Become a Creator today!Start creating today - Share your story with the world!
Start for free
00:00:00
00:00:01
Career Pivots and Forging Your Own Cyber Journey with Stacey Lokey-Day
143 Plays5 days ago
This week, Stacey Lokey-Day joins the show to talk about her career pivot from stay-at-home mom to cybersecurity analyst!
George K & George A talk to Stacey about:
- How she leveraged a bootcamp experience into a successful career pivot
- Why she believes in "collecting experiences" early in your career, even the tough ones
- How her time in the SOC built up her resilience and confidence
- Finding your voice, and owning who you are in tech
The lessons from her story are valuable to anyone, at any stage of their career. Turn it up!
————
👊⚡️BECOME A SHOW SUPPORTER
https://ko-fi.com/bareknucklesbrasstacks
For as little as $1 a month, you can support the show and get exclusive member benefits, or send a one-time gift!
Your contribution covers our hosting fees, helps us make cool events and swag, and it lets us know that what we're doing is of value to you.
We appreciate you!
Recommended
Transcript
Chasing Opportunities Early in Career
00:00:00
Speaker
Yeah, I think the biggest piece of advice that I give people is chase opportunities. you know Especially when you're early on in your career, just collect them. Just collect whatever opportunities. You don't have to fall in love with all of them, um but at least get that exposure to it so that way you know. but We had an opportunity when I was in the MDR to do a round of threat hunting, and that was a month of just you know and They essentially ran the hunt, and you would just have to analyze the data. Nobody like liked it, because and you weren't doing anything. You were just looking at logs and finding bad. Usually there wasn't any. And so no one really liked it. And um so I volunteered and did a month. I didn't like it. I think I cried probably by the end of it. I was so tired of looking at logs and being isolated from everyone. Did not like it. But that was an opportunity I collected. Now at Wizz, I had the opportunity to help grow our own program.
00:00:50
Speaker
And now it's like one of the my favorite things to do. It's a favorite part of my week. And the only reason I'm able to like contribute contribute meaningfully is because I got that exposure during that time to talk with senior hunters.
Introduction to Stacey Lokey Day's Journey
00:01:10
Speaker
Yo, yo, yo, this is the show. This is Bare Knuckles and Brass Tax, the cybersecurity podcast that tackles the human side of the industry. I am George Kay with the vendor side. And I'm George A., Chief Information Security Officer. And today, our guest is Stacey Lokey Day, career pivoter from SOC analyst, threat hunter, and now a security engineer.
00:01:32
Speaker
And this was a long time coming. We've been talking to Stacy for a while. We had an episode scheduled, but some bad weather got in the way, knocking out her power. But this was well worth the wait.
Inspirational Career Pivot into Cybersecurity
00:01:44
Speaker
Tales from pivoting from homemaker into cyber and where she is today is ah really inspirational.
00:01:53
Speaker
Yeah, I think her her mindset and her attitude was what I found the most pleasing to kind of talk to because, you know, she has the right mindset for making it into this industry, for getting a job. She got a job. You look at her work history. Yeah. She got jobs when everyone else is getting fired. I mean, she managed to pull that off. But I think a lot of that Comes from her gumption comes from from her just approach to to learning You know, we talked a lot about learning allow this episode and I think that's a big part of it And we talked a lot about you know, the value of we'll say structured networking or actually networking with a purpose Yeah, I think there's a lot of really good practical advice in this and she even goes into some tales from the sock and which I absolutely love because, you know, from my day, it was always just a game of like, what's this?
Overcoming Personal Challenges in Career Transition
00:02:42
Speaker
And she definitely gets in a little bit more detail than that. So I think our listeners are going to love listening to Stacey. Yeah, she puts a lot of words to a lot of things that we have talked about. So we will turn it over to stacecy Stacey. Stacey, Loki Day, welcome to the show.
00:03:00
Speaker
Cool, I can't believe we're actually finally doing this. It feels like i've i've we've had conversations about doing this for about like, I don't even know how long at this point. It's been a while. Yes, it's super cool to finally be here with you guys.
00:03:14
Speaker
Yeah, we're we're polite pleased to have you. I think for our listeners, we did have you on the books, and then Hurricane Helene put a quick stop to that as it ripped through Georgia. yeah But yeah, I'm glad we can connect here and now. So you are on the practitioner side, which means by the rules of bare knuckles and brass tacks, I get to go first. What have we got for brass?
00:03:37
Speaker
So I'm going to start with ah not your full journey into cyber, but more around the career pivot. You know, how did you select cyber or how did it find you? And then just describe that moment and then kind of the full effort that you went in to try and make that change because a career pivot is nothing to you know yeah knock.
Motivation and Early Career Steps Post-Divorce
00:04:01
Speaker
It's really hard.
00:04:02
Speaker
Yeah, no. um So mine is a little bit different than some of the stories I've heard. I actually, um when but I turned 29, I got divorced. My my husband, he decided ah he wanted something different than I did. And so um he left and started to make his own journey. But the real unfortunate part is I got married pretty young. I got married when I was 20.
