Episode 16 · · 45 min
InfosecSherpa From Travel Agent to Law Librarian to Security Analyst!
SOC Analyst at a global company
Episode summary
Tracy Maleeff (@InfosecSherpa) was a professional law librarian and at the top of her game. Looking for change and meaning, she searched until she found the field of Information Security. This is her journey.
BIO
Tracy Z. Maleeff (/may-leaf/), @InfoSecSherpa, is an independent information professional providing research and social media consulting with a focus on information security. She is a frequent presenter on best practices of data mining from social media, professional networking, and introduction to information security topics. Tracy has 15 years of experience as a librarian in academia, corporate, and law firm industries and earned a Master of Library and Information Science from the University of Pittsburgh. She is the Principal of Sherpa Intelligence LLC–your guide up a mountain of information.
Notes
There is a condition called the "Librarian Face"
Librarians who have a Master's Degree in Library Science are taught to be approachable
Was never a public librarian; she worked in "special" libraries. This made her really good at finding and accessing data
Tracy shares some social engineering tricks she did earlier in her life
Didn't grow up with computers around her
Advice: "Know yourself"
Quotes
"If you are out in public… people are likely [going] to come ask you questions because you look like you know things."
"I did fail, but I did not fail as badly as I thought I would!"
"I don't regret the path that I took."
"For someone like me who does come from a technical background... having the certifications is what people want to see."
"They need to see some receipt!"
"Even if it turned out to be nothing, don't be afraid to speak up."
"I don't think I realized it was social engineering; I just knew it was something that I wanted."
"Managed to talk my way not only on the plane, but also into business first."
"They had me at port scanning."
Before infosec: Travel agent and law firm librarian
Chapters
- 0:00
Intro: the librarian turned security analyst
Ayman introduces Tracy and teases her job-hunt struggles and her optimism.
- 1:32
What a SOC analyst does today
Tracy describes her SOC role, threat hunting, tickets and internal outreach.
- 3:13
Fifteen years as a law librarian
She explains special libraries, the approachability of librarians and the 'librarian face'.
- 7:03
Feeling stuck in 2014
Reaching the top of her career left her restless, leading to her 'year of my career' resolution.
- 10:17
Trying tech meetups and finding security
After false starts with front-end development, a friend and a Black Hat brochure point her to a cybersecurity workshop.
- 14:24
First conference talk at BSides Philadelphia
She gives an OSINT talk and realizes her librarian skills are valuable to infosec.
- 17:49
Quitting the law firm and starting a business
She planned the leap carefully with her spouse and freelanced while networking.
- 21:18
The job hunt and the 'L word' on her resume
Automated rejections and advice to hide 'librarian' push her to double down, until a friend's post gets her hired.
- 26:43
Certifications and failing Network+
She wishes she had earned Net+ and Security+ sooner and shares how she failed less badly than expected.
- 31:21
Two SOC war stories for beginners
Speaking up about a suspicious network and handling a minor incident show why beginners should not hesitate.
- 35:15
Social engineering as a kid and a traveler
Library-card lock picking and talking her way into business class are early social engineering stories.
- 41:35
Parting advice and closing plug
Know yourself, network, and stay current on news like WannaCry; Ayman then plugs his new community.
Key takeaways
- Look for the skills from your old career, such as research and organizing information, that security teams can use, and build your role around them.
- Plan a career change methodically, including finances, instead of quitting on impulse.
- Entry-level certifications like Network+ and Security+ help career changers get past automated resume filters.
- Network online and in person, because a friend's social media post led directly to her interview.
- If something on the network looks wrong, speak up even if it turns out to be nothing.
- Keep up with security news so you can discuss the latest malware in an interview.
Notable quotes
people are likely to come ask you questions because you just look like you know things
My professional fate was going to be in my own hands, and I was adamant about that.
even if it turned out to be nothing, don't be embarrassed to speak up
Questions answered in this episode
- How did InfosecSherpa go from librarian to SOC analyst?
- Tracy Maleeff felt stuck as a law firm librarian in 2014 and resolved to change careers in 2015. A security workshop, conferences, a freelance business and networking on Twitter led to her SOC analyst job in 2017.
- Do librarian skills transfer to cybersecurity?
- Yes. Tracy says her research, information organizing and people skills help in a SOC, especially in threat intelligence, OSINT and awareness outreach to other departments.
- Are certifications worth it for career changers?
- Tracy believes so. Coming from a non-technical background, she says certifications such as Network+ and Security+ give employers the receipt they want to see and can get a resume past screeners.
Show notes and links
Show the original episode notes
Tracy Maleeff (@InfosecSherpa) was a professional law librarian and at the top of her game. Looking for change and meaning, she searched until she found the field of Information Security. This is her journey.
