Transitioning from Software Engineer to Security Engineer

all right should we get started so I I saw everybody had an awesome presentation and then I was like man I should have had one too that way you know you can stare at other things too just and not just me but I'm super excited to talk to you guys today um about something that's not just a career change but a total mindset shift um which was from moving from software engineer into a security engineer and I hope that by the end of it that if you're looking to either figure out which where you go um that you find your way or at least you have a path to follow um and I wanted to start off a

little bit about my background um because it'll help kind of see how this journey evolved um but I actually um I was uh born uh in Armenia and I moved to Germany when I was 3 years old and I lived there my entire life until I was like 21 and then that's when I uh came over to the States but um the reason why we moved from armania to Germany was because my dad had some uh health conditions that the medical resources in Armenia were not able to help and cure and so what ended up happening is we moved to a country like Germany where there were incredible medical resources and they could help him to live a longer

life um that Journey was not easy uh I wish we would have just hopped on a plane and then landed in Germany and everything was great there were a lot of struggles a lot of fear um and uh a lot on my mom who uh you know had three little kids um to bring over to a country that she couldn't speak the language but I felt though after you know like immediately actually because I was only three years old right so pretty little but I felt though that Germany was my home there was nothing um that differentiated me from other Germans I felt though I I belonged um that was uh my home my country and um even though I assimilated

really quickly and I loved the country I did feel a little bit I was a little bit different than the rest of my friends and and people around me but I didn't let that stop me um if you know much about the German School System you might know that you get ranked pretty early on so around Elementary School um you then start um you know depending on your Gres you fall either in the top the medium or the middle and the then there's the bottom and that does um pretty much um you know determine your future and depending what bucket you were in you might have different um you know fields and careers uh schools that you can go

to but I was very determined to become a doctor and so I thought there's no way I will become I will get into the top tier and I will go to university and become a doctor um but I quickly found out I was really not that great at biology and memorizing things were not my skill but I pushed through anyway my parents though they thought that was not my you know my path and so for them they thought it would be great if I became a teacher or a journalist or a stayed home mom and that just wasn't what I wanted to do so at age 18 actually uh my dad passed away and that's when I kind of

felt like my whole world crumbled and I didn't know how to make decisions for myself um if you've had somebody you know from an early age to make decisions for you and then all of a sudden that person is gone you don't know where to start what's right what's wrong um and how to really live life the way you used to so I thought you know I'll leave all of that baggage in Germany and then open up a new can of worms in the United States and uh my goal was to you know go get as far away as possible for my grieve and my anger and my sadness um and the the US seemed pretty

far enough so here I actually studied psychology uh during my bachelor's degree because I saw how terribly my family dealt with pain and grief and the loss of my father that I wanted to help them them and I thought well why not help others as well um and so Psychology was actually something I was very passionate in and I was really good at um things came very easily to me and early on I I wanted to fix problems fix problems that people had fix problems uh within our brains um and I was very observant of how people were acting and the way that um you know the things they were doing and how that could change or how I could

help them change to the better so during my last semester though um is when I stumbled upon coding and if you've used your left brain most of the time it's really hard to shift um and I did not even I mean I've used apps before but I've never even thought what it would be like to build one or create something like it um it was just a no yeah it just made no sense to me so um I actually through so the thing that I uh that my coworker showed me was free code camp and it was building this you know cute little app um and that day I spent my entire day doing that and I spent my

entire weekend doing you know free code camp and trying to look at other things and it just fascinated me because that was just not something I had ever done yeah it was JavaScript yeah um so pretty front and basic but it was awesome so from there I um decided that because I was working at a psych office and I just wasn't enjoying what I was doing in order to become a psychologist you need a master's probably also a doctorate um and lots of Li licenses and in insurance so I thought doing the you know math around it I thought that was just not something that was plausible to me and it wouldn't get me to the results that I wanted

early on so I actually um after my after I finished my Bach's degree in Psychology I did a boot camp at V school downtown um in web development and that's uh where I learned within 12 weeks how to do front-end development um learned right because how much can you really learn in 12 weeks but um I right before I finished I actually got my first offer at a company and that was thanks to lots of networking I made sure that I went to every event that was possible I met lots of people and I asked all the questions and so I actually met a lady at one of the events who ended up helping me get

