Mind the Gap: Career Growth and Management for Security Engineers

All right. All right. Good morning everyone. Welcome to Besides SF 2025. I hope you're all having a good time. I hope you enjoyed your day yesterday. And here we are for another panel. Uh we're going to do Mind the Gap Career Growth and Management for Security Engineers. We're going to have Josh Liberty, El McKina, Sarai Hosenberg, and Andrew Klene. But uh before we get started, if you guys have any questions, please take a picture. Never works when uh Okay, there you go. Uh for Slido, this is where you're going to you can make questions. Uh you can also go to besides SF2025.org uh Q&A. Um, and well, with no further ado, please uh go ahead.

Thank you. Is this thing on? Hello. Okay. Better.

I think it's just mine. I can just shout. Really? Um, no. Oh, no. Actually, you need Well, go on. I'll take this one. Yeah. Okay. Is that better? Yeah. Thank you. Um, so yeah, this is Mind the Gap: Career Growth and Management for Security Engineers. We plan to discuss um the good, the bad, the ugly of managing your security career. Um, I think to get started, we'll just go down the line and have all of our panelists introduce um themselves. If you want to start. Sure. Uh, I'm Andrew. Uh, I work at BS as a senior security engineer. um started my career primarily as a security consultant um handling breaches and doing instant response and I went

internal because I hate billing. I'm Sarai Rosenberg. I manage cloud security at Netflix and uh I started developing a special interest in people management especially for software engineering teams accidentally when I was 11 years old by reading a copy of uh psychology of computer programming. I'm Elle McKenna. I lead security and IT at a small like 200 to 250 person company. Just a couple fun facts about me. I am terrified of public speaking. Uh I'm really bad at writing speaker bios. Um and I do think that if you're an individual contributor sitting in this room, you should unionize.

What a great panel. Um I'm Josh Lebertie. Uh I work at Door Dash in security operations. I also occasionally deliver food. Um I've been in this uh kind of line of work for over a decade. Um and I'm moderating, so I'll be talking a lot less than all three of you. Um I think to get started, Andrew, you can get us kicked off with just helping us understand how do you know what you want to do in your career? like we get into the industry and then what happens? Can you kind of walk us through like how you think about that? Sure. I don't know. Um I still don't know what I want to do. Um and I read

this I was struggling with that early on and I read this book. Um I think it was do good work or something like that, some self-help thing. And the thing I took away was that there wasn't some thing out there for me to do that I was just searching for. the thing that I needed to do was um anything and try it and get good at it and then I'll love it. Um so that's how I've approached security engineering as a whole is just trying new things and getting good at them and learning them. Um and that's how I've ended up where I am. I think that answers your question. Anyone else? It's going to change through your

career. So be flexible. Um look for advice. Ask other people. Talk to people around you. Find mentors. Find different mentors. Every person is going to have different strengths. Every manager is going to have different strengths and every person is going to give you different ideas. So, gather around ideas from different places and bring them together. I think the best piece of advice that I've gotten on kind of career goals and kind of the steps and once you figure out what step you want to take and you know what you need to do to get to the next step. Not every opportunity is going to be available at every place at every time. So know what you're going to

tolerate. What do you want to tolerate and what are you willing to tolerate? What are you willing to sacrifice if that opportunity isn't available right now? Are you willing to wait? How long are you willing to wait? six months, two years, three years, five years. Are you willing to move to a different team, to a different company, move to a slightly different uh topic or domain in order to kind of do something that you wanted to be doing? What does that look like? I think also, you know, looking for uh opportunities that scare you a little bit um in the exciting way, not the I'm, you know, going to go build something that I'm uh morally opposed to or

whatever, but um if if there's an opportunity, you know, that you see that you're like, "That sounds so cool, but I don't know if I can do that." Go do that thing. Go do that thing. It takes a really long time to pip someone out. So, even if you're really bad at it, um go do that thing for like a year and decide like, am I getting better at this or is it time for me to go find something else to do? Um but definitely take those opportunities that um kind of scare you and excite you in equal parts. So, um, kind of on that that last topic, when we're thinking about a role and

