The NonInclusivity of InfoSec: My Experience

Good afternoon everybody. Um I'm Dan Ogilvie and um as you might have been able to tell from the description and stuff, I'm actually coming to you today uh somewhat outside of the industry just telling you about a bit about my journey trying to break into my first role and um the issues I've faced along the way. Hopefully some of you will relate to it. And um maybe some further discussions afterwards. So, hopefully I'll get this working. Um so, yeah, tell you a bit about myself. Um I'm from Hereford. Um I currently work as an estate agent um at the moment. Um have been doing so uh for the last 7 8 years. So, I've got

sales background. Probably explain the reason why I've come today so vastly overdressed compared to everybody, but at least I didn't I made the effort to not wear the same shirt I'm wearing in that photograph. So, um Uh couple of other random facts. I've actually got two apprenticeships um on the um on my sort of stepping stones and career ladder to where I am now. Um I'd say German speaker. I mean, I've got A-level quality. I've used to go out there quite a few times like over school and college and um built up my language skills. A lot of sort of self-learning as well. Um music's another big thing of mine as well. Back home, I I front a

punk covers band. So, I'm used to being in front of crowds of people. But um music I've got quite a loud guitar to sort of drown out hecklers. So, um this is a bit different. So, please go easy go easy on me. Um So, probably starting to think why why cyber. Um so, growing up and going through school and college, I've always been interested in tech. Um I've studied IT and GCSE and A-level. Um so, that was always there in the background. Um but obviously after coming through sixth form college, um sort of shoehorned into university. I I did a business information systems degree at Cardiff University, um which actually had a placement year. So, that was obviously quite an

attractive option when you're that sort of age of 18 not knowing what you're going to do next. Um I went into that, but then I quickly realized that the university um environment wasn't for me. I'm much more sort of hands-on. Like to learn on the job. Like I like to earn money. Um so, I took the decision to leave that. Um and then I then went back home and I did an apprenticeship um at an insurance brokers for 12 months. And from then, I side-stepped into property just to sort of work myself up up a career ladder. Um and having done that for for several years, um I'm at the point now where uh time to make another career change. Um

expand my horizons and my my my skills and the experience I've gained over the last sort of 7 8 9 years. What better way or what a better time than now to get into uh tech-based industry. Um I landed on cyber from um sort of various friends I've got in the industry um who then told me for the first time that there about this thing called a talent gap, which I will obviously come to later on, which hopefully will be the overarching sort of message of this talk. So, uh So, going on from that, um I thought so well, how can I enter the industry with the skills I have? So, being a sort of sales-based kind of

person in the in the role of selling property and our services, I thought great, I'll try and find a sales job in security and just change up what I'm selling. But obviously it's been a few years since um I've done tech. So, uh I self-studied online all in my own time, my own expense. Um I've just listed some of the providers of the courses that I've I've done myself. So, places like Udemy and the Open University and Cybrary. Only just sort of doing um fundamentals to begin with. Um But as I went along, I was learning about, you know, or relearning a lot of the stuff I'd done in A-level and GCSE. Stuff about hacking, social engineering,

malware firewalls viruses Trojans phishing, social engineering like I said. And the more I sort of went along and learned about this this all all these things, my thought oh okay, yeah, this is kind of like the dark side of tech. This is, you know, this is what I would love to get into. Um so, and the more I did the more conversation I had with people I knew in the industry, I then learned more about the offensive side of security as well. So, like stuff like pen testing um and and red teaming. I thought oh this this will be for me. This is this is this is great. Um So then uh after all that process, um I started

applying for jobs. Um And this is a process that started basically at the beginning of 2023. So, um all year, I've I've sat through, I would say a copious I'd say probably like a dozen interviews. Um all ranging from startups that literally sort of made up of one-man bands to the biggest names in the industry. I've had interviews with them all. Well, not all of them, but you know. Um Even as gone as far as second stage interviews um where I've had to do role plays and and presentations. Um every time missing out every time. Uh I would be losing out. They'd they'd come back and say great interview, great showing passion um for the industry

clearly. Um you know, really great to get across the message that, you know, the the end game is to to reduce risk and increase resilience, but we're talking to someone next week uh who's got 12 months experience in the industry. So, um you know, and I I I'd lose out to them every time, um which is obviously gutting, but I've you know, I've kept going. But um ultimately I'll be missing out to people with previous experience. Um and I thought it might might just be a one-off thing, but it's literally since the beginning of this year, um it's happened again and time after time. Um Got to shout out recruiters though. Um cuz that's obviously a natural part

