Guest to root - How to Hack Your Own Career Path and Stand Out

thank you for that lovely who's screaming here so ya don't see me fun I'm Javad Malik thank you for in boo to run off uh-huh yeah what do I do two hands okay oh I don't that my work right so I've only got 25 minutes or 30 minutes for this talk so i guess i should high-tech solution speed it up cool thank you so i'm going to okay has anyone ever seen one of them see me on youtube ok cool so for those of you who haven't you probably have no idea what I'm talking about but that's a good thing okay so three security people walk into a bar stop me if you've heard this

one yeah the three people are a security person that security person and V security person and if you walk into a conference or if you work into an interview that's kind of like you you adopt one of those three personas if you haven't seen me on youtube and if you don't know who I am I'm just a person here at a conference standing in front of you asking you to listen to me if you have seen me on youtube then you're like oh he's that person who talks some bullets sorry please no one tweet that can you edit that out i'm not i joined alienvault about a year ago and it's the first time i've got a PR person who

actually like you know slaps my wrist every time I I slip up yeah thank you thank you

so yeah because it's only 25 minutes I prefer interaction like that think of the like the new facebook reaction emotions interact like that with me don't ask long questions cuz we don't have time for that anyway so if you see me on youtube you say oh he's that person and like you know but if I was actually someone of importance and value then you say oh he's that person V person so during this causes talk I might be a person to you now but by the end of it I'll demonstrate how I am the security person so it's broken into three acts like a classical drama but like a marvel comic there's something off to the trailer so don't leave too

quick if you think that after that end credit so don't leave too quickly this isn't a talk about how to write CV or how to go and give an interview or the body language issue to adopt or the language you should use or the suit you should wear if there's plenty of really qualified people who can help you do that this is more about how do you build your career how do you map out your path and how you get get ahead whew I don't need to happen my career I'm perfectly happy I can cruise along and work is not my life does that describe anyone is anyone really really happy that is everyone really happy in their job

you've got the the right type of work and the right type of money or you're overpaid and you know if you are then that's great but what if disruption happens and we all talk about disruption because a actually over the next few days you're going to hear a lot about disruption because every startup is disruptive in in the security space but on a personal level we get disrupted all the time sometimes we get married or we get divorce or we have kids or an older parent gets ill and we need to look after the wigger ill so or our company gets acquired by another company or a whole myriad of things happen things get disruptive and then you know what you

don't want to be is back to square one weighs like oh crap now gotta make a CV and now but I'll go apply like a security person Hey look I've got a CI SS p boom yeah that should get me in there no it doesn't so a lot of this I built in to my own career over many years because I found myself in a position where like your nails are okay I'm worth more than why I'm getting paid or I shouldn't have to compete with you know masses of uneducated herds hey Tom I see you thanks for making it cool but let's say we may you did find a decent job and one thing I found very early in my career

that there are certain myths that come along with a job that you know hey there's a career ladder or you'll be treated fairly or you know you'll be rewarded purely on your good work and nothing else and I found these to be myths so I thought okay need to take matters into my own hands and we reached the first really main point that how I brought be a bit serious about this you got knowledge along the x-axis and a lot of what we do we spend our time focusing on that x axis you spend your entire career saying oh you need to know more you need to learn more so eat so we read that we take courses we come to

conferences and we learn about technical staff and all that kind of good stuff but simply moving along the x-axis isn't enough there's also this y-axis it's loud there's also this y-axis that indicates how far your reach or influence goes with that knowledge how many people do you actually affect positively with that knowledge you could be the best web app developer in the world you can code some seriously secure stuff that no one can get into but if that isn't adopted or easily implemented or you know understandable by others the value goes down so you know you can break it down into like you know over here down down on this side of you know the lower end maybe on your line manager

realizes the value as you go up the industry or your peers begin to recognize your value and write the top the public you know or like you know so that's kind of like where Dave Kennedy is were like being asked to come on Fox all the time and and this is where you know some some new wood would be so now we can play a game and the game which I started off playing with I'm like home well you know where do I think I am on the knowledge scale out of like you know if this is like you know the sum of all security knowledge or just secure you know knowledge within your particular field

how might have far along am I on this and then how far up does my influence and reach go how many people actually know that I know that much about security and then it's completely arbitrary yeah and then i thought i put plotting points and I thought hmm who do I think it's outside thinking about different people I thought how much do they actually know and how much are they actually known or how much influence or how much positive influence have they got on it so you can think I i call this square this circle here Peter lines Peter lines as a gentleman I used to work with at a bank and he probably knew

more about card security than anyone I've ever met in the world he was about 70 the last time I saw him he was still working he was involved in with the first debit cards sort of design in the UK he went from advise many banks and regulations and everything like that but he was very content in just doing his own work and no one outside of his bubble knew why he done and at the age of 70 when he was just about to retire he actually was learning less than what most of the other junior consultants were making I know money isn't everything over here you've got the excuses own this is where people don't

