Why Taking a “Step Back” Might Be A Smart Cybersecurity Career Move | Root To CISO Podcast

0:01Speaker 7:Hi, and welcome to the Root To CISO Byte Size podcast. I'm your host Kris Rides, and in these bite-sized episodes, we'll be speaking to experienced cybersecurity hiring managers. We'll be asking their advice on how you can stand out from the crowd to make the career moves you desire.

0:22Speaker 6:you've had such a well-rounded like career and sounds like there's a couple of times when maybe you've made steps that from the outside could seem like a, like you even mentioned yourself, like backwards or a sideward step that moves you forward. Yeah, so I think that's a great place to start because that's something that a lot of people. In fact, I think every single CISO I've spoke to on here has had to make that step, and I don't think anybody's got away with having a.

0:49Speaker 6:Career that just went like this. Indeed. And there are a lot of people out there that are in situations where maybe they're having to take a role that they would feel might be a backward step or they worry about how other people could see it as somebody that's been through it and seen the outcomes of, of making tough decisions like that. Like how has it been for you and any advice that you've got for people that may be going through similar situations?

1:16Speaker 7:I think I'll start off by saying that all of those feelings are very normal.

1:21Speaker 6:Mm-hmm.

1:21Speaker 7:And are incredibly validated. And to say that I did not feel that way, that I did not question that I did not think of those things would be an absolute lie. I mean, I think that as I was faced with those opportunities, for me, I was like trying to take a step back and look again, bigger picture. So if I was going to take a step, back or a step sideways, okay, well what am I going to gain and what am I going to give? Because I see it, both ways. Like I wanna be in an organization that I can give from everything that I've learned and help make the organization better, but that I can also gain experience, learn more, and really plant myself So.

2:04Speaker 7:Couple things. And it wasn't easy. I had really great folks in my life that I could pick up the phone and say, in all honesty, I'm considering this and that, and I feel bad. Like, when I left Corra, I had two job offers. One was, as a ciso and the other was with Lowe's. And I still chose to go the Lowe's direction because again, it was just. So exciting, like just meeting the team and talking to the team and talking to their ciso. I was like, wow, I can truly make an impact here and I can also learn a lot.

2:45Speaker 7:Whereas in the other opportunity, sure, I would have the title and I could come in and make a lot of change, but I wasn't necessarily going to add anything to me, as a professional and as a practitioner. So I'll be honest, the salary was more, the title was better, the Prestige was there, but inside in my gut, I knew that that was not the right choice for me because it wasn't just about that and it's never really been about, I. The optics of, I don't wanna be a celebrity cso, Kris, that's,

3:21Speaker 6:you're on here now. It's too late. That's it. This is, this podcast makes celebrities out, CISOs. That's how, that's what we do. No, it's not.

3:29Speaker 7:I mean, there, there are some celebrity CSOs out there and I love them. Or you're doing incredible things and they're writing incredible books. I, that's just not where I am maybe in another 10, 20 years. Right now, I'm just, I wanna be somewhere where I can make a difference and where I can learn something new and contribute to something greater. That for me was more important. That attracted me more. And it was not easy. I literally, spent time writing pros and cons talking to my mentors and saying, this is what I think.

4:00Speaker 7:And, ultimately they're like, margarita, I think you know what it is that you wanna do. So do it. And it's okay, because even if you get it wrong, that doesn't mean that your career ends there. So I made a wrong step. That's okay. There's always something to be gained. There's always something to learn, and there's always something that you're gonna take out of it that's gonna propel you to where you need to be. I really feel that just having the trust in yourself to just let go of those types of things and make the steps, you'll be fine.

4:33Speaker 7:It's hard in the moment. There's just, no doubting that it was very hard and that wasn't obviously the only time that I was faced with. I just learned that that didn't really matter. And even when I came here, as a VP of head of brands, I was just really excited to get to work with all our different countries, with all of our different brands. Like how amazing to be that bridge in that conduit to helping drive change and drive adoption. And that to me is exciting.

5:04Speaker 7:Especially in a culture as amazing as it is here in Carnival, where, I mean, it's a lot of fun. That's the reality. We work hard, we play hard, but it's such a great, culture and I love that. So I would say to folks, that are gonna face that because I think we all face that one way, shape or another. Just trust your gut and don't be afraid because it really doesn't matter what others think. Like if anybody thought of anything when I went to those and thought, oh my God, you took a step back or whatever, well look at me now.

