How young upstarts can get their big security break in 6 steps

If you’re young, breaking into the security industry can be hell.

Companies have either suffered a data security breach or live in fear of one. So when they’re hiring new IT security personnel, they want years of experience. If you’re fresh out of college, that’s a problem.

Another problem is that security practitioners are control freaks by nature. They have to be, if you stop and think about it. They have a huge responsibility, and delegating some of the work to younger pups is a lot to expect.

But here’s the problem: The future of information security is in the hands of the youth. That may seem a cliched statement; so obvious it sounds stupid. But it’s a fact.

Also see CSOonline.com’s Security Basics page for fundamentals in network security, business continuity, security management, and much more

This column isn’t an invitation for young upstarts to cry and lament about the disadvantages they have. Instead, it’s about a few things you can do to break through and make it in the industry. Think of it as suggestions for becoming a security rock star, which you almost have to be to make a difference these days.

This morning I’m at Security B-Sides Boston, listening to a talk from someone who is fighting this battle right now. Joseph Sokoly, a security analyst at NetBoundary, recently gave a talk at the Austin, Texas B-Sides event about the troubles of being young in the security industry. This time, he’s in Boston giving an update on where his career trajectory has taken him in the weeks since then.

He has found that breaking into the security community is not nearly as hard as it first seemed. In fact, his career got a big boost simply because he had the guts to stand up in front of people and give his talk. “Giving the talk in Austin helped me tremendously,” Sokoly said. “It has opened doors. My being here is a result of that. First, the positive reaction from the community encouraged me not just to listen but to speak again.”

His Austin talk has also inspired security heavyweights like Chris Hoff and James Arlen to look at establishing a mentor program to coincide with this summer’s B-Sides Las Vegas event.

“Being proactive works. Put yourself out there and things will open up, but speaking doesn’t have to be it. Use Twitter. Start blogging,” Sokoly said. He’s absolutely right.

His suggestion young security practitioners speak up and force others to take notice isn’t a new concept. But it’s advice that too few people take.

Instead, prospective employees try to let their raw technical ability do the talking. They get so bogged down on the technical that they ignore the cultural. It’s unfair to be frozen out, especially if you’re skills are well above someone who gets the job simply because they’ve been kicking around as employed security practitioners for five or more years. In other words, because they’ve simply managed to survive.

But life is always going to be unfair, so it’s better to focus on ways to get ahead. In that spirit, here are some suggestions, which I’ve admittedly borrowed from Sokoly. Call this imitation that’s meant to be a form of flattery, because what he said makes sense.

1. Learn how to write: Like it or not, writing is part of your job in the information age. You can’t make a difference simply by knowing how to configure a NAC system or do penetration testing. You have to be able to tell colleagues, bosses and business partners what you are doing, in their language. You’ll have to do this in board presentations and in reports. And if you really want to make a difference, you can share your experience by blogging. That gets you noticed, and in many cases will get you hired.

Also see CSOonline.com’s Security Jobs board

2. Learn How to Talk: The days of a security administrator holing up in a dark room shut off from the outside world is over. You have to be able to articulate what you’re trying to do in the spoken world. This isn’t just about learning how to be a good public speaker, though that is of high value. Learning to talk means learning to speak the language of those who decide how much budget you get for security or who gets hired.

3. Learn how to dress: This might sound weird, because most practitioners will dress according to the requirements of their employer. That could mean suit and tie, business casual, or something in between. But then there are times to dress to match the crowd you are in, particularly at security conferences. Business attire won’t help you network in a crowd of hackers at ShmooCon or DEFCON. Dressing like a punk rocker won’t cut it at a more C-level event.

4. Master social networking: You can be shy as can be and still be heard thanks to the world of social networking. Set yourself up on Twitter, Facebook and LinkedIn and share what you know. If you know what you’re talking about, people will follow you, including prospective employers.

5. Learn to work with suits AND mohawks: One of the problems in security today is that the profession is split into two groups who don’t communicate well: The executive-level suit and tie CSOs working for billion-dollar corporations or high-level government agencies, and the torn jeans-wearing, ear-pierced researchers. You can see the cultural chasm clearly when you go to a conference like ShmooCon and then something like CSO Perspectives. If you work on being able to communicate and work in both crowds, your stock will rise considerably.

6. Get to conferences: This one is easier said than done, because conferences cost money that you may not have. There are ways around that. Some companies will send interns to security events to get some real-world experience. If you blog, some conferences will give you a free press pass so long as you write about the conference in your blog. Then there are events like B-Sides, which is free and ongoing around the country. These events are full of knowledge. But just as importantly, these are places to meet people. The more people you meet, the more you know, and the more you know, the better your career prospects.

None of this is scientific advice, backed up with statistics and other data. It’s my personal observation as a security journalist. I hope it helps.