really know that much they're not really willing to increase their knowledge and they're not really like sharing or reaching out to people so they tend to make excuses ah you know what I'm not getting a pay rise because I'm short or I'm brown or I'm overweight you know where I've got facial hair or about tattoos or piercings or what and this is where like you know and then you find other people that like that song yes I don't get promoted as well because I'm short as well yeah okay and over here this is that the worst zone to be in Piers Morgan that's a good one was that you oh who was it I don't know I'm just

throwing me throwing this stuff I need to get rid of this these are meant to be oh sorry these are meant to I hope no one's diabetic because then you think I'm trying to poison you if something I use a call that the Gregory D Evans sort of bubble butt Piers Morgan it is good one I'm did really pausing here because I think this is one of the main sort of things here if anyone's got a really quick facebook like type reaction to give me you can do and i'll throw you chocolate or answer your question good so now I came on this stage and I was just a speaker but now on that speaker

I'm that speaker who explained a wonderfully complex you know formula to you and I'm that speaker who's been assaulting you with Hershey's chocolate see now if I had come to this conference and not given a talk I would have just come as a person and left as a person but this way I've influenced this whole room full of fantastic security professionals so act to habits of highly effective security professionals and i'll be looking at a lot of people and some people call it stalking I quality intensive research into like what what some of our peers do and what makes them really successful so one thing they do they they make others look good you know

sometimes there's that tendency to want to hog all the credit and you can do great stuff and do the credit but if you make us look good in the process it actually works really well you're always bitching and and this is a tweet a karma the guy who pushed past me on the tube and then suggested to go [ __ ] myself just arrived for his interview with me and I see that happening quite a lot of conferences as well you know sometimes we come here and this free booze and there's parties and people get loose a beer and then you like someone's really good but then you get a call from someone nice someone says come for a job

interview what do you think of it and all you can remember is that person drunk and making inappropriate comments towards the marketing lady so you know these things go a long way create be a creative not not not a consumer and I think you know in our industry we're pretty good like this people who is creating stuff but you know the more you create as opposed to consume the more better is for everyone be known for the success of others you know it's really easy to say hey man I totally owned their system okay that's cool well done we've been to energy as an industry we've been doing that for many years what we did to make that better embrace

your limitations who knows who this gentleman is he's possibly know sorry who said that who look at your dads like where wasn't me don't throw the chocolate at me oh okay whoever said that yeah it's scatman john now he was a singer you can look him up on youtube he had a way oops I offered this peace offering he was actually born with a really bad stomach he couldn't get through the whole center than interview they incorporated that action into his style of singing he was a success okay he only had one hit yeah but that kind of ruins the narrative that I'm trying to show here but you know trust me you can embrace your limitations that there

are people who work in remote parts of the world now they don't have come to conferences but they can still make an impact in the industry there are people who have some challenges but you know personal challenges physical changes but this can still make a thing and you do that by embracing your limitations this picture of me here this is me here I look like I'm about to throw up because I was about to throw up this was in 2012 be besides London and I was about to go and give my first talk and five minutes in you know they say it's all about that initial push like you know just get the ball rolling and you feel better

absolute rubbish because five minutes then I was like still shaking and I was like I just want this to end and like you know I could see people looking at their phones and losing interest bit like that guy in the back but that's all right but um but um everyone at the bank's wondering did he point of me did he point at me no but um yeah I think speaking is one of those things it's like a miles you just got get enough miles up and you get a bit better at it's marginally better if you're not good at writing or blogging the more you do it the better you gave you're not good at coding is it's like that 10,000

hour rule that marc malkin level things the obligatory motivational poster of Mahmoud Ali I don't count my sit ups only count and when they start to hurt because they're the ones that really matter are you pushing yourself at three walking the talk so how do you bring all these things together and and do that so who's familiar with what this is it says it on it yeah yay so go then there's a personal OSI model that I created boom so this is what I can't light used to refer to as my personal website model when I'm going to a conference because i'm actually quite an introvert I know it doesn't look at I'm a media [ __ ]

actually but yeah I'm seeing okay these are the things is kinda like my little checklist so i'm taking my back pocket and what is it do I know what I'm talking about knowledge is power if you don't know what you're talking about just so you don't know what you're talking about this is what I called the fish and chips presentation layer fish and chips are the same that there's the same fish and same chips but the presentation makes it very very different where would you take your wife you know you know and what would you pay more for session when you interact with someone you have a session with them what does it walk away thinking did you

even listen to what their to say were you talking about 100 miles per hour an excuse because I'm upon or not but generally in 121 what's your transport layer how are you actually communicating and what's the best one for you are you like me do you like to use YouTube do you like to speak at conferences do you like to write about stuff in blogs you like to post medium do you like to share stuff through as a beauty of Instagram or do you like to make those coffee and lemon stain portraits this all forms of communication what's your transport channel yeah networking these are great opportunities abd always Oh ABN always be networking not suppose and yeah that

goes without saying that you know I know conferences are notorious for bad personal hygiene and all that kind of stuff but hey we can all do something that this is where I need your help how much time do we have letter I'll be on time yeah cool okay so like I said this is a bit like Marvel I'm going to pretend to end here yeah and I really need all your help yeah either I'm paying attention yeah okay cool I want to say thank you and walk off stage and I want you to start clapping and ask for an encore is that good cool okay thank you very much everyone

