An Information Security Career: Maximize Your Chances Starting Now! Allan Wall, Senior Consultant Sept 16 th 2012 MSc Information Security Distance Learning Programme Royal Holloway University of London ISM Solutions Information Security Management Solutions 1

About Allan –BSc. Biochemistry & Genetics and PGCE –In IT for ~25 years Systems and network admin, application support; anti- virus “guru” IT Security ~17 years – all aspects Managed Symantec UK Presales Security Practice for 9 years –CISSP (8 years); Founder Associate Member IISP; Fellow of the British Computer Society –RHUL Information Security MSc Guest Lecturer on John Austin’s Malware Module –Active member of ISSA UK Director of Academic Liaison; Expert panels; Web Conferences Committee –Currently Independent Consultant Mostly helping SME/SMBs with their infosec issues ISM Solutions Information Security Management Solutions 2

Assumptions! You want a career, not just a job You want it to progress in some fashion You want it to provide sustenance and fulfilment Always seeking to improve 3

Outline Three of the (many) success factors: Plan your next 5+ years, constant periodic review Objectives to achieve, Aims to execute on Get to know yourself Gain experience that allows you to show competence (being qualified, proficient, able to perform, accomplish, achieve) Evidence based, checkable via references or testimonials Get it verified if possible (written, certified, recognition) Build, maintain, expand and churn your “network” Some of it will be “who you know” 4

Tool 1 - The CAREER Model Contemplate Assess Research Explore Execute Reflect CAREERCAREER Source: Dr Randall S Harrison 5

Planning Visualise a future state and “look back” 3-5 years How did I get here? Fill in the route – major then minor milestones 6

Tool 2 – the Personal Development Plan You can do you this for yourself or with a manager This belongs to YOU – not your manager! You chose to share it in order to achieve mutually beneficial goals – it WILL be negotiated There may be more than one version ! It should be “balanced” It might change a lot at times (be flexible) 7

8

IMPORTANT POINTS SMART Specific Measurable Achievable Relevant Timed Activities should be real, non-trivial, well articulated Use it! Refer often. Review often. ….but never underestimate the power of “the gut” to initiate change What was missing from the example plan? 9

“Hard” v. “Soft” v. Business Skills Personal “soft” skills - Examples Time Management Presentation skills Communication skills Critical Thinking & Problem Solving Negotiation skills Influence skills Change Management Conflict Management Management skills Business Analysis Project Management skills Leadership skills 10

Use them or lose them…. For technical people, technical knowledge and skills will “stick” more because they use them The non-technical and business skills need focus – and the best time is immediately and continually after the training Apply BOTH sets of knowledge and skills together Gain experience that allows you to show capabilities Evidence based, checkable via references or testimonials Get it verified if possible (written, certified, recognition) E.G. See or 11

Tool 3 - The Power of Networking For shy, introverted technical people this can be a challenge! Ease into peer interaction opportunities that enhance knowledge, skill, and professional growth Get useful contacts for getting work opportunities & advice Perhaps find a Mentor, get coaching Perhaps become a Mentor For learning about different professional roles/career paths Giving YOUR feedback on what you know or have learned Participating in innovative research, projects & workgroups Access to specialist recruiters & organisations with employment opportunities 12

Examples of Networking Organisations Obviously - RHUL (and other) Alumni organisations and events Professional Organisation “Chapters” – ISSA IISP ISACA ISC 2 BCS (& specialist groups – ISSG, IRMA, YPISG, Cybercrime Forensics) NEXTSEC and quite a few more etc 13

What can Networking do for Me? “I believe the greatest benefit of ISSA membership is the networking opportunities – and as ISSA reaches out more and involves other organisations like the BCS – these become potentially even more “lucrative” whether you are looking for work, a mentor, a mentee, to widen your infosec horizons, or the opportunity to ground yourself in comparison to other professionals. I would probably not have done the RHUL MSc if I hadn’t encountered Alumni at ISSA meetings willing to champion it!” Allan Wall,

Examples of Organisations Running Events Often annual, sometimes more frequent: SANS RSA Gartner Forrester Research Vendor Specific events Infosec Europe etc 15

What has Networking done for me? Significantly enriched my experience in the profession and my feeling of belonging to a professional community 16

Summary Plan! Gain Experience! Network! 17

Thank you Allan Wall, MSc, FBCS, CISSP, A.Inst.ISP Senior Consultant - ISM Solutions Director of Academic Liaison - ISSA-UK ISSA Web Conferences Committee Phone: +44(0) Find me on LinkedIn ISM Solutions Information Security Management Solutions 18