I’ve been thinking a lot lately about how security professionals can grow their skills and experience most effectively. As someone who consults in large organizations, as well as runs training classes for infosec, I’ve long pondered what the right mix is to help people gain the broadest, most applicable knowledge and experience in the shortest amount of time. Personal motivation, self-study, and natural proclivity for certain types of work are all factors, of course. However, I do think there’s some general truths in how you go about acquiring jobs, working in those jobs for X length of time, and then moving on from those jobs to different ones.
From what I’ve seen, most corporate infosec jobs do not really allow you to explore a lot of new and different activities and disciplines. In other words, you start as a network monitoring staffer, you stay in that role, and you watch the traffic. Or, you work as a risk analyst or security architect, and you have zero chance of exploring things like vulnerability management or pen testing. And so on. This is not absolute. Some organizations I’ve worked in and observed really facilitate infosec team members moving in different directions and exploring new skill areas. On the flip side, some organizations are so understaffed that the security team does too MANY jobs, all of them somewhat haphazardly. Many organizations DO send people to training, but I see a lot of people come to SANS classes that are just learning something they’ll never do at work – pen testing in particular. A good 50% or more of my students in some conferences are learning pen testing because they think it’s “cool”, not because they have any hope whatsoever of doing it within their organization.
What do you value in a job? Aside from a paycheck, of course. If stability and a “comfort level” with your workplace is important to you, then you should stay in one organization for a longer amount of time. However, if you want to get real hands-on experience with a much broader variety of scenarios, tools, and disciplines, you’ll likely have to do a bit more “job hopping”. In some ways, I think infosec is vastly different from a lot of traditional IT, in that it is entirely different depending on where you are. Risks are different, politics are different, attacks and breaches differ, etc. Contrast this with an Exchange admin – Exchange is Exchange is Exchange, with some differences in integration and tweaks to make it work. I suppose the same could be said for someone whose infosec career is “tool focused”, like ASA firewalls or EnCase for forensics. But if you really want to learn more technical areas of security, and see more scenarios, I think you’ve got to move around a bit. One other reality is the “job rut” – people get burned out, and some organizations just don’t value security. That may also be as good a reason as any to get the hell on down the road to something new and different.
One argument I get is that “knowing the organization” is invaluable in security…and to some extent, I agree. But really more for defense than offense. If you want to be a great defender of ONE ORGANIZATION, then you’ll probably need to stay there for a longer period of time to really get the lay of the land. If you want to be a better pen tester or red team member, you’ll likely need to work at a number of different places, or go work for a consulting firm (at least for a while to get more broad experiences). Some very big companies I know have so much stuff for pen testers to assess that they get a lot of variety. But most are not this way. So in general, I’d say that defense and risk positions may be good fits for longer-term positions in one organization. But if you want to do offense, you may be better off moving around a bit.
In general, I think loyalty to an organization is somewhat overrated. Most aren’t really loyal to you – that’s an old mentality from the 1950’s. Getting a bit more and different experience is a better way to go, in my opinion. I’ve also seen a trend related to tools and products – they’re really only useful as resume fodder in the earlier stages of your career, with some exceptions. If your goal is to be a firewall jockey, then go for it. List all those hardware and software versions you spend time with, because they DO matter. But later on, especially for risk-focused positions, or architect jobs, this seems to be less important (unless you need really advanced skills with a complex technology like a particular SIEM, for example). If you’re in more management-oriented roles, moving to new jobs tends to be more based on your track record of success stories versus hands-on skills. Did you develop a sound program at company X? Successfully coordinate a data breach defense at Organization Y? And so on.
Just some observations I’ve had over the years.