SecurityMetrics Podcast | 8
Diversity and Mentorship in Cybersecurity
“We need each other. Cybersecurity is a global event and we need all the brains,” says Noreen Njoroge. “Threat actors don’t care where you are from or what your social status is. They are there to attack everybody. As cybersecurity specialists, we should also have that mindset. It’s a community effort. I have to help my brother, my sister, my coworker, my friend, know how to better defend themselves against attacks.”
Njoroge imbues that same philosophy into her cybersecurity mentoring projects. As a Security Threat Engineer at Cisco, President of North Carolina Women in Cybersecurity, and leader of the Mentors and Mentees Group for Women in Cybersecurity, she has a unique perspective on the humans who make up the cybersecurity industry.
Noreen Njoroge sits down with our Host and Principal Security Analyst, Jen Stone, to discuss:
- How making more “room at the table” for diverse thinking strengthens our defensive stance and improves cybersecurity around the globe.
- The qualities that make for a good cybersecurity analyst and how to get the most out of a mentor/mentee relationship.
- How the industry can recruit more security analysts with diverse skills, strengths, and backgrounds.
Resources:
Cybersecurity Mentorship Resources
Download our Guide to PCI Compliance! - https://www.securitymetrics.com/lp/pci/pci-guide
Download our Guide to HIPAA Compliance! - https://www.securitymetrics.com/lp/hipaa/hipaa-guide
[Disclaimer] Before implementing any policies or procedures you hear about on this or any other episodes, make sure to talk to your legal department, IT department, and any other department assisting with your data security and compliance efforts.
Diversity and Mentorship in Cybersecurity Transcript
Hello and welcome again to the Security Metrics podcast. I'm Jen Stone, principal security analyst for Security Metrics coming at you from the shed in my backyard. It's in the backyard where the critters are, so this makes me happy. And today, something that also makes me super happy is I have Noreen George with me here today. Noreen is a security threat intel engineer at Cisco Systems, and she's, she we'll let her tell you more about herself because I'm sure I'll get it wrong, but over a decade in, experience in cybersecurity.
She's also a cybersecurity mentor and president of North Carolina Women in Cybersecurity.
Noreen, welcome. Thank you so much for coming and talking to me today.
Thank you so much for having me here. I'm so excited just to have a chitchat with you.
Me too.
As we locked in. Right?
Yes. But Yes. We have the virtual outside. Right?
Correct.
Will you please tell us a little bit about yourself?
Sure. My name, As you had, my name is Noreen George. I work at Cisco System as a security threat intel engineer.
I've been in the industry for over ten plus years.
I started as computer engineering with school and then proceeded on to cybersecurity.
On top of that, I like mentoring others because it's good to pass on their knowledge to others and help others close the bridge on the other side of security.
And, also, I'm a president of the North Carolina women in cybersecurity where I help women, launch into the career, transition into the career, inspire, mentor, educate, and just have a community of women in the security arena because it's it was lacking for a while, but it's it's heading on the right track.
It is. It's going in the right direction.
Yes. Yes.
And I have two kids, so homeschooling and working at the same time from home is also a part of my my day to day duties, but I love it. It's part of my responsibility, and I enjoy it.
That is an excellent attitude. I get a little grumpy about it sometimes.
I try not to. Oh. But no. Well, that's and my my kids aren't even, school age anymore. My kids are in their twenties.
So I don't know what I have to complain about.
But, no. My kids are great. So tell tell me about, from a cybersecurity perspective, what got you interested in security?
Well, upon graduating, I went to University of Massachusetts Law where I did information technology. Then I landed my first job as a system admin at most corporations. And while I was working there, they used to have a group meeting where they would discuss what's trending in every department. And there was this one gentleman who used to talk about a malware.
There's this malware that's trending. We need to be cautious about it. And me with a curious mind, I always had to ask questions. What are you talking about?
Where is that person? Where can we find it? Where where where don't we know about it? Right?
And my curiosity come into cybersecurity.
I remember the the owner of the company actually provided me an opportunity to attend a program at Massachusetts Institute of Technology where they were offering the launching the cybersecurity program. And that's where I got to learn the more hands on in-depth about cybersecurity, and my interest grew from there.
Oh, excellent. That I love how you talk about the curiosity. One of the things that I noticed, a strong difference between people who who follow an IT path and who follow a security path is being interested in in figuring things out and not being afraid to push the buttons until until things work again.
Yeah.
I mean, there is that fear that you're going to break things beyond what you can fix, but that's all part of the learning learning curve.
