Rafal Los, James Jardine, and Michael Santarcangelo -- #DtSR and What Makes a Good Security Consultant?

0:05Chris RomeoThe Application Security Podcast. Here we go. Greetings all. We have a treat for you this episode. Robert and I are joined by the crew from the Down the Security Rabbit Hole podcast. This includes Rafal Los, James Jardine, and Michael Santarcangelo. This is a special conversation for me because the AppSec Podcast was born from the first interview that I ever did on a podcast, and that was with Down the Security Rabbit Hole. I was featured on their episode 204 in July 2016 after a friend suggested me to Raf on Twitter. Thanks, Nigel! The Down the Security Rabbit Hole episode was entitled On Changing Culture. I'd listened to these guys on and off for years and now had the chance to be interviewed by them. The experience pushed me to start this podcast, and here we are 17 episodes later. In this conversation, we answer the question, what makes a good security consultant? We quickly admit that a consultant does not have to mean somebody that charges per hour for security. These guys have a wealth of knowledge and experience on this topic, and I know that you'll walk away with multiple ideas to apply. All right, folks. Well, welcome to this episode of the Application Security Podcast, and this week we're going to tackle a question, and that question is, what does it take to be a successful security consultant? And when I say security consultant, I don't mean necessarily somebody who's getting paid per hour to do security. I think that everybody has a role across an enterprise to do some type of consulting to try and bring people along. And to answer this question, I've got a number of different guests with us here today, the entire crew from the Down the Security Rabbit Hole podcast, actually. And so with that, I'm just going to jump in and we're going to round robin and rapid fire.

2:19Yeah.

2:20Chris Romeoour approach to doing this. So, Michael, what's your take on this idea of a security consultant and what are the things people need to do to be successful there?

2:30I like that.

2:32Here's where I think it starts. We have to define consulting and I've actually spent a decade looking at this. There are 3 basic levels. You can be a contractor, you can be a consultant, you can be an advisor. By way of analogy, if you think about it this way, if you've got a pile of rocks in your front yard and you want the rocks moved, you can hire somebody for the day, give them $50 and a shovel, and they're— as a contractor, they're going to go move those rocks to wherever you tell them to move them. When you get to the consultant, the consultant might work with you on an optimal system and a good way to place them. And a consultant could work by the hour, or a consultant could say, here's an outcome and here's the value of that outcome. When you get to the advisor, the advisor walks up, looks at you, and says, why do you want to move the rocks? So, if we're going to focus on the consulting side, and I like that distinction of how this works in an enterprise or in any sort of an organization, it starts by looking at the mindset. So, there's a skill set that we can all talk about, but where I would start is it's the mindset. The consultative mindset isn't one that says, I know the right answer. It's the one that says, I'm going to work to understand your context. I'm going to understand the nuance, and I'm going to help you find the answer that's right in that context to get to the outcome that creates value.

3:45Chris RomeoOkay. All right. So, Raf, what's your take as somebody who is a security consultant on the outside? How do you approach this issue?

3:53Man, I got to tell you, I echo largely with what Michael says. I think from a consulting perspective, having been on both sides of this, unfortunately, consultants are sometimes seen as people who jump in, drop a grenade, Laugh maniacally and leave. You got to work hard every day to earn that trust from the people that you consult for, and it's it goes back to actually solving problems. This isn't just crazy talk.

4:23That is crazy talk.

4:25I know. Hey, look, this isn't just I'm smarter than you guys are because a lot of the times I walk into a client and and before the boss shows up, the employees typically do one of these. All right, look, I've been telling the boss this for 6 months, but I guess if you say it, it'll be right. And my first question is, great, what do you want me to tell him? If it makes sense, let's make sure. And now, of course, that means it has to make sense. We got to bring that experience. We have to bring the ability to listen, formulate intelligent replies, and drive change from an outside-in perspective. And I think that's kind of what helps. Having that outside-in perspective, I think that's where the consultant can earn sort of the badge. And it's a tough gig, man. You show up, you have to learn everything in a couple of days, couple of weeks, a couple of months at best, and about them, tailor something, get a problem solved. It's back to freaking solving problems.