of any any career change. I'm sure most of you in this room have probably um had dealings with them. Had a lot of great chats with them uh over the last few months. Had lots and lots of great advice. Um really really good people. Obviously I guess we we don't know it's been a tough year. It's been layoffs and obviously since since COVID, the game's kind of changed. Um but none of actually managed to sort of help manage me sell my my my experience and my passion to uh any any new employers. So, um so, after this um this let me sort of kind of take a step back, take stock, sort of reevaluate what my

my next move was going to be and um think outside the box as to the next steps.

So, I thought I'd put myself out there. Um I started to attending um start start to attend some events and meet people face-to-face. Um so, the first one I attended was the International Cyber Expo um here in London. Um As you can see, I've I included a uh a screenshot of my of my pass for the day. Um I put myself down as a trainee trainee in cybersecurity, which obviously from the nature of this talk, I am not. So, I was quite chuffed with myself that I basically pulled off my first red team of of an international cyber event. I've got in to this event as someone outside the industry with no experience and no screening by the way.

Um just got let straight in and there I am in the middle of the Olympia in London talking to CEOs, you know, heads of sales teams, um even sat four rows back from senior MPs in the in the same room. And I'm sort of sat there like, I shouldn't be here. But um but no, what a great day that was. Um met so many people. Um helped helped me grow my network and obviously that face-to-face interaction really helped sort of, you know, get across um sort of my my situation. Um going for the human approach and just just getting across my my situation like I said and trying to get across my passion and just try to make as many

contacts as I can um to help land that first role. And I sort of I carried that forward. I went to the um expo at the QE2 back in October as well. As with much of the same. But even still after that, the first role still eluded me. So, um what next? Here I am talking to you lovely people. Um I've got to give shout outs to um to James Bourne and to James Mason for sort of talking me into this, but also uh opening doors for me that there is a community here of people who who obviously listen, um you know, give support, but obviously it's kind of for my my benefit doing this, but ultimately inclusivity affects

everybody. Um whether it's someone like me who's got no prior industry experience, but I have transferable skills. Um obviously, you know, that there's a lot of um media coverage of like women in cyber and all these different things. So, it affects everybody. Um so, that's kind of the aim really to to create the discussion. Um and now I come on to what I said before, the the talent gap, which is continuously pushed. Um it's a bit pixelated, but hopefully you can see. So, even you got outlets as big as Forbes. Um Uh these articles are all from this year um end of October. So, they're they're still they're still pushing this narrative. Um So, uh Forbes is saying there's the

quest to close the cybersecurity talent gap. The CSO they're saying that there's a uh shortage that's reached 4 million despite a recruitment drive. Um and even you got Pinsent Mason on the end there even going as far as say it's the skills gap is a ticking time bomb for the industry. Um obviously I'm I'm reading these and I'm thinking, like, why is this still a thing when when I you know, I'm struggling myself to land a my first role. Um and just just going on from that, the articles sort of continue to say um That top one there saying Gartner predicts that by 2025, more than half of significant cyber incidents will come from a lack of talent as well as general

human error. Um I've had some good conversations earlier. We're talking about sort of human error being um you know, a a key part in in the industry. Um but that kind of lands back to the point where uh you've got to kind of diversify and get people from all different backgrounds to help um you know, solve the issues that that we have. So, um highlight the bottom article there. Um people Yeah, people with varying backgrounds can bring diverse perspectives to problem-solving, which is a key skill for cyber professionals. And if if the media is is driving this, um why is it still an issue? Um and that's kind of what I want to bring to

you today. Um so, the takeaways from what I'm trying to say really is um from my experience, I I think there kind of has to be a quite a big mindset change. Um I think the industry kind of has to think outside the box even more just to look beyond the industry where it's only hiring people in the industry. And we wanted to sort of try and avoid maybe a culture of people job hopping and um really look at the the greater talent pool of people that are outside of the industry um to see what skills can be can be brought in from the outside cuz we want to promote inclusivity of course, invest in potential.

Um and again, diversification I think is the is the solution. Um So, yeah, that's uh that about wraps it up. So, you know, thank you very much for for listening and I'll just just leave you with with that to finish on. If anyone wants to hit me up after this, THANK YOU.

