BSidesNCL 2020 - G.E.D. to C.E.O: How I Hacked a Career in Cyber - @infosecwar

hey duncan because that's why everyone's here sorry about that no worries no worries it happens right so you can hear me okay now though right that is loads better yes thank you fantastic yeah i gave it a little gain on the mic there okay so uh as i say in cyber speaks live uh we get some great co-hosts on there for each episode i'm talking folks like troy hunt from have i been pwn caitlyn bowden from the badass army um and johnson uh gosh the corporate vice president cyber security with microsoft marcus j carey um you know if you guys are familiar with the tribe of hackers book series in the summit uh he's the founder of that whole

movement there and by the way speaking of the tribe of hackers the blue team edition of that book series is dropping on the 16th of this month i am so honored and just grateful to be one of the co-authors of that so if you haven't already uh check it out on amazon or whatever book source you use and uh go ahead and pre-order that it's just a phenomenal series but um you know the other role that i host in in uh play is what we're here for today and that's being the founder and ceo of operandis where i get to work with some of the cyber security industries most recognizable brands helping them to create

compelling technical content for their audiences as well as doing some uh or conducting some pretty insightful competitive analysis engagements for their internal teams uh so that's what i do on a day-to-day basis when i'm not sitting here on a saturday doing these kinds of things so uh with that this talk is actually uh night and day from david so he had what 90 slides there and you saw my one slide so i'm gonna be basically just playing off of my notes here and shooting from the hip i hope nobody minds that but enough of the powerpoint stuff uh you guys have my video okay yep yep looks great really good perfect all right so that being said um you know it's really

hard for me to get into the subject of today's talk about you know going from basically a ged and in case that doesn't translate well into the uk i don't know but basically a general equivalency diploma um you know how i went from being you know high school dropout with a ged to becoming the ceo of my own company and you know the cyberspace i really can't do that without giving a little bit of background um on essentially why i didn't graduate high school to begin with and some of the effects that that had on me in my development years in early adulthood so forgive me but i'm going to give you a little bit of background on me

and um this might get a little bit deep emotionally so trigger warning for any of you that might relate to some of this um i'm going to talk about some some core issues at the heart um i had a pretty rough upbringing um i i didn't i didn't come into cyber like most people that you know graduate high school go off to a four-year university graduate from that and you know maybe they interned during their summer months and you know just landed into a job and went through the career development process from there my life had a much different set of circumstances so to speak so my mother was a 12 year old runaway and met my father when she was 15 got

married had me at 16 and um he was a very abusive alcoholic and put my mother into the hospital a couple times and after that second time she left him took me and we left mississippi where they were and went back to new hampshire where my grandparents were and started over um that experience and growing up without a father played tricks with me um it weighed real heavily on me and especially around the age of five in kindergarten and starting into school i start i started to see that i was different than the other kids there this was the early 70s and it wasn't acceptable back then to come from a broken home it wasn't acceptable

back then to be a single mother raising children uh you know divorce wasn't as commonplace as it is today and women that did divorce their husbands were frowned upon and as a child of a broken home i was looked at differently i wasn't good enough um same kind of thing played out in my head with my own father and you know as much as he was an [ __ ] and someone i didn't need in my life i still wanted that fatherhood i i wanted that relationship and it didn't matter um you know when every birthday christmas new year's it didn't matter any holiday kind of brought those feelings back up and you know looking for that birthday

card in the mail or a christmas present or for him to show up on the doorstep you know wanting to be a father in my life it just it never happened and it started making me feel like um there was something wrong with me that if my own father couldn't love me if he didn't want to be a part of my life there must be something wrong with me right and that weighed real heavily on my mind and started to affect the person that i was becoming and by the time i was in my early teens i started acting out and i got involved in drugs i got involved in alcohol i was partying all the time having sex way too young