considering a new role, either in your current company, maybe leaving a company, um, what factors would you consider um, when it comes to deciding to stay or or leave? And I guess L, since you kind of wrapped that one, you can kind of go on there. Um, so I think about this from a lot of different perspectives. I mentioned uh the ethical. Um, I look for people that I'm excited about working with. Um, I look for a company that has a financial outlook that makes any kind of sense to me. Um, having the opportunity to look for something new in a year is not the same as having to look for something new in a year. Um so making sure that you

know the the product is something that I think has a future. Um the company itself has a financial plan that looks like it is not going to collapse in the next 18 months or so. Um and having scope you know with sufficient enrichment activities uh in my enclosure um and and again just I can't hammer this home enough. the people look look for people that you are excited to work with. Um because whatever you wind up doing those relationships are going to serve you throughout your entire career. Anyone else? Sure. Um I think it goes back to your first question about knowing what you want out of your career and what you've tried previously and got good at. um and

reflecting on what you've done and what you liked doing, who you liked working with, who you didn't like working with and and for why. Um and then going and evaluating what's next for you based on that. So asking the right questions and interviews um that will elicit the response from who you're going to work with that will show whether or not you'll like working with them or not, or the work you'll be doing, whether it matches up with something you've done um previously. So, I think self-reflection is probably the key aspect for finding your next role, wherever it is. Something that comes to mind for me there is not everything is going to have it's not going to be perfect. No matter

where you are, no matter what situation you're in, every company is going to have problems. Every job is going to have problems. Every team is going to have problems. What kinds of problems are you willing to deal with and tolerate and work around and, you know, improve? There are some things you can change, some things you can't. What are the things you're willing to work with? Find those things and that's a good way to kind of think about where do you go next? And then I think um also, you know, thinking about how much effort from you is this role going to take and and do you have the bandwidth for that in that moment? Um, sometimes you have the

bandwidth to be working 50 and 60 and 70 hour weeks and that's not great work life balance, but sometimes that is where we are in our lives. And other times you're already on the path to burnout and you maybe need to look for somewhere where you're not going to have to fight as hard, you're not going to have to put in as many hours. Um and so knowing, you know, where you are uh in your own um capacity, knowing where you are in terms of uh balancing your family's needs, um and and really having honest conversations with yourself about um whether or not the job opportunities in front of you are aligned with your your your needs as a human being um and

the obligations that you have in your personal life, I think is also a really important factor. Yeah, I'm glad you mentioned that because um I had a question that I was going to ask the group which is is work life balance a lie? Um because I think it might be only because I keep seeing this phrase work life flexibility something like that come up on LinkedIn which is the idea that you can't really balance your work and your personal life. So um can you just like kind of give us more about how you find the balance? um I know as a as a manager or Andrew as a as a contributor. Um and then also like what do you actually do

to manage burnout? Like what does that actually look like? Do you want to take this first? Go for it, Andrew. Oh man. Um I had a a mentor once when I was at PaloAlto and uh I was asking him about how do I care less to a degree? And that wasn't the question that I was asking, but it's what he summed it up as. And um he said to me, "You need to go pick up uh I think he specifically mentioned kickboxing and to to beat it out of something, which I thought I'm not a violent person and so that's not what I'm going to do." But I I took what he meant to heart in a sense that um I

needed to express myself somehow outside of work with a level of verocity that was almost similar to what I do at work. And I guess that's a level of balance in a sense, but it meant that I was going to commit to something outside of work. It meant that I was going to care about it. And so that's what I started doing. And I think that's helped me um a lot. I don't think there's a balance. It's certainly not 50/50. Um, but that's kind of how I've approached not caring so much about work. Care about something else as well. I guess I think that burnout is something that generally fundamentally comes from the environment that you're in. So

