Latest / Career Catalyst / Ep. 6 Cyrus Tibbs : Cybersecurity is a Lifestyle

Transcript

Ep. 6 Cyrus Tibbs : Cybersecurity is a Lifestyle · Career Catalyst

• Rory: everybody. everybody, I'm Rory Devine, this is the Career Catalyst Podcast. Today our guest is Cyrus Tibbs. He is someone that I've known for years. ⁓ Locally, I worked with him ⁓ back towards the beginning of his career, and as he's kind of grown and evolved into the person he is today, we thought he'd be a great addition to the Career Catalyst family. So again, if you're checking in on this, we have a YouTube channel at Career Catalyst Podcast on YouTube. You can find us at the Career Catalyst Podcast on Instagram, and also on Apple at the Career Catalyst Podcast on anywhere for audio. So thank you so much, and Cyrus, thank you for coming. Awesome, it's great to be here. I'm happy to be here talking about careers. ⁓ Yeah, and a rare in-person pod, so thank you. And then with us as always is our fearless producer and co-host, the mayor, Derek. He actually was at a event for work and came over to set up everything, so I just wanna say thank you very much for that, Derek. You are one in a million. Really appreciate it. Yes. So why we wanted to have you on besides, you know, ⁓ knowing you for a long time and seeing your evolution of your career, ⁓ I think you somewhat follow a traditional career trajectory to a point and then it kind of really hockey sticks up as they say. So I'm kind of interested for people now who don't know you, can you tell us what your job title is and ⁓ where you work? I don't No. Sure, so presently I'm the Chief Information Security Officer at Penny Mac Financial Services. However, I'll be leaving there in a week and I'm starting as the Chief Information Security Officer for First American Finance on June 1st. Congratulations. It's my second CISO job, yes. ⁓ Congratulations. So we got you in the transition, which is amazing. So this podcast is really for people entering the tech market right now, emerging workforce in the 1920s. So although data is the most significant major right now across the country, up 900%, I would tell you that cybersecurity is up 23 % across the country. So there is a huge demand. They see the demand for security right now. Personally, in my employee and what I do for a living, everyone's talking about data and AI projects, but putting So there is. money where your mouth is, most of the stuff is cloud security or AI governance and guardrails. So you are in kind of a sweet spot right now and in demand. Yeah, I would see it as like a derivative of that because like cybersecurity really is just a it's an application of data science. And so like with the explosion of data, and the number of platforms you have to support and cloud and third party integrations, ⁓ I still always think that like, when I first started in cybersecurity, I was like, is this really going to last as a career, but it keeps getting larger and crazier and more difficult. And, ⁓ you know, the it's important to memorize the the principles but the methods are many, many, these days. it's, especially now with AI coming around everything, I think it's gonna be a big, big change. So I keep seeing the demand growing. Yeah, I agree. And I think the undergraduate workforce sees that as well, which is why you're seeing the up-pitch in cybersecurity. I think a few years ago, from my staffing point of view, the people who were kind of willing to do the work would go into the cybersecurity because it was always available. I think a lot of people were always chasing maybe sexier positions in the industry, but now they're realizing that this is steady and it's growing and it's becoming more prevalent. Yeah. It's definitely not the sexy part of the business. So if you're looking for the sexy part of tech, I don't think cyber is that it's more of you're kind of more of the security office back office kind of kind of role. And I, know, it's also tough as a first job, I think, you know, I think there's a big debate in cyber around whether or not it's like a good entry level path. I mean, there's lots of these like boot camps that are out there and they promise you to go, come take a cyber security boot camp and you'll get a job right away. But I really don't at the first entry, there was only a couple of ways. in at the beginning level. Most people I think who really do well in cyber really move up a lot, start somewhere else. And I actually would personally, your mileage may vary and people have different experiences, but I would recommend to people to do something else first. be a developer first, go do like cloud engineering or DevOps first, or do some data science first. Some of the best hires I make in my teams are me finding people who have never had any cyber experience at all, but they're really good at some other area and then saying, I can just, you learn the cyber kind of subject matter expertise, all your technical background is actually more important. So I mean, I took that path. started as ⁓ in the, if we're going to go back to 1998 is when I started my career, right when I was in high school. So I did the MCSE, Microsoft Certified Systems Engineer, the Certified Network Associate, Linux Plus, A Plus, Net Plus. I took that whole path of like all, that was the big thing in the 90s. Everybody did certifications and... ⁓ yeah. Back then, think the demand was so high that you get a certification, you would get a job. They would train you on the job. don't know if it's like that as much anymore, ⁓ but I started there and I started doing ⁓ Microsoft desktop administration, and then I moved into server administration, the network administration, and