 Welcome everybody and thank you for coming to the presentation. Today Mike and I are going to talk about dispelling a lot of the urban legends and myths that persist in our information security careers. Mike and I are real pleased to be back here at DEF CON. I gave a presentation last year a little bit geared towards career management. Let's tell you a little bit about myself. Oh goodness, this is my 10th con so I'm feeling a little old. I've been working in the recruiting industry for the past 12 years and it's been exciting. We've been able to talk to many different people at many different stages of their careers and I've really had the pleasure of working with them and seeing them accomplish their goals over the past decade. And I'm Mike Murray. I come from a little different place than Lee. I'm a security guy myself, spent the late 90s pen testing and doing vulnerability research and then doing a whole bunch of different stuff. And I ended up doing this mostly by accident. It just seems that I've thought a lot about my career and worked with a whole lot of people who have gone through some career stuff and spent a whole lot of time mentoring people. And Lee and I became friends a few years ago actually at Black Hat and DEF CON. We met in an elevator. Yeah, we did. We met in an elevator. That's hot. And the more we talked about it the more we realized that we were seeing the same things and that we had different perspectives that we could bring to this. And so we started putting together these talks and we started talking to groups of people like this. And so before we actually start talking, I know many of you who came in were getting flyers at the door that we are doing a survey on this stuff. We've been up here a couple of times. We talk about this stuff all the time. And we do podcasts and we blog and all that sort of stuff. And it's a whole lot of Lee's opinion and Mike's opinion. And we kind of get tired of ourselves after a little while. And there are a whole lot of questions that we wish we had the answers to. If you look around the industry, everybody does career surveys. Everybody does salary surveys. But it's like ISE squared or SANS or CSO Magazine or somebody like that. It's a really narrow group of people. You never get a really good cross-section of the entire industry all at once. You get a really narrow position usually from people who have an agenda. We're really lucky. We don't have an agenda. We don't have anything to sell. We're not here to make money off you guys. We just want to be able to give you guys the best information that we can and give you guys the best advice that we can give when we're talking about careers. So we're going out and we're kind of in our spare time putting on the full court press doing podcasts, talking to reporters, trying to get as many people in this industry as possible to put some data together that can allow us to, next year when we get back up on this stage, give you guys some real information not just about what we see when I'm mentoring people or when Lee's talking to his people, but what is really going on out there from a really broad perspective. Two things about the survey. One, I'm a security professional myself and I'm paranoid about my own information. So it is anonymous. It is completely anonymous. We are not collecting any information about any people with the survey itself. We're not collecting IP addresses. We're not collecting any of that stuff. There is, after you leave the survey, you bounce to a thank you page on a completely different server where we let you put your email address in so that we can send you back the results when we finish collecting them. Completely unrelated stuff. If you want to know more about the technology, my email address is on that flyer that you got. It's really important to me because I know how important personal information is and I spend my life protecting it in my day job. So I wouldn't put out a survey that was irresponsible like that. And second, tell everybody you know because we really, the more data we get, the better and the better we can help everybody. So on to the real, to the real meat of the talk. It's sort of a really cruel trick. By definition, we grow up in a world that prepares us for the last world. We grew up and were educated in a world that prepared us for the careers that our parents had. And most of our parents probably started with a company when they were in their early 20s and they got to their late 50s before they were laid off or had to retire or whatever. We don't live in that world. In our world, we switch jobs. We have to do things that our parents never had to do as far as career management. And so we were prepared to live in a world that is not this one. And many of the lessons that we were taught have spawned such misinformation and so many myths that Lee and I spend all of our time saying, that's not how it is. That we wanted to get up here and talk about what some of those things are and what the reality of it all is. We'll start with job hunting and mostly because that's what most people think about when they talk about careers is how do I get that job? And myth number one right there, almost everyone prepares a cover letter. You read any book on job hunting. You read any book or advice or anything. It always says have a great cover letter, that they add color to the