5:22Chris RomeoYeah. So, James, is your experience in the world of consulting more from doing consulting, kind of going and dropping into a particular organization, or do you have some experience from kind of the inside?

5:35Well, I mean, I've got experience really from both sides. You know, an interesting thing to point out, you know, when we say security consultant, and you had started to say this at the beginning, right? Security consulting is not just external, it's internal as well. You know, I mean, you play a security consultant role even as an internal employee. And, you know, I've had that experience of being internal where you're kind of that consultant level, and external, where you're coming in third party. You know, and I think with all these, you have kind of the same basic needs, right? I mean, having some form of experience with what you're dealing with, just so you can have some sort of background, right, and knowledge to form what I would like to think of as some empathy for what you're walking into. You know, all too often, you have people come in and they have no idea what they're talking about. You know, they've got no experience working with something, so they come in They provide you results that are, you know, kind of just regurgitated.

6:33They—

6:33well, the documentation says to do this, you know, but they've never actually done it before, or they can't really empathize with how difficult that may be. Right. We see it all the time in application security where we come in like, well, you should just implement manual security code review and you should do this. And but if you've never done it, you can't just say, oh, I'm going to implement a static analysis program. It doesn't happen like that. There's a lot that goes into it. And so I think from a security consultant standpoint, having that ability to have empathy for who you're working with and become collaborative and not come in, you know, as both Raf and Michael have said, you know, I'm not coming in saying, hey, I know everything. It's, I'm going to understand your situation. I'm going to help you find a solution, potentially implement a solution, but we're going to help you find the solution that works for your environment, not just whatever it is, you know, best practice written-down ideology that exists out there.

7:26Chris RomeoSo what about the— so I think that's interesting that you mentioned empathy, and empathy is not a technical skill, right? So what do you think, and I'll throw this back to Michael, let him kind of jump back in on this, but the difference between or the importance of the technical skills versus the non-technical skills for both the external and the internal consultant, what's more important out of those 2?

7:48Well, I don't think it's more important. I think that there's a balance of it. I mean, if you If you lack the technical competence but you've got really good chops in terms of communication, then great, knock yourself out and go focus on the technical. If you've got good technical chops, which is what we tend to see, then you need to make that investment. Here's the difference. We consider technical skills to be hard skills and we believe them to be acquirable, and we then buy into this mythology we call them soft skills, which is odd because they're typically harder to acquire. Then we do things like, well, you're either born with it or you're not. Well, it's based on your personality type. Well, it's based on some assessment I took someplace somewhere that told me if the stars aren't aligned properly, I can't possibly do that. That's all rubbish. There's an entire science and there is an art, but there's an entire science behind it. When you say they have to exist in balance, so when you're talking about somebody who's a consultant, that means that they have the capability to come in and to connect with other people, to read the situation, And then to map a way out, sometimes without knowing the answer before they start, you got to have the technical competence to know what to know and to know what's missing and to know that there's a couple different approaches. But you have to be able to communicate. You've got to be able to prioritize. You've got to be able to organize. You've got to be able to clarify that focus. So they both exist. And what I would say is if you're not sure which ones you need to work on, the answer is probably yes. But if you know that you're fairly strong in one, then you probably need to work on the other.

9:19Chris RomeoYeah. So, uh, Raf, I'm gonna throw this one back to you. Which one of those do you think is easier to acquire? Do you think it's easier to acquire technical skills or, or, or non-technical soft skills?

9:29Oh, great. Send that hate mail to me. Um, look, I, I think frankly, I think our brains are set up to learn technical skills. Uh, from what I personally experience, I can learn technical skills a lot easier Not that necessarily it's easy, but a lot easier than I can some of those communicate. Communication is a tough skill to master. You know, it's, you know, scripting and coding. There are books on that will give you examples and everything. But how do you go into an organization and not put your foot in your mouth, not throw anybody under the bus, not, you know, not ruin a relationship? Those are— and ask the right questions. Filter out the BS answers. Those are tough. So, I think, unfortunately, you know, I think that both of those can be hard or easy depending on the person you're talking to, because I'm confident there are people out there that for them, the easier part of it is the, you know, the communication, the organizational management, the, you know, personality kind of skills. where, and they can, you know, they can do the other stuff simply or backwards, right? So I think just purely from, again, my experience, for me, and I know plenty of others that would agree that it is, I think it's easier to take the tech skills on. They're more concrete. Maybe that's the reason. Maybe it's just more concrete than those communications and consulting. High-level skills.

