Episode 17 · · 46 min
InfosecJon From Rudderless Youth to Navy Engineer to Security Professional
Information security consultant
Episode summary
InfosecJon runs a website cataloging his learning and dedicated to helping others get in the field. He shares his personal story from a directionless youth to enlisting in the Navy (and its follies) and his tribulations getting into the field. He also shares some interesting Navy stories. Look out for the bonus episode!
BIO
Jon is a father, husband, and a veteran. He went from an aimless youth to enlisting into a career path he never liked. After 7 years as an electrical engineer, he got the chance to pursue his dream of working in information security. Now, he runs a website devoted to helping others.
Notes
By almost getting crushed in a two-story engine, Jon learned to be adaptable to the situation
Got exposure to computers by working with dad at his computer store
Was an engineer at heart who fell in love with the inner workings of things and how they work
Became the go-to person for technology in his department
Always had a knack for helping others, even before the military
Quotes:
"[The] biggest skill I got was to be able to figure things out quickly and troubleshooting."
"You can't troubleshoot something until you know how it works."
"I just wanted to learn as much as I could."
"I want to work with technology; I want to help people."
"Going to a traditional school, being more mature, was [seen as] a negative."
"Everybody doesn't know everything. That's why most security teams are... teams!"
"I want to help people; I want to protect people."
"The networking knowledge, the [SysAdmin] knowledge, and then the drive to learn new stuff... is what they were attracted to."
"Nobody wanted to do it. I volunteered and stepped up."
"One thing that attracted me to the school 100% was the advertised hands-on labs."
Before infosec: Navy engineering electrician, fire alarm technician and sysadmin
Chapters
- 0:00
Intro: the Navy veteran behind infosecjon.com
Ayman teases Jon's directionless youth, drive to help people and job-search struggles.
- 1:23
How infosecjon.com started
Jon explains how a learn-to-hack journal grew into career advice articles.
- 2:28
Dropping out and enlisting in the Navy
A directionless teenager enlists and ends up in an engineering electrician role instead of IT.
- 5:26
Engine room life and a near miss
Twenty-hour days and getting trapped in a running engine taught him adaptability.
- 8:37
Taking apart his first computer
Working at his dad's computer store sparked his fascination, and later he became the Navy engine room's computer fixer.
- 12:42
Fire alarm tech, tech school and first IT jobs
His wife's enlistment let him study full time, then a help desk job led to a 'Mac team' surprise.
- 23:58
The Stuxnet moment and wanting to protect people
A security class video and his urge to help people pushed him toward infosec.
- 26:47
Rejections, sysadmin work and the firewall upgrade
A CISSP-based rejection, mentor advice and volunteering for a firewall upgrade shaped his path.
- 30:31
Finding a mentor and the pool-hall interview
A veteran mentorship program, more rejections and a technical interview played over pool led to his security job.
- 35:48
VulnHub, imposter syndrome and security teams
A coworker introduces him to hacking labs, and he explains why nobody has to know everything.
- 38:52
Social engineering war stories
As a fire alarm tech he talked his way around buildings, including watching a surgery as a supposed resident.
- 41:30
Security roles beyond hacking and closing
Jon plans to write about policy, compliance and training roles; Ayman closes with a plug for his community.
Key takeaways
- Learn how normal systems work first, because you can't protect or troubleshoot what you don't understand.
- Build a foundation as a sysadmin or network administrator before aiming for a dedicated security job.
- Volunteer for tasks nobody wants, such as a firewall upgrade, to gain security experience on the job.
- Veterans can use mentorship programs to get a realistic career roadmap.
- Pick training with hands-on labs, and don't treat being an older student as a disadvantage.
- Security has many roles beyond hacking, including policy, compliance and user education.
Notable quotes
you can't troubleshoot something until you really understand how it works
I want to help people. I want to protect people.
Everybody doesn't know everything
Questions answered in this episode
- How did InfosecJon get into cybersecurity?
- Jon served in the Navy as an engineering electrician, then moved through fire alarm work, tech school, help desk, patch management, sysadmin and systems engineering roles. After several rejections he was hired into a consulting security role.
- Do you need to be a hacker to work in infosec?
- No. Jon points out that security also needs people in compliance, policy and user training, and that builders such as sysadmins are in demand.
- How can you cope with imposter syndrome in security?
- Jon says no one knows everything and that is why security teams are made of specialists in code review, networks and user awareness, so you only need to be strong in what you are exposed to.
Show notes and links
Show the original episode notes
InfosecJon runs a website cataloging his learning and dedicated to helping others get in the field. He shares his personal story from a directionless youth to enlisting in the Navy (and its follies) and his tribulations getting into the field. He also shares some interesting Navy stories. Look out for the bonus episode!
BIO
Jon is a father, husband, and a veteran. He went from an aimless youth to enlisting into a career path he never liked. After 7 years as an electrical engineer, he got the chance to pursue his dream of working in information security. Now, he runs a website devoted to helping others.