5:33Speaker 7:Like, look at where I'm now. So it's like. Those steps, it will take you to where you need to be.

5:39Speaker 6:Love, love, love, love, love, love. Yeah, there's, there's a few things you said there that hit home and it's stuff that I've seen that's almost comes with a level of wisdom or maturity that looking at how things are further past, oh, it's the highest paying job, or it's this title and most of the people that we work with. Consistently I hear, I wanna work somewhere where I can make a difference. Yes. And where I can be heard, where the things, the mission, the actions resonate with me.

6:11Speaker 6:And when I talk to somebody and give my thoughts on it, I know that they're, they might not say, okay, we're gonna do that, but they're at least listening and taking them on board. And I know that I can, I can make that difference. And it's people like that, that go into work every day and really enjoy it not going into a job that I'm miserable in, but it pays plenty of money. Right. Or it has the right title. So I think the stuff that you talked about there would, should really hit home with a lot of people.

6:36Speaker 6:And for those that are earlier in careers, a great learning opportunity.

6:41Speaker:yours is a story that's interesting because it twists and turns in the middle. some people have had to take. roles that they don't necessarily feel is the next step in their career. Maybe it's a side step or a backwards step, or at least they feel it's there. I try and encourage them to realize that I haven't, I can't really think of anybody I've met that's just had a perfectly straight ladder of a career. Obviously you had one that you chose to change, but did you have anything else that happened in your career where it was really maybe a backward step or a sideward step, but it's led to some really interesting stuff for you

7:17Speaker 2:i, yeah, I'm sure there are things like, when I was much younger and I had an offer from PWC when it was the cybersecurity practice was 20 people. I decided not to take that because I didn't want to travel. And I was just about to have my first child. Had I taken that I would have had a very different and probably financially very, very successful career path. I don't regret it, but I think that that was a legitimate path And i'm ultimately I did go back to pwc after many many years And saw people that I worked with and started that practice when I started at that practice who actually became partners and they're doing really well.

7:53Speaker 2:So I I could have taken that path I don't regret it because I think i've had a pretty pretty interesting time Very interesting career as well as life. On the other hand, I ended up doing really interesting things and have lived in many places around the world. And that's become invaluable. Being able to take a year off and move abroad or live in Germany or Japan or the Netherlands. So, I can't say any, any step backwards for any of your members or step sideways would be bad.

8:28Speaker 2:There's, there's no point in saying, oh, I wish. I wish I had done X, Y, because you, you're only where you're at now, not where you could have been. But if somebody wants to keep moving forward, if they make a misstep and they want to correct course, they can correct course, so they can go down a different path. It's, I think you never really set yourself back as long as your mindset is to move forward in some direction.

8:53Speaker:if you could go back and speak to early, early career Jonathan and give him a piece of advice. What would be the piece of advice that you would give,

9:02Speaker 2:I think advice that I would give to people who are starting out in their career is, stay really curious. The most important question you should have just throughout life is, is the question, why? And if you're always asking yourself, why you're trying to figure out the answer to that, you will just end up learning things. You'll end up understanding what an IP packet is. You ask yourself, how does the internet work? Well, eventually you're going to get down to the level of understanding what, internet protocol is.

9:36Speaker 2:Like you'll, you'll look it up and knowing that allows you to do things like understand how firewalls work or understand how, an authentication protocol can be bypassed. So stay curious and ask yourself, why is this working? Why is it that I, when I use the pass key, it works. The information is available. You can read about it. You can understand it. And as you're reading, ask yourself, well, why does that work? What, what is asymmetric cryptography versus symmetric cryptography?

10:08Speaker 2:Ask that question and try and find out the answer. So, so, stay curious and that will lead to you becoming an expert in an area and that will lead to more job opportunity. It will lead to more career growth. And I think ultimately it will just lead to more interesting life because you will be intellectually engaged with things more. I was hired as a technician owning something. so I was on the security team because I owned the identity solution. So that's how I got into security.

10:39Speaker 2:At a certain point I got to a place where I, I was, helping with strategy and doing a little more than just hands on the keyboard. And an opportunity came up to be the acting for a minute. I was the acting information security leader for a minute there,'cause their information security key leader left. I'd say that was probably 5, 6, 7 years in, into being there somewhere around that time. So I did it'cause they needed someone to just be the acting person and I didn't just fill the hole.