ONE TWO. IF YOU'VE GOT ANY QUESTIONS, THEN FIRE ALL RIGHT, I'll I'll walk from the front. I think you've got it. No, I uh Do you think so? You're being too polite. Um Hi there. Hi. Uh one of the things you were saying before is when you came to some of the events, you said you kind of felt out of place cuz you're not in the industry yet. How how would you say you get around that that sort of mindset? Yeah, so I guess what I meant then is imposter syndrome, which obviously I think everyone kind of gets to a degree, but my attitude is that if if you want something, you know, that much, you really push

yourself You've got to push yourself forward to get what you want and you know, really sort of believe you should be there if you're passionate enough about it. So, um so, yeah. Thanks. Well, I'll go for you.

Hey, thank you. I think we connected on LinkedIn. I don't know if you remember, but um Oh, Serene. Yeah, yeah, yeah. Hi. Hi. Um yeah, I I in in a lot of ways I could kind of resonate with you because likewise I made a career pivot and um yeah, it took me several years um of first getting interested in security about 11, 12 years ago and it's only been the last four and a half, five years that I've actually finally made it. Um but yeah, you're right, it is it is quite difficult and I think I just wanted to highlight that I think you brought up a really good point around diversity. So, I've worked in uh

employee resource groups, DEI and all of that and it Yeah, often I we've definitely noticed that inclusion is really about it it's really also about it becomes like a class or an education access or or even just, you know, uh different learning style kind of a thing as well, right? Um it's not just those those things can also get in the way and and I think and you're right, that is something that I believe in the industry is something that's often missed. And you know, I can understand from a business perspective of oh, we want to save money you know, we'd rather do the less risky choice of a candidate with more experience, but but you you brought

up a really good point around transferable experience, uh your work ethic, you know, business being driven, that kind of a thing cuz it's also about the soft skills and the other experiences that you can bring and not just the technical stuff where the other stuff that you can actually learn on the job. Um so, yeah, I I think it's I think it's really it's something that you really need to look at and like you said, it's it really comes down to a a difference in in background and being able to show a different way of thinking. You know, it's like when you talk about board advisors, advisory boards, they will say have a more diverse board and that way you have more

uh difference different views of looking at things or solving problems. And and you know, statistics do show that. So, yeah, anyway, I just wanted to highlight that um because also I really do agree that it would actually help businesses because that way they would have more different ways of looking at things, different ways of approaching a problem, innovation, solving problems and all of that. And um and also it's about kind of it like you said, reducing the talent gap, right? We all hear about this talent gap and there's so many candidates trying to make it. In the US, you've got these jobs where they want entry-level with a CISSP, which is ridiculous if you look at the

requirements for that. So, anyway, um I I think kind of my question I guess is Sorry, that was really long. I think my question I I like you, I I don't do well with the traditional education system at all. Um and likewise, it's more about sort of so something that really helped was doing hands-on stuff and then being able to like blog about it or show do some like online free CTFs and say, "Hey, I learned this. I did that." And um yeah, I I don't know if maybe you'd you'd consider a degree apprenticeship or like going maybe not going back to uni, I suppose, but um yeah, I I would say probably also look at things like

open source um projects that you can contribute to, things like OWASP application security and such. But yeah, sorry, that wasn't really a question. That was more a Yeah, that was definitely a I'm on like sort of things that I don't know if you're if you've thought about if you're looking at that as well. Yeah, yeah, um apprenticeships, I'm I'm totally on board with like I said at the beginning, I've got two already and I definitely had a third, which, you know, yeah. I think the last 30 seconds are going to be the case of Oh, no, we have four minutes. Sorry. That's absolutely, yeah, demonstrated. Okay. Um Yeah, so open source projects is a fantastic one because they're always

looking for assistance. There's no barrier to entry, only your time. And time is very valuable. And people respect your time in the open source ecosystem. If you find a bug, that's that's a great great great contribution. If you create documentation on how to better secure an implementation, it's a great contribution. It demonstrates that you understand the concepts, the technologies being used. Um likewise, documenting what you've learned, um sharing that. These are all really good things to augment your profile. Mhm. The hard thing is how do you separate yourself from the competition? Mhm. A bit like when you you know, you're positioning a property, you need to know both the buy side and the sell side.

So, you want to take those skills in selling and look at yourself and how you're selling yourself and augment that. Absolutely. I'm going to have to draw to a close then. So, No, no, thank you all very much. Thank you. Really interesting insight. Thank you.