getting in trouble with law uh law enforcement uh skipping school getting arrested um you name it i was putting my mother through a living hell to the point that she ended up shipping me down to my father when i was uh 13 years old and that didn't last very long he ended up beating the hell out of me and um well i'd be immediately sent back home to my mother where things just continued to get worse and worse along the way my arrest history started to get much more severe and getting into trouble but i always seem to manipulate the probation officers the courts the prosecutors and would have continued sentence after continued sentence longer probation these kinds of things

but never really doing the jail time itself but um fast forward probably into uh 15 years old i ended up working at this restaurant and had a friend that was there he introduced me to this cop that would come in very regularly and uh got to know him pretty well you know at least you know from a customer perspective you know we would sit there and chit chat and whatnot and one evening he comes in with his partner and uh they sit down have dinner i wait on them you know doing a little chitchat like we normally do they leave and afterwards my manager comes up to me grabs me by the hand and says come on i need to talk to you

outside and we start walking towards the front door and i'm wondering what the hell is going on well i go out there and there's my you know police officer friend dave reagan and his partner that i just waited on and he looks at me and says son sometimes there's things that we have to do in this job that we don't like and this is one of them he said i have four warrants out for your arrest don't run apparently he knew my track record and knew that i liked to run from law enforcement i told him i won't dave and uh he said something to his partner that walked back inside the restaurant and he

and i got into that car starts taking me to jail and decides to pull off on the side of the road puts a car in the park opens up the slider to the back and he looks back at me he said son what the hell is going on with you so what are you talking about so what's going on why are you doing these things and i told him dave just put the car in drive let's go he says no we're not moving until you tell me what the hell is going on in your life why you're doing these things why you're ruining your life and taking your mother down with you and i don't know what it is about that

man or that moment but for some reason all my guards just came down i wasn't being that hard ass anymore i just became vulnerable and i lost it i i was crying uncontrollably and i let it all out put it all out on the table and i don't know how long we were actually there but we were there a good long while i wish i could say that dave took me home and slapped me on the wrist and everything was fine from there he took me to jail and unlike every other time my mother didn't get me out she left me there this time and i spent a couple weeks in juvenile detention where i spent

about 22 hours a day in my cell only came out for meals and uh finally my court date comes and i'm looking at all these charges not just the four that i was arrested for but all the other ones that had suspended sentences and i go into the courtroom and in walks dave reagan that police officer and his eight-month pregnant wife and he asked to speak to the judge on my behalf had it not been for that man and for that moment of being vulnerable and just breaking down and putting everything out there that man he saved my life or at least put it on a different trajectory than what was in store for me it's very likely that

i'd be in prison or dead right now if it wasn't for that man and him taking a chance on me so lesson one it's okay to be vulnerable it's okay to let others in and tell them you're not doing okay you know there's a lot of things that we go through in life and in this career that are challenging and it's okay to be vulnerable um good things can come from it it did for me so i end up becoming a ward of the state um my mother she she just she couldn't put up with me anymore i was too much for her and put her through way too much hell so basically i flip-flop between foster

homes and group homes for the next you know couple years and as i'm approaching 18 it is required of me to take ged preparation courses because i was a dropout um that's a whole nother story but basically in order for me to drop out of 15 i had to get by the probation officer i had to have three letters one from my school saying it was okay one for my employer and one for my mother now the employer was no problem i i got that one just lied to him told him a [ __ ] story and they gave me the letter the school that was an interesting one i walk into the principal's office tell

him what i wanted to do and he looks at me butch scared i still can't stand the guy um and you'll know why here in just a second but he looks at me and he says let me tell you something boy you want to come to school fine you don't find i'm tired of [ __ ] with you his words not mine so yeah i got the letter from the school the one from my mother that one broke me um when she signed off on that letter she basically was writing me off and i knew it and i can't blame her she did the very best she could with me but i was too much and when she wrote