resume, that they really help you out. In 12 years, I've never had somebody get a position who had inferior skills but a great kick-ass cover letter. If you ask me, no one really has time to read cover letters and a lot of times they could just dismiss as a personal adjective exercise. Everybody knows how no one ever has a little opinion of themselves on a cover letter so people dismiss it all the time. In fact, most of my clients won't even read it, they won't even request it. As a hiring manager, I've never read one myself. Neither have I. Second myth on the list. Really, all resumes, we were taught at the beginning of our careers, you have a resume and you put on there the stuff that you think the hiring manager wants to see and then you put that out there and the hiring manager will hire you based on your resume. There's so many different misconceptions on resumes. You could read books from here to the end of the year about how to write a proper resume. Let's just address a couple things. There is no real defined length for a resume. Whatever you've accomplished, put it down. Communicates succinctly. If you have enough information to fill up one page, fill up one page. If you have enough information to fill up two pages, it's worth reading, fill up two. Objective statements. Unless your objective is to get the exact job that they're advertising, do not put an objective statement is. HR people read objective statements and then they say, oh, this person wants to be a Chief Security Officer. We're only hiring for Vice President of Information Security. We don't want this person. Obviously, they can't have any skills useful to that organization. If you're going to go after different jobs, have different resumes. You do not only need to have one resume. Understand your audience. You are marketing yourself to your potential employers. You have to be able to go out and understand the positions that you're looking at. And therefore, tailor your resume to grab the attention, to hit the hot buttons, to make the person on the other out says, well, we really need to talk to this guy. Let me ask you a question. How many people use the word expert on their resume? Okay. Let me ask you this question. If you are in a situation when you're hiring somebody and you see the person's resume and the word expert is on that resume, what do you do as an interviewer? You grill the shit out of them, right? You're going to just see how much of an expert they really are. So guess what? Unless you really are an expert, don't put it on, and those who are experts never call themselves experts. I think the one thing that's very important to talk about with resumes in general is that it's the one thing that you just can never overlook is your accuracy on your resume is critical. I've seen many people go through month-long interview processes for very high-level positions and at the end of the time when they've been doing background checks and reference checks, the resume doesn't check out. And it's a very painful discussion. So when you come down and you're putting together your resume and you're talking about your jobs and you're talking about your careers, you can't really omit that six-week mistake because it might come back. The hiring manager might know somebody that worked with them way back then that said, oh yeah, I remember them from XYZ Company. They look at the resume, XYZ Company's not on the resume. What is this person not telling me? I cannot trust them, I cannot hire them. So please make sure that you're accurate when you're putting together a resume. Similarly about that, and this is always my favorite thing in the resume and it goes right along with the expert piece. Your technical expertise should be accurate as well. I've interviewed countless numbers of people, especially when I'm building vulnerability research teams, that say, oh yeah, I'm an expert in PPTP, or I'm good at that. Protocol is known, point-to-point tunneling protocol. And I asked them about it and they say, well, I read it in a book about four years ago. That's not something that should be on your resume. If it's on your resume, expect to be grilled about it. If it's there, you better be able to back it up. Even if you don't say the word expert, because the first thing that that tells me is that that's about the level I can expect you to learn everything. The level to which you know the worst thing that you are, your worst skill on your resume, is the level you're going to be judged at technically on everything else. One more thing about resumes, it doesn't really matter what kind of paper you put them on. So save your money. Here's another myth. Your resume is really the first thing that the hiring manager should hear about you. That's basically the way you get it from an online job board. Yeah, you know, sorry. Go ahead, man. This is what I was taught when I was going into careers. You send the resume to the hiring manager and that's the first thing that they know about you. It's the first thing that they see. It's total crap in this industry especially, but in this day and age, it's not true at all. So by the time you get in front of a hiring manager, they should already know who you are. And I'm going to tell an example. Somebody tried to hire me this week. Somebody showed up here and tried to offer me a job. He called me up and said, hey, you know, I've heard