there's things that you can do to develop resilience, to build things outside of work that you care about, to develop resilience within the environment, get the support you need both in and outside of work. But it comes from the environment. So if your environment isn't supporting you, you need to change that. And as a manager, that's something that I can do. I have more power and influence to be able to do for my teams. But that's not something that I could do. That's not something that engineers can do to a bigger and wider extent. There's only so much that we can influence. I can influence things outside of my teams. You as engineers, anyone at any level

can influence their environment, but there's only so much that you can do. So, you need to figure out the ways that you can develop resilience and and I think work life balance is an important thing. I think it is real. It is out there. And if you're not finding it, then you need to change something. But work life balance is also different for every person. I mean, for me, I work long hours sometimes. I am someone who will work 12-hour days, three days in a row, but then I don't work the next two days, four days or six days, or I take another week off. If I work long night, then I usually spend more time off the next day and do less

work the next week. It I think it should balance out in the end. Yeah, I think that there are uh a couple misconceptions. Um the first one being that LinkedIn is a [ __ ] posting site. Uh and some people actually know that they're doing it, but most people don't. Um and and there's also the fact that balance doesn't actually mean 50/50. Balance means that your life needs and your work needs are are both happening. Um it means that you're not falling short in your obligations to yourself, uh to your health, um to the people around you. um but also not falling short in your obligations at work. Um and I think that it's actually really

important uh to, you know, as Sarai said, take that to heart and look at um if I'm giving more to one of these things this week, maybe I need to catch up uh in this other area the next week. Um, from a leadership perspective, I try to make sure that my teams are taking regular PTO because I know that one of the things that contributes to burnout is when you get yourself in this position where you feel like you can't take PTO because so many things depend on you personally. Um, and it's not a personal failing to be in that position. It's a team failing. Uh, so I force people to take at least one consecutive

week of PTO every quarter because I work at a company with unlimited PTO and I can do that and it means that we're building up the business continuity awareness uh to know what what single points of success are building up um and then democratizing those things so that there isn't only one person who can do anything. Um, and that's that's something that you do to resist burnout as a team, not just as an individual person. You can't, you know, personal choice your way out of systemic issues like burnout. Well said. Um, I'm kind of curious because one of the things that's kind of come up so far in this conversation is around like managing your, you know,

your your daily work, avoiding burnout. Um, I'm curious if we can talk about growth opportunity because um, I think it's not really obvious how as like an individual contributor you can find growth opportunities, take advantage of them um, and all of that because we have like our daily work, right? So Sarai, maybe you can kind of like kick off this part of the conversation around like how do you identify a growth opportunity and then fit that into your your daily schedule. It's actually kind of part of why I became a manager is I get really excited by thinking about the different opportunities that are out there over time and kind of mapping it out in my

head like a giant multi-dimensional Tetris game that this person is interested in doing these things and this person's interested in doing these things. I used to just do this for myself and think about where I want to go and well six months from now there's this thing coming down the road. These are the things that are here now. And so I kind of stack these things together. But I don't know more exciting as a manager to kind of imagine how these things are moving over time and they evolve over time and someone's capabilities grow and then they're ready for this opportunity and this person's over here looking for this opportunity. It all kind of meshes together in a nice

way so that everyone has opportunities. But there's only so much I mean there's things that I can do as a manager. There are things that you can do as an individual contributor to find the things that you want to do, make room for it. If you're not finding space to make room for it in your current job, there are things that you can do to support the business that help you grow. And your manager should help you align those things. And again, find other people. find mentors within the company and outside the company that help you think about that and help you find the opportunities. So, if you're working with someone, if you have a mentor

that's inside of the company, then you have a different perspective on what opportunities might be out there around um inside your team or outside your time team team or things that are inside your domain support supporting a different team crossunctionally. There's a lot that's out there that you could be finding. Um, it takes a bit of work, but at any point in time, if you persistently through a persistently long period of time are not getting what you need and not getting space to pursue growth or find those opportunities and no one's helping you connect with that, leave. I think it's also really important to have a sense for yourself of what you're hoping to get out of a growth