I actually never really ⁓ thought about getting into security. I kind of fell into it in a second job. started when I grew up in the D.C. area, so was working in the Pentagon on the Office of Secretary of Defense. But that was not a defense position. No, I wasn't like I wasn't ever like in the military. I was always a contractor. I worked for like Booz Allen and smaller boutique companies that probably got bought by Raytheon or the larger ones now. But I started doing just, ⁓ you know, data center administration. Right. and server administration, email administration, and then this was probably circa 2002 was when BlackBerry first came out. And so some of the higher ups in the Pentagon wanted BlackBerrys and nobody wanted to do this project because I was one of the younger guys. That's like 1920 at the time. They kind of foisted this on me to go do it. And then ⁓ as I was giving BlackBerrys out, the first question I would get asked from everybody was, how do I know this thing is secure? Because it wasn't even a phone. It was just like a black and white email device. So then I had to go learn all the encryption and learn everything about security. And then I kind of got branded. security guy kind of 2001 2002 and then I started getting asked to go join on security focused projects and I think that's when it really so wasn't even like cyber security wasn't even a kind of a real term at that point I actually hated the term cyber security when it first came out because it reminded me of like cyber and like cyber used to be associated with like online chat more yeah those kind of kind of yeah those kind of chats so I never liked that term initially but now I think it's it's Sure, the AIM fams, yeah, who could forget those? Yeah, of course. become part of the lexicon. Yes, become part of the lexicon now. Let's move past the stigma. So what I'm hearing is you were younger. Did you have a ⁓ computer science major? Did you have anything in the technology side when you were in school? No, I ⁓ was doing college at nighttime. ⁓ So I got recruited from my high school to do, once I got my MCSE and I was in a network administration class in my high school and it was actually such a breeze for me that the teacher hooked me up with ⁓ some recruiters and I got recruited to work and I was like, I'd rather just work full time. And I did college ⁓ at night over like 10 years. Wow. ⁓ wow, okay. Yeah, so I finished, I did what was ⁓ called decision sciences, which is what people would call data science now. it was like, it's not as cool, not as cool. I did that at nighttime. So I just basically worked in government space for a long time. And I did a lot of the kind of consulting type work, which was cool. I think what I learned in that space was I got to learn to be in different organizations all the time. So I would work in Decision science doesn't sound as good. Definitely not. No. know, one, I work at a military base one day, the Federal Reserve the next couple of months. So I was always in like different kinds of organizations. So I'd always have to adapt at different places. I think that's been, that was, you know, really valuable for me to have that kind of experience. And the exposure to how different industries and companies and ⁓ branches of the government are run is awesome. So that's really invaluable. Yeah, absolutely. mean, there's a lot of time people say, the government is always slow or something. But it's like, I've seen private sector companies that are worse than government organizations. And so it's not always the case. But when you're in the defense side of things, you're really working in sort of like, ⁓ you know, gold plated type security places. ⁓ you know, at that time it was a really kind of the first initial rush into all of these things. And then I had, I think probably the where I really kind of solidified myself as like a cyber person would be when I was working at Booz Allen. I wrote two NIST publications that are deprecated now, but it was NIST 848 and then 801 27 I think it is. Valuable in the moment though, deprecated. It was back when wireless networks didn't have the latest security they have now, and they were very easy to break into wireless networks. So there was this time in the early 2000s, you remember, everyone was like, wireless is not secure. And so then there were all these projects to do like, know, encryption overlays on insecure wireless. And so I wrote two publications on that. think that really were, that's probably the first big catalyst in my career. So once I wrote those. Wasn't that the Blackberry fad was because I think the BBM code was a secure link to another device, right? Yeah. They were, they did this, they did the encryption, right? Right. And so when I learned the Blackberry encryption, kind of said, ⁓ okay. Well then there were other, you know, that, prepared me for all of these projects to, to fix wireless networks. So basically, you know, there are all these, you know, military organizations and government organizations that had wireless networks and they realized they could be, you know, broken into very easily. ⁓ So I had pretty good bread and butter for about three, four years, just going to different places and just upgrading the security on wireless networks. ⁓ I did that for a while and I ⁓ ended up in Los Angeles when I had a contract with ⁓ Homeland Security to do, I was doing security gap fits for various utilities around the country, like all the major utility players. And when I came to ⁓ Edison, ⁓ I proposed a program to them to kind of really upgrade their security and make a big investment in their cybersecurity. And then they offered me a job to come