BIO
Tracy Z. Maleeff (/may-leaf/), @InfoSecSherpa, is an independent information professional providing research and social media consulting with a focus on information security. She is a frequent presenter on best practices of data mining from social media, professional networking, and introduction to information security topics. Tracy has 15 years of experience as a librarian in academia, corporate, and law firm industries and earned a Master of Library and Information Science from the University of Pittsburgh. She is the Principal of Sherpa Intelligence LLC–your guide up a mountain of information.
Notes
-
There is a condition called the "Librarian Face"
-
Librarians who have a Master's Degree in Library Science are taught to be approachable
-
Was never a public librarian; she worked in "special" libraries. This made her really good at finding and accessing data
-
Tracy shares some social engineering tricks she did earlier in her life
-
Didn't grow up with computers around her
-
Advice: "Know yourself"
Quotes
-
"If you are out in public… people are likely [going] to come ask you questions because you look like you know things."
-
"I did fail, but I did not fail as badly as I thought I would!"
-
"I don't regret the path that I took."
-
"For someone like me who does come from a technical background... having the certifications is what people want to see."
-
"They need to see some receipt!"
-
"Even if it turned out to be nothing, don't be afraid to speak up."
-
"I don't think I realized it was social engineering; I just knew it was something that I wanted."
-
"Managed to talk my way not only on the plane, but also into business first."
-
"They had me at port scanning."
Links
-
Infosecsherpa: https://twitter.com/infosecsherpa
-
Women’s Society of Cyberjutsu (WSC): https://womenscyberjutsu.org/
-
Intro Music: Cascadia by Trash80 - https://trash80.com/#/content/133/weeklybeats-2012-week5
-
Outro Music: JR Tundra - Natty Roadster
Resources
- Art of Improvement: https://www.youtube.com/channel/UCtYzVCmNxrshH4_bPO_-Y-A
Getting Into Infosec
- Twitter: https://twitter.com/coffeewithayman
- YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
- Book: https://www.amazon.com/Breaking-Step-Step-Starting-Information-ebook/dp/B07N15GTPC/
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
Hey everyone, I'm Ayman Elsawah and this is Getting Into Infosec. My guest today is Tracy Maley. You may know her as infosec Sherpa. Tracy was a law librarian for many years and those skills actually applied to her job as a security analyst.
I knew all along that my librarian skill set is something that the infosec profession could use, but that really just confirmed it there. Like, oh, I know things that you don't and I can help you with your job, you know, by sharing what I know.
Tracy also shares some trials and tribulations she had trying to find a job in infosec.
Told me I had to lose the L word from my resume, librarian, librarian. And I was very frustrated by that, and that made me even more determined. I'm like, oh, I'm going to go all in, double down, You know on what this librarian can do for you tracy's amazingly optimistic and i had a really wonderful time speaking with her yeah because you see your score right away and i was actually happy and the guy in the exam center goes no ma'am you failed i'm like oh but i didn't fail as badly as i thought i was like no this is actually good news i'm like you know i could do this and also they had me at port scanning all right on to the show hi tracy welcome to the show Hi, thanks so much for having me.
Great. Many people know you as InfoSecSherpa. And I think, you know, not much of an introduction is needed. But in any case, tell us about what you do today in information security and a little about how you got into the field.
Sure, sure. So I'll start with present day and then we can work backwards a little bit.
Yeah.
So I am currently a SOC analyst in a security operations center for a global company. And I've been in this position for about a year and a half. And if you're not familiar with the tasks of a SOC analyst, for those of you listening, I'll just speak in generalities here. It's a lot of looking at the network. There's threat hunting aspects. There's threat intelligence aspects. You know, working, what are called, you know, tickets, you know, when incidents arise. I also branch out and deal with other departments, which is something I recommend that people do. I do outreach into other departments to help, you know, explain things that we do. It's actually sort of awareness in a way. I kind of help mediate between the technical and the non-technical side as far as awareness goes.
And I do, you know, a lot of little things. I have a librarian background, which we will get into in a moment. So organizing information and performing outreach to people inside my department, outside my department, is really my specialty and something I enjoy. I've kind of, you know, made my own luck in this position with my skill set. And I've really, you know, kind of tailored things that I do to match my strengths. And while I build up my other strengths in the meantime.
Great. Yeah, that's wonderful. So you used to be in a past life, a librarian.
This is true. In some ways, I still feel like a librarian. But that's, I guess, a discussion for another time. But yeah, that is correct. Yeah, I did work as a librarian in past life.
I have the utmost respect for librarians today, past and present. And even on my local library, the librarians are just welcoming to newcomers or to folks looking to find more information. So yeah, I would love to hear how you were able to transition from a librarian to a stock analyst.
Sure, sure. Well, first I'll just address your perceptions of librarians. Yes, being approachable is Is one of the major tenets of librarianship that we go over in graduate school. A lot of librarians have a Master's of Library and Information Science degree, like I do. And that is something that is really worked on, is the approachability factor. And just a quick funny story, as a result of that, A lot of librarians wind up with a condition called librarian face.