11:06Chris RomeoYeah, I guess it's easier to— I mean, you can get a certification to learn some type of technical skill. You get a book and you can go through that book and learn all the different things that they want you to know. I haven't yet seen a soft skill certification yet where you take a class and then they test you to see, can you communicate and not act like a crazy person when you're at work?

11:25Yeah, those are master's degrees, dude.

11:28Well, I don't know.

11:29That's your MBA.

11:31that struggle with it. But here's what I would tell you, right? When you look at leadership and you look at communication, the rent's due every day. There may not be a certification that you can point to, but you can certainly point to results. You go look at most programs that are stalled, it's a result of friction. And we always look at friction, good and bad, but the excess of friction erodes value. It's corrosive. It increases the cost of human connection. And here's the thing, a lot of it stems from our communication and our inability to communicate. If we go look at the fact that You know, one of the number one challenges in organizations today, every time there's a survey, it says it's what?

12:05It's communication.

12:06What else? Accountability. Where a lot of conflicts start, someone doesn't feel that they're heard. Someone doesn't feel that their voice is properly exercised. We look at those things consistently. So the upside to this is, whereas the technical skills are things that can get you noticed because there's a technical competence to it, it's the— and I won't call them the soft skills. It's the skills of communication and prioritization and leadership and empathy and those elements that actually propel you. That's— so if you— so if we bring this back for a second to talking about what does it take in order to be a successful consultant, somebody who's in an organization but plays a consultative role, think about what that means. It means that you are that person who's able sometimes to help them clarify their own situation. That's something I've been running into the last couple weeks, and I got to be candid, I was a little surprised by it. But when we go help people get straight talk, you know, it's— the journey for me has been, well, actually sometimes the challenge is figuring out where to get straight talk.

12:59Right.

13:00Well, it turns out there's a sub-challenge, which is what's the problem we're actually trying to solve, which feels meta if you know the framework, but it's much more of a problem scoping. So if you want to be an effective consultant, you've got to be able to clear away the cruft, get down to the, to the essence of an issue, and then help people focus on it the right way at the right time. That's a ticket punching exercise that you got to go through every single day. The good news is if you blow it today, you got an opportunity tomorrow. It just might cost a little more.

13:28Chris RomeoYeah, a little more, cost you a little more in the relationships and things you may have burned along the way to get there, but—

13:34Exactly.

13:34Chris RomeoYou still get a chance to try again tomorrow and try and be better. So yeah, that's good stuff here. So one of the things that we normally do on the Application Security Podcast is we ask people their superhero origin story or their security origin story. We don't have time to hear all of your stories today, so I'm going to modify the question a little bit. And actually, I'm going to start with Robert just to bring him into the conversation here. But everybody that's on this session right now has been a consultant in various different ways. And I think one of the ways that we could really help our audience is to share something that's made you successful in your consulting career. It may be somebody that helped you. It may be some event, some project, or something that you did. But I think it'd be a really neat thing to do would be to just provide some real life in here. and tie back this idea and give back a little bit based on the experience of everybody that's on this recording right now. So, Robert, why don't we kick this off with you and let you kind of answer that question. What is one thing that's made you successful in your consulting career? It could be external, could be internal. Tell us the story that goes behind that.

14:43Sure. Well, I remember a number of years ago when I went into consulting first on my own and tried to do some things and learned some failures. Failure is not bad, but just, oh, I made a mistake there. I didn't know that. I didn't know I needed to do that. And then I went and joined a company for a while, a consulting company, and I learned a lot there. But one of the things I learned was a great lesson to me is to try to leave them, the client, the customer, better than when you left, or arrived rather. So I learned that sometimes it does help to go the extra mile, figure out what can I do, what can I help them with that maybe they weren't thinking about that I can then provide some value. So it's almost like working yourself out of a job maybe. I've heard that before, but certainly I like doing that and that's been very helpful, very successful for me. I get returns on clients that want me to come back and do some more work and things like that because I took that approach. So that was really helpful and I learned that from seeing this company that I worked with that did the same thing and I appreciated that lesson.