Notes
- By almost getting crushed in a two-story engine, Jon learned to be adaptable to the situation
- Got exposure to computers by working with dad at his computer store
- Was an engineer at heart who fell in love with the inner workings of things and how they work
- Became the go-to person for technology in his department
- Always had a knack for helping others, even before the military
Quotes:
- "[The] biggest skill I got was to be able to figure things out quickly and troubleshooting."
- "You can't troubleshoot something until you know how it works."
- "I just wanted to learn as much as I could."
- "I want to work with technology; I want to help people."
- "Going to a traditional school, being more mature, was [seen as] a negative."
- "Everybody doesn't know everything. That's why most security teams are... teams!"
- "I want to help people; I want to protect people."
- "The networking knowledge, the [SysAdmin] knowledge, and then the drive to learn new stuff... is what they were attracted to."
- "Nobody wanted to do it. I volunteered and stepped up."
- "One thing that attracted me to the school 100% was the advertised hands-on labs."
Links
- InfosecJon (Twitter): https://twitter.com/infosecjon
- InfosecJon (Website): https://infosecjon.com/
- Navy C-School: https://www.quora.com/Whats-a-Navy-C-school
- Jon on the different types of hackers: https://infosecjon.com/types-of-hackers/
- Intro: Cascadia by Trash80: https://trash80.com/#/content/133/weeklybeats-2012-week5
- Outro: White Smoke by Endless - http://www.endlessslove.com/
Resources
- SEED Labs by Syracuse University: http://www.cis.syr.edu/~wedu/seed/index.html
- David's CTF Post: https://bsidessf.org/news/2019/03/running-the-bsides-sf-2019-ctf
Getting Into Infosec:
- Twitter: https://twitter.com/coffeewithayman
- YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
- Book: https://www.amazon.com/Breaking-Step-Step-Starting-Information-ebook/dp/B07N15GTPC/
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
Hey everyone, I'm Ayman Elsawah and this is Getting Into Infosec. My guest this week is infosec John. He has a website dedicated to helping those get into infosec. He talks about his youth.
The big part of my story when I was younger is I had no direction and I had people pulling me in different directions.
But he always had the drive to help people and be helpful.
There was something that just drew me into wanting to protect and help people. I volunteered when I was a teenager at old folks homes and, you know, did dinners, you know, made dinners and stuff and would sit down and talk to them. And I just like being nice to people and helping people. Out.
John also shares his struggles trying to get in both professionally.
The guy told me, like literally looked at my resume. He's like, you have nothing here that tells me security. Like you need to work a security job to get a security job with me. And personally, my wife ended up enlisting herself to take the pressure off of me from earning a single income so that I could go to school full time and really focus on personal growth.
All right, on to the show. Hey, John, welcome to the show. Hi, how's it going?
Good, how are you doing? I'm doing great. Really honored to be on here.
Well, I really appreciate taking the time to come on to the show. So, you know, I found your website by accident as I'm stumbling through the internet doing research for guest research. And I found your website. I really like what you have on there. And for folks listening, well, maybe you could talk about your website a little bit.
All right, we can start with that. So last year, I registered the domain name infosecjohn.com. I didn't really know what I was going to do with it to start. A coworker of mine got me kind of introduced to the hacking scene. Infosec Twitter is where I kind of started out. And at first it was just like a journal, a learn to hack journal, you know, Hey, my Cali exploded today. I have to rebuild it again, you know, stuff like that. And then I started seeing people questioning about career related questions. Like, you know, should I apply for a job if I don't feel I meet the experience? And I wrote a little bit about that and it just kind of grew and took a life of its own a little bit. And now I'm
Trying to be more organized and write more professionally, more detailed articles and make better content.
Tell us a little about yourself and your role in security today.
Well, a long time ago, I was like many people out there, a teenager who had no direction and didn't know what I wanted to do with my life. I worked for my father a little bit in a computer store and I tinkered a little bit with 46 machines that were broken. I just took apart and put together Pentium Pro machines and Packard Bells and Compact Preserios. I was like, wow, people get paid to install Windows or upgrade to Windows ME and stuff like that. And I was intrigued. But when I got out of high school, well, I dropped out of community college because the program really didn't meet my needs. What were you enrolling in? Well, I was enrolled in a management program in community college, which isn't really what I wanted to do.
And I guess that's a big part of my story when I was younger is I had no direction and I had people pulling me in different directions. So I ended up enlisting. I really wanted to do IT for the Navy, but had to wait. There was a wait list of a year because they only have so many people doing school classes.
Hmm.
And so I was like, oh, what's available right now? You know, which is never a good story when you're listening. And they're like, well, we have this IC position and OS. And I was like, well, what's technical? I want to do something technical. And they're like, well, IC is communications electrician. You'll be working on phones and TVs. I'm like, that sounds fun. So I did that. I get to boot camp. I go through that and I get to my A school and I was top three, I think, in my A school class. And they're like, hey, you know, you're doing really good with this. We're going to give you a C school. So. And what's a C school? A C school is advanced training.
Okay.
Usually, well, I was told if you're top of the class, you get a C school, you know, but usually when you're in the fleet for a little bit, they'll send you back for training. And it's like kind of a bonus because you get like a job category that is highly needed for the Navy or something like that.
I see.