about you. Let's sit down for a meeting. I don't know who this guy is really, but let's have coffee. Guy knew everything about me. I swear he talked to my third grade teacher before he sat down with me. Seriously, he read everything that I had written in the last five years. This is the way hiring managers approach people they want to hire. I do it too. If I'm going to hire somebody, Google is my friend. And this guy's never even seen my resume. He knew everything that there was to know about me. I talked to a couple other people that were like, yeah, that guy called me asking about you. The hiring manager is going to hear about you before they ever get your resume. The point of your resume is just to confirm what they already know. So how do you make sure that they know the right things? This is the point where I get to start talking about networking. Because if that guy had called all the people that he called and found out that nobody knew who I was, he'd have had a really hard time researching me. Your network is going to get you more jobs than you ever know about. People that you know are really going to be the people that get you jobs. This kind of place is the best thing that you can do to invest in your career. Come to a conference like this and start meeting people. Start meeting everyone and anyone that you can. Like Lee said, we met in an elevator. It was not. It really was. And that may seem kind of ridiculous. But that meeting what, four years ago now, led to a job and a whole lot of different speaking engagements and a whole lot of stuff. And it was just like, you know, we got in the elevator and like, he noticed he had a black hat badge on. I'm like, hey dude, what's going on? And our friendship went from there. Your friends will get you more jobs than you will get through monster.com or sorry, Lee through recruiters or through anything like that. Unless you become friends with those people. You know, I mean, find people like Lee. Find people like, you know, other people who have that influential location within the industry and get to know them. I don't know anybody in this industry who knows more people than he knows. And who is better friends with more people in this industry than Lee. So he's a great guy to know. If I want to know something about someone who I'm about to hire or whatever, I can always call my friends and say, hey, you know, what's this guy all about? What's this person going to be like when I'm working with them? It's not about the resume. It's about who you know and how you get to know them. And I'm actually going to put a pause on this talk for a second because I like to walk my talk a little bit and it would be really lame of me to stand up here and talk about y'all getting to know each other and not force you to. So I want everybody to take like a two-minute break here and really simple. I want you to turn to the person to your left, turn to the person to your right and introduce yourself. No one's going to notice they're busy introducing themselves. Let's give him a second more of a knee-disruptive table because it actually works out. They're not noticing when he's up here doing all this logistical crap. All right. Wow, you guys are great. Yeah, you guys are fantastic. Give yourself a round of applause. So on to the next myth. Most of us were taught that interviews were kind of like exams in school. You went in and you had to pass. And that's very true to an extent. The company does have a decision to make. Yeah, but, you know, you hold the cards. Or in Vegas I can make card references. So the truth about it is this, is that the company can offer you a job all they want, but ultimately you are the decision-maker. So the best advice I can give people when they go into the interview is go out and get the job. Go out and make them want you. If you go out and you make them want you, then you will have a better decision to make. You will be able to get more information. If you conform to their culture on the interview process, you have a better chance of actually seeing who they really are and then making a decision whether or not you want to go work for that company. Ultimately you have the most to lose because the company will be there with or without you. But you are going to devote a good portion of your life to that company. So the best thing that you can do is find out as much information as you can in the interview process. Now on the flip side, before you go into an interview, the most important thing that you can do is be prepared. You can know about the company. You can know about the role. You can know about the people whom you will be meeting with. You can Google them and figure out their backgrounds, ask your friends about people who they have worked with, see if they're all right folks. It's important because you're only going to get a couple of different snapshots for you to make a critical decision for your career. Here's a rule of thumb that I like to live by. Anytime that a company will offer you a position on one interview, you should be afraid. That means they need you more than you need them. You have to press for information in the interview process because ultimately it will affect you the greatest. I think one thing that's also worth saying is that we have a lot of times that people come into interviews and they already are talking about their next