16:00Chris RomeoYeah, and I think that's a lesson that applies external or internal, both. People should always be trying to work themselves out of a job as crazy as that sounds because if you work yourself out of the job, you're ready for the next one. managing a bunch of other people that do the same thing. So, Raf, how do you— what's your take on this? What's made you successful in your career as a consultant?

16:21I will refer myself and you guys all back to some famous words from my father: sit down and shut up and listen. My dad used to say that a lot because I, as a youngster, I tended to misbehave in school, apparently. I know it's hard to imagine, but I— that's right, laugh at me, my pain. But no, I used to be very, you know, just talk, talk, talk, talk, talk. And not that that's gone away as I got older, but I think as a consultant, it's very important to listen, figure out— that's how we get to the problem we're trying to solve. Listen, let people talk, and then—

17:03Yeah.

17:04pick up on what they're saying that sometimes goes beyond their words. So, some, you know, how are you doing? Okay. Right. The manner in which they said it, you know, what their kind of their facial expressions. And if you can, if you're there, that's why it's always helpful to do things in person if possible. I still very much believe in the handshake. But I think listening is a skill that is unfortunately going away because we text each other, email each other, DM each other. And otherwise dehumanize our communications quite a bit. But by the way, emojis not helping. But I think just listening to people, listening and trying to get to the root of what what ails them, what they're really thinking, what they're feeling, because that is I think where the solution starts to come in, where we actually understand what's the problem. I can't tell you how many times I've I've. Failed to listen to my own advice and ended up solving a problem somebody didn't have. And that's the fastest way to work yourself out of a relationship.

18:07Chris RomeoYeah, and not in a good way. That's not the good way of working yourself out of a job.

18:10No, that's not the good way.

18:11You're right.

18:12Chris RomeoYeah. Okay, James, what about you? What would you share that's made you successful in your career?

18:17Well, I think the first thing to put out there is consulting's hard work, right? It's a lot of work. I mean, Anybody that's done it, they've put in the hours, that's for sure. You know, and everything Raf has said, you know, I agree with, you know, I mean, listening. I think one of the things that we often overlook, and when you're in a consultant role, this is important, is having a level of confidence. I mean, I've had the luxury of being able to be a consultant both on the development side and on the security side. And, you know, when I first started out as a consultant, I was a little bit more shy. I didn't really speak up.

18:51Chris RomeoYeah.

18:51And that actually hurt a lot more because when people are looking for consultants, especially if you're looking for an external consultant, right, you're looking for somebody to provide you feedback. And if you don't have that confidence level to be able to provide that feedback and the ability to say, I don't know, right, that's a key thing out there. You know, it's okay to say, hey, I don't have the answer to that. I mean, I can't tell you the times I'll tell clients right up front, yeah, I don't do that. That's not my specialty. I stick to this.

19:19Right.

19:20But having that confidence and building that up over time will help you as you're going through that. Because like I said, they're looking for somebody to provide feedback. If you're a consultant that they send stuff to you and you just kind of respond back and you don't really put the legwork in and you're not speaking your mind, you're just saying what you think they want you to, to say, what they want to hear, then you're not going to be very successful. And sometimes what you're going to say isn't exactly what they want to hear, but You have to get over that and be able to say that. And that shows that you're actually dedicated to helping them, not just collecting money, right, and doing a job. You're actually there to work with them and build it up and provide a good service.

20:02Chris RomeoMichael, what, uh, what's your take on this question? What's made you successful in your career?

20:09Well, I think you've all captured on things that, that I found to be essential elements of success. I think being able to listen before speaking, being comfortable not knowing the answer but knowing the process all makes sense. The piece I think I could potentially add to it is when I got started in consulting, the advice I got— this is going back 20 years now— was it's the art of taking the client's watch and showing them what time it is without insulting them.

20:41Right.

