You want it all. You can see the brass ring and you want to jump for it. But you're scared. You don't want to put on a suit and watch your soul shrivel like the spot price on RAM. There is another way. In this session, you will learn: why you want to do this to yourself, how to get the first job (which will suck), how to turn the first job into the next job (while still having fun), how to get the top job (sooner than you thought you could), and how to do it all without feeling like a corporate whore. You want to hack the planet? You've got to start somewhere.

1. From a Black Hat to a
Black Suit
How to climb the corporate security
ladder without losing your soul.
~Myrcurial

2. Disclaimer:
I am employed, but do not speak
for my employer as my
employer seems to like to
speak for me and wouldn’t
appreciate any opinion which I
held which was not given to me
by them.

3. I am a suit.

4. I know – you can hardly tell.

5. I wasn’t always a suit.

6. I wasn’t always a suit.
I used to be an artist.

7. I wasn’t always a suit.
I used to be an artist.
I had dreams.

8. I wasn’t always a suit.
I used to be an artist.
I had dreams.
I was counter-culture.

9. Now I commute.

10. Now I commute.
I read the business section.

11. Now I commute.
I read the business section.
I’m at my desk by 8.

12. Now I commute.
I read the business section.
I’m at my desk by 8.
You can be just like me.

13. Seriously.

14. Seriously.
You’d be surprised how
interesting it can be.

15. How easily you can keep yourself
out of an executive position
forever.

16. And how much easier it can be
to get into that elusive
exclusive club.

17. And how much easier it can be
to get into that elusive
exclusive club.
The CISO.

18. What do you want out of life?

19. What do you want out of life?
Do you want 40 hour weeks?

20. What do you want out of life?
Do you want 40 hour weeks?
What about 60 hour weeks?

21. What do you want out of life?
Do you want 40 hour weeks?
What about 60 hour weeks?
How does 80 hours feel?

22. Do you want to never be…

23. Do you want to never be…
On call?

24. Do you want to never be…
On call?
Where the buck stops?

25. Do you want to never be…
On call?
Where the buck stops?
Sleepless?

26. Your answers basically define
your ability to get (or keep) a
job in the corporate infosec
world.

27. You will be trapped between:
¤ Boredom
¤ Terror

28. You’ll have weeks when:
¤ Finding 30 hours of work is
work
¤ 80 hours isn’t nearly enough

29. You’ll be:
¤ Updating documentation
¤ Hunting for lost tapes
¤ Cleaning up after other people
¤ Underappreciated

30. Do you have what it takes to
scramble all the way to the
top?

31. Are you willing to stand up for
your ethics?

32. Are you willing to stand up for
your ethics?
Do you have ethics?

33. STEP ONE:
Getting the first real security job.

34. Probably as hard – or harder -
than getting the last job.

35. Get your cred together.
¤ Resume
¤ Blog
¤ Google results
¤ Actual skill

36. Don’t forget about keyword
filtering.

37. Don’t forget about keyword
filtering.
And never lie on your resume.

38. Pay your dues.

39. Pay your dues.
Long hours.

40. Pay your dues.
Long hours.
Boring work.

41. Pay your dues.
Long hours.
Boring work.
Log review and metrics.

42. Pay your dues.
Long hours.
Boring work.
Log review and metrics.
Doing it the SANS way.

43. You’re here to survive.

44. You’re here to survive.
Build the resume.

45. You’re here to survive.
Build the resume.
Get involved.

46. You’re here to survive.
Build the resume.
Get involved.
Be a generalist.

47. Don’t be afraid of job hopping.

48. Don’t be afraid of job hopping.
Stay at least 1 year.

49. Don’t be afraid of job hopping.
Stay at least 1 year.
Big company.

50. Don’t be afraid of job hopping.
Stay at least 1 year.
Big company.
Small company.

51. Don’t be afraid of job hopping.
Stay at least 1 year.
Big company.
Small company.
Public sector.

52. Work on your non-technical
skills.

53. Work on your non-technical
skills.
Persuasion.

54. Work on your non-technical
skills.
Persuasion.
Likeability.

55. Work on your non-technical
skills.
Persuasion.
Likeability.
Cooperation.

56. STEP TWO:
Getting the first real
management job.

57. Hey, hey!
You’re a team leader now!

58. Can you lead the team?

59. Can you lead the team?
Run interference.

60. Can you lead the team?
Run interference.
Maintain your skills.

61. Can you lead the team?
Run interference.
Maintain your skills.
File your personnel reports.

62. Infosec has very little to do with
technology…

63. Infosec has very little to do with
technology…
… and everything to do
with people.

64. Are you ready to give up hacking
the machines?

65. Are you ready to give up hacking
the machines?
Are you ready to start hacking
the people?

66. How do you feel about
organizational politics?

67. How do you feel about
organizational politics?
Work with the HR people.

68. How do you feel about
organizational politics?
Work with the HR people.
Manage the budget.

69. How do you feel about
organizational politics?
Work with the HR people.
Manage the budget.
Get along with the machine.