opportunity. Um, you might be looking for opportunities to expand your skill set. Um, you might be looking for opportunities to move towards a promotion. Um, sometimes these things look the same, but more frequently they actually look radically different uh from each other. Um, and the path to promotion might actually be doing a bunch of work that you're not interested in. um where you know if you're looking to expand your skill set that probably is feeding your interest and um the things that you enjoy about the work that you do. Um and so understanding that those are actually often two different things I think is really important. Um and I think also I would add that um just

having an expansive sense of understanding that growth is not the same as upward mobility. um when you're climbing the career ladder as an engineer um being, you know, a a no prefix engineer or a senior engineer doesn't have a huge huge difference. There's a massive difference between what it means to be a senior engineer and a staff engineer. Um and so really talking to your manager about what does this different job look like and whether it is something that you actually want to do. Um, I think if people are, you know, a very very senior engineer looking at stuff, it's definitely one of those things that isn't that try doing it for a year. See if you actually like it. You

might love it, you might hate it. Um, it's worth experimenting, but it's also worth um just thinking about growth more uh multi-dimensionally than just upward. Uh, I think it comes back to self-reflection again and looking at um what you are doing and what you could be doing in a different scenario and whether that scenario is a promotion or it's a a different role. Um, either of those could be growth opportunities, but you don't know unless you actually sit down and think about what you've been doing, what you like doing about what you've been doing and what you could be doing in that other scenario. um and how that would allow you to grow based on

where you want to be um and where you have been. Um so if if you take anything away from what I've said I think today and what we've said today is a lot of it is self-reflection and and looking forward and looking backwards. Um yeah, sometimes growth is just doing less of the [ __ ] you [ __ ] hate. I think we'll end on that now. Yeah, that's a great time to uh end the panel. Thank you everyone. Uh no, but um yeah, please clap. Um no, the the thing that I think L, you might have said it that is really interesting to me is like the distinction between a senior engineer and a staff engineer. I consider them to

be like basically different job class kind of thing. Um different responsibilities. Um, I also wonder if you have a sense of like when do you just like stop climbing the ladder? Like I feel like in especially in the tech industry there's just an obsession with get to the next level, get more money and then what you know at what point do you kind of decide like okay I'm like I'm good. Do you have any thoughts on that? Um, I would encourage people to uh familiarize themselves with the concept of the Peter principle. Um, and I'm not saying that as like a subweet to anyone or anything like that. Um, but I think it's a useful thing to have in

mind. Um, the Peter principle is the idea that people will be promoted up to the point where they hit a level that they suck at. Um, and every time I get a promotion, I go, "Oh, [ __ ] Is this the one? Um, so I I think that that's definitely a part of it, but I think that also just, you know, being really honest about um am I making what I need to be able to support my family? Um, is my ability to balance my professional expectations against the things that I need to do to take care of myself as a human, to uh show up in my life outside of work? Um, do I have that balance? Um, are there

sufficient enrichment activities in my enclosure? Like, is is there enough of interest to do in this role? Um, and if the answer to those all of those things is yes, then maybe you don't want a promotion, right? Then maybe you actually want to enjoy where you're at. And when the answer to some of those questions starts being no, then it's time to start thinking about like, okay, I'm not getting the fulfillment or I'm not making enough or um you know, I I feel like I'm just not doing enough at work. Um don't say that to your managers. Um but if if you're feeling that way, then maybe uh it's time to to start thinking about like,

all right, what does a promotion look like? Um, and does that opportunity exist for me here? Or if I do need a promotion to feel uh sufficiently engaged at work or to, you know, be able to support my lifestyle, do I need to look somewhere else for that? In my opinion, this whole thing about up is it's a social construct beyond financial stability and compensation, which is also a system is choice. But constructing our system to have hierarchies and hierarchies of power, power dynamics, um the hierarchical power dynamics, structuring them as a system of power, that doesn't need to be there. There doesn't need to be an up versus a down there. And it doesn't need to be oriented in that

