Selling Your Brand: Why Self-Marketing is Key to Advancing Your Career in Cybersecurity

good afternoon or morning evening depending on where you're all joining from i want to welcome you to a topic that's near and dear to many of us self marketing first i will introduce myself i'm not going to leave myself a stranger that you have to listen to for the next 30 minutes then i'll briefly talk about career advancement just to set the stage next i'm going to talk about some foundations these are things most of us are probably already doing to accept to some extent but they help build the basis for the next step which is self-marketing here i will not only discuss what it is and how it can help but also give some pointers along the

way this will all be sprinkled here and there with some of my own experiences to keep things interesting and also because well this is how it worked for me see i promised i wouldn't say a stranger ready here we go so my name is samantha cowan but pretty much everybody calls me sam unless you're in my family i took a really random winding path to get into security i've been a pharmacy tech i've refereed soccer staffed nursing departments worked emergency dispatch worked for the park service and nit once i arrived i started as a security engineer first at first at zenefits then moving on to cover hound where i led security and compliance from there i transitioned into a solely

compliance role at one login leading their team and now i had security compliance with some privacy thrown in at hacker one it's been an unusual path but in security is there really any normal way to do it and that right there is why you have to sell your own brand before we can get into that we need to talk about why we're doing all of this career advancement it's something most of us want to do at one point or another career advancement and career development are two terms often associated with success at work but they don't mean exactly the same thing for a vast majority of us the overall goal is career advancement we want to promote

or find a new work opportunity however in order to accomplish this career development is a key factor there are those things we all think about when it comes to career development learning new skills attending trainings also growing at work and taking on new responsibilities and projects then you have your big steps promotions and new job opportunities these fall under career advancement but could it be that there's more to it than that if everyone thinks of these career development aspects that i already mentioned why are some people getting ahead so much faster than others especially when they might have less experience the answer is both simple and surprisingly complex self marketing we all hear about it we know we're

supposed to be doing it the question is how how do we do this magical thing that's supposed to help our careers so much well let me share a few tips with you first i'm going to discuss four pretty well-known areas that are related to self-marketing but a necessary base then i'm going to dive into the topic topic itself and share some of what i've learned over the course of my career so far first the foundations because we all have to start somewhere networking is that one thing that we're constantly being told we need to do but why first it's all about meeting people about creating connections in the industry expanding your contacts can open doors

to new opportunities for business career advancement personal growth or simply new knowledge don't forget that many jobs don't even get advertised your network can be an excellent source of new perspectives and ideas to help you in your role engaging information on challenges experiences and goals is a key benefit to networking because it allows you to gain new insights that you may not otherwise have thought of being visible and getting noticed is a benefit that's essential in career building the opportunity to gather new information is an often overlooked benefit as it's not the most obvious one but it also offers career progression and development discussing common challenges and opportunities opens the door to valuable suggestions and

guidance i can tell you that some of my best contacts have actually been at smaller events such as workshops or evening panels these are places where you have time to get to know the people who are there and there aren't so many people that every face is just a blur i'm actually still friends with someone i met at my very first workshop at my very first black hat and that was probably six years ago we text all the time still even though until recently i lived in california he lived on the east coast then you have mentorship there are two sides to mentorship you can have one or more mentors and then you can also be a mentor to others

both offers different and sometimes some of the same advantages one of the things i like to remember is that the person who mentors you and provides you with help and advice might not always be in the same industry mentors can be just about anyone one of my first mentors when i came to work in the tech industry from federal government actually taught me more about startup life than anything to do with security or technology i was used to let's just say a much different way of doing things for example we didn't have startup kitchens we didn't have a work culture that was anywhere remotely near my age and we didn't have quite such an exuberant way of doing things

one of the first things he taught me actually that comes to mind probably has to do with emails and how to make them more interesting also that including memes was actually kind of expected particularly when cats were involved i don't necessarily have anyone that i regularly that i regularly mentor but i do have those people i've met and worked with who come to me from time to time when they need advice or guidance i think the two most common questions people come to me with either have to do with whether or not they should get a specific certification or an advanced degree in security or just asking about experience with a specific compliance area either way taking on that role is an