That's interesting.
Which means if you were out in public, outside of your job, if you were out in public, people are likely to come ask you questions because you just look like you know things, which has happened to me on so many occasions. And one woman actually said those exact words to me.
Wow.
I was in Boulder, Colorado. She came up to me. First time in Boulder. I had never been there before. She walked up to me and she had her finger out and she looked at me and she said, you look like you know things. And of course I didn't know the answer to what she needed. So yeah, that happens a lot. So that's kind of a joke that, you know, Oh, I have my librarian face on and it's that whole approachability factor. So I just wanted to tell you that is not by accident that they are welcoming to you. That is a major foundation of librarianship. So they are doing a good job. Yeah.
That's awesome. And as we know, that's a really important facet to have in cybersecurity, which I'm sure you'll talk about. So, yeah.
Yeah. Yeah. So I worked as a librarian for about 15 years. And like I said, I have a master's degree of library and information science from the University of Pittsburgh. And I love connecting people with information. And that is also something that ties into information security, doesn't it? We're connecting them either with information about their network or information in the sense of awareness. So I had this job in librarianship. I mostly worked at law firms. I worked at two different law firms for a long period of time. I had shorter stints in academia. And in corporate life. So I actually was never a public librarian.
Oh, interesting. Interesting. Okay.
And I never worked in a school and I never worked in a public library, except for in my childhood when I volunteered at my local public library, but I don't count that as professional work. So yes, I worked in the world of what was called special libraries.
Oh, I see.
Yeah. So, I mean, a lot of the tenants and foundations are the same, but you're dealing with You know, a different group of people, you know, you have different, we would in library world, you'd say patrons, you would say end users, You know, you have a different set of people that you're dealing with, but it is essentially the same. So because I was in a corporate academic law firm environment for most of my librarian career, my research skills and my people skills were very well honed. So I was able to find things, you know, organize information, you know, figure out logistics of, you know, physically getting information to say an attorney who had to fly overseas for a deposition. You know, and they needed, you know, some things.
So there was a lot of, you know, strategy involved and legal things with, you know, copyright and stuff like that. So what happened was, you know, I did, I loved being a librarian. I loved it, but I had kind of reached all I could do at one point. So it was around 2014, I'd say I started to get these pangs of
I don't know what else there is to do. The only other next step up was to be a director.
Right.
And that wasn't really where I saw myself.
You hit the peak of your career, basically.
Yeah. And it kind of got depressing a little bit because, you know, I worked so hard to get to that position I had, which was, you know, I had my own office. I had floor to ceiling windows. I was in a center city.
Nice.
Philadelphia, high rise building. And I had nice perks with the law firm and good salary and everything. And I felt too young to be in a rut. I was like, wow, I worked really hard to get to this position and I'm here. Okay, what do I do now? So I had a lot of teary eyes.
Commutes on the train in and out of Philadelphia. You know, I put my headphones on and stare out the window and listen to music and, you know, not like ugly, open, sobbing, crying, but, you know, some tear or two rolling down because I just... I felt stuck.
How long did you have this feeling for?
Maybe the last half of 2014, I should say.
Like six months a year, something like that?
Yeah, probably. It was towards the end of 2014, and that's pivotal to my story because what I did on New Year's Eve that year, December 31st, 2014, it clicked in my head of, I am going to declare 2015 the year of my career. And what that meant was, and I still hadn't even thought of infosec yet. That was still down the road. I just decided that on New Year's Day, I was going to redo my resume, redo my LinkedIn, search for jobs, apply for jobs. I just wanted to see what else was out there and how else could I improve myself. So in the midst of all this, I read an article from Entrepreneur Magazine called How to Future-Proof Your Career. And that's also what was weighing heavily on my mind because there was a lot of law mergers going on.
The economy was in flux at different times during my law firm library career. So I did not have confidence that I could have longevity as a law firm librarian. And I wanted to be in the driver's seat And not a victim of the economy, of downsizing or a merger. So that's when I stopped crying on the train and had some real deep thoughts with myself. And I thought to myself, when did I really feel joy in my job? And I thought long and hard. I thought about all the different jobs that I'd had in the past. And I came to the conclusion that whenever there was a tech aspect of a job that I had, That got me really excited and that made me very passionate. So I realized, okay, connecting the dots. Tech is what gets me excited and has like that fire in me.
So 2015, I applied for a bunch of law firm librarian jobs, quickly realized that it was just all the same, but different firm. So I'm like, okay, you know what, I'm gonna have to take this leap of faith and start going into the tech pool, dip a toe into the tech pool. So I went to meetups, you know, meetup.com has meetups.
Yeah.
I went to workshops. I went to events. I just Google alerts for tracking text stories.
Oh, okay.
And I approached it in a very librarian, researcher type of way.
Yeah, nice.