direction. There doesn't need to be levels of people who are like up and down. It doesn't have to look like that. It can look like hills and valleys. It doesn't have to look like a linear numbering system. It's a choice to have our numbering system for levels be like that. We can recognize things in much different ways. We can imagine mapping things onto a sphere or a circle or I don't know hyperbolic plane or something like there's no definition of up that makes sense. And this is sure coming from me as a topologist and I don't really think directions mean anything or kirality means anything but you know levels are just a social construct. If you're getting what you

need from your work environment, if you feel good about things, if you have financial stability, what else do you need? Love. Don't Don't get that at work. That's that's not a work thing. Agreed. We need to keep that out of the workplace. Um the um I think a lot of what you're saying also is really dependent on the company you work at, right? like your company can support that concept and also your company could be very hierarchical where you can't do anything without the approval of your manager and and a peer manager that kind of thing. So I think that's goes back to the point earlier of you know interview the people that are interviewing you if you're

considering a new role. Um I want to touch on a concept that we haven't really talked about yet which is feedback. Andrew, I'm curious to hear your opinion on feedback. Um, how important is it to you as a, you know, individual contributor? How do you I'm mostly interested in understanding how you discern useful and like not useful feedback because over my career I get lots of feedback. I proactively ask for feedback, but I can't say that all of it I treat equally. So, I'm just curious how you kind of like approach receiving feedback and what you do with it. I love feedback and I'm frustrated that a lot of companies don't seem to do it

the right way and I think organic feedback is the best kind of as you mentioned in terms of asking for it. I don't think that's a given at a lot of companies. So asking for it is really the foundation. Um a lot of companies do peer review processes you know quarterly or yearly. Um but I really personally love asking people directly and um it's how I manage myself in terms of I get worried about whether I'm doing the right stuff um whether people like working with me um is my work product even good and so I've gotten more comfortable not comfortable but less uncomfortable with asking people you know how did I do with that and I think

that's where the quality feedback comes into play that if your company supports that sort of organic, direct, transparent feedback versus just generic. Yeah, it was it was good. You did good. Um your code worked. Uh that's not useful. Um actionable. You know, you did this thing well, you did this other thing not as well. I would have liked to see this um done differently. That's helpful. So candid feedback is a bit of a hallmark of Netflix culture. Um but that kind of obsessates that feedback is a lot more complicated than that. Feedback depends on your relationship with another person, how comfortable they are sharing things, how safe each person feels. And that's on both sides. It's

part of the relationship. It's part of each person's kind of psychological safety in their own environment within their own team within kind of their power dynamics between people whether it's racial power dynamics or manager report power dynamics. There's all kinds of different factors that influence how feedback conversations happen. But one way of thinking about it is different levels of feedback that you can start with like a very basic kind of hey this didn't go as well as I expected and you can get more complicated like this like you so a higher level feedback might be saying something a bit more directly like I think you seem to be hesitating um can you tell me more about that? So

there are different levels of directness that you can be part of that and different levels of things that you share and you start the conversation see where it is. It's going to change based on your relationship with the person and that's going to change over time and that's okay. I think it's also worth pointing out that a lot of feedback actually isn't verbal. Um, a lot of feedback is, uh, noticing whether or not someone is putting their hand up to work with you consistently because you've built psychological safety with them. Um, feedback can look like the systems that you have put in place to do security on purpose actually working or, you know, as Wendy was saying in her keynote,

maybe showing indicators that they're not working. That's feedback. That's really valuable feedback. And the most exciting thing about that feedback is you don't have to go asking for someone to tell you that feedback. You have the data in front of you to make sense of, to derive feedback from, and to work from. Um, so I I do agree that a lot of places do not do feedback well. Um and that in an ideal scenario, we're looking at the data points that we have and then also getting constructive feedback um that is both positive and uh critical from the people that we work closely with. But I I think that it's also really important to actually look for