opportunity to reflect on your own experiences and also allows you to improve your own communication skills job specialization is pretty much what it sounds like it is having a specialty or expertise in a specific area of your industry for example i have friends in the security industry who specialize in application security while others specialize in physical security you do of course also have people who do a bit of everything your security generalist this is less common the higher you go along the career path as more in-depth knowledge is generally needed and it can often be hard to gain that level of expertise in all of the different areas this even applies to my current team even though we're in compliance and

privacy i have a small team right now i have someone who specializes in vendor management i have someone who specializes in privacy and then i have someone for iso and sock too federal is more of my own area everything else we kind of split up and share among the team the thing is these are all really common things most people know about them and do them either naturally because they just fall into them or they seek them out they are the things everyone tells us to do but if everyone is doing them how do you set yourself apart this is where self marketing is key these are the above and beyond steps that some do

really well which really helps them to stand out you don't have to do all of them it's an area where you certainly can but you can also pick and choose what works for you an easy way to start is by volunteering this is kind of like networking 2.0 there are some really quick and easy ways to get into this first do you belong to a professional organization maybe one that's in your own area see about volunteering to help with committees maybe i used to manage the publications committee for women in security and privacy and that was a really good way for me to get involved volunteering to help with events is another great option and there's a huge range of positions if

your company has a booth somewhere and you want to start small to check things out see if you can go to represent your company and help talk with people who are interested in learning more about it i've done a lot of this over the years as i usually join our booth when i'm not out speaking you can also volunteer with the event itself this puts you in a position to meet event organizers and a lot of the attendees also depending on the event if you work enough hours sometimes you get a discounted entry entry rate into the event itself really any of these volunteer roles comes with numerous benefits that help with career advancement it's just a matter of taking that first

step and looking for the position so remember how i mentioned i used to volunteer with women in security and privacy helping to manage their publications committee well it just so happens that writing and getting your work out there is another great way to market yourself probably the most common option for a lot of people is to start their own blog this gives you control over content design posting schedule the decision of whether or not to bring in guest writers really basically everything it requires you to remain current as you need your content to be just that so you're always up to date on what's happening in the industry and it establishes a digital footprint very much tied directly to you

don't have time to do all of this yourself or worried about whether or not you have enough of your own content to keep it going all the time there are alternatives to running your own blog the easiest is probably to be a guest writer and one that's already established many people get busy and don't have time to constantly create all of their own content plus some just like having variety you can find established blogs who are looking for people to submit a one-off or sometimes fairly regular post to supplement their own content i've done this myself writing a number of pieces for a raspberry pi blog another option is to write an article for an online publication

think online magazine or website not a blog but a place people go for new industry information this is something like taking your work a step up the ladder and a final rung on that ladder is to submit it to a journal these are a little more time consuming as you get to cite sources and you often need peer review many of them are research based however they also tend to hold a lot more weight i can honestly say i have no journal articles on my resume in fact it has been a little while since i did any writing next we have that one thing people tend to either love or avoid like the plague speaking

clearly i'm not in the avoidance category there are a ton of places you can speak i presented at high school career fairs you could definitely do the same thing at a higher education level you could even speak to a specific class or club perhaps maybe running a workshop professional organizations are a great option many bring in speakers for their own meetings as well as running events and conferences one of my favorite places to speak are at small networking events i've done two different kinds of these one has been more of a networking over coffee where everyone met and talked for a bit we had a panel discussion broke up for a little bit of more

networking and all headed off to our respective workplaces i've done far more of them that were in the late afternoon as work was wrapping up and many of us had more time to relax and meet people this format usually worked a bit better as it gave us more time so there could be more individual speakers and a lot more time to network and actually make a connection with people finally you can speak at conferences i worked up to this one as writing abstracts was a little bit different to me pro tip for all of this if your company has a marketing communications specialist that person will be your best friend they will know the ins and outs of who's

looking for speakers what type of topics they're looking for and they can get that abstract and bio started in together for you as for how you should present you have options here too i've really only done the first and last one here i clearly present as an individual speaker but i've also participated in numerous panels and they can actually be a lot of fun if you're putting on workshops that's a great example of a time when i've seen small group presentations as you can have multiple people to present and also assist those who are learning from you it really just comes down to what you're comfortable with and also what works for your specific presentation