So, from from the, the time that you went to, university and then you you got a career at to now, tell me about your work at at Cisco.
At Cisco, I'm a cybersecurity consultant, but heavily dealing with threat intelligence. So I have, Fortune five hundred companies and also small SMB business companies, to stay proactive against cyberattacks Because, you know, the threat landscape is constantly changing, so we always have to provide those recommendations how to better position the security devices on your network to be protected against the cyberattacks.
It's an interesting job because I get to interact with so many people, which I like to do. Sure. And, just to share my knowledge and expertise with others, it's a passion that I have. And just to have that candid conversation with a business, just talk tell me about your business.
What are your challenges? How can we help you? That's usually very, very I look I look forward to it every day. And, in a nutshell, that's what I do.
And and like you said, it's always changing. So what are some of the biggest changes that you've seen since from when you started there to now?
One of them is that and I hope it continues get to increase is cyber awareness. Right? Cyber attack awareness. Most people are not aware that cyber attacks were taking place.
Most people are not even aware that the information is trending in the dark web. Most people are not even aware that you need to change your password. Right? They didn't care or they were not conscious about it.
But because of these cyberattacks, now they are constantly on the news, in the media.
Even when you're talking with your coworker, your neighbor, you get to hear everybody's concerned about, oh, my account be hacked. I got a this got this transaction. The mechanism of the attack has constantly keeps changing, and that keeps us on our toes to be aware that these attacks are taking place. And, also, the the way they attack.
Right? For example, right now, with the COVID nineteen taking place, the attackers now have launched a phishing scam. Right? They send you an email, tell you click on this link to see a a global how it's how the attack is trending across the globe or, even now that the government is saying that it's issuing checks, now they've transitioned now to banking schemes attacks, right, where they send people a text message.
Don't wait two or three two or three days to receive your paycheck. Just click on this link. Provide me your information. You get your money right away.
Mhmm. Right there, you've given out your information. Right? So, like they say, we always have to be a hundred percent while the attackers only need one percent and fifteen.
Yeah.
And I you brought up a a really good one that we can all walk away with, which is if someone contacts you and asks for your information for something you want, you know, we all want these things. We want more information. We want money. Whatever it is that that is, causes that kind of urgent feeling in us. And then if there's a feeling of urgency along with, oh, by the way, just give me a little information.
That is a hundred percent the sign of a phishing attack. So don't don't give people your information.
No. And that's also I know it may come from a legit account. Right? Like, if you bank with banking x y z Mhmm.
They send you that information. I mean, I usually say trust but verify. Right? What would your bank be asking you for your information if they already have your information on file?
Yeah. Right? Exactly. Yeah.
Trust but verify.
That's a that's a really good point.
And so, the the awareness, that we all have to have just to be able to function in life right now. And so, one of the other things that you talked about was passwords.
Here's here's something that always kind of I don't know if it makes me laugh or if it just kind of frustrates me.
You get these big companies that have a breach, and then, of course, you get the email. We are so sorry, and we care about you very much. And you're like, okay. Whatever. And then they say, since your password was breached, change your password. But the problem is not changing your password on that platform. The problem is if your information is breached and they get your password on that platform, they're gonna walk away and try that password on another platform.
Right? So let's say that that Facebook gets breached and then they get your password. They're gonna turn around with your information and try that password on your banking or on in your credit card company. And so Right.
Whenever we get those things, I I always tell people, if you get told change your password where you've been breached, automatically think change my password everywhere else too.
Yes. And don't and don't use the same password across all platforms.
Yes. Exactly.
Change change it. Yeah. There are good tools out there to help you with the password keeping. Right?
So if you if forgetting is an issue, then use the tools to help you store your password securely.
For sure. I do. I use a I use a password manager all the time.
I don't know how you I yeah.
You have to. Mhmm. It's it's basic, what do you call it? Cyber hygiene. Right? Then when we wake up, brush your teeth, wash your face the same way, please.
Yeah. It's your password secured it safely. And remember, it's your data, not somebody else. Right?
And a lot of the people I work with say, well, why do I have to do this? It's just such a pain. I never had to do this before.
But like you were saying earlier, the threat landscape has changed. We all have to carry about this because there are more threats out there.
Right. Right. Yep.
So so tell me, I I saw you on a on a podcast that came from in two thousand nineteen during the, the the week that Defcon and Black Hat happened.