all of that feedback and not just rely on the things that people say and not take all of that feedback because some of the feedback is not going to be useful to you. It's either doesn't really help you because that's not the direction you want to go. There's also biases. Biased feedback happens all the time. My thesis feedback that sticks in my head decades later. When I was teaching, I once taught a class in which um I got feedback that uh from stu, you know, student feedback that happens every year. And one piece of student feedback was she comes into class late every time. And initially I thought, well, okay, yeah, I guess sometimes I that

time and I are not great friends. um time management is not great with ADHD. So I I I I accepted that and I was like, "Yeah, I should probably work on that." And then I looked again and I was like, "Wait, this is from a class where I I teach two classes in a row in the same classroom. I never left the room." And I was getting this feedback like starting class late, but I'm always in the room. I'm always starting class on time. That is the one class that never starts late. Feedback can be nonsense sometimes. The skill of being able to say, "Thank you so much for that feedback. I'll take it into

consideration." And then just move on with your life. Is is a really really worthwhile skill to develop. Yep. That's why you're the boss, L. Um, so we do have a few more um, questions that we solicited from not this audience but the internet and that I want to get to now. I'm just going to read them verbatim and kind of hand them out to our panel here. Um, oh, and we had the Q&A as well. And there's a lot of questions here, so that's perfect. Um, the first one is, what skills will be most relevant in three to five years? And L, I think you want to take this one. I do have really strong feelings

about this. Um, human skills, human skills are going to be relevant 3 to 5 years from now, irrespective of what the job market looks like, irrespective of what the technology that we are working with looks like, irrespective of what the macroeconomic climate looks like. Building the skills to um show up genuinely in the ways that Clint was talking about in his keynote yesterday. building the skills to admit when you are wrong and correct from that as Wendy was talking about in her keynote today. Um building the skills to communicate openly and honestly and freely with the people that you work with on a day-to-day basis. Um and building uh the the connection and community that you

get as a result of that. Those are the skills that are going to save you if you get laid off laid off tomorrow. Those are the skills that are going to save you if we wind up with computers taking all of our jobs and having to go back to bartending or whatever um two years from now. Uh the the way that we show up at work, the way that we connect with um people, those are the skills that you should be investing in because those are the skills that are not just going to save your career but also help you advance it. Next question. What should someone consider before deciding to move from an individual contributor role to a

management role? Sarai, I think maybe you can take this one. Therapy. A lot of therapy. I think the best thing that helped me prepare for managing people is knowing myself and being able to understand my feelings, introspecting on how I communicate with other people. And therapy is a big part of how I get there. Sure, you can read books on leadership, books on management, books on communication. Um, a lot of them suck. Uh, I've read, I think, 83 books on management, communication, and leadership over the last 5 to 10 years. Um, and a lot of them say some really horrible things that you should absolutely never do. So, pick and choose what you're going to

read and what you're going to learn from. Pick and choose the people that you look up to as models. Get mentors. Learn from other people. know what you're getting into. It's a commitment. It has impact on people. So, if you're taking on management, it's not something you can try out for a few weeks or a few months. It's a commitment to a bunch of people that you have an impact on, you can have a huge impact on someone's life from saying something small. So, knowing how you communicate things effectively and safeguarding that even if your intent is there, it does not matter what your intent is. Impact comes before intent. your impact on other people will matter and you're not

going to see the extent of that until you're actually in the role. So preparing for that is pretty important. And if I can just add something, I think that one of the places that intent really does matter is you need to be honest with yourself about why you're considering moving into management. If you are moving, if you are thinking of moving into management because you're viewing it as a promotion, that's maybe not the right move for you. Um, if you are considering moving into management because you see an opportunity to make things better not just for yourself but the people around you and to solve systemic problems and support people who are currently suffering from those systemic problems.