that letter it kind of told me i'm done you know this is it she's giving up i'm not good enough not good enough for my father i'm not good enough for my mother not good enough for the school you know we moved around all over the country you know i never had friends anything like that i wasn't good enough i didn't sound like them i didn't look like them you know everything in my life at that point was told me i wasn't good enough but remember dave reagan took that chance he told me i was good enough that i had a future i had an opportunity to make something of myself so i do the ged preparation course and

um right after my 18th birthday you had to be 18 and or to take it back then in the state of tennessee i uh i think there's no way that i've passed this thing you know i i didn't have the confidence going in and the whole time taking the exam i'm thinking there's no way i'm not good enough i don't know this stuff it's too much i should have stayed in school i'm gonna be washing dishes for the rest of my life a few weeks go by and i get the package in the mail big manila envelope and i open it up and there's a letter congratulating me on passing it along with my certificate

that i still have to this day so i passed my ged and that's essentially how i got to not finishing high school to begin with sorry for that background but i think it's applicable to some other things that happen later in my career so i'm 18 a couple years go by i'm 19 i meet a young lady and uh fall in love and she ends up eventually becoming my wife but we ended up uh co-workers together working for this company and we had some really great benefits there and uh one of those was access to a credit union and i um i convinced her to let me take out an 1800 loan to go buy a brand new

computer and printer and i told her i'm going to make money off of this now part of what ins incited me to go out and spend that kind of money on a brand new computer and take out a loan to do it was the other fringe benefit of this company is that they had a relationship with the local community college that they would bring college professors on-site to teach credit courses at our facilities and if we took those courses and maintain a c at uh c average or above they would pay everything up front you only had to pay if you fell below that c average or you didn't finish the course so here you know being this you know ged

high school dropout you know i have an opportunity to get some college credit now the three courses that they offered uh initially were psych 101 dos 3.0 in lotus 1-2-3 i took all three i wanted max out now i'd already uh got married at this point we're still working together and we're pregnant with our first daughter in the psych class we kind of became the uh case study so to speak for family psychology we were just the model working together married having our first child all that stuff the dos class i loved i absolutely fell in love with the dos operating system i don't know why but it just intrigued me the lotus 123 i'm not a spreadsheet guy

i i could have taken that or left it but i did maintain a 4.0 for all three of those classes and it really got me moving so she agreed to let me get this eighteen hundred dollar computer and printer the brand name was leading edge it was 486 slc and it was badass for what computers were back then but one of the guys that i met in the dos class that i worked with obviously um he and i started chit-chatting about stuff and he told me about these bbs's bulletin board systems back then well i didn't have a modem so a couple weeks go by he comes in and he hands me this this card that goes inside of the

computer and he tells me here you can have this use it to get online and it he tells me it's a 2400 baud modem that he doesn't need anymore he just upgraded i'm like cool so i run home i take this thing apart and i'm figuring out how to drop this card in there and make all this stuff work and for the next two or three weeks i'm just beating my head against a wall you know pounding the keyboard trying to figure out how the hell i get this damn modem to connect i can't do it to save my life and back then you know we didn't have google we didn't have you know computer books you know

filling the shelves at bookstores magazines you know they weren't really prescriptive or guiding in these kinds of things so i'm sitting there on my own trying to figure this [ __ ] out and nothing's working no matter what i do i can't figure it out i can't get this damn card to work so eventually i tap out i go back to arthur the guy who gave it to me and i said look man i i can't get this to work he says what's going on i said nothing i uh nothing at all it will not do anything he said all right i'll come over and help you so he does and in less than an hour we

have this thing working you know i didn't know anything about jumpers i didn't know anything about irqs i didn't know anything about high mem all this stuff you know we sit there you know tweak a couple things and i get that very familiar sound that i'm sure you guys know that squelching modem connecting and i get my first glimpse at a bbs a bulletin board system and i fall absolutely in love in love with it to the point that within just a few months i decide i'm tired of just calling into other people's bbs's i want to run one so i go out and i get wildcat 3.0 and i start building my bbs and before long i'm

