Rob Carson From USMC Infantry Officer to Information Security Officer

Rob Carson0:24

You know, at the end of the day, like I wasn't getting shot at. I worked at climate control, you know, so people would be all stressed out. I'm like, well, no one's going to die. So it's okay. Like, it's not great. They can only fire you. They're not going to kill you.

Rob Carson0:44

It wasn't as hard as I thought it would be. I was nervous though. What I figured out at first was that It was really just different weapon systems and how to employ them. And that's what I'm good at.

Rob Carson1:00

I used to have a full head of hair. Like a couple ISO projects later, like it's gone.

Rob Carson1:23

Let's get to the show.

Rob Carson1:28

Hey, happy to be here.

Rob Carson1:32

Yeah, absolutely. So I guess quick background. I'm from Colorado and I left to go to college at Texas A&M, got my degree in maritime administration. So it's basically shipping logistics, which actually helped me out later on, believe it or not. But Did that, graduated from that, also went through the Marine Officer Program and became a Marine Corps Infantry Officer and did seven years in the Marine Corps. Got my master's degree in management science from the University of Maryland. And then when I got out, I started as a project manager at a small MSSP because I was trying to figure out, like, what do I do? I figured out what... I was basically a project manager. I did a lot of patrols. Those were all projects.

Rob Carson2:33

Oh so that was it was an adventure like so i prepped a lot but i had you know i had to learn a whole new vocabulary so When you get out, it's a totally different language. SMTP and email, I thought those were two different things. I did a whole project on that. It totally confused me when I first started out. The good part is the Marine Corps taught me a lot of leadership. I was good at working with subject matter experts. I had this team of super nerds that could just do great things. As long as I could buy pizza and Red Bull and keep the executives away from them and find DEF CON money, everybody was happy. But it was definitely an adventure. But at the end of the day, I wasn't getting shot at.

Rob Carson3:32

So... It wasn't as hard as I thought it would be. I was nervous, though. What I figured out at first was that it was really just different weapon systems and how to employ them. And that's what I'm good at. If I'm in the firewall, we're having a really bad day. And I used to be nervous about my lack of technical skills. But it turns out, because I'm good at the logic and I understand how business works and how people work, I was able to fill my role very well. Infosec now, it's almost like medicine. You've got heart surgeons, you've got pediatricians. It's the same thing. If you need to do encryption, you go find an encryption guy. That's a thing. It's its own special snowflake. You're going to be good enough to know that you should go get a guy.

Rob Carson5:03

Yeah. So what I did, I started to get my CISA, Certified Information Systems Auditor, because for me, I didn't have a tech background. I had a wise phone. I didn't have a smartphone. I had the Zach Morris phone. It was... You know it was what it was like it wasn't that i was afraid of being of tech it's just that like i didn't have a lot of tech and so you kind of had to drink the kool-aid is the way the best way to describe it's like joining a cult or something like it becomes your thing it just becomes your thing you got to like embrace it and just not be afraid to ask like i asked a lot of questions i had three whiteboards in my office so my it manager would come in and like we have to just draw it out so i could figure out how these things actually work from a logical standpoint but

Rob Carson6:55

Where you see people part as a really big part of your job right now or even in transitioning so can you talk about that i've been a company commander so i had 110 marines so i knew what it was like to lead you know large groups i had also led small groups of subject matter experts and so you know when you're dealing with smes you know it's paying the king of shilling like asking their opinion first not sitting there and well i read a book about it like it's just throwing yourself into it getting in there with them and like hey show me how to do this like Okay, like, what do I need to know? You know, and asking those questions, like, what do I need to know, you know, and filling your role. And that's where, like, for me, my transition, it was tough.

Rob Carson8:25

Well, and the fact that I could go to the classes and like, there was something for me. No, there were some, when they're throwing up command line, like that wasn't the class for me. Cause when I think of command line, I want to run Oregon trail. You know, I wish I could throw four lines of Python at a problem, but I'm not that guy. But, You could go to the classes, just the talks and just meeting all the people and just getting involved in the community. Once I realized like, we're all a bunch of deviant people. We're all strange in weird ways. And like, we all fit in because the cool part is it's all about who you are. They don't really care about where you come, like your skin, your ethnic, your sexual preference.