There was also a cyber security Women in Cyber Security gala and you were featured on there. I loved one of the comments. I wrote it down because I didn't wanna forget it. Cyber security is a global event and we need all the brains. And and I think you were talking about, cybersecurity in that one. Can you tell me a little bit more about or is it diversity in cybersecurity? So tell me about your interest in in developing diversity in cybersecurity.
Yeah. That's an interesting, question I get asked a lot of times, but this is my takeaway.
When when the security when the threat actor is out there to attack, they don't care whether you're from this continent, this country, this state, or this county. Right?
Mhmm.
They are there to attack everybody. They don't care you start a school. And for us as security cybersecurity specialist, we should also have that mindset. Right?
It's a community effort. I have to help my brother, my sister, my coworker, my friend how to better defend themselves against the attacks. And bringing that security awareness across the globe. Right?
Because when the attack occurs, it it doesn't affect just me. It affects everybody. When your bank gets hacked, it's it doesn't just have you as the only account person. Yeah.
Somebody who's in another country, another continent. So it's a global effort, and we have to diversify just as the attackers are also diversified. Right?
Right.
Some are very skilled in a specific arena of cybersecurity, so we have to be skilled in all domains. Again, we always have to be a hundred percent, and for them, just one percent and they get in. So I believe in a community effort, making sure that everybody is included at the seat at the table, and everybody's voice is heard because we all think in a different way. Right?
Right.
I I may come this way and say, oh, we can defend this way and you bring your idea. Well, since we migrate to the cloud, I think this is the way we should everybody's voice can be heard, and then let's take all these brilliant ideas and brainstorm and then come up with a good solution how to better defend, not only just our own businesses, our own account, just the whole community, our globe internal. Because when when your bank gets hacked or your account gets hacked or your company gets hacked, it is it is it does it affects a lot of people, and these people are family members who have families to feed.
Right? Mhmm. And not only don't they have family to feed, they have a payroll. They have people to pay.
So it affects each and every human element, and that is why I advocate for a global cybersecurity awareness all across, the continent.
That that is a great way to put it. Another thing that I've I've seen myself is we we hear that there are not enough cybersecurity professionals and how do we bring more cybersecurity professionals in. One of the ways to do that is to to bring in, some of the demographics that are not typically associated with or haven't in in certain, parts of our of our history been associated with cybersecurity.
So, if we talk about people who are not, you don't typically think of as cybersecurity analysts and then bring them in. So what kind of backgrounds do you think make good cybersecurity analysts?
Interesting. Right? Because cybersecurity what I've seen with time, you cannot have, a defined, status quo say, this is this is what you need to be in order to qualify for this. What I say I usually tell my people, even my mentees, I tell them, what is it that you really like to do?
What is your passion? Once I get to know what your passion is because your passion will drive you through the whole career. Because remember, cybersecurity domain keeps changing. Right?
Sure.
And if your passion doesn't drive you from the get go, forget about it. You get bored down to down down the lane. Right? So once you identify what you what what you really like to do I'll give myself as an example because I can only speak for Mia. I can speak for somebody else.
Sure.
I realized I like sharing knowledge. I like helping others. I like, to take, a specific dataset, analyze it, and provide information. So in my threat intelligence field, I make sure that I can be able to understand who's the attacker, where is the attacker coming from, where are they attacking, what do they target, right, and how can I protect?
Once I'm able to answer those five questions, I can be able to provide great threat intelligence to not only my customers, but also to the greater community. So when you're coming into this field, first identify your passion. What is it that you really like to do? I like to talk.
So that because I like to talk, threat intelligence worked perfect for me because I can share my knowledge and share this Yeah. This this information with people. Right? Mhmm.
And so if you like to break and fix, maybe pen ethical hacking is for you. Right? Remember in cybersecurity, the three domains. Right?
There's the the defense. Right? And then there's the offense, and then there's the incident respond. Three of them.
So figure out which one you like to do. Do you like to be more proactive? It's like when you go to a a banking and they're trying to do your financial portfolio, they ask you, are you a high risk or are you a low risk taker? Right?
And depending where you feel, that's where they position your portfolio. Same applies to cybersecurity.
Do you like to being on the defensive side? Do you like being on the offensive side? Or do you like being the incident response person? So once you identify where you like to be, then start working towards that.
Then you'll be able to identify what arena of cybersecurity you like to be.
That broke it down really clearly. I worked with, a great cybersecurity, team of students up in, up in Idaho, earlier, I guess, end of last year, who were all interested in cybersecurity. They were studying it, but they weren't sure what direction to go with it. And that's exactly the same same kind of, questions that I asked them was, how do you how do you interact with the world?