now let's talk about online presence i'm going to start out by reminding you that you do get to pick and choose among all of these self-marketing areas and this is one that is not necessarily my strong suit however for those that do it right it's super useful as you can see not only do we spend a ton of time online every day here in the u.s an average of almost eight hours which i can guarantee you i exceed almost every day but of that time almost three and a half is spent on social media that i almost never reach but i can guarantee i have friends that more than make up for it for me so

how does this information help you first you have twitter probably one of the most common social media platforms where someone uses their account is either a solely professional or a meld of professional and personal content as you can see i'm actually on twitter i just don't use it very often you can however find tons of professionals who specialize in infosec privacy appsec hacking the list is nearly endless if you go this route make sure you follow a few quick tips make sure you have a good photo and bio this is how you're introducing yourself to your audience you want that impression to be a good one if you created that blog we talked about or have another personal website or

portfolio to share that is relevant to what you're speaking about link to it here use your post to show off your interests thoughts work and accomplishments do you have a speaking engagement coming up post about it also remember to engage with your audience and retweet the content of other users twitter is a community and you don't want the content you share to be all about yourself it's definitely a balancing act between your own personal content and hey look at this great thing that someone else posted

next you have youtube this is admittedly where my friends spend basically all of their time physics videos coding tutorial tutorials you name it i do use youtube but i don't have my own content however those that do can build a really dedicated following youtube is great because it's lasting content once you've posted it unless you remove it more and more people can find it and recommend it to others you can also live stream on youtube if that's something you're looking for perhaps live interviews of industry professionals are something that interests you content-wise you can do that on youtube the platform setup is great for sharing a variety of content if you have a subject that you want to

just talk about you can do more of a speech format or sitting and talking to your audience but it's also great for a tutorial to approach as you can show video walkthroughs to help your audience learn new skills finally many find it to be one of the best places to grow an audience as properly using seo tagging helps more people to find your content

similar to youtube you have twitch i will be the first to admit i am rarely a twitch user this is included as a recommendation from others twitch also allows you to live stream content and share thoughts and tutorials similar to what you could do via youtube however the feedback i've found is that it's often more difficult to grow an audience on twitch additionally from numerous searches i did find far less content related to information security coding really anything i could quickly think of to try and locate any sort of industry content so personally while twitch is super popular for gaming and entertainment if i were to go and have to pick between youtube and twitch i would definitely go the

youtube route i just wanted to make sure that everybody here had information on both options finally there is linkedin this one i definitely do use although i might post a little more sparingly than i used to linkedin is important for a number of reasons not the least of which is the audience it reaches with nearly 740 million members and 55 million registered companies it's a great place to make an impact however while 87 of recruiters regularly use linkedin keep in mind that on average people are spending less than 20 minutes a month on the platform so you need to make sure that you're optimizing your profile for the right impact i know that might sound like an

undertaking and how does one optimize a profile anyway really what all of this is about is having a full and complete profile i'm including a few key tips on this and the following slides to highlight pieces that people often overlook choosing the right profile picture and background photo is one of the first steps while profile pictures are fairly common background photos have a tendency to be ignored make your headline more than just your job title use it to say a bit more about yourself what you do and why you're an awesome person vertical lines are a great way for a quick topic break as you do have limited space and you can see that i use them here in

my headline turn your summary into your story don't just list a bunch of skills there's a completely separate section for that this is your most personal piece of content marketing and it's worth putting some time into as you can see my summary talks about some of the type of work i do in my current compliance position the compliance areas i have familiarity with things like that it also talks about the fact that i came to compliance from a background in security engineering and how that mix of technical and compliance experience is helpful not only to me in the workplace but also makes me a valuable employee

share content on your profile linkedin allows you to insert content in a number of different ways i include a section where i list my speaking engagements and i've included one of my slide decks uploaded there including links to a blog youtube channel articles you've written you can see i have a listing of mine but none of them are actually linked i still need to see if i have a copy so i can link to them from box or dropbox these are all things to include in your profile and they're examples of your work and thought leadership that people can see immediately before they even have to reach out to you make use of endorsements and