work here. So I ended up doing that. And that's probably when I switched from the consulting world, which again, the consulting world is great. I mean, I would highly recommend it. I think people who are just getting out of school, working at a large consulting firm is a great place to go. I'd say, you know, they have really good training programs. They have great entry level programs. ⁓ You know, they'll put you, you'll get a lot of wide different experience. You'll be exposed to people who are much more senior than you. And they're usually the large organizations. I worked for Accenture for a stint and. you know, it's hundreds of thousands of people. So there's all kinds of stuff you get exposed to and all kinds of knowledge systems you get exposed to. So I think that's a, I'm really glad I did that at first. But then when I went to Edison, that's when I really switched to like actually, you know, okay, now I'm not on an SOW contract. working, I have a mission here to work for this. Exactly. you were a stakeholder at the company you work at. At that point, that where you would say that you were, because you said other people viewed you as a security person and you kind of fell into it, which I also have heard that most of the time for security people, fall into it. When did you start seeing yourself as a security person as opposed to everyone else kind of putting it on you? Yeah, I think it was sort of, know, Booz Allen is really when I did that, when I first started seeing myself that way, I really kind of leaned into it and said, I'm going to be a wireless security specialist. I started being a wireless security specialist. And I think, think when I went to Edison, I switched more into being an architect, which is kind of more of like a systems engineer focus. And that's when I think that was when I switched from, that's when I think in Edison's, when I realized I wanted to do more than be just an individual contributor. I was in my entire time at us, I was an individual contributor. and I was doing risk analysis and rewriting all the policies and then helping run some of the enterprise projects for information security. As an individual contributor, I started getting to the point where I realized that I was having influence in other people and it was becoming more about being the steady vision and execution management and coaching others ⁓ was more what I was getting more satisfaction out of that than actually kind of like... digging deep into the security world. so then I kind of, you know, that's when I wanted to pivot more into management kind of role. Yeah, I've seen you do, you spoke at the InfraGuard event and even with a couple of Wi-Fi snafus, no shade to Derek and his wonderful staff, he did really well. But yeah, I've known you for over 10 years now and I believe one of the reasons people gravitate to you is that you identify things as obvious to you when they are simply not to the way I would say the gen pop. So yeah, then you know, you should do this and then you just, I'm laughing, I'm like, I don't think anyone's following this train nearly as quickly as you or is even on the same track. So. you That's always been a challenge. It's always been a challenge. guess. Yeah. You know, I kind of never see myself as like, ⁓ like knowing a lot of things. I always want to, I always try to stay curious about things. So I always want to ask, I ask lots of questions. I always tell people, if you're looking at me time, I'll ask, I'll just ask you questions until death, until you, until I stop. ⁓ But, ⁓ is a powerful through line in this podcast. All the people who have made it to certain points in their career have stayed curious throughout. So that's good to hear. I mean, that was really the thing I realized is that when I was an architect at Edison, I Edison's huge, right? You're talking about, I don't know, 800,000, million systems, probably all different kinds of systems, all kinds of different challenges. And you realize that it becomes less about, I know the technicals of every single one of these problems? And more about, okay, who are all the people that know these things? And how do I ask them the right, know, expose the right principles about what's happening in this? world to help kind of take their ideas and coalesce them in a way to create a vision for fixing that problem or enhancing that security problem. And I realized that that was kind of a more impactful thing to do. It wasn't so much about my technical skill anymore, it was more about me being the catalyst to coalesce other people's technical skills to solve a problem, but then also kind of understand, you know, my job was sort of measure the outcomes, make sure we're getting to where we need to go and then kind of reporting on that. And that really pushed me more into wanting to be into the management layer. know, Edison is a great company to work for, again, another great cyber program, but there wasn't really a management role available for me there. And so I sought out a management role at ⁓ City National Bank following that afterwards, and they wanted me to build out their security operations center. And that was pretty cool. That was a fun experience. I was kind of switching from. ⁓ the defense space to the utility space now to kind of financial services, which is kind of where I'm finding a home. I've always kind of been interested in finance just personally. think money's fascinating. ⁓ But working at State National Bank, we built out their security operations center, ⁓ did that for about two or three years. And that was a cool experience to kind of start that from scratch. Yeah, you were over there. Mm-hmm. And that's when we