But my C school ended up being console maintenance. So I get there and they're like, yeah, you're going to be in the engine room and you're going to be controlling the consoles. And I was like, whoa, whoa, this really isn't TVs and phones. Like, that's really what I wanted to do. So I get through that. That was fun. There's only four students in the class, so it was really easy. Then I get to the ship, and I realize for the first time, I'm going to be working in engineering. Ah, I see. Engineering, for people who don't know what it's like, there's the 9-to-5 Navy we call top-siders. And then there's the engineers where... I think most of my time I was doing 12-hour days, 10-hour days when we were in port.
And then on my second deployment, which was the worst, I was working 20-hour days because engineers do six and six watches. And then in between watches, I was unlucky enough to, I was what they call work center supervisor, which is you're in charge of doing maintenance assignments and stuff. So I did that in between my two watches. And then when I got off watch, I did paperwork and passed out. Oh boy. For nine months. It was crazy. It was great because I learned to be quick on my feet, dealing with all sorts of crazy situations. Like my first week on the ship, there were engine men that were working on the engine and we had to work on a sensor inside of it. And I'm in there with a senior sailor and he's showing me how to do everything.
We're inside the engine. They drained it out to do their maintenance. Oh, wow. And so we're in there working on our sensor inside. And all of a sudden, the engine pistons start turning while we're inside of there. And I'm like, what's going on? And he's like, get out now. Wow. And yeah, so... We're in port.
And the pistons are like as big as cars, right?
On those engines, we're talking two stories. The engines were two stories, 16 cylinders. Oh, my God. Okay. And we were working on one of the cylinders. About like a six-foot person could fit inside of the cylinder spot. Wow. So they're pretty big. And, you know, if they got you, they would crush you to death.
Yeah, of course.
And it just happened to be that the person who they have this tag system and the person who took their tag off for their maintenance took our tag off also and turned it on. Yeah. While we were inside of it. So I learned to keep my head on a swivel and be adaptable to situations. And then another aspect of being an electrician in engineering is there's always the, hey, it's your fault. No, it's your fault. It's electrical. No, it's mechanical. So I learned to figure out systems that I was working with By reading tech manuals and tinkering around with them. So I learned not only just the electronics of it, but I had to learn the pneumatics, mechanics, hydraulics, how engines and boilers and all that kind of stuff worked.
So it was pretty cool being exposed to all that kind of technology and everything.
Did it help your thought process to think like an engineer?
Definitely, definitely. The biggest skill that I got was being able to figure things out quickly and troubleshooting. And I believe in the, you can't troubleshoot something until you really understand how it works. Because if you don't know what a normal situation is, then you're not going to be able to get it back, restore it to that, you know? Right. So that's the training that I got. And that was my mentality and my attitude.
Okay.
And, you know, for an undisciplined kid who had no direction, it was unfortunately what I feel that I needed. Yeah.
Okay. Were you always interested in technology or when was your first itch in technology?
Probably when I took apart my first computer. And when was that?
I want to say... Or not when, but which computer was that?
It was when I was early teens. It was one of those, I think it was a 286 machine that broke. It was one of the first ones I did. And, you know, I didn't know anything about how they worked on the inside. And I opened up the case and I was just amazed. Like, there's all these little... Pieces and parts that, you know, work together and produce a video on the screen. Right. And I just wanted to learn as much as I could.
And what made you open it?
Well, I was working at my dad's computer store and it was a slow day. He had me working on the sales floor, helping customers when I walked in because I was As a lot of people are when teenagers, they can help out older people because we grew up with the technology, so it's not new to us. But it was a slow day, so I went in the back room and the technician was fixing or trying to fix this machine. And he's like, hey, why don't you take it open and try it out? So, you know, I unscrewed the screws and I was just amazed at how everything worked together. And that's kind of, that's probably the earliest time I fell in love with like the inner workings of how things work. And, you know, that kind of sparked pretty much my whole path, but I still didn't have the discipline and the direction to pursue it.
I still kind of just did what people People told me to do, which was perfect attitude for the military. But I didn't really start down this path until I was in my mid-20s.
Okay. So in the military, did you get a chance to work directly with computers?
Yeah, there was one computer system that they put on and nobody could figure out. It took readings from all of our sensors that went to the console, but it's put it out in a computer screen instead of the old analog console that I was in charge of.
So you're still in the engine room, right?
Still in the engine room. Okay. And they're like, well, you're the console tech, so you just take care of that. And I'm like, well, why don't the ITs take care of it? And they're like, no, no, no.
It. Okay. So, you know, once again, they threw it at me and I was like, okay, it was just a simple, there was one server, four workstations, one in each of our control rooms. And there were also PDAs that the engine men, when they took their rounds, you know, what's the pressure, what's the temperature, you know, is the fuel tank getting low, like that kind of stuff. They manually would take readings that the sensors didn't spit into it. And it was really simple, really easy, but they kept breaking the PDAs because they didn't like using them because they were very resistant to technology. No offense to anybody, but there were some real knuckle draggers in engineering.
And they broke them on purpose?
Yeah, like actually caught someone throwing them down a ladder wall. Wow. It was three stories to go from the main deck down into the engineering space. And I was leaving and I saw a guy at the top drop his PDA, like on purpose.