job. Well where's my career path? What does this job lead? The truth of the matter is that anybody tells you a really good answer to that question is lying. The reason that they're lying is that they cannot predict the future and neither can you. The only questions that you should ask would be does the company have a history of promoting from within? Would I have the opportunity in this position to show all my skills and to have access to people that matter? And more importantly is that is this a place where you want to be and you believe it's going to bring out the best in you? If you can answer yes to those questions that's better than any make-believe promise of somebody telling you oh yeah you know in two years you'll have my job. Things don't work out that way. Anybody who claims to predict the future really can't. Actually I have a story I have to tell. I once took a job at a company that the CISO had been pretty clear that he was looking for his own replacement. He was looking for somebody and he said that I had the background and he was looking for me to come in, take the role and ultimately train up and replace him. He got canned two weeks after I got there. That's true. Yeah. I found something else that was more interesting to do. Here's another myth that interviews are only about your job qualifications. It's one of those things that I see and this is one of those mistakes that a lot of people especially starting out as hiring managers make when interviewing. For the most part we think that interviews are about what we know. You go into the interview and you get grilled on some technical stuff and you do well or you do poorly and that's what gets you the job. It doesn't mean that much. Obviously you have to be able to back up what you're good at. If, as I said, you go in and there's a bunch of stuff on your resume that you aren't really good at, well obviously you're not qualified for the job. But for the most part interview decisions are made in the first 90 seconds. There's been a huge number of research that shows that the first 90 seconds of an interview determine whether or not you get the job. The reason for that is really simple. You can have all the right technical answers in an interview and if everyone who interviews you doesn't like you or thinks you're lying or thinks you're an idiot, you're not getting the job. Flat out. An interview is about who you are, not about what you know. The nicest thing about owning my own business is I get to pick the people who work with me. Yeah. It's really fortunate. I mean, at one of the companies that I worked for, we would talk often about a candidate passing the beer test, which was really simple. Would we want to take this person out for beer? Would we want to have beers with this person? Guess what? If you failed, I don't care how smart you are. Really? You could be the most brilliant dude in the world and if you're not somebody that we want to work with on a daily basis we're not going to work with you. Yeah, that whole thing about having to have the qualifications helps. So, all right. Now that you're actually moving on into a new section and that's a lot about job hunting, but now that you have the job there's a whole lot of things. Now that you've been offered the job, there's a whole lot of other parts of the career to manage. And the advice that I got early in my career was that you should always take the best-paying job. If you have three or four things that are on your plate, generally the more money that the job pays the better off you are. The real truth of the matter is that if the job pays more money than it's supposed to, watch out. Chances are that there's a reason that they're having a hard time putting people in the role and they have to woo people with money and that will always be a temporary solution to a longer-term problem. A lot of things that, you know, how many people ever go on an interview and they give you one of those HR forms and it says desired salary. Anybody who's interviewed for a corporate job gets that, right? What do people normally put in? One million? How about one billion? How about open? Open is a favorite, right? A horizontal stroke? Yeah, people really like that. That's HR's friend, the horizontal stroke. The truth of the matter is that when you get asked that question, you really need to be honest. Now, you could ask, you know, you could say, look, I don't want to fill this out until I really know what the job entails. That's fine. But when you've gone through an interview process and they ask you what you're looking for, you should have a sense of the market. You should have a sense of what your skill value would be. That's another place where our survey will come in handy. Shameless plug. But the idea is this is that you should have an understanding of the market and whatever you put down there should be something that you can live with. Something that you feel is fair, something you feel is reasonable, and something that you believe that the company is willing to pay. If you know that you're not going to take a job for less than $120,000, there's no reason to write down a number less than $120,000. Now, if you're only earning $80,000 and you write down that you're not going to take a job for less than $120,000, chances are they're going to left you out of the door. Unfortunately, one of the rules that do exist