met, because I was working there. So from the backtrack to the industry hopping thing, so were you chasing a title there, or were you trying to expose yourself to as many different industries as you were going? it was like, you know, was a, more of I wanted to move into management. I wanted to manage people. I like people. think I'm like most tech people aren't known for liking people, but I actually really like people in general. ⁓ I like most people. And so I kind of realized, okay, I'm actually good at, you know, helping setting a vision and getting people to understand like what's in it for them and building a strategy people can buy into and coaching and feedback. And I really kind of get into more to leadership side of things. And I really wanted to, I kind of felt that when I was at SM then. was like, okay, this is something else I think I'm good at. And I realized I can be effective like this. So I think it wasn't really chasing a title as much as like, I want to be in a place where I can grow that skill, grow leadership skill, right? Yeah, I recall when we first started working together, some managers just give like, here's a list of requirements. I was an account manager at City National. You would be like 30,000 foot view, 20,010. This is why this is important. This is why I need that. And I remember walking out of there thinking like, that was more than enough time. He didn't need to give me that. I could have gotten like top three tech stack or whatever priority you need. And you really took the time. So I think that's good to identify yourself. know, management isn't. You were feeling. fucking out of Right, right. for everybody. So I think if you can identify that within yourself and self-awareness is always superpower and that with your career, I think that's important for everyone to know. Absolutely. Yeah, I gravitate toward ⁓ servant leadership is my style. I really like ⁓ you know, each individual person is showing up to work for a different reason. And, you know, some people are, you know, they really love the technical side of it. Some people are just doing a job. Some people have different motivations for what they want to do. So I'd like to kind of understand what drives people and kind of meet them where they're at and try to figure out a way to connect. where they wanna go in their career and what they're trying to accomplish with what the mission of the company is and the mission of the program is. ⁓ And I really enjoy just watching people grow because there have been some folks in my career where ⁓ I just give them kind of a simple, this is the outcome we're trying to achieve. ⁓ just with regular coaching two, three times a month, just to kind of keep the guardrails in place. They've grown tremendously and it's super satisfying because you can really multiply that effect. You kind of help people, you know, feel motivated in what they want to do and driving that. if I see it now as my job to, you know, I set a vision for the program, make sure the vision aligns to the company business vision, because, you know, the, you know, if you're doing cybersecurity for the power grid, that's very different than cybersecurity at a bank, which is very different than any other organization. So you got to understand the business you're working in. align those visions, then you got to build a strategy that's something that's achievable, also kind of exploring the edges of what everybody find, find the look at the team you have the team you're going to hire and then explore the edges of what they can achieve. And, ⁓ you know, set a strategy that's realistic, but also measurable. And it's not so much about achieving the outcome, but setting up regular, you know, ⁓ conversation points. So your people are everybody has having a conversation everyone it's more about are we having a strategy that's driving the right conversations that we're all driving the right program and then setting up, you know, coaching and feedback. Everybody like I make it a point of ⁓ any team I'll own no matter how big and I don't know maybe maybe maybe I'll scale out of this one day, but I haven't haven't yet. ⁓ But I make a point of making sure that I'm available to speak to everybody and talk to everybody to every level of the organization because that's really really important to understand. You got to understand what someone's experiencing at the front line to really understand like is your strategy going. Yeah, mean, feedback loop on the defense side is really, or cyber side is really important there. So that's, that's valuable. Uh, that's, that's great. then moving into, so I know that one of the funnier things I remember, I think it might've been Carl at the time and to see, so he said, you know, this is a domestic bank. So anytime we get an attack internationally, it's pretty easy to identify. then I I think a Toronto based bank bought you guys within like a month after that. I'm like, well, that's going to change, you know? And I think I remember laughing about, like, he really kind of put that out there and a guy came back and, Yeah. Yeah. Yeah. So then ⁓ he moved over to Penny Mac, right? Is that what the next step was? So then you had a great time, you built the sock out. Yeah. Well, I had one little stint at city national when city national went to the cloud, went to office 365 and Azure, they moved me over to do enterprise engineering for a while. It's like, I got a taste of infrastructure for a little while again. I think I was just really engaged in the infrastructure teams on some security work. And so they kind of understood that. ⁓ that's right. I could help there. So they put me in that role. So I did that