00:04:25
Speaker
And I think a lot of women do this, um unfortunately or fortunately, you know, you want to support your partner. And so you put whatever you're doing on hold so that way they can, you know, excel and, and you know, flourish in their career. And so in doing so, I had, you know, I was about to turn 30 and I had I had no career. I was a homemaker. like had you you know How do you put like that into real skills? And very quickly, I realized if I want a better life for my boys, I had two i had two boys. And um very quickly, I realized I need to like get into gear and do something. And so my first my first foray back into the job market was actually doing, um I was a 911 operator. And, you know, I needed I needed the cash. I need the income.
Discovering Cybersecurity Opportunities
00:05:12
Speaker
And I did it. And I did it for about six months. And it was it was pretty terrible. um I know a lot of dispatchers. I think people think you just answer phones. It's it's crazy hard. and And for context, too, like you weren't you weren't like in the military. You were like.
00:05:29
Speaker
I was assuming like you were actually a full-time stay-at-home mom, that kind of thing. Yeah, yeah, I know. I was, you know, like during that time I was raising kids and like, you know, in my early 20s and into my, you know, just barely into my 30s. I'm raising kids. I'm at home. I'm not, I'm not customer facing at all and anything and um And so yeah, so I was like I was lucky enough to get a job um Working 911 and you know, I wasn't I didn't have the luxury to be like no, this isn't for me No, I needed to make it work. And so I did it and very quickly. I realized I don't have the personality for this I would cry every shift. It's very draining. It's very emotional I mean, those are the probably the strongest people I I've ever encountered, you know, they can just take it on the phone, hang up and pick up the phone and do it again. That's like wild. um So it wasn't only sustainable long term. And um the area where I live in in Georgia um has a signal base around here. And so like rumor had it was like, there's these good security jobs, um you know, in cybersecurity jobs, but you have to get your security plus to work on base because you know,
00:06:34
Speaker
I forget what the the the certification is that the government requires. It's like, DD, there's some number. Anyway, so I needed like at least a security plus to get a contractor job on base. And so um i I went to my family. It's kind of why I went to my family. I was like, hey, I can't do this anymore. I need your help. I need your support. And I was like, this could be a really long term career for me and the boys.
00:06:57
Speaker
And I think that the most attractive part about cyber is exactly that. It was a career. like There was going to be so many options. you know there wasn't I wasn't going to get pigeonholed. I had the the whole you know the whole field to kind of pivot into, whether it's pen testing, GRC, whatever. But I just needed to get my foot in the door. And so um that is kind of what led me to pivot and dive into cyber. It was just the necessity that, hey, there's a lot of contracting jobs around here. I just got to get my security plus.
Learning, Networking, and Career Breakthrough
00:07:28
Speaker
It's awesome. Thank you. That's a, I didn't know that, but I have a lot of follow up questions, but I'll turn it over to George. Yeah. Um, I have to be honest with you. I think.
00:07:41
Speaker
You know, I can resonate with that a little bit because like cyber was a new concept to me when I, when I first started this too. Like I was like, Oh, this is cool. I didn't think I could take my military skills and actually get a job out of this. So that's why I was like, Oh, were you in the army? I was like, no, no. I was listening to you. I was like, no, you were staying at home. You had like good, good life.
00:08:01
Speaker
I really did. like i you know and that's hard It's hard because it's like I don't wish I could change anything about that those first couple of you know that decade spending at home with my kids, but at the same time, as like I didn't do myself any favors when it came to back entering the job market. like and That's kind of why I'm so intense on LinkedIn. I'm so intense about networking. and because like i have I feel like I have so much catching up to do, so I'm doing everything, not 100%, 110%, 120%. So beyond just your your main job career, like you let yourself in as like the business, like you yourself are the brand, you yourself are the product you're putting out there. And and do you see those kind of ambitions turning into potentially like multiple revenue streams? And this is like
00:08:50
Speaker
and for for listeners listening to this thing, people who are coming from like maybe not so good conditions trying to get into the career. What I'm trying to show is like you are someone who's self-motivated into finding gainful employment from this whole thing, learning how to do the thing. And now you're building a brand and you know we have over 10,000 followers on LI, you've done a really good job. So logically that turns into like, oh, you want to expand this into like a business.
00:09:18
Speaker
Logically, for you, how did you begin? What did day one of this whole journey begin? I'm talking about your first day working at the dispatch job. Because I think what a lot of people need to understand is it all starts with one step one day.
