yourself and those around you. What is the ideal outcome everyone involved would like? Is it understood and agreed upon by everyone?Consider history: Expectations are the anticipated outcome of actions, decisions and the factors that influence them all. If expectations are defined before acting, then the results inform how accurate the expectations were. Over time, this leads to a keener ability to accurately judge effort and set more reasonable expectations.

2.

3.

Master the ability to use expectations to improve your security career.

When working through the Career Compass program I developed, participants are asked to share their career goals — within the next year, within the next 3-5 years and seven or more years down the road.

Most of the people I work with have operated under the "expectation of reaction" for so long they struggle to consider the future. The exercise, however, is important: by considering where we're heading, we can then work to calibrate daily, weekly and monthly actions and set the appropriate expectations.

Changing expectations already set takes some time. Start with more realistic expectations of yourself. Work with others to share your process for setting expectations and involve them in the process of setting (or re-setting) realistic expectations that benefit everyone involved.

The power to improve your security career starts with setting the right expectations. Finding the balance on expectations is a lifelong pursuit. It takes practice.

Today is a great day to get started.

About Michael Santarcangelo: The author of Into the Breach and creator of the Awareness that Works System, Michael Santarcangelo is a human catalyst that advocates for individuals while advancing organizations. By connecting people to the consequences of their actions, he delivers results that reduce risk, increase resiliency and allow organizations to make better decisions and do more with less. Get more insights from his blog at www.securitycatalyst.com/blog or engage with him on twitter.com/catalyst.

Copyright © 2011 IDG Communications, Inc.

7 hot cybersecurity trends (and 2 going cold)