recommendations give them but also request them from people who you know well and would value one from these are a great tool on linkedin recommendations are located towards the bottom of your profile and there's a feature for you to request a recommendation from your contacts remember to write a personalized note and include any information you might want them to touch on in their recommendation it's also important to write recommendations for others you can find incoming requests down in that same area or if you have a specific person you want to recommend you can go to their profile and find recommend under the more button next to message this is on desktop i apologize i did not check mobile

endorsements are a little bit trickier people are prompted to give them on random things when they visit your profile but really your best bet is to pick the items you want endorsements on say maybe three to five things and email some of your contacts who are familiar with your work in that area ask them to endorse you in those areas and ask which areas they would like your endorsement on in return finally share content and posts this is kind of a first step in this area respond to comments and move up to sharing long form content to start discussions this isn't as time consuming or daunting as it might sound like at first you might share a link share someone

else's post but share something and respond to any comments you receive those shorter form content posts help you get engaged and comfortable so that you can share longer posts down the road as you become more engaged in a community on linkedin all right you've listened to me talk about a lot of things let's recap so that we can see what this really all comes down to first we talked about career development versus advancement development being building your skills and growth in your role whereas advancement was taking the next bigger step our big focus was things today that would help you with career advancement the first foundational things that help you with this things that most everyone does were

networking mentorship and specialization they helped to start build skills increase your confidence and help you meet people in the industry however in order to really take it that step further we talked about how you could use self marketing through volunteering writing being a speaker and increasing your online presence to really build a name for yourself in the industry it's this name you're building that makes the difference it makes you recognizable and makes you known as somebody who's a thought leader this is why self marketing is so important and this is why it's key to advancing your career so on that note thank you so very much for your time today please don't hesitate to ask any

questions you might have or reach out to me later if it just takes you a little bit of time to come up with the right one

all right i will start asking for questions there was uh definitely a lot of chatter going on as you're going through there i think i stopped sharing there we go yep and uh yeah somebody was mentioning you know they they didn't have their mba uh listed on some of their profiles because they were worried about it coming off as pretentious you know but now they're they're kind of second guessing that so a lot of a lot of it's interesting you know because like in my case um i don't have a college degree yeah i i did some college and and dropped out and just uh jumped straight into things you know so you know i tend to leave education

off entirely unless somebody asks about it so i'm on the opposite end of the spectrum i'm i'm trying to hide the fact that i don't have a degree whereas other people have the degree and they're hiding that fact if you look at my degree my undergrad is in liberal studies it has nothing to do with computers i don't know about nothing i mean all it taught me was how to write a paper and like follow those rules but if you talk to people in the infosec industry most people come to it either through a degree that's completely outside of the industry or no degree like it's it's really common i would say instead of shying away from

like hiding whatever like emphasize the different workshops you go to emphasize the different um like running b sides emphasize the different workshops you teach you know things like that because i feel like in our industry it's like one of those weird ones it's not like one where everything's about how much education you have it's more about like it's more about what you do yeah i was just gonna say you know like my job right now 90 of it is being a compelling writer and even when i was a pen tester like 60 of my job was writing up those reports and you want it to be compelling you want to convince them hey this is

important you should fix this yeah you know and it has to be you know you've got to make things readable you know especially being concise i think is is really tough and a lot of what we do does eventually come down to writing to communicating the issues that we find that we're trying to convince people to fix um so i've been in many situations where on the receiving end i wish somebody you know had some of that writing experience i had some more of it um let's see we do have some questions coming in uh the first one is uh around getting a first job in cyber security uh somebody coming from a different field

with uh crazy random experiences i think generally crazy random experiences are a good thing but what do you think i mean i don't think it's like work experiences or like you don't ever want anybody to do a background check experiences [Laughter] i'm gonna answer it from work experiences okay um yeah it worked they clarified work okay um i would say that's super common in the industry um what a lot of people do and like the advice that i give to a lot of people is to make sure that you're looking at the jobs that you're applying for and the things that they're looking for and pulling out of your experience what meshes with that so if they're looking for like