00:09:35
Speaker
it it It really does. And I think that's, people overwhelm themselves with the planning, I think. And but sometimes I think you have to get out of your head with the planning and just do something. Just start. Just start. And then, cause I think, you know, oh what certification do I get? What jobs, the right job to start with? No, no, no. Just, just get a job. Just get in, just get in. Just start with day one. And so again, um so dispatch, I did that. I was crying. That was like a moment. I remember um calling my boyfriend at the time, just like,
00:10:05
Speaker
you know It was ah a domestic call and I'm just like, I can't do this. it's like This is goingnna my personality and like I'm going to destroy the person I am. just I just can't handle this. I need a pivot. And so I was like, I have to change something. And so um I ended up quitting that job. And you know again, with the support of my family and I was in a very blessed place to be able to do that. And they gave me like a certain period of time, like, hey, you have like six months and then you need to like either go back and get and you know go back and get a McDonald's job, wherever, you know, or you got to make this work. And again, having children is the biggest motivator because I was so tired of just not being able to provide like, okay, I could feed them dinner. But it was like, we couldn't buy the Jordans, we couldn't buy, it you know, we couldn't go to Disney, we couldn't do anything extra. And that's like really
00:10:51
Speaker
you know, you only know I think ah as a parent that like, not being able to provide for your kids or give them that extra is like the biggest motivator in the world. um And so okay, so to back up a little bit, so I am, I hate telling people this, because I don't want to give it like a false, a false like,
00:11:10
Speaker
endorsement but so I enrolled in a boot camp and I did that for six months and from day one of that boot camp I had my camera on I was starting to post and that's when I started posting on LinkedIn. I was like oh we're learning about containers and I would talk about Docker and you know post something about it or you know I would talk about oh I wonder what different cloud jobs there are and I post link on LinkedIn about it or I would say hey you know I didn't really understand networking guess where I posted about it.
00:11:37
Speaker
on LinkedIn. Yeah, I had like, I don't know, 25 connections at that point. But you know, those 25 connections, like you said, I'm like at 10,000 or something now. And like, that didn't happen overnight. That was constant grinding and grinding. And so about six months into that bootcamp, when I was about to graduate a month before I started applying for jobs, and I think I applied for like about 200 jobs. And At one point, a recruiter reached out because he had saw my
Embracing Opportunities and Public Learning
00:12:03
Speaker
post on LinkedIn. I was like, hey, I have a fishing job for you. It's a fishing analyst job. um Would you be interested in applying? And again, I didn't have the luxury to be like, nah, it's not for me for me. You know, I really want to do cloud, you know, maybe maybe circle back or something. No, of course you got to take you got to take what comes in your what comes your way. And so I did it. And I mean, saying yes to that job, um doing that interview changed my life. I said yes to the opportunity.
00:12:30
Speaker
and that opportunity led, um so I got a phishing contracting job at the beginning, and that was a six-month contract, and then that ended up three months in, I got offered a full-time job as an associate MDR analyst, so in their MDR SOC. And then from there, I got promoted to career, and then from there, I stayed in there for a while. I was at XPELL for a little under three years, and then um from there, earlier this year, I pivoted and um landed a role at Wizz. So, I mean, you just say yes to opportunities, and you keep,
00:12:59
Speaker
I mean, I think one of the things, too, that really helps me out expel is um because they were still in startup mode in the beginning when they had they're like, does anyone want to do night shift? Oh, I'll do it. You know, does anyone want to do threat hunting? Oh, I'll do it. And it was just because I was just trying to collect all these different experiences. So that way I could determine later, hey, I really like this. I didn't like this. But without without that exposure to all those opportunities, I can't really decide what's cool, what what I like, what's boring, what's exciting. And so I try to look at it as a collection of opportunities, especially when you're breaking in. you know there's There's no reason to say no.
00:13:35
Speaker
Yeah, Stacy, you took all my notes. um But this is, so I guess I'm curious, I have one question that's very quick and then a follow up. So having been a homemaker and a 911 dispatcher, these are not jobs that are like loud on LinkedIn. So I guess I'm curious, like how did you come around to the idea that you were gonna learn out loud like this? Like you were gonna, like this was a ah thing to do for yourself.
00:14:00
Speaker
you know it's I'm sure you guys tell this to people. I tell this to people. I have people say, I mean, you see it everywhere. and Everyone tells you to network. And I think for most people, it literally goes in one one year and goes right out the other, right? They're like, that's not for me. you know And again, I just, I don't know. you You reach a certain point in your life when you're really ready to make changes.
00:14:20
Speaker
And you're just like, OK, let's do it. Let's just try. Let's just try and see what happens. And again, I didn't have the luxury for this to fail. So I was going to throw everything, you know, at at the wall to see what stuck. Yeah, I think there's a lot there. um Seneca said that luck is what happens when opportunity meets preparation. Right. And so I think a lot of that preparation is saying yes to weird things.
00:14:47
Speaker
um As you said, collecting experiences, I try to tell that to a lot of young people, like we're long beyond the years where you're going to spend like 30 years at a job. I think everyone knows that. And so I'm like, if you're going to go into this job, they're going to get something out of you, but you need to get something out of the job, which is pad the resume, acquire the skills, get the experiences. I like that.
00:15:09
Speaker
i I actually think that we've been connected for more than three years because I remember you going on the night shift. I remember that being the big thing. I also remember watching you like live stream a CTF as you were like just muscling your way through it, probably on Hack the Box.
00:15:28
Speaker
yeah um Can you talk a little bit about that learning out loud experience? Because I think it's very brave and George and I have talked about this as a skill set for new hires. Like you have to show that you're learning, that you're not just like really good at taking cert tests, but that you are developing skills. But I also am cognizant.
00:15:47
Speaker
that I hear from a lot of newcomers, the the fear of just getting, I don't know, whatever, blasted in the comments, and also the double fear of women being talked down to in this field, which happens even to seasoned security
Misconceptions and Proactive Career Building
00:16:01
Speaker
veterans. yeah I want to want to hear because I have a theory about it, but I want to hear your response. And I think because there's that Eureka moment while you're explaining kind of how you felt about the whole thing. And I want to talk about what makes you different. Let's hear your response first.
