I write frequently about getting into cybersecurity, or IT in general. But it’s been a while since I “Got in” to the industry myself. I sometimes wonder how applicable my advice is. I tend to focus on what I look for (at least I can be transparent about that), but maybe what I look for is way different than other hiring managers.

So this post is my caveat — I’m going to tell my story of how I “broke into” IT, and then broke into cybersecurity, and then hopefully you’ll know how much of my advice is useful, and how much is maybe specific to me.

The very beginning

In high school I was a volunteer tech support person — I knew something about computers, and I’d help the teachers. Right up until I made a CD-ROM smoke and ruined a computer. They were less interested in my services then.

But not long after that my then-girlfriend’s dad was chatting with the owner of the only computer shop in my hometown and he mentioned he was thinking of bringing someone on. I came up and next time I was visiting their house he told me to walk down and introduce myself, which I did. I was pretty transparent that I didn’t know a lot but I was eager to learn and Bill said “That’s great — I want to teach you my way of doing things, so you knowing nothing is better.”

It’s funny that I owe my career to an ex’s dad.

That’s what I did up until I served an LDS mission — I worked at that little computer store and I put together hundreds of computers and installed windows 98 so many times I could still do it in my sleep. Even when I spent the year after high school working at a machine shop (and making way more money) I still worked for Bill on the weekends and if he needed help with something big.

During that time I also got to borrow the occasional computer and do weird things like install linux, or set up a home network. I still remember the first time I got linux to boot and it was like a whole new world opened up — computers could do so much more than I was used to, and they could do it in SUCH weird ways! Why did every linux desktop at the time make the windows wobble when you moved them around? I don’t know but as a teenager I was like “How has Microsoft not caught up to the wobbling window technology that Linux has??”

Primary lesson from this phase of my life: you can do so much by just experimenting. You don’t need a class or to wait for permission, just try stuff out. Sometimes you make a computer smoke, but you know … don’t do that again.

College

I served an LDS mission, then when I got home over the summer I interned in a steel mill where my dad worked. It was so new and crazy — going through these huge buildings with giant cranes moving scrap around, the incredibly loud melt-shop that would turn the scrap into liquid metal, then pour it into billets (basically like a steel log — the raw material that would get turned into other stuff). They turned the billets into fence posts, wire, rebar. It was crazy.

I worked primarily in an isolated server room. I took a golf cart to it every morning and then rarely spoke to anyone for the rest of the day. It was my introduction to servers, hardening devices (I created a kiosk for people to check their medical benefits on which was immediately vandalized) and my very first baby step into hacking — we had to recover some passwords and I googled how to do that and then … well, did it. It was so funny to show the other IT people “Yeah, we just access this file, run ophcrack with these rainbow tables, and boom! Now I know the CEO’s password.”

After that summer I went to Utah for school and got a job working at a helpdesk run by the university.

It’s funny to look at which jobs I got that I knew someone, and which I didn’t. My first two jobs were from connections, but at college was just me sending my resume to someone and showing up for an interview. I actually wound up with three jobs in college (the helpdesk, another different helpdesk, and, kind of out of left field, working at a rehab home for teenagers) and for a brief time I did all three of them and did school full time which was … not successful.

I definitely spent the most time at the college helpdesk, though. I started as a level II agent, then I worked the night shift over one summer–

(SIDE NOTE: I worked midnight to ten AM four days a week — a schedule that left me a zombie during the day and, as a side effect, if people called me while I was sleeping I would answer and hold entire conversations and even MAKE COMMITMENTS without realizing it, until a few days later when they’d call me back and ask why I flaked)

After I got back on days I became a trainer. I made some good friends in the training department (our department was three people) and we made a curriculum to help bring level I agents up to Level II skills, which was an awesome experience.

You may be asking yourself how my college degree played into my career and it, uh … didn’t. I started with a degree in Applied Physics, then switched to Public Health, Speech Pathology, Education, I think at least two more that I’m forgetting before landing on Sociology.

I got married, I worked briefly on the helpdesk for another company, and then officially dropped out of school and tried to get one of those “real jobs” that they kept warning me about.

Primary lessons: I mean, a ton, but a big part of my personality is the idea that things can always be better. Back when I worked with Bill in high school and was learning linux I had this idea for a new computer that I thought would revolutionize the world! So I did some hunting and somehow found the email for a VP at Hewlett Packard and then pitched my idea and he politely declined. But that was just how I was, always daydreaming and thinking of how things could be better, and then always trying to tell someone about my ideas.

So that started in high school, and then continued on my mission where I regularly emailed ideas to my mission president (who indulged me with infinite patience), but at college I had a manager who was absolutely fantastic and he welcome these ideas, so I sent them with regularity. One day he called me in and said “Hey, I liked your latest idea but you know … it was six pages long. Maybe send me a bullet list or something next time.” It was so simple, but it was such good advice! Obviously this blog post is evidence that I’ve strayed from the path of brevity.