I tapped into the media because I wanted to read these text stories because I thought to myself, if I don't get excited reading these text stories, then that's a problem.
Right.
I should be excited reading these stories. So- I quickly realized that this whole front-end world, and no offense to anyone who was a front-end or a software programmer or anything like that, it was not my cup of tea. I didn't feel comfortable at these meetups. I didn't have that fire inside me. I really did not care about front-end.
It just didn't click, right?
It didn't click. I walked out of a Ruby on Rails class because I thought it was a bunch of nonsense. Mm-hmm. And I didn't want that in my life. So a friend of mine who was actually in security and in IT for a long time, watched me spin my wheels, you know, let me learn on my own and finally was like, let's have a beer. Let me tell you about what I do on the back end and talk about security. And I was like, I wish to subscribe to your newsletter.
It intrigued me. So I noticed I started to be drawn towards You know, when I got all my alerts for all my tech alerts that would come in, I noticed that I kept clicking on all the security-related articles. And I kept getting drawn to all the security news. And so then fast forward to August of 2015, the same friend was at Black Hat. And he stumbled upon a booth for a group called the Women's Society of Cyberjitsu. And he took a picture of their brochure. He opened it up, and he took pictures front and back of it, texted to me, and he said, you need to do this. You need to do this now. And it was descriptions of their classes. And a couple weeks later, I was enrolled in their cybersecurity fundamentals class or workshop, I should say.
It was a two-part workshop. And my joke is they had me at port scanning.
Nice, nice.
I discovered this world that I didn't realize existed. And I just fell in love from there. And I was surrounded by these just powerful, smart, dynamic women who were either already in security or also learning with me. And that was pretty much it. So another month or two later, I actually ran the Cybersecurity Awareness Month program at the law firm because I stepped up and contacted the CIO. And said, hey, security is my quirky hobby. I want to do something. And that was a success. And that's when things really started to heat up. And I had the realization that my natural paranoia and distrust of things was a career path. So I started to make plans to make a whole career change. So a couple months later, January, February 2016,
I quit my job at the law firm and started my own company. I did some freelance things. I still needed to bring in money while I was looking for an infosec job. But I applied my library science skills of research, of talking to people and sharing information and organizing information. I was able to get clients in the infosec sphere. I was able to go to many conferences. I went to so many conferences in 2016 just to learn and absorb and network.
How was it going to your first conference?
Which one was my first conference? Let me think. Hmm. I'm sorry. I'm trying to remember. I think it was B-Sides Philadelphia.
Okay.
Was my first conference, if I'm remembering.
You spoke there too, I believe, right?
I did. Am I getting the timing right? Yeah, I think that was 20. Yeah, because my first big one was SchmooCon.
Okay.
But that was 26. No, okay. So B-Sides Philadelphia, yes, was my first conference. And I spoke at it. And yes, it was intimidating. It was scary. But this is what happened. So I decided to play to my strengths. And I did an OSINT talk. It was basically about how to research on social media. How to locate some other things online, all from the GUI perspective, not from the command line. Now, I was very intimidated by this because I thought I am in a room full of people who could write scripts and scrape pages and do circles around me. So I remember laying the groundwork early on in my talk saying to them, like, yes, like you may know how to scrape web pages, but I'm going to show you how to do things the GUI way because I had a lot of people telling me, well, there's a lot of functionality with GUI that you can't just you can't get from command line.
And people don't realize that. So I kind of laid that out there. And then within a few minutes of my talk, kind of just engaging the audience, asking for a show of hands of who knew what. And I asked them what I thought were very fundamental questions. And at a room of maybe 100 people, maybe three people raised their hands and knew different things that I was talking about. And that gave me immediate confidence of, oh, I know stuff that they don't.
And by the end of my talk, I had some guys come up to me and say to me, like, I learned so much. I didn't know that these things existed. I didn't know this functionality of this one site. And it really just was a great boost. I was like, oh, you know, I knew all along that my librarian skill set is something that the infosec profession could use. But that really just confirmed it there. I was like, oh, I know things that you don't and I can help you with your job, you know, by sharing what I know. So that was really, yeah, what that was like. That was an amazing experience.
That's wonderful. When you were applying for speaker submitting CFPs, have you done that before or? How did you get to submit CFPs? Because for those out there trying to break into information security, I think some people say try to speak or try to attend conferences. What would be your advice looking back on your experience?
Well, I wasn't new to speaking in the library world. I had given a lot of talks before. So that aspect wasn't new to me at all. But, you know, there are pros and cons to being a speaker. Let's face it, you know, there is some joy in going to a conference and just being a civilian.
Okay, yeah.
Especially if you're new to something. But again, if you're going to go there and be a speaker, you definitely want to present something that you're very well versed in. I don't recommend that people try to present on something that they've just learned. I don't know that anyone would do that, but in case someone maybe is a little too overconfident...