00:16:15
Speaker
Man, I wish I could say I had some eloquent response to like how I was able to do this, but I mean, truthfully, I just... I don't know. You just power through and you just, I just did it. i I literally thought to myself, I have to make this work. I have no other option. Like my other option was to move back in with my parents in a really tiny town. And I knew like, essentially in my head, my life would be over. Like I would never be able to do anything exciting. And I think what really helped too is every time I did do something scary,
00:16:47
Speaker
And you know of course, there was failures. Of course, there was moments when people talked down to me and stuff. But there was also a lot of positive stuff that came out of it. I got a lot of connections. I met a lot of really cool people. I had fun opportunities. um I know one of the opportunities that had Gerry Ogier, he invited me to do like a team CTF with him. and i mean that's really that And that doesn't happen from being quiet. Correct.
00:17:10
Speaker
but doesn't He doesn't notice people who are just, but you know, not posting. you You have to put yourself out there in order to get chosen. You're never going to get chosen for these really cool, fun, exciting opportunities if you're hidden, because people don't know you're there. And so, I mean, it's it just comes back to like how bad you want it, because if you don't want it, somebody else does, and they're going to speak up and take it. So why not you?
00:17:33
Speaker
Yeah, that that was kind of my whole point, was I think what differentiates you compared to a lot of students who I've run into who complain about the boot camps. And George and I rail on the boot camps all the time. That is a thing for us. What I'm seeing, though, is that your attitude is different. And what I see with a lot of the students that complain is they have like almost this sense of entitlement. Like I did this boot camp. Where's where I get a job? Where's my 250K job to start?
00:18:00
Speaker
And you have this, like, just learning mindset of like, hey, I want to learn things like I'm not entitled to learn the things, but if you'll give me the opportunity, I'd like to. And you have this like approach that I just wish I wish more people had, because that's that's how you have to be. Well, I think she didn't. I think that there's a lot there, right? If I am just a student. Hmm.
00:18:24
Speaker
It's low stakes, right? But you got two kids and you got to survive. Then it's like go for broke, you know, full throttle.
00:18:34
Speaker
I will say one interesting thing. I don't know if you've ever peeped the, the so if you look on TikTok and you look at like cybersecurity and um you see people that'd be like, like it's it's kind of unfair though because I feel like influencers and different people who are, they they sell people this dream that's like, hey, you just do this course and you're going to land a six-figure job. And the reality is so much different. And then meanwhile, if you search up like CS grads or CS majors, you have all these people who have like computer science degrees saying, I can't get a job and I've been spending six months. And it's really interesting to see the economy between these two different mindsets of, you know for cybersecurity, just do this course and you'll land a job. And then you see other people saying, I have a computer science major.
00:19:17
Speaker
and I can't find a job and it's been eight months, this is useless. So I think, you know, unfortunately, where people get their information, um it really, it really, it does them a disservice because it doesn't set them up for success to know what the realities are.
00:19:32
Speaker
100 percent. I mean, that's what we talk about. We call it the parasitic boot camp economy, which is. um But and I say that as somebody who knows several people who went through boot camps and made successful pivots. But I think to George's point, they all had some hunger and the boot camp was merely the first step. It wasn't like the ends to the job. It was like, I have to do this. And I think you said, right. You heard about the security job close by that kind of plants the seed. And then you're thinking, OK, what are the steps I need to do this thing?
00:20:02
Speaker
you had a support network that was willing to give you the time to go do it. And then I think this is very clear, right? You said you applied to 200 jobs and yeah probably got little to no response, but it was the learning out loud that brought someone to you, which is very, very different.
00:20:19
Speaker
Yeah. No, you're, you're exactly right. I had, I had interviews that I bombed, like, ah you know, they would ask me a question that the question I hated the most was like, what happens when you click Google? Like, how does that work? You know? And I've had interviews that I've just completely won. I forgot where I was even interviewing and I was so embarrassed. We were just like dizzy from all the applications. It was just it was just you know, I've had those experience where I bombed where I froze But then I've had those experiences where like everything went smoothly But that didn't happen by accident that happened because I mean as corny as it sounds even this year when I applied to is and I got those interviews and I was practicing my interviews. I had my husband ask me, why do you want to work at Wizz? Why, you know, why are you leaving your job? And not that my husband knows the answers to like, yeah especially some of the more technical questions, but I wanted to practice actually saying out loud my answer so we can know, oh, that sounds terrible. Don't say that. Or, you know, oh, that was a good one. You know, write that one down. And so I think people discount the effort that goes into like even changing jobs, um you know, because they don't see that that behind the scenes work. But there's so much work that people don't see that, you know, unfortunately, it's just a reality in the boot camp. Did they it was all skills that did they ever walk you through the career training sort of thing like how to interview or how to I'm just curious on that.
00:21:40
Speaker
Maybe lightly. um you know I think we we had to like research different jobs or different areas, and and that's kind of how I knew like GRC existed and you know the different cloud engineering jobs versus like um you know an analyst job or IR. So I did know a little bit, but one thing I will say that it didn't help um is it wasn't and until I was active on LinkedIn that I started to recognize the companies.