When I was a kid my dad would always say “The worst they can do is say no,” and I took that to heart. Any time I thought something could be improved I’d bring it up. Sometimes it went well, sometimes people just … really hated it. But I’m really grateful for those managers who have taken the time to listen to my ideas, and I try to be that kind of manager myself.

Anyway, the point is, part of my personality is this attitude that says “Sure, things are good, but we can always improve them. What can I do better? What could be better? How could I do more?” I don’t know if other people are like this, honestly, but it drives me to always try to learn more and do more. At the same time, it means I’m never satisfied with what I’ve done. I look back on my career with the knowledge I have now and can’t help but think “Man, I could’ve done all that so much better, if only I’d worked harder back then to learn as much as I know now!” Which doesn’t make sense and isn’t possible.

It’s an attitude that drives me to do more, and also makes me perpetually dissatisfied with my efforts. I’ve gotten better at coping with the dissatisfaction, but it still is just … a thing I deal with.

The point is, I attribute a lot of my career success to that desire to improve systems — to not just doing the work, but trying to make the work itself better. I also attribute a lot of my stress to that desire. It cuts both ways.

My first “Real Job”

One of my trainer friends got a job working at a non-profit and, shortly after, he invited me to apply. So far we’re about 50/50 with jobs I’ve gotten without connections vs. jobs I’ve gotten with connections.

I was a good fit for the job because of something that had happened in college. See, our organization used sharepoint, but most of the technicians hated it. It’s kind of ugly, kind of a pain to use, kind of complicated. Like a lot of Microsoft products it is a Frankenstein’s monster that is constantly acquiring body parts with every release.

Because we were trainers we had to learn every tool, and I took the time to make sure I understood Sharepoint so that we could train effectively. Having that knowledge made me a good candidate for the job because so few people had even that very basic knowledge. I learned that doing something no one else wants to do, but is important, can open doors.

I worked on the Sharepoint team as a jr. engineer. When we started it was a fairly small environment (maybe 20 servers in the farm between dev, stage and prod environments), but not long after we got settled they hired a rockstar sharepoint evangelist to help, just, really take our usage up to 11. Or whatever.

And that’s what he did. Which meant our small farm went from 20 servers to something like 100 in the course of a few months.

There was way more work, and my friend and I were falling behind so we surveyed our time to figure out what we were spending it on. There were two big things — tickets from the helpdesk, and deploying code to the different environments.

As we reviewed the tickets we noticed that most of them could’ve been solved by the helpdesk, they just didn’t know how. It wasn’t a rights issue, it was a knowledge issue. So we decided to go to the helpdesk and train them on sharepoint. Once a month we’d head to their office, bring donuts, and give a training about an aspect of sharepoint. The escalated tickets almost disappeared after just a few months.

Next we had to deal with the deployments. When looking at different options I realized I could write a script to do most of the work in powershell (everyone’s least favorite scripting language — again, volunteering for work no one else wanted to do). I pitched a new program that would automate deployments between all our environments. I knew we were too busy to build it on the clock, so I pitched my manager (and then his manager) on building it myself in my off hours and using it with our environment, with the understanding that I could then sell it myself to other orgs.

They agreed, I got to work coding for many late nights over the coming weeks. Eventually we got close to release time and my manager’s manager informed me that I would not be able to sell it.

This was a blow because the reason I cooked up this whole “sell the program” scheme was because they’d cancelled raises that year, and my family really needed a raise. So … I started applying for other work, and I left the work I’d finished to that point on the script with another engineer (I don’t think they ever did anything with it).

Primary lessons: I already mentioned “Get good at something that is important that other people don’t like.” The second lesson is “always get stuff in writing.” And the third is that sometimes you just need to move on. I am in general a pretty loyal person, and I like to invest in an organization — to feel like I’m contributing something important of myself.

Which is fine, except organizations aren’t like people. They make decisions at a great distance from the people who feel the consequences. I’m sure my boss understood that I was underpaid for my role, and that I was in need of some financial assistance (my wife was sick and having a hard time working). But the “no raises” edict came from several levels above him.

Even still, I tried to stay loyal and created what I thought was a win-win solution, where the org got something unique, and I got the money that my family needed. Again, the decision to go back on that deal wasn’t from my boss, it was a level above him — someone who didn’t have many interactions with me. Someone for whom that decision was much easier than it would’ve been for my boss, who knew my situation.

What’s funny now thinking about it is that I left only when I’d exhausted all other options to stay — but I was the one exhausting options! It had been one sided. And if you think about it, I could’ve left months earlier and gotten the raise I needed right away, but I didn’t because …

Because I like to feel like I’m uniquely valued, and when you move on and everyone is fine with it you realize you aren’t that special. To use a cliche, you realize you’re just a cog.

What’s funny is the realization that I was a cog was devastating then, but would end up being empowering later in my career. I’ll get to that shortly.

My second (and current) real job

I landed another job as a sharepoint engineer with my current org, with a … 15 or 20k raise from what I’d been making before. It was enough to get us out of trouble, and I was very grateful for it.