dropping in a robo board i'm adding a 20 meg hard drive i'm upgrading the ram i'm doing all this stuff and i end up building one of the largest bulletin board systems in the state of tennessee i was having fido net email back in 1993 you know that was like the first version of internet email um you know it was one of those things if you've never been on a bbs or never been a sysop that's being a bbs sysop system operator it is just like being on the front lines of a help desk you have to learn how to support your users you have to not only support your own users but you're likely

working with other bbs sysops and helping them they're helping you uh the phytonet network you're having to deal with other nodes on that network that are up the chain so to speak you know so that really got me even further inspired and wanting to make a career or do something with it it was a hobby still but i was so enthralled with everything but now i'm turning 21. i already have one daughter i have another one on the way and i turn 21 and it's time to pay dave reagan back for what he did for me i go into law enforcement now while i was a police officer um one of the detectives came up to me

one day and she asked what do you know about the world wide web apparently word got around that i was into computers i said i know a little bit i really didn't um you know i was just getting out there and uh she said do you think you would be able to help us create a web page on the world wide web that's what they still called it back then that or the information super highway we won a webpage for rape awareness and prevention she was with the sex crimes unit i said yeah let me see what i can do so using the mosaic browser and trying to figure out html 1.0 i'm looking at

other web pages and viewing the source on those and kind of looking at it side by side and seeing you know how these paragraphs are structured how the bolding works how headers are working links and images and all this stuff and i'm basically reverse engineering the html 1.0 language and trying to teach myself how to program so i can write this webpage for them and i do there is nothing wrong with reverse engineering other people's work so that you can build your skill sets there's nothing wrong with looking at scripts or application code and teaching yourself from what others have already created you know it's a great way to be able to build your skill sets and

you know build off of what others have already done out there now i'm running the bbs i'm still in law enforcement and i decide i want a little bit more so i go back to columbia state community college and i sign up for a nobel network in 2.2 course and intro to programming logic and design now that last one there i still use those skills to this day for scripting programming writing code um you know that was just a phenomenal course using the hypo language which doesn't even exist it was hypothetical it was a machine level programming language that the university wrote but it taught me how to think logically when it comes to programming

or scripting and that skill set you'll find out came into extreme use later on in my career but now i'm really starting to build some foundation and the reason i left law enforcement is at the time the metropolitan nashville police department and our division within it was caught up in a lot of politics and unfortunately it cost two officers their lives and it's a long story but at that funeral they're my dress blues i started thinking to myself this is not what i want for my daughters i had two of my three children at that point and i didn't want them to grow up fatherless like i had i didn't want them to have something like

that funeral uh [Music] be their last memory of me so i decided i'm going to leave law enforcement and i'm going to make a career out of my hobby and i did the first job that i took was working for a break fix company basically we had small businesses that we supported from an i.t perspective and they would have anywhere between say five and 50 at most computers in their environment some of them had nobel networks which that course obviously helped me out with but it was break fix kind of work you know swapping out memory you know upgrading hard drives replacing monitors that kind of you know bollocks but it gave me a lot

of foundational skills that i needed and after about six months i went to work for a bank that was headquartered there in nashville a little regional bank but very well known throughout the southeast region and i went in there as a contractor um working for a third party kind of like the brake fix company where they owned the pc support contract for that bank and they kind of paid us i would say decent it wasn't on par but it was enough i went in making 28 000 a year and i thought that was pretty good money for you know essentially a high school dropout you know and this is around 95 and i go in and

very quickly start to see the writing on the wall and this is another lesson look for changes in the marketplace look for those things that are signals the writing on the walls so to speak but we were a nobel shop we were running cc mail and a bunch of archaic stuff but i could see that we were implementing more and more microsoft based technologies so i started focusing on those windows 351 uh windows nt351 windows nt40 sql server exchange windows 95 and i started to carve out a role for myself within the organization focused on those technologies and as the bank decides they're going to do this forklift migration essentially taking every product that competed with microsoft