Perhaps. Well, let me ask you, have you always had the entrepreneurial spirit? Because, you know, it must have taken a lot of guts to quit your job and then start the business, try to find clients and then, you know, go on that path, right? Because you're still not fully into, you basically created your own path.
Oh, yeah.
So talk a little about that.
Yes, I've always been like this.
Okay.
I used to call it intrapreneurial spirit. Because it just meant the attitude that I had working, say, inside a law firm. You know, I had all those qualities of an entrepreneur that, you know, go get them attitude. But, you know, I wasn't hustling for jobs because I already had a job. So, yeah, I used to call it this entrepreneurial spirit. So, yes, I would be very proactive, you know, doing outreach within my own company. And, you know, creating opportunities for myself. So, yeah, I mean, and it wasn't like it was on a whim. I didn't up and quit one day. It was a process. And, you know, my spouse and I, we looked at the financials of it. And, you know, I'm grateful that my husband, you know, was supportive of this.
And also that just financially we were able, you know, to have me take this cut in salary, which I always saw as temporary, which that was never a thing. So, yeah, it does require some planning.
Right.
Financial planning on your part. And you know, the reason why I did start my business is just because I needed to have some sort of income while I was doing all this learning and infosec networking. But I was able to spin it in such a way that I was able to then get clients in infosec and kind of combine the two things.
So that's really useful.
Yeah, that's just kind of part of who I am. Yeah.
There are a lot of folks that try and change careers and they're kind of stuck because they want to change career, but there's that gap, you know, where the pay, where they need to fulfill and maintain that gap or whatever it is. So thank you for sharing that. That's, I think that's good context for folks to understand that you didn't just, you know, up and quit. It was a process, right?
Oh, yeah. I didn't stand up one day and say, I've had enough. I'm out of here. No, it was very methodical, a lot of planning. But yeah, I mean, believe me, when I typed up my resignation letter, my hands were shaking. And I remember walking down the hall to my boss's office to give it to her. And I just remember my hands were shaking because- I was taking a big step, but I had a passion and still have. I discovered this passion for tech, for infosec, and I wanted to pursue it. So it was also excited energy too, not just nervousness. I mean, I do not regret my move whatsoever.
That's awesome.
But yeah, if you discover that is your passion, Then you need to go for it and to plan for it because I was adamant that I would not be victim of a downsizing. My professional fate was going to be in my own hands, and I was adamant about that. Absolutely, I will not be a victim of the economy. So that's also why infosec was also important. You know, something that really sparked something in me and that made sense. And I'm not even talking about I wasn't like following any money trail. I was pure of heart following my passion for this industry. But it doesn't hurt that this is such a phenomenally growing.
Right.
Industry. So yes, so that is important to me that I wanted to be in control of my career.
Okay, so let's fast forward a bit. And when you were going to apply as an actual cybersecurity professional or a SOC analyst, walk us through that experience and how that was and the highs and lows, you know, either rejections and things like that. Can you walk us through that?
Sure, absolutely. Now, before you ask, I really don't remember anymore how many jobs I applied for. It wasn't anything ridiculous like 100 or anything. I don't know, 25 maybe. I was also very selective. I mean, I had a specific geographic area that I was looking in. There wasn't really a lot. But I was looking for things that talked about research because that was a strength of mine. But I quickly learned that research in infosec doesn't necessarily mean what I thought it meant.
Mm-hmm.
But I was applying for jobs that were entry-level, things that I could leverage my skills, even if I could just get a foot in the door to be able to explain myself during the interview, looking for things like that. I looked at some awareness positions as well, but I really wanted to do something that was more technical.
You mean security awareness?
Yeah, sorry, security awareness. I didn't see many of those, but if I saw anything that had to deal with security awareness – Because I knew that it meant interacting with people and things like that. The bottom line is I was looking at jobs, not by their title or anything, but what the requirements were, because I wanted to know if there was a job that I could leverage my skills, basically. So I applied for a lot of positions, and what was getting very frustrating is that I could tell that I was getting rejected automatically by the screen readers or the scanners. I could tell that people like humans weren't even looking at my resume because of the timing things. Rejection emails were coming very quickly after submitting.
One of them was literally in the middle of the night. I think I stayed up late one night and submitted one at midnight. And then like at 2 a.m., I get the rejection email. And it was for something that was in my time zone. And I'm like, no, nobody looked at this email. And that one really hurt because that was listed as a researcher job. I believe it said something like, You know, strong research skills required. And I was like, hello.
This is me to a T. So you didn't have the right keywords in your resume? Is that what it was?
Yeah, I didn't have the right keywords. I met with someone from, I don't want to say what company, but it's one of the large, well-known consulting firms told me I had to lose the L word from my resume, librarian, librarian.