I don’t want to talk too much about my current job because, well, I’ve talked about it before, and I still work there so you know …

But when I say “Current job” it probably gives the wrong impression. Let’s go through my titles with a brief description of them:

• Sharepoint Engineer — I built out sharepoint farm out in a couple of months, got it running and then … had nothing to do! I do good work and it didn’t need more than routine maintenance.
• System Administrator — When I told my boss I had time he got me to work on other systems like active directory, exchange, ironport, etc. I learned a ton about these other systems, and my powershell knowledge really came in handy!
• Developer — I was asked to build an app on top of sharepoint and worked on it for one month, but I wasn’t a programmer so it sucked. I mean, I delivered a (barely) working program, but it never got used because it was awful. Good learning experience, though.
• System administrator — back to system administration. I focused on a few of the smaller systems that were just used by a couple of the divisions within the org and became good at those. That led to my next opportunity
• Director of IT — they split the IT department up and, because I was the person who knew the most about the systems at one division, they put me in charge of the IT team there. Once again learning something other people hate pays off for me. Sort of. It was a rough experience, but I’ve written about it before (see the note about this position at the end of this list, though)
• Director of Strategic Solutions — kind of a one-man IT kaizen project squad, thing. Tasked with seeing how we could use technology better.
• Director of Development — I mentioned I’m not a developer, but I was put in charge of a development team and wound up enjoying that a lot, and because no one on the team liked to design stuff I picked up UX and did basic designs in Figma. I’m a broken record, but finding the thing people hated it and getting good (or at least doing it) pays off again.
• VP of Cybersecurity — I’ll get in depth here in a second.

OK, so remember the whole thing about being a cog being both devastating and liberating? It was devastating after my one experience, but as Director of IT it was liberating.

See, I was in a position that I had no idea how to do and I was spending my time trying to do everything I assumed other people wanted me to do — but those people didn’t work in technology, didn’t know the team, and probably didn’t actually know the best way to spend our efforts.

After some soul searching I realized that I had to do the best that I knew how. I was going to learn to be the best manager I could, and manage things that way I thought they should be managed and, if I didn’t do the job they wanted well … okay. They could fire me. They would be fine because I was a cog, and they could find anyone to do the crappy job I’d been doing up until that point. But I didn’t want to do the crappy job something else defined for me — I wanted to do the job that I knew needed to be done.

I got out of my head, basically. And more than that, I realized that I’m not a cog for my family. That’s the only group where I definitely DO bring something unique and valuable. I’m a husband. I’m a father. No one else does those things exactly as I do them, and I wasn’t going to let my cog status in my professional life turn me into a cog in my personal life.

The point is, I just needed to do my best work and if it didn’t fit them that was fine. I could be replaced. And I could go somewhere else. The company would be fine and I would be fine, so why not do the best I could?

Breaking into Cybersecurity

As Director of IT, we were undergoing a PCI audit and we didn’t have anyone with cybersecurity experience, and no one really wanted to learn it.

This will shock you, I’m sure, but I saw something no one else wanted to do, and did it. I learned PCI. Finished the audit. Got my CISSP and then … did a bunch of other stuff, but kept up-to-date on cybersecurity. I volunteered to help write policy when the need arose (another thing everyone hates). When the role I’m currently in came up I re-upped my CISSP, got my CISM and started working on a degree in cybersecurity which I would finish just a few months after I got the job.

So I didn’t break into Cyber the same way most people do. I worked with one organization, did a bunch of different stuff and got a reputation as a capable person, and when the opportunity came up I pounced on it. Most people aren’t “breaking into” cyber with 8 years with one org and 20 years in IT overall.

But as I’ve reflected I think a few things stand out:

• Get good at important stuff no one else wants to do and you’ll always be in demand
• I never had a specific goal, I just tried to do my job the best I could, and by building skills to do one job better I naturally built skills to do other jobs
• Things can always be better

The man, the myth

We mythologize our own stories. We look back and like to see each decision as a stepping stone to greatness. We allow our hindsight to masquerade as foresight in our memories. We assume we are more active in our success and that our failures were the results of others.

And I’m as much guilty of that as anyone. As I went through my history I can’t help but couch it all in the language of the hero, if that makes sense. Even a pretty normal hero.

But really … but really …

I don’t want to give myself too much credit or too little. I work hard. But when I remember my managers I have been just … so incredibly fortunate. I’ve worked for about 90% amazing managers and 5% meh and 5% bad. I mean, even starting with Bill, who managed just me in that tiny store in my hometown. He took the time to talk to me and teach me, when I wanted to borrow a computer to install linux he let me. How rare is that? Someone who listens, who shares their knowledge completely unselfishly, who allows you to pursue your interests and grow as a person.

Luckily for me that manager actually hasn’t been that rare — it’s been most of my managers. And that does feel very lucky. It feels like I could’ve run into a manager who just beat the “suggest new ways of doing things” out of me. But I continuously ran into the opposite kind of manager and that’s probably one of the biggest contributors to my success.