is that unless you are bringing a very highly specialized skill to the table that is recognized by the company, your next compensation will be predicated upon your past earnings. If you are asked about your past earnings, do not misrepresent them. You can tell people that you're eligible for up to 20% bonus even if you only got 10%, that is not a lie. But if they ask you how much you got last year, you need to tell them the accurate numbers. There's no reason to play court. The system, unfortunately, does not work for us here. And you have to understand that you are playing within the system. If you have questions before you take days off from work and go into interviews and things like that, what you should be telling people is up front and say, look, if you have a magic number, let them know that up front. You will save your time. You set parameters. That's what we do all day in my office is set parameters with our customers. If we know that a candidate is going to need a specific amount of money, we communicate that. And if we deal with a candidate that's unrealistic in their value, we will not send the candidate into the client. All of our clients, and we deal with the Fortune 500 and we deal with a lot of product vendors and we deal with a lot of service providers in this industry, over about 140 or 150 to date. All these customers, they demand that when we send somebody in that we have accurate compensation, because they don't want to waste their time. So all those things are very important. And when you get down to it, you never want the compensation portion to be a win-lose scenario. Your first real interaction with this new boss that you have and with this new company is going to be how you handle this portion of your introduction. So you need to utilize this time to set a president of the type of person you are. Are you going to be reasonable? Are you going to be a mercenary? Is it always going to be about money? Or is it going to be because you're really excited about what you're doing? People who are passionate about what they do always find a way to earn money. People who go from job to job for money to money wind up with a crappy career. Short-term success, long-term failure. I see it every day. I see people paying for it. They're mistakes to the last five years. Here's one thing I'll digress. I listened to a Sports Talk radio show. I can't believe I'm actually pulling something in a DEFCON presentation from a Sports Talk radio show. But the guy on the radio said it was more of a life lesson. And he talked about his father when he was a child using a yardstick. And everybody's seen a yardstick. I try to find one in Vegas, but all I could find was booze and hookers. So the truth of the matter is in this yardstick is that everything that you do out on that yardstick automatically stays on that yardstick. So if you've done some bad things early in your career, unfortunately when you're 20 years out, those things that you did early, they're still on you. They were using references like drugs and cigarettes and stuff like that. But the truth of the matter is that you're always building on that same path. And every time you make a decision, your previous decisions do come to light. So you have to think of things that way. So since we're on money, a bit of a digression because I've managed a lot of people and I know that money is one of the hardest things for us, for most people to deal with. We have this North American cultural thing. We're talking about money is really difficult. Sorry, I wasn't on the mic there. And when we talk about raises, it's a really interesting one and I know a lot of people, especially earlier in their careers, think that if they just go to work every day and show up and work their butt off and they've got talent and they've got skill, they will get the raise they deserve. That's the myth, but everybody's laughing and saying what reality is, is that you have to understand what your market value is. And you have to have a good relationship with your boss to be able to communicate that with them. I mean, you know, if you're having a problem making your ends meet at home, you need to sit down with your boss and say, look, I can't afford to work here anymore. That might sound crazy, but guess what? That person probably has some of the same problems as you have. And if that's an issue, you don't say in a line in the sand type of scenario, you just communicate with them and say, look, the raises are coming out next year. I've been approached a couple times during the year about opportunities that pay about $5,000 or $10,000 more than I'm currently earning, but I'm reluctant to pursue them because I enjoy working with you. Now, what do you think that person is going to do when it comes raise time? If they value you and you've been a good employee and you've worked hard, they're going to do their damnedest to help you. If not, they might say, hey, look, you know what? I appreciate you telling me this. Unfortunately, I can't do anything for you. I encourage you to go look at other things, but just keep doing a good job and I'll work with you. It's important to have a great relationship with your boss. It's important for them to understand a little bit about where you're coming from. That will ultimately help you during the raise time. I mean, one of the other big myths out there, I mean, you