Oh,
And she told me, you know, no infosec person is going to hire you with the word librarian on your resume. And I said, well, I can't remove it. It's in the name of my master's degree. And it's my title. I mean, keep in mind, I was in law firm libraries for 10 years. Like, I can't not list the library jobs. And I was very frustrated by that. And that made me even more determined. I'm like, oh, I'm going to go all in, double down. On what this librarian can do for you sort of thing because I was offended. I was like, I worked hard to get that master's degree and to attain everything that I achieved in library world. And here's this woman just saying, oh, just hide it, call it something else. And that made me really angry.
And hell hath no fury like a Sherpa scorn because I was on a mission to just double down. So I kind of changed my networking strategy and kept leveraging my library science skills. So one day in April of 2017, I received four rejection emails in a single day.
Oh, wow.
And I lamented to a friend, you know, a new infosec friend that I had made. I lamented to him, what do I have to do to at least just get in front of someone so that I can explain what skills I have and what I can offer? And he said, do you mind if I post about you on my social media? And I just thought, couldn't hurt.
Okay.
Why not? Go for it. Go for it. Next thing I know, I get a tweet from my now boss saying, oh, okay, yeah, I didn't realize you were looking for a job. I'd like to talk to you. So about two weeks later, I had an interview. And about a month after that, I started at my current job. So that's why I talk about networking, beat that drum of networking with people. Because if I hadn't networked in that friend, I wouldn't have had him as a confidant to use as a sounding board when I was feeling really frustrated that day. And then he in turn did that for me and literally got me my current job in infosec.
That's awesome. How'd you meet that friend?
I believe we met on Twitter and he's like, I like your different ideas. Would you like to come on to some podcasts with me? Would you like to do some blog work with me? We eventually met in person once. At one of the conferences I attended. But yeah, he was just paying attention and he was like, I like your skill set. I see something in you. I think you're going to be good at infosec and I want to help you with that. So it was all through Twitter.
That's awesome. That did that. Yeah. So looking back, is there anything you would recommend to the Tracy of 2016, 2017 or whichever to help shorten that path into information security that you took?
Well, I mean, it was only really like a year and a half. So it wasn't.
Yeah, I know. I know.
It wasn't that long.
To some people, it could feel like an eternity.
Yeah, no, fair enough. I mean, because of the other jobs that I had, I don't regret that year and a half at all, to be honest. But yeah, so to your point, I probably would have buckled down a little harder with getting some certifications like NetPlus and SecurityPlus. I did go through some net plus training classes. I did sit for the exam, but unfortunately it was very soon after a family death and I wasn't able to postpone it. I was like up against the deadline.
Sorry to hear about that.
Yeah, it was just terrible timing. But on the bright side, I did fail, but I did not fail as badly as I thought I would have.
Always on the positive. That's awesome.
Yeah. Cause you see your score right away. And I was actually happy. And the guy in the exam center goes, no, ma'am, you failed. I'm like, oh, but I didn't fail as badly. I was like, no, this is actually good news. I'm like, you know, I could do this.
That's awesome.
Yeah. He was like, okay, lady.
I'm like,
Yeah. So in hindsight, I do wish I had buckled down a little more. I think having those certs probably would have got me past some of the screeners. But again, I don't regret the path that I took. But yes, if a year and a half is a little bit too long for someone to do, then I know there's a lot of disputing ideas about certifications. Right. But specifically for someone like me who does not come from a technical background, you come from some other background, having the certifications is what people want to see because they need to have some sort of, I guess, to talk like in the vernacular of the kids these days. They need to see some receipt that you have at least some ability in this new profession, this new industry.
So that's one thing that I probably could have worked harder on in hindsight.
Yeah, that's fine. I think sometimes you're changing a whole career to a new career. I've heard of folks taking about a year to two years, but there's no average. It could be faster. It could be shorter. But thanks for sharing that. That's pretty cool. So Tracy, you mentioned the workshop that you attended. Can you tell us more about that? Was that a local workshop that you attended or was it online?
It was about two hours away from where I am in Philadelphia. It was held at the University of Maryland. The Women's Society of Cyber Jitsu is basically like a Baltimore, D.C., Washington, D.C. area thing. So I did do a lot of driving for different workshops I took of theirs. I was probably the one coming furthest away. So, but it was worth it. I mean, it was, I say it was about three hours. So there was a period of time where I spent six hours a day driving just to go and, you know, and take different classes with them.
Was that worth it?
Yeah, it was definitely worth it. Absolutely.
Great. And what are the things that you learned in that workshop, for example?
Well, the cybersecurity fundamentals is just like it sounds. It was very basic introduction. We learned about port scanning. I mean, I learned about ports to begin with. We also learned a little bit about steganography. It was really like a it was a buffet. It was just a little bit of a lot of different things. I remember we did one exercise where we had a just like a JPEG that we were told to put into our trash on our laptops. And then empty the trash. And then we were walked through an exercise of how to retrieve things that were emptied out of the trash. So some very basic forensics and things like that. It was really meant to be like a sampler sort of class.
Foundational class, right?