That's when you should consider moving into management. Moving into management is not a promotion. It's a lateral shift into a completely different job family. Um, and I think that that's a really important thing to internalize as you're kind of working through that question of, oh, should I stay in IC or should I move into management? Next question. Is it better to specialize in one domain or be a generalist? Andrew, let's have you take this one. It's a toughy. Sure. I I always This cracks me up because it makes me think they're asking if they should do the CISSP or if they should do a SANS course. Um no. Yeah. No. Who's paying for it? Um, I

think about it like everyone should be uh um and this is not an original idea by any sense, but I try to become a T-shaped engineer in that I'm deep in one to two areas of the domain um and knowledgeable about many others so that I can work with other teams. I can do my job um well for other people uh with their needs in mind. um like the appsac team, working with them as a um a detection engineer, knowing how they do things will make my collaboration with them much stronger. Um but I certainly can't be a detection engineer and an application security engineer and do them really well at the same time. So um

being a T-shaped engineer is is my goal. I think it also depends on where you want to spend your career. If you really love working in tiny companies, then being a generalist might be the better option for you. But if you have this desire to go work in a company with thousands or tens of thousands of employees, then specialization might actually be the thing that serves you better. Um, and so having having an understanding of, you know, where where do you feel like um kind of the rhythm of business is a rhythm that uh speaks to you is also going to inform how you think about what skill sets you should be developing. So self-reflection on what you want is

important. All right, we have about 11 questions. We won't get through all of them, but I'll uh we'll expedite this. Um, for engineers without direct exp, this is from the audience by the way. For engineers without direct experience wanting to pivot into security in one year, what is the most critical proactive step to take and what is the biggest pitfall to avoid? So, how do you break into security in 2025 is the question. I think the biggest pitfall might be putting that one-year timeline on it. Um, if it's something that you want to do, um, first of all, you know, ju just so everybody in the audience knows this, um, you are not limited to putting the

things that someone has paid you to do on your resume. You can put things that you have done out of curiosity, um, out of a desire to expand your skill set. Those things can also go on your resume. Um, you also don't need to put things that you don't want to keep doing on your resume. So, one of the things that I would recommend doing is actually tailoring the the version of yourself that you're presenting to companies before you ever even speak to a person there. Um, to highlight the work that you have done, the skill sets that you've developed, um, and maybe take off the things that you don't still want to be doing. Um, so that you can have more

honest and targeted conversations with people. All right, next question. How does public visibility from the industry impact career growth? This one was a little targeted at me. I won't read that part. Um, but it did make me laugh in my mind. Um, so um I'll just say for myself, I try to um whatever I'm working on personally that's internal at work, I try to make that public somehow. blogging, um, you know, posting on LinkedIn, as good or bad as that platform might be. Um, open source software, uh, that's worked for me, um, just to kind of like sustain, um, a quote unquote personal brand. Um, but I'm curious if anyone else has thoughts on how, um, being visible

publicly has helped your career, if at all. I actually can't be public about a lot of the things that I've worked on as an engineer. Um, which is I think something that a lot of people in this room probably share. Um, and so what's helped me is um building a a you know public self that cares about um equity and kindness and being decent to people. Um and and honestly the thing that has uh helped my career the most has been being the kind of person that people want to work with again um based on how I show up, you know, and and do the things that I say that I'm going to do or um let people know early if I said

I was going to do a thing and I'm realizing that I'm in over my head and asking for help. Um, and I think that, uh, the other thing that has probably helped me the most is being willing to publicly admit when I'm wrong, cuz we are all wrong sometimes. Um, and it's a superpower to be like, I thought this, I got new information. I'm wrong. Um, anyway, here's what I've learned and here's what I think now. And, and things like that really, really do make people actually want to work with you. I found that public visibility can help open the door. it can get you into a conversation. But when I look at it from

the hiring manager standpoint, I don't think it's fair for me to take one person who has had the opportunities and chosen to have public visibility and compare that differently. At the end of the day, I should be judging people based on the skills and the capabilities that they bring into the job role.