Rob Carson8:58

Are you a good person or not? Like, are you trying to front pretend you just like, let's face it, you go to DEF CON, like, there is somebody smarter than you, probably at the barstool next to you. So you got to be very careful. You learn how to humble yourself.

Rob Carson9:19

Oh yeah. And then building that network, like I started volunteering. So that was one of the things too. We'd hired a bunch of guys from our group. They came in, you know, we've gone to DEF CON and all that stuff. And they're like, Hey, you got to go to Derby CON, which I'm going to like tomorrow, actually.

Rob Carson9:33

And I started volunteering there. Then I was having a conversation when I was there with a buddy. And all of a sudden, this guy's like, hey, that'd be a great talk. Send it in. And all of a sudden, next thing, me and my buddy are talking at Gurkhan and started doing talks. And just started to find my passion and find my place in the cyber landscape, if you will, what I'm good at and being okay with that. But figuring out, I don't have to be afraid of not being the cloud architect. It's okay. There's a guy for that, but I can do my part.

Rob Carson10:13

I think it's empathy. So... I was just talking to a customer today, and they're at that transition point. A lot of times, I work with customers that are in that SMB space that are going from either the outsourced IT, the one-man IT shop, but all of a sudden, they've got these compliance requirements for them to grow. And they're trying to figure out how to do it. And it's one of those helping to understand like, hey, I know what you had to do to get here. And I understand it's duct tape and Superglue. We're going to change. We're going to grow. But Don't feel bad about what it is. Let's start making that continual improvement. Hey, we can't send that stuff to personal email accounts. Like let's get a mature.

Rob Carson11:01

You know, it's like, okay, your two factor is SMS. We know that's not the greatest two factor out there. We know it's easily spoofable and stuff like that, but it's still a, one of those like helping people get to the baseline so they can keep growing and go, Hey, you know, It's okay. You at least have that. Let's worry about the stuff you don't even have. That's where when people say, oh, compliance sucks, I look at it as if you can't do compliance, you're not ready for any real cybersecurity. But helping them not try to boil the ocean. I used to have a full head of hair. A couple ISO projects later, it's gone. You can't do it all at once and understand why. At the end of the day, people are doing the best they can with what they've got and helping them spread the gospel, if you will, of, you know, of infosec and making sure the message resonates and helping, you know, what helps me now, a lot of it is helping to understand, you know, some of the most passionate people in the world where they're like, they're ready to die on that hill for something silly or it's like, Hey, I get it.

Rob Carson12:37

Yeah, exactly. And simplifying the solution. Half of it's like, Because I used to over-engineer stuff. I've made policies for the sake of policies. I've done it. I call myself a lessons-learned enthusiast.

Rob Carson12:49

I like to learn the hard way a lot of times of how not to do it. I tell customers, don't do it that way. I did it that way. It didn't work. Let me tell you why. But And explaining, having that strategy of like, okay, working through those programs and helping them understand, okay, hey, you don't want to do it that way. That's going to be a bad idea. I know that sounds great in theory, but you need to push that responsibility someplace else. Because you know what? It's not your decision. You let the business owner sign off on that. And that's a great way to start solving problems. That's why coaching, a lot of it's just coaching and going, hey, well, if you can get your boss to sign off on that, that's great.

Rob Carson13:34

Because it's not a security business. Typically, even if you're in an MSSP or in a security company, you're only doing security so you can sell and make more money. You're not doing it just because the hackers are coming. Doing to protect revenue yeah unless you're actual security company right which is like then your reputation's on it and all that but your reputation matters but it's like there's a great quote i'm giving a talk on guerrilla warfare in a little few weeks here a great quote from john f kennedy where he was basically talking you know they're asking about the space program and he was like i don't care about putting man on the moon but what he did care about was beating the russians there you go yes and that's what it's like people understand like hey

Rob Carson14:33

Sure. So it's one of those things, you can't manage what you can't measure, right? Mm-hmm. And so, like I said, you have two big metrics, right? There's a lot of stuff that boils up into that, right? So how do you make sure you're going to pass your audit? How do you stay at that 90% audit ready? Like when you go into the audit for the actual cert or whatever, that third party audit, like there should be no surprises. You gotta find something that should be like, oh, we didn't know about that. Holy cow. Like you shouldn't be shocked. So like what I do is I put metrics together that I truly define the metric where I'm breaking out like how we're going to do it. Okay, so the metric, it's here to meet this control.