Yeah, yeah. So like I said, it feels like a blur. And it feels like so long ago by now. So I took that class with them. That was a two-part class. Later, I took... I don't know, just very like Wireshark workshops. I took the Network Plus. That one was the six to eight week class that I went down every week for just going through the whole Network Plus book. But yeah, as many as I could. They also had some things online as well, but I just know that I learned better in person and, you know, financial and weather issues. Provided I was able to go down there.
Right. Do you have any interesting war stories from your time, either working in security or just all around?
Any war stories? Yeah, I feel like I haven't been around long enough. Well, I can think of one. There's one I can only really speak about in vague terms, you know, hashtag OPSEC. But There was one day when, well, actually I can think of two good stories that are good for beginners. So I'll tell the first one where I noticed that something was going a little screwy on the network, but I couldn't really identify what the issue was, but I just was having this instinct that something wasn't right. And I knew enough to say something and I pulled someone over and And long story short, it actually was an exercise that we were being tested, but we didn't know that at the time, but yeah, I was able. So we actually got a lot of commendation for that because it was truly a team effort because I noticed something I'm like, I can't really identify what this is, but this doesn't look right.
I have a bad feeling in my gut about this. You know, I wasn't too proud or embarrassed or shy to pull someone over. And I said, I don't think this looks right. What's going on here? And then the eyes got really big. He was like, oh, yeah, no, that's not right. And then we're working on everything furiously, and then all of a sudden it was like, hey, surprise, it was a test and you passed. So... So that was one thing. So that's a big lesson of even if it turned out to be nothing, don't be embarrassed to speak up and to say that. Just to say like, I don't know what this is, but this doesn't look right to me. And if someone tells you, oh, it's fine, well, then you just say, okay, well, can you explain to me what's fine about it?
And then after the dust settled, can you explain to me what was wrong? What made your eyes go so big? Explain that to me. So that's a good one for beginners to not hesitate because that really made us look good as a team.
That's awesome.
And then the other one was one day there was a legit incident that we were all working on when a secondary minor incident popped up and everybody was like, ah. So I quickly looked into the second incident and I realized I had enough skills to handle the second incident by myself While everyone else who was a lot more skilled than me could work on the big one. And so I just called it out. I was like, I got the second one by myself. Everybody just keep doing what you're doing.
Nice. I got this, right? Yeah.
I'm like, I got this. Because, yeah, I was able to very quickly surmise. I was like, oh, I know how to do this. I got this. I got this. It's fine. I got it.
Cool. Nice.
And then I just had somebody senior – Double check my work after the fact. And yeah, and everything was fine. And so yeah, again, don't be afraid to speak up and have confidence in what you do know. Like I said, I was able to quickly surmise. I'm like, oh, I know how to do this. Got it.
Yeah, that must have been a big confidence builder right there.
Yeah, it was pretty awesome. And then that enabled the rest of the team to very quickly stamp out whatever was going on. And they were able to do it a lot quicker because nobody had to babysit me or pull their attention or anything. Yeah, so very quickly, everything was resolved and all was right with the world again.
Nice.
And then I think we ate lunch.
All in the morning, huh?
Yeah, everything just happened quickly. So those are just two war stories for people starting out. Don't be afraid to call something out. Even if you're wrong, it doesn't matter. Then you turn it into a learning experience. You say, okay, well, then what did I get wrong here that I thought was bad? And if you see something that you think you can handle, then handle it. Jump in and handle it.
Is there a time where you had to be creative and hack the situation you're in to either get out or get an outcome that you wanted?
Oh, my. Well, I have to think carefully because of statutes of limitations.
It doesn't have to be a technical hack.
Oh, I'm talking about anything here. Yeah.
Yeah.
So, yeah, I have lots of stories about that. And I don't think at the time I would have known to call it hacking. But I have been known to pull a social engineering instance or two to get something that I wanted. That, again, at the time, I don't think I realized it was social engineering. I just knew that it was something that I wanted. I'll give you two innocuous ones. One is I was a latchkey kid, as many kids were. I guess still are. And my problem was, is that I would often forget my key. So through the magic of television, I noticed that on TV, they were always opening locks with a credit card. And I did not have a credit card, but I had a library card. And at the time, my library card was a very, very thick plastic card.
How poetic.
Yeah, I know. I wish, yeah, hindsight's 20-20, right? Like, this is where it all began was loiting a lock with a library card. So yeah, one day I came, you know, I went home, realized I didn't have my key and remembered those TV shows. So I pulled my library card out and I loitered the lock to my house with my library card and got inside. I used to break into my parents' house a lot because I'd forget my key a lot. So I got very good at breaking into my own house. And one time I actually broke a window, but I broke it cleanly into four solid pieces. And left no mess. My father was so impressed he couldn't even be mad at me.
Wow. How did you do it, The Rock?