20:42And that's always been interesting to me, but yet we've all come across situations where because of our experience, because of our situation, something seems somewhat obvious to us, but it's not always obvious to them. And I've learned that if we, you know, we've talked about things like empathy and context and nuance, but it really to me just kind of boils down to it's not about us, it's about them. And if we make it about us, then we're the really smart people that just showed them what time it was and, gosh, they're so stupid. I think successful consultants do the exact opposite. They look at it and they say, oh, awesome. Look, you've got all the stuff right here. Cool. We got this. We're going to work it together. And you'll hear me talk a lot about elevating and accelerating other people. So I think that a lot of what we just talked about in my world culminates in that you don't have to know the answer, but you do need to know a process. I love the idea of working yourself out of a position. I've never found where that's been a bad thing. And learning to listen and to be quiet. I love asking questions. If anybody's been around me for longer than 30 seconds, they know that. But in the end, from a mindset perspective, it's not about you. And James was just talking about that need for validation. If you can be comfortable that you're going to bring value to somebody else, then you can really help them wherever they are. It's not about fixing broken people. It's about elevating awesome people.

22:05Yeah.

22:10Okay.

22:11Chris RomeoSo, that makes me— and what I heard across from all 4 of you kind of made me think about something else. And, you know, I certainly agree with listening, confidence, hard work, you know, working yourself out of a job, elevating and accelerating people. These are all good. These are all positive and good things. Now, I want to flip it around a little bit because consultants also have to be able to They also have a bad name in a lot of different places. And so I'm wondering if you guys have any experiences that our audience could learn from about what not to do as a consultant or something that you've seen that's happened that just made you cringe as somebody who's a professional and really cares about the things that we talked about so far. Anybody have something they can think of they want to throw in the hat there? Yeah.

23:02Yeah, if it doesn't feel right, don't do it. That's probably good advice for life, but I can't tell you how many times I've had to relearn a lesson that I had a bad feeling or an inkling that it wasn't a good deal, I wasn't the right fit, it wasn't whatever, and I talked myself into, no, no, Michael, you're overthinking it, and I did it anyway to regret it later. Not always catastrophic, but those are the projects that don't end well, or those are the projects where somebody gets hurt in the process or Feelings get ruffled, right? So all that friction I've talked about, some of this is firsthand. I can show you the scars. So that's, to me, one of the things is James already talked about, you know, know what you know and know what you don't know. So in that, if you're in a situation where it's, it's just be upfront and go, well, I might not be the right fit for this. We don't, as a consultant, you can't solve every problem and you can't help every person. And when you think you can, man, you, you run headlong into problems.

23:53Yeah, I was gonna, I was gonna say, Michael, uh, to your point, know your limitations. You know, I mean, from anything over the years, you know, not just on my experience but seeing other people, understand, you know, what your limitations are when you're going to go out and do consulting. Because if you get too far in over your head, right, I mean, there's always going to be some level of I'm riding this edge, but if you're too far over that edge, right, it's going to end up bad. Either you're not going to supply what you want to supply you know, you're going to supply the wrong information and it's just not going to work out well. It's going to break down the relationship. And that is one of the biggest killers, is people trying to overreach and say, I can do everything. And that's typically not the case. I can't do everything, but here's what I'm really good at. Let me focus on that. And, you know, feel free, you know, pass it over. You know, if somebody's asking you to do something that's not your forte, say, hey, I know somebody that does this. Let me give you their information and they can get that squared away. But that's what's going to get the relationship built up. But when you don't do that and you're like, oh, I'll just take it on and I'll do it, and then you get buried, you miss deadlines, even worse could happen. That's when things really start to break down.

25:05Yeah, or you just get totally distracted, which means your core business suffers, your other clients suffer. You know, I— you know, James, you're so right. If you, if you find somebody else who's good at that particular thing and you've got a good relationship with them, Hand it off. Everybody wins in that situation. That's consulting. That's not contracting. That's, that's being a professional, and that's awesome. So, you know, you brought up that consultants sometimes have a bad name. Yeah, but those aren't consultants. Those are just jackasses that are making money. That's— consulting is an honored tradition, but we've bastardized the concepts around it, and that's what we get as a result.

25:44Chris RomeoYeah, it just makes me think about True consulting is thinking about what's best for the client. And in some cases, that may mean that I'm going to give away what could have been a pretty lucrative contract for me, but yet I know I'm not the best fit and I know I have a friend or a partner or somebody that is a good fit for that. When I think of the customer's outcome first, then it'll all come back around. They'll come back. They'll bring something else to me in the future if somebody in my network does a great job for them.