And I was like, what are you doing?
He's like, I hate that damn thing. I can't figure it out. Wow. Okay. Alrighty. They'd rather use paper logs.
Okay. Yeah. Cool. So you were able to solve the problem, I'm assuming, on this nerver?
Yeah, I was able to figure it out. I thought it was really cool. And I kind of decided then that's what I wanted to do. Okay. Because, you know, every once in a while the computer would go down and I'd have to figure out, okay, what's going on? A big problem was they'd overheat a lot because, you know, we're in a hot engine space. And somebody didn't think maybe we should put extra cooling on this computer. You know, so we'd have like the CPU, you know, burnt out once and the hard drive burnt out another time. You know, like simple stuff like that.
Yeah. So you became the go-to person for computer stuff.
Oh, yeah. I was able to figure it out. And everyone's like, hey, good job.
Nice. Okay. So after the military, what was the next step in your career towards infosec?
Well, when I was getting out, my girlfriend at the time, my future wife, she was the first person to actually sit me down and say, what do you want to do with your life?
Sounds like a movie moment.
Yeah, like seriously. And I didn't know, like I wanted to get a job making money and go to school using my benefits from the military. So when I got out, I became a fire alarm technician and I was planning on enrolling in a local school, the community college, just to try out college. I was still really intimidated about going to school, but I knew nothing about, you know, the IT industry or anything like that. Right. But then as a fire alarm technician, I was able to work with some cool gadgets and fire alarm sensors and smoke detectors, heat sensors and all that kind of stuff. And I kind of liked what I did. So it held me back a little bit from pursuing my dream. And I was really intimidated by school.
So I had a lot of fun doing that job. But my wife ended up enlisting herself to take the pressure off of me from earning the single income.
Oh, wow.
So that I could go to school full time and really focus on personal growth, which is absolutely outstanding. It's probably the single most self-sacrificing thing anybody has ever done for me.
Yeah, that is amazing.
Yeah. So I'm very, very grateful to her for doing that. So we ended up getting stationed in Navy Town and I went to what I call a party school, one of those traditional colleges because it was a big school around there. And, you know, everyone was talking about the parties and the clubs and I hated the school. It was an IT management program and I was ready to give up on it. And a buddy of mine said, hey, look, there's this other school. It's not as well known. It's a tech school. But what they do is, you know, they get you a job when you graduate. And it's an accelerated program. I ended up finishing my degree in two years and some change. But I sat down with a career counselor at the school and he's like, well, what do you want to do?
And I said, I want to work with technology. I want to help people. And he's like, well, we have this degree program in network security. They had a game design degree in network security and a mobile app development program.
Now, is it a vocational school or what type of school is this?
They call themselves a university of technology, but they're...
But like what kind of school for those out there looking for a similar type of school, what would they look for?
So one thing that attracted me to the school 100% was they advertised hands-on labs. And in every single one of my classes, like for instance, in the Microsoft Windows class, we used VMware, we built a desktop, we built a server. Then we used DC Pro mode on the second server to connect them and create a DC. And then the final lap of that first class was to connect the virtual workstation to Through the DCs to the teacher's computer.
Oh, okay.
Which was really cool. Yeah. And then like in my networking class, we had to create a, you know, we worked in teams, but we had to create a network in the class from scratch.
Nice.
And then in like my Unix class, I don't know why they call it Unix, but we used Red Hat and basically did the same thing with virtual Red Hat machines and connected to the teacher's machine. The final lab was, hey, can you get to Google? And that was, if you got to Google, you got 100 on the lab and that was it. But the teachers there were very helpful. They would stay after hours in the Unix class. I struggled a lot because I had never even heard of that before I went to school. I never heard of PowerShell before I took my PowerShell class. I didn't know any of this. And, you know, I'm surrounded by a bunch of kids, you know, teenagers, 19, 20, 21, going to school, going to college for the first time.
And I was much older and I was like, you know,
How much older, you know, about approximately?
I started going to this school when I was in my late 20s. I'm in my mid 30s right now.
Okay.
So it's been a while, but...
Okay. And you would recommend it for those of any age, I would say, that want to shift in?
Yeah, definitely. Going to a traditional school, being more mature was a negative. Because you're surrounded by a bunch of kids who just want to have fun and get their degree at the same time. Going to vocational school or trade school, I don't know, at least at my school, it seemed like my maturity attracted the kids to me and people wanted to partner with me because I was more disciplined. I was more focused on getting the project. Done instead of like just hanging out.
Yeah, it makes sense.
Yeah. So I thought that was pretty cool.
So you graduated from the vocational school, the trade school. And then how was it now? Did you start applying for jobs right away? Did you start before you graduated?
Well, I actually, when I finished my associate degree, there was like an internship program. They guarantee that they try to get you a job or they guarantee you an interview.
Hmm.
Which, you know, I think they had like a 97% job rate. If you know they give you the interview, you got the job. So I started out working on a help desk. And my friend actually makes fun of me because I was actually only on the tier one help desk, technically for like two weeks. While I was in school, I worked in a retail store. They called me the Apple specialist because I was trained in helping customers in the store fix simple things in their Apple computers. A lot of people didn't know the difference between Windows and Apple Mac OS. And they're like, I don't know how to do anything on here.