I put my heavy winter coat up against the window and I think I took a pen and I nailed the pen. Precisely in the middle of the window. It wasn't a very large window. It just was a piece of a window large enough that I could put my hand through and open up the doorknob. But I hit it just right there. So I don't know. It was just dumb luck, to be honest. But yeah, I remember my dad came home and as I fessed up to it, I was like, look, I forgot my key again. And this is what I did. I'm like, here's the four pieces. And my dad was like, I can't even be mad. He's like, you did a good job breaking that window cleanly.
That is hilarious. Yeah. That is awesome.
Yeah. So that was literally like elementary school. So then fast forward to before I was a librarian, I was a travel agent. Okay. And I had a free ticket to, I was going to South America and it was a free ticket, but it was in coach. But I decided that I was too fancy for coach. So I decided to flirt my way into what they called business first. It wasn't full first. It was like a combo thing. So I flirted my way into business first class for this 10-hour flight to South America. Wow. But the more ballsy, may I say, part was when I went to go home, I decided that I was still too fancy for coach. So I just went to the first class check-in line at the airline. Oh, nice. And I acted like I belonged there.
And long story short – I got business first again on the way home. And I was the last person on the plane because, and I don't really speak Spanish, so I didn't really know what was going on around me. But we were one of the last planes out of Chile because it was the Pinochet riots of 1997. I was the last person on the flight to New York. They pulled the plane away from the jetway as I was still walking to my seat. Like they just reversed it. And got out of there wow that is scary not only so remember keep in mind i'm on a free ticket so they could have just left me there yeah but i managed to like talk my way not only onto the plane but into you know the business first and then be the last person on the plane and yeah i don't know how but yeah wow
I see. Have you thought of going into the social engineering contest?
No, no, I don't want to. I think those days are over now. But I respect that whole part of infosec. But yeah, I don't think there's any way I could pull that off.
Okay. You know, you have the librarian face.
Yeah. But yeah, so that's, you know, call it hacking or social engineer, you know, whatever you want to call it. There are times when something comes up and You know, you need to get things done. So you get things done.
Yeah, nice. And what was your exposure to technology when you were younger?
We didn't have a computer in the house until I was, you know, an adult. So we didn't have a computer in the house. So yeah, not really. I mean, we really didn't have I think I had some toy computer that I was given, like legitimately like a toy. And nothing was ever discouraged, but it wasn't necessarily encouraged. I mean, I know my mom was very insistent that I learn how to type. Like typing was a big thing. Like we had typewriters in the house. Like that was probably the limit of the technology. And like I said, I don't want to say that I was ever discouraged, but my parents were of an older generation and it was foreign to them. So I don't even think they knew how to encourage computer science.
Yeah.
Okay, cool.
So I'm not blaming them. I just think it was just foreign to them and it wasn't something they necessarily thought to encourage. And I was the youngest. Youngest are pretty much like free range. They're kind of left. Kind of left alone.
Yes, I'm familiar with that. Yeah.
So, yeah, no, I'm in awe of when I hear people tell stories of, oh, my dad and I worked on this motherboard together and blah, blah, blah. And I was like, yeah, that is not my experience.
Okay, cool. So do you have any parting words and advice for folks out there looking to get into infosec?
I would say a couple things. You know, first, know yourself. Do you have a passion for this? Are you getting into this for the right reasons and the right reasons of things that resonate with you? Is this something that you want to do? Is this something that you like? Will this make you happy? I see Marie Kondo's in the news again. Does the idea of infosec bring you joy? Because if you're not interested in this, then you might just be spinning your wheels for nothing. Really, you need to be invested in this. Second, I would say to network with people. You know, a lot of people might be shy or, you know, have some sort of social awkwardness. There are things that you can do to still network with people.
Maybe you just network online or, you know, work on your social skills. But however you do it online or in person, get to know people. You know, ask questions, just make connections with people because that's what's going to help get you around all those filters and all those roadblocks that seem to be in the hiring process. So you really need to get to know people. And third, Stay on top of things, know what's going on, expect to go into an interview and have to talk about the latest malware that might be in the news that morning. That's what happened to me. The day of my interview was the day that WannaCry happened. Yeah, so when I drove to the interview, I remember going over in my head, listening to, I found a podcast already or some news or something, but I remember going over in my head
The details that we knew at that time of WannaCry because I knew it was gonna come up on an interview and sure enough it did and I thought through my answers ahead of time so be up to date on what's going on keep an eye on the news and be prepared to talk about it and again I was less technical two years ago when I went on that interview but I was still able to answer that question when it came up about WannaCry So you really need to be aware of what's going on around you and be able to speak about it. So I think those are three big things that people can concentrate on.
Well, that's really good advice. Thank you for your time today, Tracy. I think it was a wonderful conversation. And thank you for sharing your experience.
Sure, it was my pleasure. I hope my words are helpful to people. And good luck with your own professional journey.
Great. Yeah, I'm sure they will be. Thanks. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
