Who do you want to be when you grow up, “a gartner(*)-head” or “a packet-head?“
Huh!?
Over the years, I realized that even in our mixed-up field of information security there are essentially two paths (that is, provided you do choose to follow a path as opposed to just “dabble in security” or be an “I just work here” kinda guy…)
- Instead of starting from asking a question of “do you even need a path?” or “is security your career or your passion?”, let’s assume that it IS in fact your passion. It might vary in strength from all-consuming mental affliction to a mild case of “securitis? (or “securosis”, per chance? :-)) - but it is a passion nonetheless.
How do you plot your course through that passion without losing your mind and then switching to real estate career (BTW, a real case I’ve heard of)? And how do you stay on your path without diffusing your efforts, losing focus and becoming “aware of everything and expert in nothing.” As I mention, there are two paths:
- A path towards super-deep technical kung fu in one or very few related areas. It does not have to be exploitation (even though that is a popular choice), but can be about network packets, web app security, malware reversing or something even more fun (eh…logs?). This is what I humorously call “The Path of a Packet-head”
- A path towards … well… let’s call it “strategy”, even though the word is heavily abused. This is where “CSOs-from-god” and good security product leaders come from. This is what I humorously call “The Path of a Gartner-head”
It goes without saying that suffering through a few hex dumps or through a few policy rewrites, does not put you on the path. And neither does reading an exciting piece from … well.. Gartner. I am talking here about a commitment to become one of the best in the field [BTW, I hate “be the best you can” theme – for many people it just means “you’d still suck”… but I guess that’d be an unamerican thing to say, so I won’t say it :-)].
But here is the trick – there is some MAGIC in carefully blending the two paths a bit. The trick is in NOT losing focus on your path WHILE blending in (but not dabbling!) something from the other path.
A simple example: if you spend 12 hours a day looking at the smoking guts of malicious software, try reading what some analyst firm wrote about the anti-virus market – even if it sounds a bit boring at first. Does it make sense to you (or not)? Does what they say match your experience?
An opposite is even more true: if you spend 8 hours a day writing policies and connecting pieces together into “a big picture”, why don’t you pick one of said “pieces” and look what’s inside? Does it have code? What does it do? Does it really work? And how do you know?
Thinking about things like that has a potential of moving you forward on your path, however counterintuitive it might sound. It will also give you career advantages without failing into the “generalist expert” crap….eh….trap.
At the risk of praising myself too much, only now I fully grasped the compliment somebody gave me a few years back “… you can switch from reading packets to reading Gartner in a second – and not even flinch” :-) Let’ consider this an inspiration for this post, nothing more…
(*) no offense to esteemed folks from Forrester :-)
Possibly related posts:
- Skills for Work vs Skills for Getting Hired
- A Myth of An Expert Generalist
- All posts related to career