Wait, sorry. You were in a retail, what kind of retail store that had Apple computers?
It was a military exchange.
Okay.
And so a lot of people had never seen Apple before, I guess. I don't know. But it was a lot of simple stuff like, hey, how do I open my email? How do I get to the internet? Really simple questions.
Yeah. I'm trying to paint the picture because you said retail store and then you said Apple products. So I was trying to make the connection there. Oh, yeah.
Yeah, the company that I worked for was a marketing company technically, but they were licensed by Apple to sell Apple products at other stores. So the display in the store kind of looked like an Apple store, but it was a regular, you know, like the military exchanges have like everything and they're like department stores.
Oh, I see.
So it was in with the other computers and like the TVs and that kind of section.
Oh, interesting. Okay.
But that's important because when I was at my interview, they were like, okay, oh, I see you know Apple. So I was like, yeah, I'm pretty good with them. They're like, okay, save that for later. Two weeks into my training, I get a call from the recruiter who was like, well, you know, there's an opening on the Mac team. So we're going to put you on that because you have Apple experience. It's an extra dollar an hour.
Mac team?
Mac team, yeah.
Oh, Mac team. Okay.
Mac team. Yeah. So I stayed in the training class. They did five weeks of training because it was on a military network and they want you to know the naming conventions and like, you know, the terminology for the military networks and how everything works. So it was good training.
Hmm.
And so I start my first day on the Mac team and I see nothing but Windows computers and everything. And I go to my supervisor and I'm like, hey, where are all the Apple computers at? And he's like, who told you there's no Apple on military networks? I was like, well, that's why I'm here. And I found out that Mac team meant move ad changes. Hilarious.
I was wondering, I was like, the military had Apple computers in turn? Okay, sure. Let me go along with it.
Nice. So he kind of, he was a great supervisor. He really helped us out. And he actually pushed me when he found out that I was interested in security. I worked really hard to learn my job there, which was basically like processing new users in Active Directory, email boxes in Exchange. Creating and changing names of people and stuff like that. Really simple stuff. And he pushed me towards working on what they called IA mitigation, which was basically like patch management. But it was a step up for me in pay and it was a promotion. So I switched contracts to go to that place. And it was kind of cool because it was my first real look at, you know, that they would take scans of the inventory of computers, you know, and they would switch site you're at, you know, each week or whatever.
And they would give you a list of machines and they would say, OK, it failed for this. It failed for that. You know, Java needs updated or, you know, Internet Explorer needs updated, whatever. So. So I remoted into machines and did manual patches. And I was like, well, is this security? And they're like, yeah, this is really important because the patches are for vulnerabilities. And, you know, I had taken a couple of security classes, so I knew the terminology, but I never, I guess I never understood the big picture of how everything was interconnected until I got there. I was like, yeah. Vulnerabilities are released and they patch them. And so they can't be exploited by hackers, you know? And this was still when I was like, Oh, hackers are bad people, you know, which I kind of feel silly for thinking that,
But that's also, you know, that's something that I wrote about, too, is like the way the media treats hackers is like hackers are always bad. So that's what I believed back then. And I feel bad about it now because I was a veteran. I signed up for a mentorship program and I was like, hey, you know, I'm in this entry level security job and I want to move up. And they were like, well, you don't really know anything. And that was when I first got my five year plan from this mentorship program. Like, and this is what I write about on my website, too, is, you know, they advised me that I go become a system and then go become a network administration and then go do like system engineering and learn all the different technical aspects.
Of it before i tried to get a security job because what they told me all the time was you know how can you protect something if you don't understand it you know and it went back to my military training was how can i fix something if i don't understand how it works yeah So that kind of resonated in with me and I was like, okay, the negative part of contract work is that sometimes contracts can end abruptly. And I got told by my supervisor, hey, in a couple of weeks, contract's over. So I kind of scrambled around and I was lucky to find another job. And I ended up working on another military contract as a system administrator.
Okay. So let me pause for a second. When did you know you wanted to do security versus just regular IT?
When I was in school and I took my first security class, we watched a video about Stuxnet, which was, I think... I think it was semantic researchers.
Yes.
That first wrote the white paper about it.
Yeah.
And that had just come out and, you know, we watched a short video about it. And the way my teacher talked about it was like, this is how powerful it is that, you know, that state actors are using it against other states. This is how complex it can be. And I was just kind of blown away and all of how powerful it was. And that's when I kind of decided I wanted to do it, but I didn't know how to get there. And as good as the school was to getting you a job, they weren't good at pointing you in the right direction for everything. So I kind of had to learn, like I got my A plus out of school because that's what they told me to get. And then I got my sec plus because it was required for my help desk job.
Oh, was it?
Yeah. They, something came down and they're like, yeah, everyone's got to get it in six months, which for me, it was easy because I was, you know, taking the classes while I was starting to work there, finishing my bachelor's degree. So I got that.
And so you saw the video about Stuxnet. And what role did you see yourself playing in security?