Rob Carson16:54

Oh, good question. So I would say start joining the local chapters. So if you're chapters of chapter, like ISSA, cloud security Alliance, ISACA, whatever it is, start going. And like, it's okay to say I'm a noob. I don't know, but don't be scared and don't be afraid. Like I was an infantry officer. I barely had a computer half the time because I had a rifle and a radio. So it's one of those, like, don't be afraid of it. And understand it's more than that. You know, military guys, we all do this stupid information assurance stuff. Where it's like you do this online training once a year so you can keep your email address and it's usually pretty awful. It's much more than that. And don't be afraid.

Rob Carson17:59

So that helped quantify what I did, because it's one of those things, like if your resume says you were a jungle warfare specialist, well, that's great. But guess what, guys? Nobody's hiring a jungle warfare specialist. So... It's not relevant. Or why would it be relevant to the job? If it's not relevant, you got to cut it out. And it's hard. It's one of those, I taught urban combat in Moldova. I was super excited about that. Like, yay. And guess what? It's not on my resume because you know what? Nobody cares. It's a cool story, but it's not relevant to what I was trying to get hired for. So understanding that, if you're still in, start training out. Go get a cert. Go get a security plus. Get that.

Rob Carson21:01

Yes and no. So some of the adaptation that you will have to deal with is some of your bosses might suck. Really? I think...

Rob Carson21:41

It's one of those, they should. You should know your people, but it's not always the same way for everybody. Understanding the same level you might be used to, even if you didn't think it was all that great, it can be worse. If you have that drive and motivation, you can sail right through it. I would say that and other adaptations. If you're getting out, I'll tell you what I did. There's a set of podcast tools called How to Interview Series, Manager Tools. Best thing ever. I went to Steps and Taps twice. It was terrible. So that's actually the best set of how to interview stuff. I literally would record myself every night answering three or four questions, explaining why that was relevant to something, practicing, train, train, train, train how you fight, just like we did in the military.

Rob Carson23:13

It's not that bad. Remind yourself, like, you ain't getting shot at. It's okay. The other thing, too, like, I remember, funny story. So I was all nervous about how to dress, right? Because in the military, you have a uniform. That is probably the one thing that was hard for me, was how to dress. Because, like, because you know what to wear every day. It's tall. Like, that, it's pretty, it's all for you.

Rob Carson23:35

And like, so when I interviewed at my first company, like I met these guys, this guy was like in a tap out t-shirt and jean shorts, whatever. And then like, and I talked to my boss, she's like, yeah, just wear, you know, cargo shorts and a t-shirt or whatever. And I wore like a collared shirt, but I, and like, and they happened that day, they were messing with each other and they were all dressed up in suits. And I'm like, what the heck? I got all confused. So, but I would tell you, if you want to be noticed, don't dress sloppy. Know sometimes you have to tell engineers like you've worn that same shirt for the last three days have you showered like do you have more than one shirt and that's the thing like so you know get some clothes you know but it's one of those things like the best thing to do is kind of watch how people dress like talk to somebody figure that part out like it's one of those it's not a big deal but first impressions matter and so

Rob Carson24:31

I would tell people for an interview though, wear a suit. I don't care. They have jobs. You're trying to get a job. You should be just in the, I need to get a job clothes. They have the, I already have a job clothes.