know, you start talking about raising, you know, what's more important than money, right? Well, title is the most important thing in a job. Title really defines who you are. I mean, right? I mean, if I don't have a great title, you know, my mother-in-law can't brag about me at cocktail parties and things like that, right? Does anybody in the room know who Guy Kawasaki is? Yeah. Anybody know what he originally... Everybody remember his first real big success and what he was originally famous for? A couple evangelists, exactly. Somebody remembers his title. That's impressive. I was gonna say, does anyone know what his title was? Because not very many people do. Everyone remembers that he was big on the original Mac team. He was part of the big first Macintosh thing. Nice job. But for the most part, it's not about what his title was and his title was actually Raging Thunder Lizard Product Evangelist. Gotta love those 80s tech titles. That was his actual job title, but nobody cares. Everyone remembers that he did really cool stuff at Apple and now he does really cool stuff elsewhere. Your brand is not gonna be about your job title. What is gonna be remembered five years from now is not the title that was on your business cards or the words that were on your offer letter. What is gonna be remembered is the cool stuff that you do. And that includes not even within your job. That includes outside your job. I was talking to somebody here yesterday and unfortunately I'm the networking guy and I didn't get his name, which is bad me, but he was the guy here talking yesterday on SCADA and we were talking in the speaker green room and he was saying that when he first started talking here on SCADA, he didn't work in SCADA. His day job had nothing to do with SCADA but it was something that really got him excited and he really liked talking about it and he really liked working on it. And that's what he got known for doing. Nobody knows what his job title is probably but everybody knows he's good at SCADA and that's the way that your career path is really going to flow. You're going to get known for the things that you do. People email me and call me and approach me all the time about security careers. It's not what I do for a living but I get up here and talk about it all the time and I get known for what I do. Each of you is also known for what you do. Within your company, within your circle of friends, you are somebody, you know, whether it's the guy who always shows up late or the girl who never calls you back or whatever, you are known for what you repeatedly do. Thank you for your personal experience there. Yes, absolutely. Actually, if you ask any of my friends and some of you are in the room and can verify this, I'm the guy who's way too over committed and way too busy and has way too much going on for any one human being to keep up with and thus, I don't call people back enough. But, you know, you get known for what you do, not for what your title is. So, since we're talking about branding and what you get known for, it's really hard to plan that without knowing where you want to go. So we want to talk a little bit about the career path. So, just getting back to title for one quick second, you know, never let your title define who you are and never let other people define you by your title. You know, be proud of what you do, be good at what you do, have passion about the things that you do, and your title will turn out to be insignificant. But here, I mean, big myth, right? I mean, the myth is that the longer you stay with the company, the better your career is going to be. I mean, that was a real big hit back in the 50s and the 60s. And I have to jump in and talk about this because somebody pointed out to me the other day that this is the fourth straight year that we've gone out for drinks at Black Hat, and this is the fourth straight year I work for a different company. And my grandmother doesn't get this one at all. You know, this is really the 50s and 60s kind of messed with us as far as this goes because anytime I go home and talk to my family, I always get the, you really need to settle down and find a company where you can have a single job. And why do you move around so much? But we don't live in that world anymore. You know, that's the world of our parents. As I said, you become known for what you do. When you're doing things that aren't worth being known for, you need to find someplace where you can do those things. Generally, that's going to be at your own company. For most people, the best job is the one you're already in. Find a way to make that job better by doing cooler stuff, by changing your job responsibilities so that you're working on things that are worth working on. Hack your job. Yeah, hack your job, exactly. But when that stops working, it's time to change. I'm the first one to stand up here and talk about my own career, but I'm not a job hopper. Every single one of those moves was well planned, and it was done with the full discussion with the management chain that I was in. Hey, okay, we've done this project. We've done this work. The next thing I need to do for my career is X, Y, and Z. Can I do that here? If the answer is no, it's time to find someplace else to be. We all know people who just sort of float from job to job, and it's like, dude, you've had the same job at five different companies