Back then, I really wasn't sure what role I wanted to do, but there was something that just drew me into wanting to protect and help people because, you know, my experience was everybody gets those spam emails from the FBI found your lottery winnings or a Nigerian prince wants to give you money, you know, and I'd seen those and, you know, I'd known some people that had lost, you know, like a hundred bucks or 50 bucks, like small amount of money, but I knew people that had lost some money to scammers who got a spam email and thought it was real. So I was like, you know, I want to help people. I want to protect people. I've always been drawn to helping people.
Even before the military?
Even before the military. Yeah.
Okay.
I volunteered when I was a teenager at old folks homes and, you know, did dinners, you know, made dinners and stuff and then would sit down and talk to them. And I just like being nice to people and helping people out.
I think that's an important trait in the security field to have that willingness to go the extra mile to help folks. What do you say?
Yeah, it's definitely important. There's two mindsets to it. You know, there's the mindset of, you know, like doing this job will probably make me some money. And, you know, I think that's okay. But then there's the people that, you know, I find this really interesting and this is what my passion is and I'm helping people and I respect that. That's kind of how I feel.
Okay.
Definitely.
Cool. So you got the sysadmin job now, and you're working that, but you're still on track, still trying to get into the infosec field. So yeah, walk us back through that.
When I was a sysad, I learned a lot about VMware and virtual technology. And I actually interviewed for a junior cybersecurity analyst position, I think it was. And that was my first rejection. That was the job that I was talking about on Twitter the other day where they told me in my rejection, well, how come you don't have a CISSP yet? And I was like, well, you know, I just graduated like a little bit ago. Like, You know, I'm still learning technology and stuff. And they're like, well, you don't have passion for security if you don't have your CISSP. And I was like, what are you talking about? Wow. You know, so it kind of threw me off a little bit. And thankfully, I had the mentor. And basically, over the next few years, I worked as a SISAC.
And then my contract ended. And I worked as a network administrator. And then I got promoted there to system engineer.
Mm-hmm.
Again, working on virtual technology, Cisco routers, Juniper routers and switches and firewalls and VPNs. But I did something there that my mentor told me to do. They were doing a major upgrade to the firewalls and nobody wanted to do it. And I was like, why not? This is awesome. I want to do it. I volunteered and I stepped up and I said, you know what? I want to learn security stuff. Firewalls are part of security. Let me do it. And my boss was like, yeah, sure. No problem. I learned a lot from the installers that came to do the installation and showed me how to configure everything. And the networking knowledge is just that knowledge. And then the drive to learn new stuff and volunteer to learn new stuff is one of the things that when I eventually got into the security role that I have now, it's something that
They told me afterwards that they were attracted to from my interview, that they could see the passion in my eye when I was talking about volunteering for that job to do that role at that particular job. And that was in a network operations center. So I got to do a little bit of everything. It was really exciting.
Yeah, that's really good. Yeah, a holistic view. So did you end up transitioning to security at the same company or a different company altogether?
Different company altogether. Pretty much with the contract work that I've been doing my whole career, it's not like loyalty isn't necessarily rewarded with more pay or opportunities. So I joke sometimes that I'm a patriotic mercenary. Because, you know, I'll jump to the next highest paycheck, you know, more responsibilities or, you know, the role that I want to do like security.
Well, that's how it is, right? Yeah, definitely. I mean, if you want to level up, if your employer is not willing, I don't want to make a blanket statement, but, you know, to level up, sometimes you just have to change jobs. Yeah, exactly. Right. It's just the fact of life, you know. You know, hopefully your employer will see there's a number of reasons why you couldn't either you hit a ceiling or whatever, you know, competition. Yeah. Yeah, exactly.
And I mean, it's because contracts are contracts. They don't get any more money if you grow your skills. Right. So they're not going to pay you anymore. Right. I understand the business side of it. I don't want to knock anybody or anything like that. But it is what it is. So you got to do what's best for you. And that's what my bosses and my supervisors have always told me when the contract ended. And I'm like, well, I'm not going to re-up. I'm going to go somewhere else. They all understand. That's just how it is.
And so how did you find this mentor? I mean, this seems like this mentor was really pivotal in your career. Is it easy to find or, you know, walk us through that a little bit?
Well, there's a company called ACP that does mentorship for veterans in certain fields. And I signed up for that being a veteran. And the woman that was assigned to me, I believe, was not a CISO, but underneath the CISO for a major hospital, hospital wing or whatever, a group of buildings that she was in charge of. And she was similar to how I ended up in security, where, you know, she told me her story was very similar. She was CISAD network. And she's like, to me, it was the best way to build your well-rounded resume. And that's what worked for me. She told me back then and I was like, okay, it sounds like a lot of hard work, but eventually it paid off for me too. And it didn't just happen either.
I applied for a lot of different jobs and I even interviewed for a handful of them. There was that one that I mentioned where I kind of got laughed at and then there was another one. Where the guy told me, like literally looked at my resume. He's like, you have nothing here that tells me security. Like you need to work a security job to get a security job with me. I was like, okay. But I just, you know, I went home again to my very supportive family. And they were like, you know, you'll get the next one. And the one that I actually did get, the recruiter told me at first that, you know, there's somebody else that they really like that's more experienced than you that they're going to go for.