And so so looking at the diversity of humans out there, how we interact with each other, that helps to kind of, take people from, what their interests are and puts them into a really valuable place in the cybersecurity, landscape as a career. So so that that's a really good transition into to my next question, which is you are a mentor. You've you've you're developing this program on on mentoring other others in the cybersecurity field. Tell me a little bit more about how you got involved with that and and what it's all about.
I began launching into mentorship when I myself experienced the challenge of finding a mentor. When I launched into cybersecurity, I had the education, the experience, but once you deep dive in into, like, a big corporate organization, you you need to understand how they operate and how to navigate in the journey of cybersecurity. And I realized there are so many domains just like we addressed the previous question. How do you know what skill set required for specific domain? Right?
Right.
So I wanted to know, those who have made it ahead of me, how did you get there? How can I be better? How can I help you so that I can help industry get better?
Right.
And I realized I needed somebody to hand hold my hand and walk me through, not not, not take too much of their time, but at least give me that guidance and cancel. Sure. I was so lucky at my company here at Cisco Systems. We have so many great engineers.
So I was able to tap a few shoulders of some and who are very, very helpful, in mentoring me.
The the grew down my journey, I got to realize that there are many other people who don't know how to navigate this cybersecurity career. Right.
And they might take advantage of mentoring because I I saw the success that it helped me to become successful in this industry.
So I said, I would like to pass on to others. Maybe somebody out there may be, you know, curious too. So I launched on, the cybersecurity mentoring, group here on LinkedIn because I wanted to hear again from the globe. I wanted to hear from everybody because cybersecurity is a global event, not just, you know, over here in the US.
Sure. So I I started with one. I think we already know about four thousand people, but they are you know, everybody brainstorm, sharing, mentoring. I mean, providing resources, answering questions.
And recently, I realized also, now that we are locked in, due to this COVID nineteen, a lot of us are in the home. Maybe I can take two or three hours from people's time and just network with them and hear what they have to say. So I launched, cyber chat mentoring ment mentoring mentee session every Saturday. Mhmm.
I started from eleven fifteen AM to around one thirty PM Eastern Standard Time Okay. Where everybody across the globe can join the session. I mean, it it started with two people now. We launched we're going from forty to sixty people, eighty people from different countries, just people coming in asking, well, how can I find a mentor?
Who where I'm I I would like to have a mentee. Right?
Sure.
And others just there to share their knowledge. And I have many Cisco engineers backing me up, coming to help me because that chat goes busy when when I'm hosting the session. Right? Yeah.
But I realized mentorship is very good because it's a two way communication. Right? It's not a monologue. It's a dialogue.
I end up learning more from my mentees than I even anticipated. I I thought I was gonna be the teacher. I ended up being the student. Right?
And and I I shared the qualities of a good mentor. A good mentor supposed to be want to be caring. Right? Because you have to care for your mentee.
Mhmm. Right? You have to be willing to share because they're coming to you for knowledge, for guidance. So be willing to share your resources, your network, your expertise with them.
Mhmm.
Also, be a good listener because you can't help somebody by just you throwing your your your words, your experiences at them if you haven't heard what they have to say. You have to be very careful listener so that you'll be able to guide them along the journey of the cybersecurity.
And also be able to provide constructive feedback. Right? And I I I and provide also a guidance, a goal setting for your mentee. Because once you start that mentoring relationship, you have to have goals.
Are you mentoring for two weeks? Is it a three weeks? Is it a six weeks? Is it a one year?
You have to set those goals so your mentee can also know how far this career is taking place.
Also, in addition, I encourage, switch your mentors. Don't just stick with one. If you come to me, I will brainstorm you and make sure that you're very good in threat intel, ethic for hacking, what have you. Go to somebody else.
Learn about GDPR, right, about data governance, governance, risk, and compliance. Go to somebody else, learn about data privacy. Go to somebody else, go learn about maybe incident response. Right?
There's so many domains. Twitch it up. Right? Because that's the way we have several doctors.
We have one that fixes the eye.
Teeth. He's not the one who does your back. Right? Right. Pick it up and learn various domains, and then that way you can be able to know this is the one I really like.
And that's where a mentor comes into place, especially when you're confused where do I start? Mhmm. Which career, which field should I take? Tap on to very many mentors, learn from them, and then the one that really resonates with you, run with that because you require a lot of self motivation and passion within.