in five years. That's not what I'm talking about. I'm talking about making sure that the things that you want to do and the things that you want to learn and the places that you want to grow, find them, whether it's where you are or whether it's somewhere else. So jumping right along with that, the same sort of myth applies to your own growth. We all grew up believing that your company was going to manage your career and your company was going to train you and your company was going to send you to these conferences. The reality of that is that you're responsible for your own career. You're responsible for the good decisions because you're going to deal with the successes and you're responsible for the bad decisions because you're going to live with the consequences. I think that the... I'll leave you guys with three main portions here. It's key to make investments in your career. Those investments can be defined in any way that helps you get to where you want to be. They can be books. They can be conferences. They could be education. They could be certifications. Whatever works for you. They could be non-information security related. All those things are good. Here are some three rules to live by. Any investment that you make in yourself is money well spent. If you do not invest in yourself, do not expect anybody else to. And the third thing is that you get what you pay for. Think about that for a second. Think about the person who flaunts that they have an MBA but the MBA is from an online university somewhere. Think about the person who has an MBA and that's from Wharton or Harvard or Sloan or Kellogg. Think about the difference between the value for those MBAs. Every time you make a decision, understand what you put into it is what you will probably get out of it. And don't kid yourself. Here's another myth. Your career is a natural organic progression that will just flow by like a nice spring day. We all know people like that. I know people who are just like, when I'm ready the next job will appear. Yeah, no. Sorry. The people who succeed plan to do so. Alright, time for a little bit of an audience survey. And by the way, these questions are in our survey. Another shameless plug. How many people in this room have written goals for the next year, five years, ten years? That's great. Okay, the rest of you, what are you doing? Why not? Yeah. Thank you for that answer. That's perfect. And that's exactly the right thought. I mean, you know, I'm going to bring in the sports metaphor now. I was reading at one point many years ago about Larry Bird, and he used to practice insanely, because he always believed that there was somebody out there practicing more than he was. Guess what there is? And that's the person you're going to be competing for a job with later. If you're spending 90% of your free time playing World of Warcraft rather than working on your career plan while you're going, it will show in where you are ten years from now. That said, equally as bad as not having a career plan as the person who is so rigid that if the job is not exactly the right title and is not exactly the right next project, that they completely ignore it. You know, my plan is so set in stone that I can't do anything about it. There's a great military general that said, I don't remember who it was, but said that no battle plan survives first engagement with the enemy. Or is Mike Tyson? No, I don't think it was, it wasn't Patton originally. I'm going to quote Mike Tyson. Everybody has a plan until they get hit. Yeah, that works too. The point there being, you have to be open to the things that come up. I mean, if you're sitting there and you're not aware of the things around you and you're not aware of the opportunities that you have, you're going to miss it. Opportunity knocks sometimes and it doesn't look like opportunity until you figure out that there is a way to exploit it. I mean, this is all hacking in some way. There are rules that can be bent and you have to be aware of what those are. You have to be open to it to make sure that when that opportunity that you can't refuse shows up, that you're able to alter your plan in order to take it. It never costs you anything to listen. Yeah, exactly. I mean, I don't think I've ever turned down a job interview in my life and intentionally. It could be a really weird job. It could be a really weird interview. But go to the interview. At the very least, it's a networking opportunity. You meet a bunch of people. You hang out for a couple of hours. You talk about things you like talking about. It doesn't cost you anything. And you're not at your desk. And you're not at your desk. Why would you not take every interview that shows up? Who knows? We've got to hurry up. We've only got seven minutes left. This one drives me nuts because most people believe that if they're going to grow their careers, they have to move into management. Quick question. How many people think their boss is an excellent manager? Okay. Enough said. Next slide. Just management is a skill just like technology, right? I mean, you have to work at being good at anything. So as a technologist, recognize that your managers are working on their skills. And the truth of the matter is, is that it takes some different skills to be a wonderful technologist or a great engineer or a great developer than it is to be a good leader