this first internship of mine and that was you know the start of something great but again when I was at that company I just didn't feel like I belonged um my team was all male engineers and um it took me a little bit to connect with them but again I used the skills that I knew I had and I tried to befriend them and I tried to really understand what it was that made a software engineer so during my time um as an engineer I didn't just wait for opportunities to come to me I took the initiative and I didn't sit still um I constantly learned I constantly grew I studied and worked outside of my work hours um and I tried

to really figure out how best I could make myself belong in that field and I uh I developed actually my own close network of people um and that Network opened doors that I honestly didn't think that they could be opened or that they were even there and so I was a front-end engineer primarily and then um learned um we had a group of Engineers that were backend engineers and so I asked them if I could you know help on the projects that they were working and they were friendly enough and at that time I had already developed friendship with them that um they sat down they taught me how they tackle things uh what makes back and

Engineering uh as great as they thought it was and um I got to learn a lot around backend engineering and if you combine you know front end and back end as a full stack engineer that's just you know a great combo so then I had a friend who was in devops and um Devo wasn't something that you know I knew much about but I knew it was there and I actually started learning Docker kubernetes how to you know shorten the development life cycle um and provide continuous delivery anything around performance optimization and scalability and that was really intriguing to me as well because I thought you know I've always wanted to learn where my code you know through

what pipeline it gets through so from there I actually had a friend who was an Sr a site reliability engineer if that role doesn't ring a bell or you don't know much about it well I didn't uh I for sure did not know what a site reliability engineer did and I thought wow just another engineer um and so that friend taught me you know what so I learned all about how to ensure um both customer facing services and internal systems and how they meet their reliability and uptime goals and then how to set slos which are service level objectives and S um service level indicators and then how to respond um to system outages and disruptions and

monitor our infrastructure and I thought monitoring was really really cool um I got really into it and that was actually the role that I thought was meant for me I was going to become an Sr um and so I was so determined then I went to the director not just my manager but the director of that company and I said hey how can I become an SRE I'm willing to do anything it takes help me to get to that point and what he said actually um shouted my world a little bit he he turned to me and he said you know Annie it's going to take you 10 plus years 10 plus years um of dedicated

work and there is is also on call with side reliability engineering and so you might not have to work weekends and um you know after hours and I thought that was not that big of a deal and he also told me well it would be really hard for you to also become a mother so if you wanted to become a mother which was not on my radar um that would be really hard because you have all this extra work that you have to put in that you couldn't do both your career and being a mother and so I thought okay well I believed him at that time and I thought there is no way for me to become an SRE

as a female um so I guess I better just give that dream up right away while I gave up the dream to become an SRE I still did not give up the skills that I learned so I started implementing some of the uh monitoring that I've learned into our you know the Sur services that our product uh was using or our product services and I got to um you know got to a point where our product team was doing really really well um the way we were handling monitoring that we were immediately aware if something was not um you know performing as it should be but um since SRE wasn't an option again um I wanted to do something that

would help me one uh level up but also that would help me match my degree to uh my current field so I decided to get a master's degree um and I thought a masters in Information Systems would help that um and I went around again and I and this you can see like obviously once my dad passed away I couldn't make decisions and so even during my work I had a hard time making decisions for myself so I went around and I asked people is it okay what do you think is a master's degree cool like should I do it and everybody told me it was a waste of time and I just shouldn't do it and um

and while like a CS degree didn't make sense to me either because you know I could learn most of the things on my own um I did think like maybe a degree like information systems would help and um well that was the first time in my life when I went against what everybody else said and I did it anyway so I got my Master's Degree and in information systems and that was honestly the best decision I had made because that was the you know the jumping board into cyber security for me at that point um because of how how I felt I was treated as a you know female engineer I thought okay maybe if

I become a manager then I can't change the narrative I can change the future for you know you know other women and other men in this industry and um the actually the information systems degree at the U is excellent it's an excellent degree because it lets you it has like different um what's it called it like different categories that you can pick from and so they had things around leadership they had things around uh Big Data Cy uh software engineering um and cyber security and I thought everything sounded great but cyber security was definitely not for me I was you know that was just not something I ever thought I could do and so um even though cyber security was

intriguing to me and I always thought you know you see these hackers out uh in videos or movies you think they are so cool um I just didn't think that was something that I could ever become and and um my Master's Degree actually made us take a cyber security class it was one of the things we had to take um and during that class that's when I fell in love with security I learned so many valuable things um around security and I started taking more classes for security because I wanted to learn more what it took to become a cyber security engineer and um I felt like though you know like being a product development engineer was great