for a stint. But then I was like, no, I really don't want to be in infrastructure operations. So like after three years, then the RBC bought CNB. then I was like, don't want to be in this. Basically, my job was going to be doing like infrastructure integration to the mothership for three. And I was like, that's not, it's kind not what I wanted to do. So then when Carl went to Penny Mac, he was the CISO at Penny Mac. And ⁓ he wanted to bring me over as deputy CISO. and to basically go over there and run the incident response operations, the vulnerability management, attack service management, data security, all the kind of core cyber stuff. And I was like, that's great. I was like, you get to go be a CISO and you can deal with the budgets and the executive stuff and I'll get to do all the cool, fun cyber stuff and I'll bring my team, we'll build everything over there. Right. And then that was going great. And I was really enjoying it. Brought my whole team over, but everybody I knew was a, was. Do remember the transfer to Penny Mac for sure. That was a real turnover there. Yeah, yeah. You wasn't, you, you know, got to people the opportunities they're looking for. Right. And we went over to Penny Mac, then about close to a year in Carl found a great opportunity. He wanted to go explore. And so then I was kind of poised with the question. was like, well, do you want to have a new sister come in or do you want to move up into the role? Cause we like you and we think you could move up to this role and be successful. Mm-hmm. And so, you know, I was like, okay, well, I don't want to get a new CISO that I don't know and they want to bring their people or something and that might change my dynamic. okay, I'll try. My team had just come over. We just, was super excited. mean, Penny Mac's a great company to work for. They were really, really supportive of my career. I have nothing but good things to say about them. And... Your team had just come over as well, so you're probably looking after them as well. They gave me the opportunity. were like, we think that you can do this. And they gave me the chance to do that. And it was Leora O'Fear who gave me that first chance to do that. So you always got to remember the people that believe in you. I think that first step into CISO, never really thought I would ever get to that role. I always thought that was a role you get to because either you know somebody or somebody trusts you or you have some other kind of way into it. And I bet if you talked to 10 CISOs, you'd have 10 different stories about how they ended up in the role. Some people come from an audit background, some people come from a legal background, ⁓ some people have a risk background. I had a technical background and the CISO job will look different at different organizations based on how they envision it. But at Penny Mac, it was definitely ⁓ the need for a technical CISO and so I took over that role and that was a huge step up because now it's like I'm the guy now. ⁓ Definitely. Right. That's a big jump. And you were 37, right? I was 37 when I became so yeah, 37 years old. Yeah, 43 now. Yeah, that's an accomplishment. I mean, that doesn't, it's funny because I feel like one of the last. funny. pieces of ⁓ for careers purposes, ⁓ cybersecurity has the most clearly defined path of career trajectory. I think everything else is kind of eroding at this point. But this, to go from where you were, ⁓ running the SOC and going back into infrastructure and then making the leap over to deputy CISO, I think once you get to the top, like you mentioned, the CISO piece is how everyone makes that final leap is different, but I think the trajectory forward. So for someone who's getting into security right now. Right. There is a clear defined path almost all the way until the top and then something like this has happened. That's why I always think it's so interesting. Yeah, I think the biggest change for me was around, you know, it's a trust job. it's like you could see, see, it's sort of like you're handling cyber risk, you're handling external trust and internal trust. Right? So external trust is all the, you know, every, especially financial services, all the ratings agencies or people who invest in you or your third party partners, they're all assessing you. sometimes I would feel like a, like a pull toy going to these meetings every week, just kind of you know, giving people the comfort around like, our program is serious and we have a serious investment and it's very supported and it's audited and we three lines of defense and all that stuff. ⁓ But I had to learn that quick, right? That was the big thing is, you know, I was so used to being in the kind of technical strategy person and everyone looked at me for that kind of guidance then to all of a sudden switch into a role where, you know, most of the people I'm talking to are not technical. And most of my... But I had to learn. key stakeholders who are going to judge my success are not cyber technical. And so, you know, I'm having very detailed conversations down and then I'm coming up with like, you know, castle and house metaphors to try and explain to like what, we're landing on. It really is. really, and it's, and it's, you know, I think it's like we said earlier, it's something I take for granted now, but that was really important to learn was. That's a learned skill set. Apples to apples is a learned skill set. And you can't be dismissive to the stakeholders and the leadership either. It's like, well, you don't understand how this works. You have to walk them down the path. That is like a real core skill set of this job. Absolutely. I mean, and there's so much fear