they were getting rid of so we were flipping from nobel to windows nt network and we were going from cc mail to exchange uh from flat databases db2 and stuff to sql server going from down level versions of windows you know windows 3 1 3 1 1 windows 4 work groups we were going to windows 95 we were getting rid of lotus notes and going to office so i really focused on those and built a role for myself and before long the bank hired me on as a full-time employee and i got a nice little bump in salary as a result i think at that point i went to uh 36k now i'm i'm bawling

right i am elated with myself remember i'm still just a high school dropout and uh anyhow um while i'm there i'm trying to figure out how can we automate this so i start looking at the now i'm responsible for this migration team that's handling the windows 95 deployment office and internet explorer those were the three things that we were primarily focused on from the desktop perspective and i owned that from a technical standpoint i had a project sponsor um you know an executive sponsor but i led the engagement or the project from a technical perspective and i needed to automate as much of this as possible so i start looking at things like scripted operating system installs and

automated office installations the internet explorer admin kit for internet explorer so we could customize it and then one day the technet cd subscription shows up on my desk back then we didn't have it online it was sent to you in this binder and you had to put all the pages in and the cds and all this stuff but one of those cds said systems management server 1.2 beta systems management caught my mind or caught my eye and i look at this cd and i start looking at the release notes and i figure out that this is a product that does two primary functions and apparently very well it does hardware and software inventory and software distribution perfect that's

exactly what i need for my project i need to know what's out there and how quickly we're moving along with this migration so software and hardware inventory can give me that and i need to be able to push out a scripted os install and automated office and internet explorer once it's been upgraded to windows 95 so i set up a proof of concept and within uh two or three weeks get it all sorted out and figured out and i'm off to the races playing with this now unfortunately the bank did not want to spend the 75 thousand dollars it was going to cost us in licensing to implement sms so that i could use it

fully for that project so that got pretty much canned but doesn't mean it didn't go on my resume and my resume was out there on monster.com a couple months goes by and i get a call from this recruiter out of new york now this is another lesson i want to give you guys recruiters get a pretty bad rep in our industry but i will tell you out of the three most significant career moves that i've made it's been the direct result of working with a recruiter in that process and remember folks this is a small community even though we're global it's very small and people talk so be kind to these recruiters you don't have to be rude to them

no matter how far off the job wreck from your skill set may be remember they're probably noobs too and they're trying to learn and they're not technical so they don't necessarily know that you as an infosec person aren't really the right target for this dba position you know just try to be kind to them and remember they can have a significant impact in your career too so i get this call from this recruiter out of new york and uh yeah he's a typical new yorker i'm the southern boy he's talking way too fast and has this thick new yorker accent you know sounds like he's right out of brooklyn and all of a sudden you know he's

telling me about this role sms admin blah blah blah you know like i said he's talking a mile a minute and all of a sudden he just throws out there this number 60. i'm like 60 what he's like 60k and i say no i'm really happy where i'm at now at that point i was making 48 and 60k just it wasn't enough for me to leave and i meant when i said i was very happy i loved my role i love my team i love my company and i was genuinely happy then he says 70. 75 and then he gets to 85 and he says that's my top out and i sit there and i think about this

and i'm like that's almost a 40 000 difference there's guys on my team that don't even make that yet so i tell them okay i'll meet with them well sure enough i get the job and now i am just in awe that i'm making that kind of money and i'm doing something that i absolutely love right so i get this role at cna insurance in nashville managing about 3 000 endpoints with sms and this starts me down this career path where i have carved out yet again a niche for myself i have a very unique skill set working with sms which back then was rare but being used by all these large corporations to be able to manage their

distributed endpoints and know what's out there you know being able to update software and all these things being able to meter for applications so i'm carving out a role for myself in this industry that is also very unique and that's one of the things that i do recommend for folks is that you find something in this field that is unique enough that you can bring a very valuable skill set to the table you know it's really hard to stand out from the herd if all you're bringing is skill sets that are comparable to everybody else out there it's hard to find what that niche is going to be for you but when you see it