Yes. Yeah. And so when are are you saying that a lot of the mentees that are coming that you're that you're seeing are are kind of, earlier in their careers?
It's a mixture, actually. Honestly, it's a mixture. I've seen I've seen I trained sometimes when it's early in their careers. Others, it's they're transitioning from one, career to another. Mhmm.
And others already been seasoned there, so they are willing just to join and share knowledge Great.
And find mentees too. Yeah. It's it's it has become a community effort. Last Saturday, I told I don't know what I'm gonna continue because this episode six, I was thinking maybe doing seven episodes. They're like, oh, no. Please keep it going because it's really impactful.
If you're not careful, it's going to be a full time job.
Not really.
I I make sure we're right. I do I do, and I'm I'm starting to launch up a blog so I can be posting everything over there. And I usually tell them, a good mentor also takes others and exposes them to other good mentors too. Right?
So it doesn't become just my job. You don't have to be mentored by me, Noreen. Look at this. We have so many mentors here.
Tap on anyone else here. They're willing to help.
So how do you get, good mentors to show up?
You'll be honest. You'll be surprised that people are willing to share and help others. What I've realized is that anybody who went through a tough transition when they are launching to this career, they are willing to share with others so that others do not go through that, transition. And you you will know a good mentor by, you know, the way they articulate the information. They they reach out to ask, can I have a mentee?
The the you can also find if if also look at their profile. Right? If you go to a social media LinkedIn, see who are the people they are connected to. What are the information are they posting out there?
Look at their work history too. And also reach out to a few two one or two people who they're connected with who can speak on them, right, speak on their behalf. And, also, on LinkedIn, it also gives, there's a portion where they have recommendation or, accolades. Your peers, they give a recommendation for you. Read what others are saying about them. And that way, you'll be able to decide, is this a good mentor for me or not a good mentor?
Sure. I was looking at my LinkedIn profile just the other day.
I tend to neglect it. And and I got down to the recommendation section, and I realized I haven't asked for any recommendations for years. It's been a long time since since I've I've reached out and asked. And part of me feels kind of uncomfortable about that.
Like, hey. Tell me how great I am so I can post it on LinkedIn. Right? So that's kind of how I feel about that.
So I haven't. But what you're saying is that it could actually be very useful to other people if you take that step and and ask.
Post about me so that other people who might be interested in what I have to say can find me and and make an evaluation?
Oh, yes. Remember now that everything has changed. A lot of things have gone digital, and it's gonna be all virtual. Right?
Gone are the days where I had to rely just on your resume. Most recruiters, even some of them even joined the mentoring chat. They talk about their hiring tactics. They say they go to somebody's LinkedIn, and they look at their profile and and all what have you have over there.
So I usually say, remember your your own self brand. Right? Mhmm. It's like when you walk to a grocery store, your your mind is, I'm going to buy cereal.
Right.
When you walk along that aisle, you already know I usually eat cereal x. But when you go that aisle, you find there are so many other cereals that have been displayed over there. But a cereal y stands out because maybe they did a better packaging, a better branding. Right?
And it catches you as a consumer. You purchase that cereal and you leave all the other boxes and you walk with that one box. Same applies to you. You are your own self brand.
Package yourself nicely, provide the valuable information that you have to do on your packaging so that when you stand against others, you stand you stand out. Right? Because remember, you're going for this job, and maybe ten other thousands are applying for that job. What qualifies you to be the one that gets it and the other people don't get it?
Sure.
That is excellent advice. So, when we started talking about diversity in cybersecurity and the mentorship program, my my impression at first was that you're you're really bringing women into the field, but it doesn't sound like that. It sounds like you're getting, people from all over the world, with all types of backgrounds, different genders. What what, what are you seeing in your mentorship program? Who's who's drawn to that?
It's it's a mixture, honestly. And when I started mentoring women at first, because I saw there was a there there was a lack or maybe the statistics were showing we were very minimal. Right? Mhmm.
I've seen that now starting going to the increase. Right? But remember, like I said, cyberattacks don't know they don't know boundaries. Right?
They don't know where they're gonna come to. East Coast or West Coast, whatever. Mhmm. Same applies to security.
You cannot just be vent, gender focused. Right? You cannot just say it's just a women thing or a men thing. Right?
We need each other. And many men, honestly, have been in this industry for long. They have tons of knowledge, tons of resources. My mentors are most of them are men because they've been in this industry for a very, very long time.
Yeah. And I've learned a lot from them. Some are authors, bloggers, podcast people. I mean, hands hands hands down to them.