00:22:04
Speaker
So, like, the crowd strikes and Sentinel-1s, the Unit 42s, the Palo Alto. And I think that does ah people some disservice, is they want to break into the industry, but they can't name any companies, like any cybersecurity companies. Yes, I want to do cyber. Yeah, you know, it's like, okay, I think we're focusing on a little bit of the wrong areas. Like, cool, you you can run an in-map scan, but you don't, you know.
00:22:26
Speaker
you don't read any blog like you don't know any of these companies you don't know any mdr companies you don't know any i r companies and not saying that you have to but i mean it just makes life so much easier when you're actually ingrained in the industry and you kinda i don't know you feel like you have roots ah no one No one gets a job by blind
Building Resilience and Facing Job Application Challenges
00:22:47
Speaker
applying. So the the concept of applying via LinkedIn or Indeed is called blind applications. And I tell people stop doing it. It's a waste of time. Like obviously George just said, you know, it's good to do the practice. It is good to do the practice. But for folks who are a little bit um more senior along in their careers, they're like kind of at my level.
00:23:06
Speaker
um It's just not even worth it. like These jobs get posted up. They're ghost jobs. Sometimes they're ghost organizations, especially if they're startups you've never heard of before. And you just get led around the street. And if you do get a callback or you get an email back,
00:23:21
Speaker
how many times it just turns into a ridiculous process or a song and dance show. Ten interviews for this analyst position. Produce this free free project, free labor. Yeah, that's super wild. I've never had to do a project and I don't think I ever would. so and Don't give away free labor. it's It's really beautiful to see your story Stacy, but it's like it's tough for some people because this thing is a maze and I think You know, I imagine, I imagine like a scene from Star Wars where, you know, they're fighting through an asteroid field and they're either getting blown up, getting hit by the rocks or they're getting blown up by bad interactions, right? It's what would be your motivation or giving words of advice for people who are like just struggling to get through that slog? Because like George mentioned, we know people that have CS degrees that have these certs and they can't get anywhere. So what are they going to do?
00:24:13
Speaker
Yeah, I think it's a testament, though, because it's really preparing you for your career in cyber. I mean, granted, so I was an analyst. So my experiences is obviously one in the sock with a lot of different analysts. But I would say the interview process and the prepping for it actually prepared me better for the sock, because then you're working with a whole bunch of smart people who know their shit. And so it's like, you know, if you So one of the one of the problems I face early on in the sock is, you know, the advice I had gotten was just speak up, just speak up. OK, well, you know, just speaking up isn't honestly it isn't enough in the sock. You actually have to sound confident. You actually have to know what you're talking about. And you you have to be prepared to be wrong and then, you know, wipe it off and then get back up and then do it again. And so it's that resilience that builds up um in such a technical role. and, you know, just being an analyst with a bunch of alerts or whatnot. And I think that resilience that you have interviewing over and over again, getting shot down, getting, you know, that kind of builds you up to so when you're in the sock, you're not just going to get ran over because I mean, it can be brutal sometimes. And, you know, sometimes it's embarrassing to know that you're you called out the wrong answer. But if you can't like pivot and get back up again, you're no good to anybody and you're no good in the sock. And so, again, I think resilience is ultimately going to be
00:25:30
Speaker
your biggest strength and the biggest thing that you can really like lean on to just continue to grow. Because if you don't have that, you're going to get crushed. are Hey listeners, if you dig the snark, the stories, and the big swings we take, we'd appreciate your support. You can now become an official supporter of the show. You can send us a one-time gift or sign up as a member to provide ongoing support. Memberships start for as little as $1 per month. Just follow the link in the show notes. Each membership tier comes with a unique set of benefits, including exclusive discounts to the BKBT swag shop and even advisory services for your team.
00:26:12
Speaker
So really, for less than you'd pay for one cup of coffee per month, you can support the show. It covers our hosting fees, helps us make cool swag, and it lets us know that what we're doing is valuable to you. Many thanks to listener Elizabeth Ramirez for her recent pledge of support. We'd love to have yours too. Now, back to the show.
00:26:34
Speaker
are Now that you've been in three plus years, right, you're not like right at the junior level, but you're still kind of rising in the industry.