26:15Exactly.

26:15I'll add something to that, guys, in, in terms of what not to do. I think there's a tendency in, in our, uh, mental, uh, capacities to— especially when you're working with a group, there's always, you know, the, the personalities that are supportive, neutral, and then negative. There's always somebody in the room Who is going to, no matter what you say, disagree with you or cross their arms and just try to prove you wrong, don't, don't, don't just ignore them. That problem doesn't solve itself. In fact, I would say, when you find that person, work hard to identify who they are because there's almost always one in every room. Identify who they are, work your butt off to win them over.

27:07Yeah.

27:08To prove value, to show that you have their interest in mind, that your solution or whatever you're offering is the right way. And if it's not, work with them to get their insight, to get back to make it better. Because I think, you know, not addressing that and hoping that that person will simply just lose interest and go away will sink even the best ideas. Because sometimes those people have no power in the organization.

27:35Right.

27:35And sometimes they seem like they have no power, but they can sink it.

27:38Chris RomeoYeah, that certainly is another piece of good advice there because, yeah, I've been in situations before where there's one person who wields a huge amount of power quietly, and if they're not happy with the way things are going, they'll squash it even though they may not have a title of VP or senior VP or something. They have positional power according to their reputation and what they do.

28:07I'll tell you what, just a quick anecdote to that, if I may. I was in a room one time where I was convinced that the person that didn't speak up, didn't seem to want to engage, somehow held some kind of ace card. But we, you know, but we just didn't seem that way. He was He was just sort of in the corner. He wasn't dressed like the rest. He didn't engage with the rest. He didn't seem to have that, like, that feel. But we made a real good effort on making sure that he was comfortable and that that person was on board. And I swear to you, as sure as the sun rises, we were finishing out that meeting and he basically looked at the leader of that group and said, all right, what do you guys think? Look, what do you think? You're the guy that's going to sign this check. And he goes, well, you know, From an organizational perspective, I love it, but I always want to get the pulse of my tech team and the person I rely on is that person. And he points at the person that none of us thought had any power except we did, the guy that we worked to make sure we won over. And the guy basically said, thumbs up. And he goes, okay, well then it's done. And I've had that happen more than once in my career. So, don't neglect people. It's just don't ever think somebody is inconsequential. It's a mistake every single time.

29:27Chris RomeoYeah. So I guess my final question for the panel here as we go around—

29:3442.

29:35Chris Romeo42 is definitely not the answer. Well, it is the answer to everything, but yeah, I'm gonna start filling in the question here if you keep throwing out answers. But no, so a lot of times we have new people that are trying to get into something And I always feel for those people because it seems like it's always difficult when you're jumping into something new and you don't really know kind of what you should do or how you can get into something here. So my question, my final question for the panel is, if you had somebody that was, what would you recommend to somebody who, let's say, just graduated from college and they're thinking, you know, I want to get into security consulting. I love security. What would you tell them to do as something in preparation? What should they be working on now if they want to get into security consulting in the future? So I don't know, somebody can just go ahead and call the ball.

30:26I'd go join a Big 4. I would go to a Big 4 that has a proven training program, or Raf's organization has a training program, and I would go understand the methodologies to it. That was my big misconception coming out of school myself. I thought that to be a consultant meant you had to be in your 40s or 50s. And a lot of life experience. By the way, I now would say that's the distinction between being a consultant and being an advisor. But let's set that aside for a second. If you're new, you're out of school, and you think, man, I like that, the upside to consulting, especially when you're doing it as your career ambition external to an organization, is you get to see a lot of problem spaces really fast. And you get a lot of pressure, and you get a lot of reward for that pressure. The downside is you don't really get a lot of ownership. So even if you said, well, you know, that sounds great, Michael, but one day I just want to be in the enterprise, but I want to take a consultative approach.

31:18Good.

31:19Then if you work with one of these large established organizations that has a training program, then, then go work for them because they're going to teach you the methodologies. They're going to teach you how to approach, how to ask the questions, how to structure it, how to frame it, how to measure those outcomes. That stuff that we just talked about, that's tough. Look, there's 1,000 people plus that can teach you tech, some better than others, and some that are gonna match your style better than others. But if, if you're listening to this and you're starting out, that's where I'd go and give it 2 to 3 years. And in 2 to 3 years, you'll have a really good bank of experience, and then you can take that anywhere.

