An Information Security Career: Maximize Your Chances Starting Now! Allan Wall, Senior Consultant

1. ISM Solutions Information Security Management Solutions An Information Security Career: Maximize Your Chances Starting Now!Allan Wall, Senior Consultant MSc Information Security Distance Learning Programme Royal Holloway University of London Sept 16th2012

2. ISM Solutions Information Security Management Solutions About Allan • BSc. Biochemistry & Genetics and PGCE • In IT for ~25 years • Systems and network admin, application support; anti-virus “guru” • IT Security ~17 years – all aspects • Managed Symantec UK Presales Security Practice for 9 years • CISSP (8 years); Founder Associate Member IISP; Fellow of the British Computer Society • RHUL Information Security MSc 2009-10 • Guest Lecturer on John Austin’s Malware Module • Active member of ISSA UK • Director of Academic Liaison; Expert panels; Web Conferences Committee • Currently Independent Consultant • Mostly helping SME/SMBs with their infosec issues

3. Assumptions! You want a career, not just a job You want it to progress in some fashion You want it to provide sustenance and fulfilment Always seeking to improve

4. Outline • Three of the (many) success factors: • Plan your next 5+ years, constant periodic review • Objectives to achieve, Aims to execute on • Get to know yourself • Gain experience that allows you to show competence (being qualified, proficient, able to perform, accomplish, achieve) • Evidence based, checkable via references or testimonials • Get it verified if possible (written, certified, recognition) • Build, maintain, expand and churn your “network” • Some of it will be “who you know”

5. Tool 1 - The CAREER Model CAREER Contemplate Assess Research Explore Execute Reflect Source: Dr Randall S Harrison

6. Planning Visualise a future state and “look back” 3-5 years How did I get here? Fill in the route – major then minor milestones

7. Tool 2 – the Personal Development Plan You can do you this for yourself or with a manager This belongs to YOU – not your manager! You chose to share it in order to achieve mutually beneficial goals – it WILL be negotiated There may be more than one version ! It should be “balanced” It might change a lot at times (be flexible)

9. IMPORTANT POINTS SMART Specific Measurable Achievable Relevant Timed Activities should be real, non-trivial, well articulated Use it! Refer often. Review often. ….but never underestimate the power of “the gut” to initiate change What was missing from the example plan?

10. “Hard” v. “Soft” v. Business Skills • Personal “soft” skills - Examples • Time Management • Presentation skills • Communication skills • Critical Thinking & Problem Solving • Negotiation skills • Influence skills • Change Management • Conflict Management • Management skills • Business Analysis • Project Management skills • Leadership skills

11. Use them or lose them…. • For technical people, technical knowledge and skills will “stick” more because they use them • The non-technical and business skills need focus – and the best time is immediately and continually after the training • Apply BOTH sets of knowledge and skills together • Gain experience that allows you to show capabilities • Evidence based, checkable via references or testimonials • Get it verified if possible (written, certified, recognition) • E.G. See www.sfia.org.uk, or www.iisp.org

12. Tool 3 - The Power of Networking • For shy, introverted technical people this can be a challenge! • Ease into peer interaction opportunities that enhance knowledge, skill, and professional growth • Get useful contacts for getting work opportunities & advice • Perhaps find a Mentor, get coaching • Perhaps become a Mentor • For learning about different professional roles/career paths • Giving YOUR feedback on what you know or have learned • Participating in innovative research, projects & workgroups • Access to specialist recruiters & organisations with employment opportunities

13. Examples of Networking Organisations Obviously - RHUL (and other) Alumni organisations and events Professional Organisation “Chapters” – ISSA IISP ISACA ISC2 BCS (& specialist groups – ISSG, IRMA, YPISG, Cybercrime Forensics) NEXTSEC and quite a few more etc

14. What can Networking do for Me? “I believe the greatest benefit of ISSA membership is the networking opportunities – and as ISSA reaches out more and involves other organisations like the BCS – these become potentially even more “lucrative” whether you are looking for work, a mentor, a mentee, to widen your infosec horizons, or the opportunity to ground yourself in comparison to other professionals. I would probably not have done the RHUL MSc if I hadn’t encountered Alumni at ISSA meetings willing to champion it!” Allan Wall, 2011

15. Examples of Organisations Running Events Often annual, sometimes more frequent: SANS RSA Gartner Forrester Research Vendor Specific events Infosec Europe etc

16. What has Networking done for me? Significantly enriched my experience in the profession and my feeling of belonging to a professional community

17. Summary Plan! Gain Experience! Network!

18. ISM Solutions Information Security Management Solutions Thank you Allan Wall, MSc, FBCS, CISSP, A.Inst.ISP Senior Consultant - ISM Solutions Director of Academic Liaison - ISSA-UK ISSA Web Conferences Committee Phone: +44(0)7770272799 Find me on LinkedIn