Um kind of another question on the topic of being new to security or a security engineering role. What kinds of goals are good to keep in mind? Like say first to first year to first three years, right? What is your goal as a security engineer? I would say that as a firstear security engineer, your number one goal should be building the trust that you need with your manager um to actually help shepherd you and and set good expectations. Um I think that uh there there's not a great way to be set up for success as an early and career engineer without that partnership with your manager and probably also your skip level manager. Um, you're gonna

make mistakes. Uh, sometimes they're going to be really, really big, really funny mistakes. Um, and not letting, you know, that one time you took down deploy for the whole company. Um, discourage you is probably, uh, the biggest the biggest and most important skill that you can develop. Uh, right along with not taking down deploy again for the whole company in that exact same way. again. Uh I think for me when I look back on my first three years, the mistakes I made were the goals that I set for myself in production level stuff. Like how can I work and create the most so that I can prove my value. Um, and for me that looked like billing, which is what I

referred to earlier in terms of billing more hours, um, working with more clients, um, getting as much done as possible, when in reality my goal should have been, um, like El said, getting the people around me to trust me so that I could ask them questions um, without any sort of fear that uh, it would come back to bite me in any way, which one shouldn't have anyway, I think, in that first three years that you're really in a space to answer or ask as many questions as you can um and learn as much as you can and that opportunity diminishes as you move on in your career and become more quote experienced. Um, so when I look back, I wish I had set

goals for myself of how many things can I learn from the people that I have around me that I'm working with and how many questions can I ask and um, how many shadow opportunities can I accomplish over the next year rather than how much stuff can I get done because you have 40 more years to get a lot more stuff done. Hell yeah. Awesome. We have uh a couple minutes, so I'm going to finish it with this last question. Um the honesty in this question is just amazing. So I'm just going to read it. Um and it also goes back to something I wanted to ask earlier. Question is, any tips about mitigating shame around failing to be

intentional about your career and instead just falling into each next job? The uh question I wanted to ask earlier is, is planning even necessary?

S I feel like you have thoughts on this. Can you repeat the question? It's essentially planning your career versus just kind of moving job to job like how intentional should you be? Um I don't think that the anyone should feel shame about not planning your career by the way. Um, but just like how do you think about that? Like intentional planning versus taking an opportunity, that kind of aspect. I think it's good to go with what's out there. You don't have to plan. Yeah. I don't think it should be something that anyone should feel shameful about. Um, if you go with what's right in front of you, go with what's working. You'll find opportunities when you want to. If you

plan, you'll often find that the things you planned are going to be inaccurate because you learn something about that and you decide, actually, I don't want to go in that direction. This isn't the kind of job that I want to be doing. So, why did I plan this? That wasn't a good path. A lot of the things are going to come down to what kind of people do you want to work with? Do you feel good about the the company, the people, the team, the domain that you're working in, the work that you're doing? And that's kind of moment to moment. You can't plan ahead for that. What you can plan are the things that

you don't want to do. So in some ways anti-planning of I don't want to do these things. I don't want to tolerate this. I'm willing to wait around until something. I think that's the extent of planning that can be really valuable. Yeah, I would agree and say that I think that we all know what happens when um even the most meticulous plans come into contact with life. Um, and I think it's a good idea to have an idea of what you do and don't want. Um, but it's silly to um, say, "Okay, here is my 10-year plan and this opportunity has come up and it looks interesting and it looks exciting and it's a little bit scary, but it's

not in my 10-year plan, so I'm going to pass up." Um, my plan was to never ever ever go into management. Um, and we see how well that worked. Um, and I even went into management going, I I can try this for a year and when I realize that I hate it, I can just go back to being an IC. And I didn't do that. Um, so I I think that, you know, having having an idea of what you love, what you hate, um, and what you need to thrive is a lot more important than any plan possibly can be. All right, with that, that's our time. Thanks to the panel. Please clap. Thank you.