Rob Carson24:49

So, well, that's why I like, well, I have skulls, I have a skull liner, so I have skulls in my suit. So it's still cool. You're right like you got to be careful and the other thing is like lighten up like that's why like videotape yourself like learn how to smile like don't be so one of the other things that was tough to transition is calling everybody sir and man oh interesting like calling my boss rob like his name was rob too was like was weird and that's it's a thing that like there's nothing wrong with being polite but as you move up you got to be careful You got to fit in. You have to be able to use first names and be comfortable. And it's going to be weird at first. It's going to be okay.

Rob Carson25:30

Weird. But yeah, I would say that's definitely, that was one of the things that now I'm thinking about it. I'm coming back to like, Oh yeah, I totally, I had trouble with that. Oh, and people don't start meetings on time. Sometimes the corporate culture can be very, very painful. I know. I know. Like, so yeah, Understand that take a breath you're not getting shot at like you don't need to be 15 minutes early that's the other part though is meetings if the meeting is supposed to start at 10 make sure you're there you know dialed in yeah five to ten or two minutes ahead of time is fine right but you don't need to be 15 minutes early because they're still they're still on another call they're doing something else like they're not like nobody's going to be 15 minutes early mm-hmm mm-hmm

Rob Carson26:16

Go ahead. Don't show up for your interview like 30 minutes early or something like that because then it's like, what am I supposed to do with you? Because you got to understand, that's what I tell people too, is like somebody who's hired lots of people, one page. Your resume should be one page unless like, if you're getting out of the military, if you've got less than 10 years in the world, like one page. Because I'm not going to read past that. So you've got to catch my attention in the very beginning. And you're going into three folders, A, B, and C. A, I want to call right away. B, I'll call if I don't find any A's. And C, why did this person apply? And you've got to go and think of it as phase lines too.

Rob Carson28:24

You know, and that's why like six months out, start crafting the resume and have people look at it. You know, go to steps and taps if you can. 90 days out or about that point, you should be recording yourself and practicing answering questions. And that's when you can start applying because like the other part is you can't apply for a job. You're not available for six months. Like they're trying to fill that spot now.

Rob Carson28:43

Yeah.

Rob Carson28:58

No, it was honestly like I had 2 p.m. job offers at the same time. One was with a big corporate company and then one was with where I went. And the big corporate one was a higher salary, actually. But I would have been doing the same thing and it would have been boring. I didn't know anything about infosec. And the cool part is it's a negative unemployment industry. People aren't making less data. It's still exciting. Like there's still so much stuff to learn and nobody's an expert anymore at all of it. They can't be. It's fun because you get to channel your inner criminal too. It's like, to be good at the blue team, you got to think like a criminal and go, well, how would I hack this place?

Rob Carson29:37

I'd say the passion is like, it's the adventure. Like it's always new and you're helping people and you're stopping, you know, maybe you're stopping bad guys, you know? I mean, you know, yeah, I fight bad guys with a keyboard now. It's not as sexy, but it is what it is.

Rob Carson30:01

Absolutely.

Rob Carson30:16

So understand that he may not be able to command the same. It depends on what industry he's in. Let's say he's in construction. Okay. It's different stuff. Like why, let's say you're paid a hundred grand. I'm just using round numbers here in construction, right? Like you may have to go back to 80 to go back up to 120. Cause a PM and infosec, a good one. Yeah. They're easily 120, 150, like the top notch ones, but they have a lot of experience in security. They know SDLC. They know these different pieces. They know how to put the pieces together and herd the nerds. They know how to go, when the engineer says, it'll take me two hours, that means two days.

Rob Carson31:04

I got to sanitize it and I got to think through the... When people are freaking out, during DR, don't yell at your people. I've been yelled at. Don't yell at people during DR.

Rob Carson31:19

It was awesome.

Rob Carson31:36

You got to start and just be humble and just drink the Kool-Aid. Join the cult. You just got to embrace it and understand there's a lot of important people. They'll tell you. It's like Navy SEALs. They'll be sure to let you know how important they are. But most people are pretty humble. And as long as you're just asking questions and trying to learn and being honest, not trying to play buzzword bingo with things you don't know what you're talking about, you're good. Cool, man. Just because you wrote a book on blockchain doesn't make you a blockchain expert.

Rob Carson32:09

All right. Have a good one.