Insights and Experiences in Cybersecurity
00:26:45
Speaker
I would venture to say that things have changed in that time, even between the time that you had started applying versus how people apply now. So um are people coming to you for advice and what would be your practical advice to them? Maybe areas that we haven't even covered here, like the learning out loud and the networking and ah
00:27:05
Speaker
in a meaningful way and and things like that. Yeah, I think the biggest piece of advice that I give people um is chase opportunities. you know especially the early like you know Especially when you're early on in your career, just collect them. Just collect whatever opportunities. You don't have to fall in love with all of them, um but at least get that exposure to it so that way you know. um Again, one of the ones that um but We had an opportunity when I was in the MDR to do a round of threat hunting and that was a month of just, you know, and they essentially ran the hunt and you would just have to analyze the data. Nobody like liked it because and you weren't doing anything. You were just looking at logs and finding that. usually there wasn't any. And so no one really liked it. And um so I volunteered and did a month. I didn't like it. I think I cried probably by the end of it. I'm so tired of looking at logs and being isolated from everyone. Did not like it. um But that was an opportunity I collected. Now at Wizz, I had the opportunity to help grow our own program. And now it's like one of the my favorite things to do. It's my favorite part of my week. And the only reason I'm able to like contribute
00:28:13
Speaker
Contribute meaningfully is because I got that exposure during that time to to talk with senior hunters You know um do all those log analysis and then it kind of gave me the foundation that I needed So now that I'm at Wizz and I can't I'm helping grow out that program I can you know It's it's become something I love and I wouldn't be able to have contributed in the meaningful way that I am now without saying yes, then I I love it. I love and and so this idea of collecting experiences. Just collect it. You don't have to love everything. You don't have to do everything forever, but just get, you know, just dip your toes in the water, see what it's like, and then maybe you can revisit it later on down the road. Trust me, you won't regret getting exposure to anything in cyber. I mean, it's just another, you know, tool in your tool belt that you can pull out when needed.
00:28:59
Speaker
And I think you also can't anticipate what, like it's, you just put your hand up. You didn't know like, I'm going to do this in order to do that. Like that's how life unfolds is often through serendipity. Nice.
00:29:12
Speaker
Yeah, no, it it really is. But truthfully, I mean, people were asking for advice like super early on. And I would hate I'd hate giving advice because I'm like, hey, I'm right there with you. And so part of the thing when I was posting online, you know, it was just to give insight into what it's like being an analyst because I'm not an OG. I'm not like, you know, I haven't been in this industry for 10 years. No, I am a ground level analyst. And so the way I frame and my audience for posting is if you just want to peek at what it's like on the ground level.
00:29:40
Speaker
I'm your girl, I got you. I can show you some things that, you know, what it's like down here in the trenches. And it's honestly not as bad as people say, and it can be really fun. Nice. Yeah, it's ah it's kind of interesting, too, though. Like, would you, when you started your career, have your jobs all been remote?
00:29:59
Speaker
Yeah, see like when I started like my first, excuse me, my first sock job was in person. It was like a brick and mortar MSSP. And ah that was a far different experience than anything else afterwards where I was working remotely. yeah Do you find starting this career in a remote way and having that digital persona like I think it's a whole other skill set to be able to be online, produce content, produce a story and be authentic. Is it now a necessary part of the skill set for future analysts to be successful? Or can they be successful just doing cyber and trying to get jobs? or like Like I'm saying, like, is the brand now part of the networking and you need the networking to get the job, right?
00:30:49
Speaker
Yeah, so I would say, I would say no, it's not. I mean, that may be a hot take. I don't think it is. So like, um when I left expel earlier this year, um I went, I went to, to Wizz and I'm obviously a very, um I have a presence online. And during that time, a few other analysts left and two of them that left, um they don't really have a presence online. And they land in one landed a job at Google doing IR and the other landed a job at Amazon, um being an engineer over there.
00:31:18
Speaker
And so, no, I don't think it is um you know key to to landing another job afterwards. but ah I will say for me, it was easy. I didn't have to go, you know, I didn't do 200 interviews this round. yeah um And so it was a different experience, but you know, I will say they're superstars. They're they're not anybody, you know, they they have the technical skillset so you can almost throw anything at them and they can, you know, they can throw it right back at you. So you either need to be willing to do the extra interviews and having the technical background to go through all that.
00:31:53
Speaker
or you know you can have an online presence and have the technical background and do it a little bit different way. So I don't think there is, yes, you have to have this online brand, no, because I know a lot of analysts that don't. um But you know what they're they're not having the same exposure to different opportunities that I am. So it' just it's just what you want. you know But you know I think it does help. Their foot's already been in the door for a while. you know They've already been doing this for four or five years at this point. So it's not like,
00:32:19
Speaker
I would also be curious. I mean, those are great places to land, but I doubt that it was through a blind application. so there's there's one some no One was a referral. I don't know about the other one. One was a referral. So a referral is the part of networking. I think that's. Yeah, no, you're right. I think people mistake networking is like acquire as many followers as possible, but it's also just you are making relationships with the people who will talk about you in the rooms that you're not in, essentially, right? Like the last two roles I've gotten didn't want a resume. andt It was literally somebody knew somebody, knew somebody and put my name in. And then we had an interview and they they take it from there.
Authenticity and Communication in the Workplace
00:33:00
Speaker
um But yeah, that's that's really great. I'm curious also, I'm very hesitant to ask this question and I'm going to try to phrase it very carefully.
00:33:13
Speaker
Do you think that there's anything outside of cyber like your skill set that has helped contribute to your success? So I say that because a lot of people When they want to pivot, they're like, well, I don't really know computers. And and and George and I have always said, like, you probably have things in your tool belt that you haven't really thought of as tools, whether you're an empathetic communicator. Right. like So, ah yeah, let me interrupt myself. So the ah your inability to do 911 dispatch in terms of compartmentalizing your emotions and stuff like that.
00:33:46
Speaker
maybe a weakness in that job, but maybe makes you a pretty clear communicator when it comes to talking about an event that you've identified or a problem. This is just a hypothetical, but just curious now that you've had time to reflect, were there are things that you brought from outside of cyber that have helped you in cyber?