oh man you guys are too kind I did not expect this own geez I've never in my life seen anyone get an encore performance at security conference have you but I'm going to tweet this out my mom's gonna be so proud hold on a second how about take a selfie I'm sorry cuz no one will believe me otherwise but I'm going to take this and I'll tweet out later as well and none of you can refute it because that's 100% the truth hold on hold on I should have proof okay so with an encore I have now gone from being that x to the guy who you want speaking at your security conferences because this is the most entertaining security

professional in the world and what I mean by that is you can distort your own reality then you can make you can't wait for people to come you know and are and and recognize your work you need to demonstrate your work and sometimes that means bending some truths in a way slightly I'm not saying lie I'm not sayin maybe it's spin yeah but I'm saying what are you doing to get yourself noticed i'm sure most of you will remember this there's been best 20 minutes of my life ever but I'll remember this a lot hopefully you remember this at least maybe you might not remember my name or anything but someone might see something will you

have that tour where that guy was talking about some things and he had a bit of an English accent he had the encore yes him yeah how many other speakers have done it and and and find your encore in your career what are you doing in your career that will get you remembered when you leave the job do you actually ever think about the projects that you worked on other than in a bad light about how messed up it was but you know what does those people think of your work when they read your name on any documentation on repentance report what are they thinking how what legacy have you left behind have you left behind enough a

legacy that they say you know what we wouldn't mind having this person back and one of the ways that i think is is really powerful is to find your own niche and the comedian i was watching original D hunter I thing and heels like Americans have had a love like these motivational short phrases but they don't mean anything it's like be true to yourself you know or like in Batman is like to defeat fear I must become fear and that which would be like to defeat SQL injection I must become SQL injection so I looked around and asked around a few people were like what was the best definition of finding your niche and this is kind of like one the

ones i settled on which is like you know it's it's the intersection between your expertise and one of your passions and if you can please that [ __ ] down if you can find the intersection and and that could work and that he might not make you the person but can make you that person and even becoming that person in the industry at the moment can can account for a lot so now his name escapes me the guy who does the faces of DEFCON with a coffee and lemon the portraits yeah exactly see you know him and how do you know him if he didn't ever do his hair dun dun he go um so how

would you ever know him if he hadn't done that I a lot of my success in my career came after i started making stupid YouTube videos flashing my sist badge and all that kind of stuff and you know it's kind of like wait wait you find your passion where and how do you do it with your expertise and I was watching didn't wanna hitters come and see that soldier or Fortran talk earlier today that was absolutely fantastic but I know that guy he's his knishes like you know he's carved out his niche and he came and demonstrated his nations mainframe security connected to the Internet something you know hardly anyone else is doing if any if anyone's

doing if I say hacking cars who do you think of there are a few names that probably pop into your mind if I say scanning the internet who do you think of you know there are certain things that you think of and then you immediately you mind will go to a few people and then there's some people who are just generalists you know there's all people you say oh I just want a safe pair of hands to babysit this risk assessment or doing like these assurance activities they're just there a security person that's just a security person there's a generalist but if you want something more specific then you go to those people that you go to that person

and that's kind of like you know I suppose the essence of what I'm trying to get to I'll leave you with three parting thoughts because I read this book about in presentation secrets of Steve Jobs and he always done things in threes so step outside your comfort zone because that's you know and a lot of people like and I wasn't joking earlier I am an introvert I hate like you know a lot public interaction and everything but I had to force myself and you know get better at public speaking and hopefully I'm slightly better you can tweet me afterwards if you disagree keep improving acquiring new skills and and these are skills for both your knowledge

and your passion when I first started making YouTube videos is absolutely atrocious I used to film on a potato and it was just horrible and now it's marginally better but even now I still like you know have a lot to learn and and the most important thing and people were saying how you talk to some of the new kids and they also know I'm talking to some of the older kids in here as well because sometimes a lot of people do a really bad job of protecting their reputation and reputation goes such a long way in such a small incestuous industry it's like you know if you're if you're at a corner like this you meet

one person they introduce you to someone else I know you and you're like the friend of so and so when you're the sister of that and you know it's such a small industry that unless you you aggressively protect your reputation you can lose a lot very quickly the industry if you read like I don't know I'm not 100% sure that of the skills got figures but what I do know is that there are plenty of jobs out there and if you're not making the money that you want to make and if you're not doing the work that you enjoy doing that's motivating you and challenging you then I don't think that's the industry for I

said it's easy to fall into the excuses trap but I think there's plenty of opportunity to do it and hopefully out is only half an hour so I couldn't go into detail on around a lot of the stuff up got detail on us is on most of the slides but you can hook me up afterwards but you know the limitations are mainly self-imposed is the boom phase of the industry who knows how long it will last make hay while the Sun shines and with that that really is the end so thank you very much

funko know on behalf of b-sides and Fitbit we like to give him a Fitbit all right thank you thank you very much