but learning how to secure what you're building so that no like your company feels what you're building is safe and secure that's on a like that's a whole new level and I'm sure like you know most of you who have used apps um you know you don't want to use an app or software and feel like at any point whatever you're inputting into that app and software could be you know exposed to millions of people um and probably used in a bad way and we all know that the world doesn't exist of just kind and honest and good people so damage is you know bound to happen but I I thought learning security would help me solve some sort of mystery

or you know solve the problem like a problem that I thought was really intriguing um and we also all know that security um or you can never keep a software or even a human secure all the way right there's always some sort of way something can happen and so I knew that there was room for failure um but failure at that point with all of my you know past it didn't scare me um and I thought I can tackle it that's that's fine and I thought failure was great because every time I you know it didn't work or something broke I could learn something something new and I could you know figure out why it didn't

work so all of a sudden um you know I had to think or shift my thinking um a little bit and um instead of building you know my my feature or fixing my bug to patch up the issue as quick as possible and it was okay as possible just to close the ticket and be done um I had to then figure out how um I could keep that code secure and um so it wouldn't be taken apart by you know someone somebody with bad intentions so again through my network a good friend of mine was actually leading uh an application security team at Adobe and granted I only had experience in security through my master's program

so not much but um I still decided I would go for for it and I applied for that role um right before I worked really hard I went on Port wiger Academy watched videos YouTube videos I tried you know to do everything in my power to be able to be prepared for that interview and by some miracle I ended up getting the job and I made it on the team and what I loved that the engineering manager said to me he said the reason why we picked you was because um your passion and your determination in every conversation I made sure you know I that I wanted this job and I was willing to do whatever it

takes to get to that point there's actually this quote from Michael Jordan who is pretty cool um he said that um some people wanted to happen some people wish it would happen and then others make it happen so I wanted to be the one who made it happen during my absc role I actually had an incredible Mentor um and I was blessed throughout my entire career even to this point to have really awesome mentors who've helped me um Advanced to you know the point that I'm at today um and to become a mentor myself to others but even though you know it kind of felt a little bit being a junior engineer because it was a new uh it was a new

field um he helped me understand that whatever I already knew from my coding experiences and my product development skills that I could use those but combine it to to come up with a different purpose so instead of writing a feature through code I've wrote you know a script that would help me um you know find certain things or instead of fixing a bug um I came up with plans on how to let these bugs never happen again and look into um you know how to actually fix your root cause so from there I act uh I worked towards a different role and um eventually ended up as a a security engineer um on the orc that I'm on

today and now I get to work with external researchers or hackers um and see the incredible work they do um and also reproduce the work um and make sure that it's working I get to come up with strategic ways uh of how to prevent certain vulnerabilities from happening again and coming up with root cuse analyses and I get to also build automation to help make our work a lot faster and easier so I need to um and then I need to be in uh in the loop of all the breaches and vulnerabilities and concerns that adobe has um and obviously stay up to date to all the latest things but the good good part about it is there

is a team so you might not you can't know everything um and so having a team of great individuals um will help you uh have a plethora of more knowledge when you you when you combine that do I still feel like a security pro I wouldn't say so um and I probably never will be a security pro but um because of the um you know because of how quickly security changes I think that I can still learn whatever it takes um to get to a point where I can talk about about things and it's very intriguing there's just never a dual moment of security you feel like you've learned something and then you turn around and it's changed or

something news come up um and it's a great great way to to learn and um keep yourself up to date and never feel like you're just stagnant or sitting there waiting for something to come to you so going from this you know coming from this girl who had people made this decisions for them who couldn't um figure out where she belonged and and what uh to do in her life I actually became this woman who is very determined and knows exactly where she belongs and what she wants to do in her life and and the places that I want to go um and I always made sure that whatever happens um I made it happen for myself that certain things

that I've wanted I made those um happening and and I leveraged my network which was a huge um you know huge positive and I learned um what I was good at and I expanded on those skills and if there's one thing I could have you take away from this talk today is that there's always somebody better than you and someone quicker than you but nobody is you so learn what you're good at and expand on that and you'll be able to you know be the person that nobody else can be and even if your parents or you know the world around you doesn't think that you could be the person that you want to be um I think that there is if you take

it into your own hands and make it happen you can and um yeah that's it thank you