00:34:09
Speaker
Yeah. Um, so I'm sure you guys can tell my personality is a little bit, uh, a little bit louder than most sock analysts. It's a little bit more. I like to communicate. I'm very transparent. And so that ended up being, um, something I leaned into cause I noticed a lot of sock analysts don't.
00:34:27
Speaker
I mean, they say the bare minimum. um they They keep it technical. um and And that's kind of it. And there's this misnomer that they're shy or introverted. And sometimes they really are. um But honestly, I think it's just because, too, the environment they're around, there's not a lot of people who talk a lot. There's not a lot of people who do this extra stuff. And so the reason I say that is so um The way it's really helped me, so in all of my investigations or my incidents, my notes were chunky. My notes were chunky. You can tell every time um we had our weekly meets, the person who contributed the most, that was me. um And so the reason I say that is
00:35:05
Speaker
and Whether I wanted to or not, it it made me stand out. And you know for better or for worse, I was a top contributor. you know I was participating in things. And those were more you know skills that I was adding that made me me. And um again, is it necessary? No, there's people who you know write their two lines and close out something. And that's fine. that gets you know But for me, those skill sets of being the over-the-top communicator landed me different opportunities that I think others um either didn't want Um, which is fine because I wanted them. Um, but it just it helps differentiate me in the pact. So, you know, and you didn't try to like
00:35:45
Speaker
change yourself into something you want. Yeah, that's a really big thing. I think that was the biggest thing because, you know, I had changed myself. I felt like so much in my 20s to conform and to like make this marriage work. And I was like, I'm never doing that again. I'm never changing myself for anybody again. And so you get like, you know, in our messages, you know, there's sparkle emojis, there's gifts, there's I'm me, and I talk a lot. I probably overshare. I'm the one asking the other engineers, oh, what did you do on vacation? How was blah, blah, blah? And so to me, that makes me me. And honestly, it's been a breath of fresh air, I think, for my shift mates and whatnot, because now they're talking a little bit more. Now we get to know each other better. And when you get to know your shift mates and the coworkers just a little bit better,
00:36:35
Speaker
I think there becomes this bond of that when you need help, it's a little bit easier to ask for help yeah when you know somebody, right? And if you're say isolated, that does nobody know favors, then you get in your head and overthink things. Don't, don't worry about that. I got you. I'm, I'm taking out all the uncomfortable conversation now. So that way when you need help, you can just ping me and be like, Hey Stacy, can you take a look at this?
00:36:55
Speaker
And um that's ultimately my goal. And so I think that comes from part of being a mom, that comes part of me just being grounded in who I am and not changing for anybody.
Adapting to Remote SOC Work and Team Dynamics
00:37:04
Speaker
um But yeah, so i I lean into my communication a lot. You know, for better or worse, it's helped me and it's differentiated me. And so I kind of say that's my superpower in this lock. But nice um yeah, we'll we'll see how that continues to evolve. Yeah, own it. Yeah, I think i think it's it's really important because Life in the sock is a different thing. And I think unless you lived it, like a lot of people don't understand it is sometimes very adversarial. Like I remember in my sock days, like being in like shouting matches with some of my shift mates. It's it's a thing, right? Like analysts have a certain stubbornness and they want to be right and they want to be sighted. And that's that's how it goes. um Have you found that you were able to like
00:37:52
Speaker
Are you still able to get that kind of competitive drive out of your colleagues, even though you guys are stuck being remote, trying to build this kind of like virtual cohesion? Because that's the thing I find interesting, like you in a sock now, of a remote sock.
00:38:08
Speaker
I feel like it's just a completely different world than like being physically in a sock with all the screens and all the the computers and all the systems and all the things, right? So like that's where i'm I'm like, walk me through this, like, how does your day go? What does operational tempo go? What do those analytic conversations look like when you don't agree before something goes into a report?
00:38:32
Speaker
Yeah, so I think it's it's really evolved. um For me personally, I remember that my first miss was ah a post once exe reaching out to a fake domain. And I remember I was like, Hey, guys, I think this is I think this is weird. It it might be bad. I don't know. I could be crazy. And ah no one believed me.
00:38:51
Speaker
No one believed me. some Another analyst said the same thing, and he was like, hey guys, I think this is bad. And they spun it up. It was a pen test. And so, you know, so, okay, that was lesson number
Gaining Confidence and Making Security Decisions
00:39:00
Speaker
one. So lesson number two happened. I was on night shift, and um there was this, it's like, MDST.exe, it's on Microsoft binary. It was reaching out to a misspelled Microsoft domain. And this is night shift. So this means if I press the button, I'm waking someone up. I'm waking someone up on my own team, a senior, and then I'm waking someone up you know on the customer end. And so I told my shiftmate, hey, I think this is weird. And I already had the previous experience of, I knew what that first miss felt like. And I was like, this isn't gonna happen again. So I gathered up all my evidence and I was like, hey, I think this looks really weird. And at that time in my life, I felt like I needed his permission. I needed my shiftmates buy-in to ring the bell. And he's like, no, I don't think this is weird. And I was like, okay. And I was like, well, I'm at least gonna send the customer a notification. So that way they at least know this is happening. you know We're not gonna sound all the alarms.