31:55I would add to that that I highly recommend, because there's— with this, with the gap in the kind of skills that we need in this industry and the clear lack of lower-level talent in terms of pure person power. We have this crazy tendency to, you know, send high school kids into college, go get an InfoSec degree, okay, good, you're good to go. It's insane. It's, you know, it's the equivalent of giving an 18-year-old a rifle and calling him a soldier. It's literally the same thing after basic training, right? So, I think what we really— what I advise people to do that ask me that question is, unfortunately, I don't think this is a short, can I take a class and go learn and be in? You can learn the skills. That does not make you a good advisor or a good consultant. I think, and this is something my old business when I worked at GE for a while had a great handle on, is Go work in a business. Go figure out why people do things that some of us security folks look back at and say, well, that's dumb. Why would anybody do that? Because I promise you, you'll find yourself as a business consultant, whether it's a project manager or something, doing and saying or asking or making a request or asking for a resource or something that somebody that you're gonna then if you critically think about it, you're gonna go, why the heck would I do? Oh God, I have no other alternative. I didn't even about this. So, it's important, I think, to get the other side of the coin. Otherwise, you can be way too heavy on practicality in terms of technology or in terms of— what is it? You can be a purist. You can tend to be a purist in security, and that does not make you valuable to your business.

33:43Chris RomeoJames, do you have any thoughts for the new population?

33:50Yeah.

33:51I mean, somebody thinking about getting into it, I mean, I would definitely, you know, I mean, like Michael said, if you get into a company where you can start doing some of that stuff, that the downside is unless you can get into one of the bigs, uh, you know, it's a little bit harder, right? I mean, you get caught into a company where they don't have the structure in place, then you just sit there spinning your wheels. It's not going to be real helpful. So that can be difficult. But for me, if anybody was asking me getting into it, I'd tell them first, think about what it is you're interested in.

34:17in, right?

34:17Understand where you want to go. I mean, is there something specific about consulting you're looking for? Is there a certain thing? Do you like incident response? Do you like application security? Do you like pen testing? Do you, you know, what do you want to do? And get out and meet people, you know, go to local meetup groups, go find people that are in your area that are dealing with these companies, because that's how you're going to find positions if you are able to get in someplace. But go out and find out and talk to people, talk to other people that are doing consulting and find out what it, really is like. Because I know before I got into security consulting, you know, there was this kind of aura of, oh man, I'm gonna be a security consultant and I'm gonna be doing all this cool stuff. I'm gonna live in a lab and I'm gonna be doing this, I'm gonna do that, you know. And it really wasn't much like that at all, you know. So going out and finding out, like, what is it I'm talking about when I say I'm going to go out and become a security consultant? What am I going to be doing? What do I want to focus on? What's that involve? You know, I mean, very different oftentimes for somebody that may be just coming out of college versus somebody older. I mean, you know, my view on things have certainly changed since, you know, 10 years ago when, you know, sure, you know, I could be on the road, you know, all the time if I wanted. Now I've got kids, I prefer not to be, you know. And so understanding that type of stuff. But, you know, one of the biggest things you can do in this industry is get out and meet people.

35:39Yeah.

35:39You know, form relationships with people, understand what they're doing, listen, as we've said, listen to what they're saying. What are they doing? What problems do they have to solve? And then see how you can help them out. And, you know, just be like that, you know, be out helping people and things will start opening up for you. You know, you can learn the tech, you can learn some of the other skills, but going out and forming those relationships is gonna be a strong entry point into any position.

36:06Chris RomeoAll right, well, with that, I'm going to wrap up our session here today, and I thank you guys very much for sharing what is decades of consulting experience kind of boiled down into 30 minutes. So thank you very much for your time, and I'm sure our listeners are going to love this.

36:25Thanks.

36:25Thanks. Thanks for listening to the Application Security Podcast. Our intro music is 8-Bit Kung Fu by Boring and TJ. And the outro is Southern Delight by Stefan Kartenberg. You can find us on Twitter @AppSecPodcast or on the web at www.appsecpodcast.org.