70. Welcome to the 6th level of hell.

71. Welcome to the 6th level of hell.
It’s ok though.

72. Welcome to the 6th level of hell.
It’s ok though.
Really.

73. You’re building a reputation.

74. You’re building a reputation.
You get things done.

75. You’re building a reputation.
You get things done.
You know your material cold.

76. You’re building a reputation.
You get things done.
You know your material cold.
You’re a people person.

77. You’re building a reputation.
You get things done.
You know your material cold.
You’re a people person.
You know people who know
people.

78. STEP THREE:
Getting the first real executive
interaction job.

79. Clean up your language.

80. Clean up your language.
You’re on parade now.

81. I know you hate these soul-less
bastards.

82. I know you hate these soul-less
bastards.
They don’t like you very much
either.

83. Resist the urge to go over to the
dark side…
… go on Luke, I know you
can resist…

84. Speak their language.

85. Speak their language.
Articulate risks.

86. Speak their language.
Articulate risks.
Understand tolerance of risk.

87. Speak their language.
Articulate risks.
Understand tolerance of risk.
Bridge your experience with
theirs.

88. Consider taking some business
courses.

89. Consider taking some business
courses.
Deal with the fact that you spend
your time with guys named
“Chet”.

90. Dress their way.

91. Dress their way.
Jokes on t-shirts are out.

92. Dress their way.
Jokes on t-shirts are out.
Business casual is a little too
casual.

93. Dress their way.
Jokes on t-shirts are out.
Business casual is a little too
casual.
Put the damn suit on already.

94. Reality smack time.

95. Reality smack time.
People will only listen to those
who appear to be
knowledgeable.

96. Reality smack time.
People will only listen to those
who appear to be
knowledgeable.
You’re wearing your knowledge.

97. You are under cover.

98. You are under cover.
They cannot know they’ve been
infiltrated.

99. You are under cover.
They cannot know they’ve been
infiltrated.
They do not understand you.

100. You are under cover.
They cannot know they’ve been
infiltrated.
They do not understand you.
They do not want to understand
you.

101. STEP FOUR:
Maintain your soul.

102. Feed your inner hacker.

103. Feed your inner hacker.
The $50 RFID kit looks pretty
cheap from $100 an hour.

104. Feed your inner hacker.
The $50 RFID kit looks pretty
cheap from $100 an hour.
Adopt early.

105. Get the company to pick up your
conference tab.

106. Get the company to pick up your
conference tab.
Go early. Go often.

107. Play.

108. Play.
Hack.

109. Play.
Hack.
Live.

110. STEP FIVE:
Avoid the traps.

111. They will try to get to you.

112. They will try to get to you.
Passive aggression.

113. They will try to get to you.
Passive aggression.
The dork treatment.

114. They will try to get to you.
Passive aggression.
The dork treatment.
Matrix management.

115. You may find yourself wanting to
be like them.

116. You may find yourself wanting to
be like them.
And you’re ok with that.

117. You may find yourself wanting to
be like them.
And you’re ok with that.
I can’t help you. Please go enjoy
the pool and a refreshment.

118. Maintain your contacts.

119. Maintain your contacts.
Don’t be forgettable.

120. Maintain your contacts.
Don’t be forgettable.
Don’t be a jerk either.

121. Maintain your contacts.
Don’t be forgettable.
Don’t be a jerk either.
Get on the facespace.

122. Choose your ‘professional
association’ carefully.

123. Choose your ‘professional
association’ carefully.
I’ve found too many…

124. Choose your ‘professional
association’ carefully.
I’ve found too many…
… issues.

125. Mentor the new people – those
who are back at STEP ONE.

126. Mentor the new people – those
who are back at STEP ONE.
Even if you are busy.

127. Mentor the new people – those
who are back at STEP ONE.
Even if you are busy.
Take the time.

128. STEP SIX:
Arrival.

129. You’re probably ready for the
C-Suite at this point.

130. You’ve built a reputation.

131. You’ve built a reputation.
You’ve created an opening.

132. You’ve built a reputation.
You’ve created an opening.
Write yourself a ticket.

133. The CISO job is not well
articulated in most
organizations.

134. The CISO job is not well
articulated in most
organizations.
Change an organization.

135. Then do it again.

136. Take over the world.

137. Send me a nice post card.

138. Questions and Answers.
Email:
myrcurial@liquidmatrix.org