you know like we were talking about for so much of this it's writing skills if you've done anything where there's where that's in the past like emphasize how that links emphasize how organizational skills are important to what they're looking for emphasize how you helped update antivirus at your office even though you weren't necessarily in the role but you helped maintain security systems by ensuring anti-virus stayed up to date just like pull out those bits and pieces to make sure that you include yeah that's good how do you find opportunities to write one-offs or guest writing positions so some of it is just if you have blogs that you follow um you can always try reaching out to

those especially if you see that they do bring in guest writers you can try reaching out to them um some of them are also a lot of organizations run their own blog and you and are looking for people to submit content so like i know women in security and privacy is a big one you they actually have that publication committee so reaching out to them reaching out to a lot of like the the security orgs they're they're looking for content they're trying to get people to get their name out there so it's sorry i've got you on my big monitor i am looking at you actually um so it's kind of a matter of where you want to post

um and what kind of content you want but um like the easiest way is to go to an organization and see how you see if they have a blog or if they have like a newsletter or something like that that they send out regularly and see how to um apply for content there other than that it's following blogs it's reaching out to different organizations to see like schools are a good one um it's reaching out to the owners of blogs um especially ones that like i said that you know bring in guest writers right yeah and you know having uh worked in marketing for vendors you know most digital marketing managers like if they could they'd have a blog to post

every day you know like they they want a constant stream of content coming out so um and and there's a ton of security vendors out there with uh you know marketing teams that are flush with budget so you can get paid to write stuff for them um somebody else made a good comment uh issa and isaka journals are always looking for uh contributions you know i know we've got a few in our local community here in knoxville who have submitted stuff to to some of those journals uh let's see somebody somebody wants you to describe the art you have hung in the background my uncle is an artist in canada let me actually tip this back

so you've got originals i so he does wood block prints so he carves on wood and then does prints i actually have the wood blocks okay those are really neat you got all of this skill in the family right yeah my mom's uh fairly within the art world she's a fairly famous artist so same yeah she does some amazing stuff um but yeah at least you have some i can't afford her art so i yeah i've got b-sides posters in the background i have one of his prints in my living room but um yeah they were i lucked out let's see do you here's a good question uh do you believe it would be worthwhile hiring a

professional or a company to improve your linkedin content and and format and and i think you could even go beyond that like i've seen people that have like a website set up to promote themselves like i think there's a lot you could potentially do there so if you know somebody who already is really good at linkedin i would maybe go that route first because i know that people can be kind of expensive but at the same time i will say when i was getting out of grad school and looking to change careers and trying to figure out like how to get my linkedin in line because it was not a thing in the government um i did exactly that

and that is why i had linkedin stuff and linkedin tips to share with you guys um is exactly because i worked with somebody who does that who did that kind of work it was years ago now but she went through actually both my resume and my linkedin at that time and now my family all comes to me for their help um i'm trying to trying to work out this question um okay so i think i've got it do you find would you suggest different strategies for different age groups like based on like folks and i'm i'm not sure if this is if you are older or younger or if you're um it probably applies both ways or if

you're um applying to a company with older or younger folks um so so you know do you focus on linkedin blogs you know stuff like that or you know more youtube and and twitter you know that kind of thing i think like what i'm looking at because having gone through this talk i'm like i need to spread myself out a little bit i i would probably try to do just that i would spread it out a bit um i think what you're going to find is that probably your widest audience is going to be on twitter but also twitter's the one that frustrates me the most um because i hate looking at my feed there's just so much stuff in there um

really personally if i were to add another one right now other than maybe looking to to do a little bit more writing i probably look at youtube because i feel like that's pretty like my dad uses youtube my boyfriend uses youtube my little sister uses youtube um i feel like that's pretty universal um twitch i'm staying away from like i mentioned um in terms of other things in term like if you're applying for jobs and you're trying to figure out how to how to structure that that application or something i would just do a really solid resume and a really solid linkedin i wouldn't worry about like if the company is younger if the company's

older anything like that or in terms of actual age not like how long the company's been around um i would keep in mind especially in startup culture if you are applying for a job and you're maybe on the east coast and you're going to an interview in california try and get an idea what the office vibe is because i have seen a lot of people show up in like three-piece suits in a san francisco startup right right and that definitely doesn't blend really well like it doesn't it doesn't really make a weird impression it's just like it stands out and it's something that when you're trying to remember candidates people are like oh remember the guy in the suit