11:11Speaker 2:I tried to be that acting person for them while I did it. Yeah. And I realized the big thing, I'm not ready for this. We had a big outage happen from a virus. Right. So I, I got baptism by fire. I realized it wasn't just the decision making. And maturity. It's just engaging people and knowing how to be a good leader. And I'm like, I did okay, but I don't know that I'm ready, so I'm not going to try to pursue. Going back to being a people leader, they actually hired a really experienced person to come in and I knew that was gonna happen.

11:42Speaker 2:Yeah. I wasn't expecting to keep it, but I didn't go pursue something else at the time. I'm like, I'm gonna keep doing what I'm doing for a while. I'm not quite ready for that. So I took on roles with greater responsibility, but not necessarily people. And I was basically like a senior architect. And I became a senior infrastructure architecture.. So they built out a solution architecture team or a set of them, and I got to be one of those leaders because I was a senior architect and I was doing more than just the technical, I was bridging gaps and helping people understand things and working with some of the upper leaders.

12:15Speaker 2:I got pushed a little bit to consider taking a, a manager job. It was like six people and I think I did really well in that first job with six people, right? 'cause it played totally into what I was already doing. So it was a low risk entry point. It's what I already knew. I was always a very risk averse person. I didn't wanna go take something on completely different than what I was doing. Next jump was a big operations job, which had. I don't know, 20 plus people worldwide, probably hundreds of contractors worldwide and multiple different technologies.

12:47Speaker 2:And I did it and it definitely broke me. That job wore me out. Right. Yeah. Because you're 24 by seven, you're on calls when stuff goes down and it was just a lot. So coming out of that role, I stepped back. I stepped back and said I need a break from this. Not that I don't think I can't be a leader again, but I just need to rethink where I am and what I wanna do. And a job opened up on the security team to do what we called an anti a PT solution.

13:19Speaker 2:So it's like, how do we think about segregating our unstructured data in a way that would make it harder for a threat actor to get to that unstructured data? And this is the beginning of what most people were like. What the heck is a PT? Right. Advanced threats. Right. I didn't even know what that meant then, right. 'cause I had been the identity person. I wasn't doing threat anything. Right?

13:38Speaker:Yeah.

13:39Speaker 2:So I'm like, sounds cool. I don't know anything about that. And now I'm getting a little more confidence, right. There, and I knew I wouldn't have to manage people. They're like, you're gonna be the project manager for this and you're gonna have great experts around you that you can tap into. So do you wanna do it? Yes. And I, I just cherish the thought of not having to deal with people's evaluations or any those things. Think about just indirect influence again.

14:05Speaker 2:So I did that for almost two years. The project, I would say, was successful for a while. I did find out about four years later it. It, it had outlived its life and that's okay. 'cause you should change things if they don't work anymore. Yeah. But it was a great experience. I learned a ton about threat management, how threats work, what the a PT is, how lateral movement works. I didn't know any of these things, right? Like I, I, I feed our lead a security guy.

14:30Speaker 2:I am like, Hey, if I take you out for lunch, will you explain to me how lateral movement works? If I said him, he would tell me anything. So I learned a ton from that and I got my strength back to say I'm, I think I'm ready to go back into leadership. And weirdly, I went back to a solution architecture job again, which was something, I did before.

14:50Speaker:Yeah

14:50Speaker 2:and definitely with all the things I learned, I approached that job so much differently than I had other ones. I flourished after that. I did much better. I learned a lot of lessons from the, the hard knocks I got on the really big one that just drowned me. And then, from there I just kept doing different things. I took a business facing job. I had never been business facing. So I was in the sales IT team and did sales and marketing support. And software development.

15:18Speaker 2:I was not a software engineer, but I had to lead a bunch of software engineers. Great

15:22Speaker:experience. And then I ended up

15:24Speaker 2:going back to a, huge platform operations job. So now here I am. I'm gonna do that again.

15:32Speaker 6:Thank you for listening to the Root To CISO Byte Size podcast. I hope you enjoyed this episode. Make sure you keep an eye out for season three of the full Root To CISO podcast. And in the meantime, stay up to date by liking, commenting, and of course subscribing to our channel. Thank you.