But something happened with that candidate. And seven months after my first interview, because there were three in the process, I got a call from the recruiter. And he's like, yeah, you know, things fell through with that other guy. They wanna talk to you again to see if you're still interested. And I was like, heck yeah, I am. So I ended up doing the most interesting interview ever with the senior manager. He invited me to a pool hall. And he was like, and shorts are optional. And I'm like, what do you mean shorts are optional? I'm a traditional guy. Every interview I've ever gone to, I've always been, you know, suit, jacket, tie, everything, you know. And something else I believe in the first day on the new job, I always dress my best clothing too.
Until I get a feel for what the dress code is in the job. And then, you know, I dress down. He was like, wear shorts. I was like, what are you talking about?
Shorts.
So I put on, you know, a nice shirt and shorts and I met him, played pool with him. It was during the day? It was during the evening. Okay. And it was a good, fun experience. It kind of relaxed me a little bit. And I ended up beating him all three games that we played. And during the third game, he even made the joke. He's like, yeah, you know, HR said, I can't judge you on how good you play pool for this job. So you don't have to beat me. And I kind of felt bad. I was like, should I let him win?
But you know you don't have to win to get the job wow it's like what do you do yeah so that was fun okay and is he asking a technical question like he's trying to basically get a feel for you at this point right yeah exactly i guess his purpose behind it was he was asking me technical questions you know like just shooting him out there while i'm shooting and i actually stopped a couple times to look at him and think about the answer he's like no i'm
You got to play while you're answering the question. It's how I test how you work under fire, you know, under pressure.
Wow.
And I was like, that's a really cool technique, you know. So I ended up impressing him enough that he offered me the job. And what I do is mostly I do a lot of system administration work, which is kind of why they were attracted to me as a candidate. Hmm. A little bit of networking work. But then I'm a consultant, so we work with the customer on site and advise them on policy. And I'm very much more hands-on than a traditional consultant where we do the policy transformation. Changes after we give the advice about it. Yeah. I've seen consultant jobs that are hacker jobs. I've seen consultant jobs that are software engineer jobs. So saying I'm a consultant is different, but we walk there, we meet with the customer, we give them advice about policy and we say, you know, Hey, this product is good.
That product is good for this or that, but we don't try to push them any certain way. We let them make the decision and then we go and implement. I see.
Implement security at the organization.
Security appliances, everything from endpoint firewall and antivirus to like web gateway antivirus and proxy and stuff like that.
Okay. And then when you mentioned policies, you mean like security policies?
Well, like, Policies on the appliances, like which file types to ban from the network and stuff like that.
Oh, okay. Specific configurations. Exactly. Configuration policy. Gotcha.
They always refer to it as policy. So yeah, it's engaging. It's fun. I'm finally in security and I still didn't know anything about like the hacker world or anything like that, which sounds kind of funny. And my friends, you know, almost make fun of me for it, but I was kind of oblivious to it. Like I was aware of breaches. I was aware of, you know, there are hackers that can exploit vulnerabilities and stuff, but it wasn't until a coworker of mine said, Hey, you know, you should check this out. You seem to be a smart guy. Are you interested in hacking? And I was like, what are you talking about? He's like, oh, well, you know, I always do the VulnHub stuff and it's fun. And I was like, no, dude, what are you talking about?
So he actually spun up a VM and showed me one of these VulnHub things. And I was like, oh, that's awesome. And so that's how I got started with the learn to hack stuff. I read a lot of other people's blogs and people don't talk about their failures. People don't talk about when they were learning. They always say, well, you know, here I am now as a professional bug bounty hunter and I found this cross-site scripting on the site and this is how I found it and blah, blah, blah. But They don't go about explaining like, hey, you know, this is what SQL injection is and this is why it works. And hey, you know, I tried this and it didn't work. So then I tried that and it didn't work. So then I studied some more and then figured out how it worked, you know.
Yeah. And that's kind of what I wanted to capture. When I first started because I was extremely intimidated. The imposter syndrome is a common phrase that I use because here I was in a security role and I was talking to people, you know, when I first started going online on infosec Twitter and Reddit and stuff. And these people seemed way smarter than me, but they couldn't get jobs in security. And I was like, man, you know, like, I feel like an imposter, you know?
Yeah, it's a very real thing. What do you recommend to folks who are facing imposter syndrome?
Well, what I see a lot online is people say, look, you know, you know a lot about what you know. And, you know, it's not a clear cut Venn diagram where the elite people know everything in the middle and you only know what you know. It's more of like a bunch of circles around you where people are exposed to things and they know those things and you're exposed to what you're exposed to and you know that. Everybody doesn't know everything and that's why you know most security teams are teams Because you have to have a software engineer specialist you have to you know that can review code for security holes Then you got to have a network security specialist that knows TCP IP and everything to make sure that Firewalls are blocking what they're supposed to be blocking and then you know You got to have your social engineer to make sure that your users are trained and aware of what dangers there are and not letting anybody walk around
In the building. You got to have a team of people that specialize in what they specialize.