um so these are questions to ask your recruiter like hey what is the dress code like in the office hey what should i um what should i plan for in terms of the structure of the interview so when you get to that point i would definitely ask questions so you can at least try and feel comfortable in your environment because that comfort level is going to help you present yourself better definitely i i have a lot of anxiety just naturally and uh not even interviewing but just as a consultant going to a client site for the first time i'm trying to pack for for the trip and i've googled for photos of the office uh or if i felt comfortable

enough with someone there you know i've i've messaged them and asked them you know how do people in the office dress um yeah because i i don't want to be that guy showing up in a suit and everybody's got dogs and they're in flip-flops and and shorts oh um not that i'm gonna show up in jorts but nobody wants that um all right i think we may have worked through it i was hoping i wouldn't end this with a comment on jortz but lord i think i backed myself into that corner okay no there's one more question thank you nicholas are technical questions common in infosec job interviews yes yes they are they're actually even

common in compliance interviews and it's interesting we actually have one of the organizers is doing interviews while the conference is going on he's jumping off of conference stuff to do some phone interviews and he's getting technical questions he just mentioned that i would definitely expect technical questions i also wouldn't be surprised for a lot of companies even at the startup level for you to have some sort of test yeah it's interesting when i moved into so wendy nather hired me into 451 research which is a full-time writing gig and i had to submit two full writing pieces into style that they published as part of the interview for that job which i thought was fantastic

and before that back when i was at elevon looking to hire pentester we actually set up a box for them to do a pen test on you know and we tried to get our applicants uh and about half the applicants were like that's way too much work and they were gone and then two of them actually did it and and one of them did a fantastic job with it and was the obvious choice for that role yeah so i actually like you know that that kind of stuff like here's a do a work sample for us yep i mean i think that's part of why things like posting some of those writing samples and stuff

on your linkedin makes it so much easier because people can see them right off the bat but then and also like if you have a public uh github or repository or something you can post a link to that so you can see some of your work right off but um it's not going to get you out of your test i'm sorry yeah yeah i've encountered some people like like i think the volunteering stuff that's great advice and the community stuff and occasionally you encounter somebody in infosec who like their goal is to have zero footprint online you know like i can't imagine what finding a job would be like in in that case because you know like uh

i don't i don't know about other people but a lot of hiring managers i imagine they're doing some googling yeah i definitely thought of that when i was working on this i'm like i wonder how those people who don't want an online footprint survive i guess you could have like an a private portfolio that you can send to people that's my guess is they do something like that and they're probably the ones that you come across and you have to be connected with them um or have it shared before you see really any information but i also i'm betting they don't like any of us on linkedin get just tons of random messages hey we've got this opening would you be

interested in talking i'm like did you read what i actually do yeah yeah security guard position security guard whack and hut be a mall cop that way i always hear stories uh about that happening every now and then i get if more than a few for prison guard really i've not gotten that one before i do have a fake chief marketing officer persona that i created to win some real awards for a fake company just to see if i could if i could win infosec wards if if they would actually do due diligence and he is to date received four offers for executive level uh infosec roles at vendors even though he's not a real person

somebody's not checking very well no no in fact like some of them said oh you know i heard from uh some of my peers that you were great it's like no you didn't this guy didn't exist until like three months ago so yeah yeah linkedin is a bit of a mixed bag i think um oh the comments are still going strong but i think the questions have stopped so i think this is a good uh good stopping point here um excellent talk uh you know i think this is uh this will be a great kind of de facto um youtube video to point people to you know for this kind of thing and i love videos like that you know that that

can live on long after the uh the recording is finished uh as a good kind of explainer helper you know especially as i i mentor a lot of folks um with uh with whatever spare time i can find and uh a lot of these questions you're just answering over and over and over and it's good to have a resource like this where you can just say go watch this video then let me know if you have any follow-up questions yeah yeah i i i tried to come up with something that was i don't know maybe hopefully going to be interesting to more than one or two people yeah something for everyone uh definitely well i mean if we're to judge

just off the the number of comments and and chatter that this talk generated uh you did just fine excellent that's good to hear