00:39:48
Speaker
but that way they're going to know. And anyways, um come to find out, yeah, that that one was actually really bad and a senior flagged it and, you know, ring all the bells the next day and, you know, all that happened. Okay, no, fast forward. and Later now, I'm on day shift now. And um it was Sunday crew, so smaller, smaller crew. And a senior had pinged, you know, our team channels like, hey, what is this? I think this might be bad. And, you know, the on shift analyst was like, no, I think this is just
00:40:19
Speaker
I think this is just IT t work, you know, it's admin stuff. And so, you know, I just come, I was just coming on. So I was like, reviewing everything. And I looked at it. And it was like, like PC Hunter in the pictures, um and the picture file path and some other weird binaries in the picture file path. And I'm looking around and I'm like,
00:40:40
Speaker
this doesn't feel right. And I messaged another analyst like, hey, what what are your thoughts on this? He's like, no, it's bad. And I was like, say less. And so I told that other analyst, I said, hey, this looks bad um because it was it looked like pre staging for ransomware. And I was like, this looks bad. And I told them either you can press the alarm or I can press the alarm. But one of us is escalating this and we're promoting. And, you know, it was it was it was, you know, they were they were setting up for for ransomware. And but I say that because that doesn't just happen overnight where you can just This is bad. You need to do something. I'm saying we're doing something. Like that confidence, that voice, no, it happened over years. And it's unfortunate that it takes, I mean, other people, it doesn't take that long. For me, it took a while because, you know, not only do you have to learn to be able to speak up, again, you have to speak with confidence. You can't. especially if I hate this. i One of the advice that I got from other women was I needed to learn to bring my pitch down because I can get kind of high and I can get kind of squeaky. And I guess guys don't really resonate with that. Guys don't really appreciate that. It's annoying to them. And then what I would also do is I would all always say these self-deprecating
00:41:48
Speaker
phrases like, oh, I might be crazy. Oh, this is probably nothing. that's Oh, but I don't know. no that's not yeah You can't can't defeat yourself before you get up. Yeah. Yeah. And I think that's the biggest lesson, right? Is like, if you don't believe yourself, why is anyone else going to believe you? And so um that type of growth ah it happens over time. Everyone's you know pace is different. But I think that's the biggest lesson that I learned in the SOC that I am so grateful for.
00:42:14
Speaker
i I really love this. I love also illuminating for any listeners who are entry-level or trying to do something in the SOC that it's not do bootcamp, get job, see alert, raise alert. I think that's like the common myth, but what you're pointing out is like even if you have the technical acumen, the actual operations of the SOC require all the EQ and the confidence because it's human communication. You have to be able to make the case that This is worth escalating. This is worth waking up the client. This is worth. It's so right. Also have to point out a book recommendation. I think this is
00:42:54
Speaker
What you're talking about is ah there's a Mark Manson book out. um so So was it the sell art of not giving a fuck? yeah I need that then. Yes, it is it is. Your whole attitude is like this book. Yeah, I would recommend that for our listeners as well, because it's I just have to do to someone actually
Diverse Paths into Cybersecurity and Conclusion
00:43:13
Speaker
this this Christmas. So I was like, oh, my God, you are. I wish I met you sooner.
00:43:17
Speaker
Yeah, no, I mean, it's it's and people didn't tell no one warned me, you know, they just said, if you, you know, you you get trained to spot bad, no one tells you how to communicate that to your shift mate, so they believe you. Like, you know, no one tells you how to make a case. No one tells you not to tell, say, self-deprecating jokes about, Oh, guys, I'm just crazy. Or I'm so sorry. so No, stop saying that stuff.
00:43:40
Speaker
Yeah. I mean, we've said it, uh, this will be, I don't know, like the seventh time on the podcast that you can train all the technical skills you want, but if you do not have what we call vital skills, we do not call them soft skills. Um, like the, the communication and the career progression gets harder and harder. You know, it really does. Yeah. Well, Stacy, thank you so much that we are at time, but this has been delightful and well worth the wait. Thank you.
00:44:07
Speaker
Yeah, thank you. Thank you for having me. um This is super cool. I was really, really really looking forward to it last time. And then of course, you know, the hurricane that was super bummer. But um no, it's been it's been really fun. And again, I always love to chat with seasoned folk and share my experience too. It's not like everyone else's. There's a little bit different caveats. But again, just to show that there's no straight path in into cyber. There's no straight navigation into the career.
00:44:33
Speaker
And it can look all sorts of different ways. And this is not to say that this is the way people need to do, but just to show, hey, this is a different option. This is a different way someone went about it. And it's definitely doable. Awesome. Well, thank you again. Thank you.
00:44:50
Speaker
If you liked this conversation, share it with friends and subscribe wherever you get your podcasts for a weekly ballistic payload of snark, insights, and laughs. New episodes of Bare Knuckles and Brass Tax drop every Monday. If you're already subscribed, thank you for your support and your swagger. Please consider leaving a rating or a review that helps others find the show. We'll catch you next week, but until then, stay real.