Yeah. Let me ask you, do you have any interesting war stories throughout your times, either as a sysadmin or in your infosec job?
I was trying to come up with one because I knew you'd ask, but... Probably the most interesting things that happened to me was when I was a fire alarm technician, fortunately or unfortunately. But my boss would often forget to let the sites know that we were showing up for inspections or for work. Oh, man. Oh, boy. And at first, I would just go back to the home office and they would yell at, go back there and do your job, you know. So I got really good at flashing the badge that they gave us, you know, Hey, I'm from such and such company. Here's my ID. I'm supposed to be inspecting your building right now. Do you want to violate fire code? Cause you know, I can talk to the fire marshal. You can come down here right now and put you out of business, you know?
And I scared some receptionists and some security people even. There were some people that got so scared they would give me like the keys to the kingdom. Oh boy. And give me, you know, just walk around the building free reign. And, you know, we're talking like I did hospitals and schools. I got to watch somebody have shoulder surgery once because I was supposed to do a fire alarm inspection in the surgical wing and all the smoke detectors, you know, I had to check them and stuff. And I'm all dressed out in scrubs and I stopped because I saw, hey, what are they doing over there? And somebody literally said, oh, he must be one of the new residents. Yeah, the doctor such and such is finishing his surgery.
Yeah, you can go in there and you can stand over here and watch in the viewing or the viewing wall.
That's hilarious.
I was like, okay. So I sat there for like a half hour while he was finishing up the surgery because I was fascinated by it. I have what I call a scientific mind where different how things work fascinate me, like how the human body works. Another hobby of mine is studying scientific stuff too. So I sat there and I watched it and everyone thought I was a resident, new to the hospital. That's so funny. Actually, I walked in afterwards and, you know, nobody even looked at me twice. And I just did my fire inspection and I checked the alarms and stuff and walked out. And, you know, it was amazing. And so, you know, I get into the infosec scene and I see that, you know, you can make that alone into a living as a social engineer.
And I'm like, man, you know, I'd like to do that one day. I think I'd be really good at it.
Nice. Well, we'll look forward to the next chapter in your security career. Thanks. I think that would be kind of interesting. So is there anything in particular you want to say about your website?
I'd like to say that I'm going to be writing about the different security roles. Everyone talks about, you know, the hacker role or the blue team role, red team role. But, you know, I want to write a comprehensive guide to, hey, you know, there's risk management, there's compliance, there's policymakers, there's, you know, user training that is extremely important because the phrase we've all heard is everybody's responsible for security.
Yeah.
But it's true, you know. There's a big difference. I see people, social engineers on Twitter talk about, I see people on Twitter all the time and say like, Hey, you know, I'm on a social engineering gig and security stopped me right before I put the USB in to, you know, put malware in the computer or the vice versa where, yeah, security stopped me. And I just told them I was IT working. Well, they got to know that they should stop everybody, you know, if they don't know who you are. So, Yeah, I want to write more about the different aspects and roles of security. To be honest, I want to do more hacking as a hobby, but I'm not a coder. I'm not technical enough to do web application hacking or anything like that right now, but I do it for fun.
But I think my career focus is more policy from the C-level down and the technical side instead of Doing the actual penetration testing and stuff like that. So I've been researching that for personal reasons, but I want to write about that to inspire other people that may not want to be hackers specifically, but want to still work in security. There's a lot of different roles that you can do.
Yeah. I mean, the way I put it to people is there's builders and breakers. So oftentimes companies usually hire or need the builders. So, you know, there's different mindsets. And then of course there's the one in the middle, which is like purple team, but Builders and breakers. So not everyone is a breaker. We need the people to build the defensive systems. So, I mean, given your experience, for example, SysAdmin is the builder by default. So, you know, there's plenty of work to do as a builder in security. So, John, any parting advice for folks looking to get into infosec?
Well, I just want to let everybody know that if you're not of a hacking mindset, if you're not a breaker, there are still security roles that you can do, like being in compliance or working in policy or teaching users how to be more security-minded, stopping social engineers, stopping insiders from doing the wrong thing. As a CISSP, you have to learn more of the managerial stuff instead of the technical stuff. And that fascinated me while I was doing the training for it. The separation of duties, the making sure that there's two people doing all the duties so that, you know, one person can't get away with insider stuff, that kind of stuff, that kind of training is what I'm fascinated in. And I plan on writing a lot about that too.
Cool. I look forward to seeing some more of your writing on your website.
Definitely. It's going to be a slower pace this year. That's something I ran into last year was a little bit of burnout trying to stay up late at night and wake up early in the morning so I could research and write. But I find that taking more time and writing more detailed articles seems to be more popular. So that's what I'm going to focus on this year.
Well, we definitely thank you for your website. I think there's a lot of really good, useful information there for folks new or old to information security. But I think it's really great that you have your website out there and it's a good service. So keep it up.
Thank you very much. And once again, it's an honor to be on your show. I really like it a lot.
Oh, I really appreciate it. Yeah, it's a pleasure having you on. All right.
Thanks. All right. Thank you. Bye.
Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.