around it. mean, especially, you know, when ⁓ the last five years, especially with AI, the threat landscape in cyber is getting is much more dangerous, I think than it. I mean, it's always been really dangerous. But I think it's getting it's going to we're going to have a kind of rude awakening with what's going on with with the AI models like me, those and opening a cyber and all of them. ⁓ you've seen like the last five years just the number of vulnerabilities discoverers like five, six, six or something like that. I think it was like 10 or 15,000 in 2020 and last year it was like 50 or 60,000, something like that. So the threat landscape's changing dramatically. even when I'm doing my tenure as CISO at PennyMac, most of our competitors had some kind of breach go on. So it was kind of funny when there was a... Threat actor names that was called scattered spider generally. And what they were doing is basically they were, ⁓ they were social engineering help desks to get administrative credentials. And this is like, this isn't your like low and slow in your environment for three months kind of thing. This is like, get, this is smash and grab. They get your credential, they get in your environment, they lock you out and they ransom you within 48 hours, right? So real scary kind of things. We had some competitors who were down for weeks when these things would occur. And so it creates a lot of fear. Right. And so when you know, right. And everyone's looking to me, what's the answer? What are we doing about this? How are we protected from this? And then, you know, that's, that's a, it definitely, you definitely have some sleepless nights. It's a lifestyle. I like to say we go talking about what's it like because he saw, say it's a lifestyle because right now I'm between jobs, right? So I'm starting at first American on the first, and I'm just, you know, running at my tenure at Penny Mac. Right. And that's your face on the, yeah. Yeah. Right now. And I'm like, I forgot what it feels like to be like a free human being. And I think this also applies to kind of anybody who's in the cyber, you know, 24 hour incident response world. You're kind of always, especially if you're the stakeholder that owns the program, you kind of always have this thing in your mind about, okay, I know exactly how the bad thing can happen and it's going to take us two years to fix. So like, you have to just learn to live with that every day. Mm. ⁓ I recall very well back in December, I host a happy hour in South Bay in Southern California. And it was at this wine bar and three CISOs all ran out at the same time. You were one of them. And I just remember like, I was hosting the time, like, well, that ain't good. You don't know what that is, but it's not good. So that's the lifestyle, right? It's a lifestyle. ⁓ So for the kids listening, learning from this, you know, ⁓ Yeah It's funny is that I even remember where the incident was How do they identify that maybe security is right for them? What would you tell yourself getting into the workforce right now? When I'm hiring people, the first, the qualities I'm really looking for is grit and curiosity first. And grit because, you know, cyber is, you're looking for a needle in a stack of needles, right? It's a lot of gumshoe work. It's a lot of analysis kind of work. ⁓ And, you know, and it's in your, you're in loss avoidance. You can't really calculate the value of loss avoidance. I mean, everybody knows there's some big loss, but... loss avoidance is what you're in. I'd say curiosity and grit is probably the first thing. I mean, you have to have really broad technical chops. So some jobs in tech, you can really specialize and kind of not care about what's happening around you. You can't in cyber. You really have to be able to, you have to be somebody that can get an understanding in hardware and cloud and network and operating systems and software and development and. I don't know, in data security and like you really need to have, you have to be somebody that really likes the general part of tech. You have to enjoy all of it. Like you said earlier, was, ⁓ you love grabbing people from other parts of the business because they've had exposure to other things, a technical level somewhere else, and they just have that desire to go in. Absolutely. I mean, so like if you're, you know, entry level cyber really, I think, you know, vulnerability ⁓ analysis and, you know, security operations and an MSP, or maybe even within like governance or audit within a consulting firm, I would say those are, you know, just from my cursory view of it, I would say those are probably the three most available entry level ways in. If you're going to be doing it kind of like second job, you know, people who are on help desk or infrastructure operations, they can pivot into security operations really fast. Yeah, it's very fast. It's a really natural fit. If you're a software developer, think that the place where there's the most, know, people who are looking for that like big ticket job, know, high paying new job, it's really going to be in the application security space. ⁓ I feel like, especially with, like I just said, with everything we're going with the AI space. ⁓ That's a skip job, technically. we're going to, you the world's going to have to develop perfect software. That's going to have to happen. can't, I think there's so many vulnerabilities now that people don't know about that we just kind of lived with for a while, but I think AI is going to bring all this to the, to the forefront. Well, it really, it's going to be in the operate, the OT side, the operations technology. So you're kind of physical technology that