grab a hold of that thing and don't let go i started with sms 1.2 beta like i said but that carried me for the next decade of my career it helped me launch a company and i'll get to that here in just a second but i start with cna insurance i i do that quite well for close to a year before i end up um getting recruited yet again to go to wachovia bank in winston-salem north carolina and there i am now managing the sms 2.0 implementation for 25 000 clients throughout the united states one of the things that happened all during this time period between cna insurance and um wachovia i wasn't that great with the sms product

at the start and when i went into cna insurance i had to know everything because i was that consultant being brought in i was the one being paid the big dollars i had to know that product inside and now i couldn't be asking the customer questions about it right or even questions really about their environment and they were kind of hard asses too so very unapproachable but i found this website called swink.com s w swynk.com stood for stephen weinke he's the gentleman that ran the website still a very good friend of mine to this day but it was a back office administrator's website meaning all the microsoft technologies server technologies and they had an sms mail list on that

website and you know if you don't know what a mail list is it's basically a you know email distribution everybody subscribes to the mail list you have a question about the product you send it out to a mail list it goes into everybody's inbox anybody can respond and when they do everybody on the mail list gets copy of the message kind of like reply to all for the internet but that mail list saved my bacon it really did because every time i ran into a problem i'd post it out there and get help from other community members you know i basically had to stand on the shoulders of giants in my mind but i also had this book i

bought this sms 1.2 administrators

skills started getting higher and higher and you know i was learning so much by trying to find the answer for somebody else i i was finding all these things out on my own so a great learning experience for me but one day i'm sitting there and i have this epiphany so to speak and i start a message to the mailing list i said you know we sit here day in and day out helping one another getting you know past our issues over these hurdles but unless it's just something we pick up you know from an off-topic threat or something we know nothing more other than each other's name and email addresses wouldn't it be nice if we could have

some kind of sms users conference where we get together and talk about our lessons learned you know compare our field notes share experiences that kind of thing maybe it could even be sponsored by swink.com and i put in parentheses wink wink well sure enough steven weinke saw that message and he pings me offline and he and i start planning what became the first sms users conference and we held in newport beach california that first conference we had about 100 people show up but what ended up happening is that conference grew and it continued to grow and just a few years later microsoft bought the rights to that conference and it turned into the microsoft management summit

and it grew and continued to grow and survived for 14 years before being rolled into tekken and eventually into microsoft ignite but under that you know sms users conference you know in microsoft management summit brand it grew to over 4 000 people every year you know one of microsoft's bigger conferences but it started with one person one message you know a community getting together and doing something so if you're trying to find a b size in your area and there's not one that exists start it yourself get out there throw messages see who else wants to get engaged make something happen you have a power all it took was one person doing something i'm not saying anything about me just

that's all it takes one person so that's kind of what got me to the point where i could be hired by wachovia to manage this sms 2.0 implementation i just started picking up so much about this product and becoming a little bit of a subject matter expert in it but one of the things that happened at wachovia and this is how i ended up starting my first company i saw a void in the sms product even in the 2.0 version there was no way to have user device affinity there was no way to relate user information to the hardware and software inventory that we were pulling off of boxes so we couldn't track departments or

managers or cost centers you know department codes any of these kinds of things so i developed a program remember that program in logic and design course paying off in spades i wrote this program that allowed companies to customize the types of data that they want to collect from their end users inputting it into these fields with data normalization and rationalization on the back end and it would tie that user input to their machine's inventory so that back in sms we could you know correlate the two and be able to have much better reporting and software targeting and all these kinds of things so i started selling this product as a side hustle and there's nothing wrong with having

your company start from a side hustle uh you know that's become kind of a known nomenclature nowadays but you know back then i was just running a side business you know so to speak but it helped me launch that company having a software product but something else that i did and what really led me to leaving wicobi and starting my own company was i also saw a void in the sms installer product and this is what pretty much every sms customer out there was using to be able to package up software and send it out to those workstations microsoft because they provided sms installer free with the sms licensing they did not support it and there was