of people. And you know what? Not everybody. That's not just, you know, just because your company says that the next career progression is to become a manager, you need to understand if that really suits you and suits your own personal goals. And that's why a plan is important. Yeah, there are just some people not cut out to be managers. Just like there are some people not cut out to be coders. I mean, you have to know who you are and what you're good at and where you want to go to know whether management's the right thing. Well, you know, I've never had anybody not get an interview or get fired because they were too technical. Never once. 12 years. Here's another myth. Whatever you know today is enough. All right, next slide. Yeah. No, and the important thing here is that this is a really interesting industry because this might not be a myth in a lot of industries. You know, sure, you can always grow your skills in any industry, but there are a lot of industries that if you were good at something 20 years ago, you're still good at it today. I mean, really, how much has C++ changed in the last 15 years? Some new libraries. I mean, it... What was that? It hasn't changed that much that my computer science degree is out of date. I could go pick up some new stuff. The fundamental language is the same. There has been some advances. How much has security changed in the last five years? About the last five months. How about the last five months? The technology, it's not even in the same ballpark. The things that would have made you in 2001 would get you unemployed today. I mean, and I'm not picking on this, but I mean, in 2001, one of the biggest jobs, like, hottest, most in-demand job was firewall engineer. How many people do you know that are really, like, just going at it, looking for firewall engineers these days? It's become operationalized because that skill is not nearly as hot as it used to be. If you're still using the skills that you learned 10 years ago, you're horribly out of date and you're horribly obsolete, which is not true. Yeah, you still have to grow in all those other industries. You still have to grow in all the other types of technology. But security's interesting because if you think about it, the biggest threat surface is always in the brand-new technology. The older the technology is, generally, the threat surface sinks. Or shrinks, sorry. That's the point in this industry, which presents a really interesting challenge. If you slow down for a second, you will perish in this industry. I'm sure everyone in this room knows somebody who was totally in demand five or six years ago, if you've been around long enough, that is really just not that useful today. That's not as true in most other industries. Now, one of the things that happens is that in the industry, everybody asks, well, what are the hot skills? A lot of reporters call it like, hey, Lee, what are the hot skills? Like, all right, well, the hot skills are different. And what happens is when a skill becomes hot, then more people gravitate towards doing it. All the certification bodies roll out and say, oh, we're going to certify you in the hot skill now. And then all of a sudden, it becomes a mass-marketed skill. There are more people. It drives the price down. And then something else becomes the hot skill. You will wind up having a really, really good body of work that will put you in a situation when you're in the room and someone's asking you about your experiences. You'll be able to address a lot of those different things. The key about your careers is being able to leverage the things that you're good at, to focus and understand your strengths, to make investments in yourself, because this industry is becoming more and more competitive. And what will happen is this, is that there are going to be more and more smart people just like you sitting in the audience. And guess what, there's going to be less and less good jobs out there. And what you have to figure out is that when you get in that room and you're invited to that party and there are four or five other people that are just like you, just as equally as qualified, you're going to make the difference in them giving you your opportunity. And it all starts from today. It all starts from building a plan. It starts from executing on that plan, reaching out, learning, understanding what you need to do to accomplish your goals. And just set your mind to it. You guys do it to everything else and you're successful. This should be no different. The survey, I mean, it keeps me plugging the survey, right? I mean, we've worked with a gentleman who's a PhD from Stanford, is very involved with the Honey Net Project to help us put the whole research spin on the survey. It's in survey monkey format. We just want to know from everybody. We want to give real good data back to the industry. And we don't want it to be colored by any trade association, by any one skill set of people. I mean, we're going to go out to, you know, all our contacts to the community. So we're really counting on you all to tell your friends to participate. And really, you know, we're going to give it back. And we're going to pay it forward. And I think that's, you know, the best thing that we could do. Anybody has questions? Come see us in the Q&A room. We're happy to answer. We love doing this stuff. So let us know. Thank you.