there are these like cameras and railroad systems and grid systems that are based on OT stacks that All the warts are going to show up and then. absolutely are 10, 15 years old and there's no way to patch these things. So I think there's going to be a serious reckoning coming up in the next five years across that. I think it's going to, the reaction is going to be, people are going to say like, you you can't release software with vulnerabilities because AI is going to find it so quickly that it's not, it's not going to be acceptable. So if you really are someone in the software development space who's focusing on application security, that to me, I feel like is probably one of the sexiest new places to focus on. ⁓ that think AI is going to have big space in. But then data security again, also is another place. If you're a data security person, maybe if you have like database experience, or you kind of understand, ⁓ you know, ⁓ insider threat data risk type things, you can kind of pivot from a socket though. I think that's also going to be in demand a lot because, you know, now the new executable is a chatbot, right? So if the chatbot's the executable, then the data that's going and, you know, monitoring that data back and forth, that's also going to increase. So, ⁓ but really focusing on broad-based because if you're really brand new, highly recommend certifications. I always joke that certifications are like driver's licenses. It means like you're allowed to drive in the road, but doesn't mean you're a good driver, but you still need to get the driver's license. Like you still need to do that. So if you're starting out, highly recommend, know, just if you really want to move into cyber broad-based certifications. ⁓ SANs are the best, but not everybody can afford SAN certifications. They're super expensive. ⁓ But you know, like, The CompTIA track is still valid, the Cisco track is still valid, the Microsoft track is still valid, Linux is still valid. So I think getting certified in those areas, if you're starting out, you're really showing like, okay, I have the broad-based knowledge, you can throw me at different problems. That's what's really gonna happen in security is that the work is not consistent. The work is always very lumpy, right? You'll have like, all of a sudden you have some, you know, the way I organize my teams, I always organize my engineers and say, okay, like the manager of architecture focuses on consulting architect, manager of a tech service, management tech service, manager of a sock. But I always say the engineers, like you got to pull from different teams to solve problems together. Cause sometimes it's like, okay, we've got a whole bunch of problems with, know, account security. Well, I need to get my data security people wanting to get some other people to all involved in that. So being the kind of person that can be a switch hitter and do different jobs and be a meanable different jobs. And that's going to be the most valuable thing going forward. And then. you know, obviously the AI tools are supercharging security. mean, it used to be when we would do security investigations, it would be like, you know, bad thing happens, track down the bad guy, you contain it. And then, you you do a log analysis and write a report and all that takes two or three weeks. ⁓ My team now, literally within hours is detecting containing Yeah. ⁓ and then having AI analyze the logs and then write the report. And it's happening in hours now. So if you're not an AI enabled cyber person, you're not going to be successful in cyber. Yeah, you have to use this technology. mean, all of the cyber tools now have MCP, the Model Context Protocol available to it. You plug it into all of those things and you have to learn how to operate in that world. There's a huge revolution in that stuff changing too. ⁓ The cycles are just contracting too much. as far as the whole, the backend data part of cyber, just like every, all data right now is all changing. Right. That's great. mean, it's get broad. Even if you are a cybersecurity major, you don't have to jump into it right away. Get out there. Experience as much as you can. It's ultimately going to make you more serviceable and just more of a Swiss Army knife when you do kind of focus in on the cyber side, because you will have to touch all the pieces of the enterprise. Is that kind of what you're Yeah. OK. Yeah, on the enterprise, my experience is on the enterprise side, right? I'm obviously, if you're working for a cybersecurity company as a developer or to start, but it's a different thing, that's different path. I'm not the right person to speak to that. But if you're going to do cybersecurity for your kind of, you know, the large enterprise, those are the skill sets that you need to have, right? I'm on, I'm on LinkedIn. I don't stay on much other social media. So LinkedIn is the only place I really have a social media presence. Right. That's really good to know. Well, where can we find you? If you have any follow-up questions. I have a Reddit account and I put my name as the accounts that way I don't comment that way. No, because I don't ever comment anonymously on those things. it's pretty much just LinkedIn and Reddit are the only two social media. I don't use any of other ones because I don't have time. Got it. Yeah, it's a lifestyle, right? It's security. All right. Well, thank you very much. You'll be able to find this on the itcareeracademy.com. Again, you can find it on Apple iTunes, anything where podcasts are stored. And thank you again. Really appreciate your time. Awesome. Thank you. Hey, thanks for having me. This is great. We appreciate it. Thank you. Thank