no training that existed anywhere even though this is the product that fortune 500 and global 2000 companies were using worldwide to package their software and set it out to these workstations it was um essentially a scripting environment inside of a ui and no training available for it so i developed a two-day course and it took off like wildfire when i announced the first course it sold out in 24 hours less than i knew i was onto something then so i started doing these public courses and having registrations through my website and this thing like i said it just took off i did not realize that it was going to take me around the world i went to

countries all over europe probably 30 or 40 u.s states canada i was doing these courses everywhere and still selling the power meth product that i developed so i was blending product and services in my first company and you know became very successful in it and it got to the point where because of the sms installer training we also started getting contracts to build the software packages that companies wanted to push out for them you know and some of them were wanting 500 and 750 a thousand applications to be packaged i started building a team and you know this company grew and grew but i wasn't prepared i didn't have forecasting i didn't do tabletop exercises of

what-if scenarios and when 9-11 happen the carpet got ripped out from underneath my feet and i fell flat on my face i wasn't prepared for the economic impact uh i had multi-million dollar projects just pulled off of the tables and you know it it gutted me y'all it really did but it also humbled me and i needed that hub humbling you know i grew way too fast way too quickly and i forgot humility in the process you have to remember i was still pretty young back then and my success i attributed to myself and myself alone i forgot all the people that helped me in the beginning you know i forgot about dave reagan i forgot about that sms mail list

i forgot about the guys like rod trent paul thompson stephen wine coop ian turner all these guys that that helped me so tremendously early in my career i forgot to give back i forgot to give thanks to the man above because i was living somebody else's life remember where i was supposed to be prison or grave so that humility it hurt but i needed it and it eventually meant me having to go back to work as an fte employee working for another company after laying off one guy at a time over the next 18 24 months after 9 11. so i get recruited again remember those recruiters to go to work for a company down in

austin texas called collective technologies and that changed my life it really did um my ceo there was a gentleman named ed taylor and um you know ed kind of took me under his wing you know i went in there as a first systems management consultant working for a company of about 250 consultants and we were building out an sms and mum microsoft operations manager practice and i was the first employee and eventually after about six months i grew the team to another four guys and he gave me the practice as the practice manager and he taught me a lot he taught me to know my numbers to know about p ls and utilization metrics and

weighted margins um you know he he really took me under his wing and he became my mentor and i was his mentee and uh unfortunately we lost ed a few years ago and you know i didn't just lose my mentor i lost a friend but you know he he saw something to me and i so valued the mentorship that he provided me and that's something else that i highly recommend to everybody out there i don't care where you're at in your career have a mentor have someone who's going to hold you accountable but also give you the guidance and steer you in the right direction not just professionally but also in life ed was that person for me and i miss him

dearly but i do have other mentors in my life now and i have mentees you know that's the other thing that is kind of required you know if you're going to take up a mentor's time eventually you got to give that back and help the next generation coming up behind us and you know i have a couple of folks that i mentor right now but let me tell you something i get so much more out of that experience than i think i ever give them but i'm blessed for those relationships and i'm so grateful to have those folks in my life so while i was at um collective technologies that's when i picked up my first security

certification my sisp cissp and i took sean harris's book peeled that thing apart i had a set of dvds that i watched every single day i pretty much ate drank and slept that sis for two three months i don't recommend that for folks you need work life balance but i was so hungry back then and i wanted to make damn sure that i got that cert um and that i passed it the first time because it was pretty expensive i think 600 back then and this was back when it was pendant or pencil and paper and the 10 domains of the sisp but i knew when that letter arrived and it said my first and last name

comma cissp i didn't even have to open the envelope i passed that thing and i passed it on my first go and yeah i was shocked because i walked out of that place thinking there was no way in hell that i passed this exam it was just like that ged all over again so when i left ct collective technologies i was recruited again to ireland to build a practice in dublin and uh it was a hell of an experience you know being able to live in a foreign country different culture different foods different music different accents the whole thing it was such a phenomenal experience and it was scary as hell i had to sell

everything i owned take five duffel bags over there with me and start over from scratch not knowing if i would succeed or follow my face again but you have to take risks sometimes and it can be scary but it can also be an amazing experience so don't be afraid to take those risks unfortunately it wasn't necessarily a failure on my part but because the celtic tiger um was coming to an end their economy started to tank and i basically had to come back to the states because it just wasn't going to happen there was not enough sales and not enough opportunities for us to be able to do anything so when i came back to the states i knew i

wanted to be in security and focus on it exclusively so i found a company called secure bench technologies svt that it was just the perfect fit because it allowed me to get into security but also stay true to that system center or the secm and mom background right their product provided compliance automation for all the microsoft server products and rationalizing that back to grc controls governance risk and compliance and it was a perfect fit for me to be able to take all my skill sets in systems management but also these new skills that i was developing around security and focus on that i was also able to get my first real hands-on experience doing things like

marketing and product development and management building a global partner network so i'm taking the foundation that ed taylor gave me at ct and you know what i was able to replicate in ireland and bringing that back inside of this security company and starting to build something there uh so i was really grateful for that experience and it ended up leading me to heat software where i became the director of the patch management product that they provide that plugs into ws and sccm to be able to provide third-party patching using the exact same process and technologies that you know organizations use today with wsus and sccm for patching microsoft products right except now all the third-party products on top

of it but i own that product soup to nuts and our investors clear lake capital also owned land desk and they because heat software had about a two year jump on land desk as far as cloud enabled service management they wanted to bring the two companies together and build on that story right so in the new organization i became the uh security principal engineer as basically a fellow a technology fellow in the company and i had five dotted lines of responsibility where i again was doing product management marketing channels uh sales engineering and services you know all these things relate to building a company and everything that you need to know in being a leader in an organization

around cyber security you know i need to know how to develop product but i also need to know how to develop service how to market and sell that how to support it and how to keep that product relevant through updates and whatnot so building all the way back to my side hustle with wachovia you know i'm still doing these things today and continuing to develop those skills i knew i was going to leave the new company avanti and i started preparing myself so i sat for another certification you know keep those certs relevant keep updating your skill sets keep those certs renewed um because if you are planning to start your own company or lead another organization you know your

customers are going to want to see that you have certified folks you may be partnering with other technology companies that those certifications are a requirement of the partner agreements so i sat for the sec plus just to see how it compared to this cyst passed it you know it is an interesting experience but i also registered myself with harvard university for their cyber security risk management program five months long grueling a lot of three and four a.m nights writing papers and whatnot but it was a tremendous experience and that harvard university looks really good on a resume or you know a profile so um lesson there and i know we're wrapping up here on time but keep your

skill sets relevant keep those certifications keep educating yourself by whatever means and there's tons of in-person online self-study you know ways to keep your education relevant and timely with the industry so with that folks i'm going to wrap things up here i just want to you know say you know enclose and don't be afraid to reverse engineer that [ __ ] you know whatever it takes to be able to get yourself learning doing things you know if you have to stand on the shoulders of giants and learn from whatever it is they're crafting reverse engineer that make it your own don't be afraid to take that short-term investment in yourself as well um keep creating keep learning find your

mentor and remember to give back with your mentees but uh you know lastly don't listen to those voices in your head that tell you that you're not good enough for this stuff it's too risky you'll fail um you know just trust in the process give it a go the worst thing that happens is that carpet gets ripped out from underneath your feet and you get to start all over and reinvent yourself so i hope this has been useful to some of y'all and look forward to connecting with you i'll put my contact info up here on the screen again i am infosec war on twitter you can also find me on linkedin and connect there as

well