And and I said I I tell my fellow women, don't shy to reach out to them. Right?
Right.
Because there are so many allies out there who are willing to help Right. And don't have that stereotype of it's a female thing or a man thing.
Nice.
In cybersecurity, it doesn't care what gender you are. If I'm talking about, an an attack that happened, it when the attack occurred, did not single went out and such just, well, the females in this database, those I'm gonna attack and leave the men. Right? Right.
Right? So we we have to come together. We have to unite together. Right? Nice. And, of course, like you like you said, I'm the president of women in cybersecurity here in North Carolina.
Yes. Remember, I cannot be all over. Right? Mhmm. So I have to focus to a specific group that I'm really be able gonna be rally behind and help them.
And that's why I decided to launch this one here in North Carolina to help the women here, embrace the journey, join the journey, learn and share a network with each other. Do we have men in our group? Of course. We do.
We have so many allies who come. They share we host meetings every monthly, which now they are virtual. We have men who come and present. Right?
We have men who sponsor the events too. So it's a community effort. Don't so I would recommend others. Don't be single lined or gender focused.
Right.
Come one, come all. We are all needed in this career.
Love it. I love it. So for me, I get drawn into questions about gender in cybersecurity a lot because I'm female. And, also, I am older than a lot of the demographic that's drawn to cybersecurity.
And so so people ask me these questions. And for me, I just wanna talk about cybersecurity.
I just wanna talk about the technology and the Yes.
The the the human beings that are impacting us from the threat perspective. However, a lot of people don't understand that, even last year, and this is the middle of summer, I was out in California. I was at a customer site and one of the IT guys straight up told me women should not be in cybersecurity. And I said, what do you mean?
He said, well, women should be home. They shouldn't be working at all. And so so so when when people ask me, well, why do we have to talk about, gender diversity and and, where do we have to talk about any diversity? Well, we don't we don't have to, except that it keeps impacting my ability to do my job.
If I can't get somebody to give me good information just because they're hung up on gender, come on.
Right. Right. This is crazy.
So so I Yeah. I I love I love talking about cybersecurity, but, gender issues.
I encounter them all the time.
All the time?
It's not it is not usually that that drastic. But Once in a once in a while somebody will throw a cup ball on you.
Right?
I honestly didn't know what to say to say. I I sat there and stared at him for a while because I I I and finally, I was like, okay.
When when I get such questions, I speak out. I speak out because I realize I have to be the voice for the voiceless. Right?
There's people who can articulate for themselves.
So just speak out and and remember people have different mindset. Maybe some when I get asked such questions or thrown such a couple, I I usually turn the question around to the person asking me those questions. I ask them, explain to me. Why why do you see it that way?
Explain to me your facility so I can understand where they are coming from. And that way, I'll be able to answer back, their question. Because maybe they don't know. Maybe, you know, they grew up.
They thought that way. Right? It's a mindset issue. But if I understand where they are coming from, maybe I can be able to change their perception about it.
Well, that's a that's a really good technique. In in my not so distant past, I would have just attacked. And and I I realized that claws out is not the way to solve a problem. So now I'm just like, okay.
And I and I try to just, you know, let go whatever. But asking the question, turning it around, making a positive dialogue, that's something that I've learned from you today, and I'll I'll try to take with me. So Thank you. How can other people get involved in in mentorship programs?
Is there room in your mentorship program? Should they be looking locally? What do you think?
I have room. My my mine mine will never fill. I'm always welcoming everybody. Come, come, one, come, or join us.
We have the mentoring group there on LinkedIn. They can find it, under my name. Okay. Also, I I usually post when I'm hosting the next session for cybersecurity cyber chat on my LinkedIn profile.
Mhmm. So feel free to come join us, to learn, to share, and to network with others. Because other than even just talking about cybersecurity, in these cyber charts, we also talk about what challenges are you experiencing as an individual. Right?
Recently, we identified the imposter syndrome is is something that's unheard of. People don't speak about it. And a few people have mentioned about it, and and now we're gonna be having a webinar, I think, this coming Friday just to address that.
Oh, that's excellent. And and a lot of people don't know what that is. Can you Yes. Can you define, imposter syndrome?
Yeah. From what I've come from my research and what I've had even from others is is trying to change you, who you are, to fit into what somebody else wants you to be. Right? Oh. I've we've had some situations where people say that I applied for this job, but x y z told me I had to customize my resume this way in order to really fit into that role they're applying. But that's really not me who I am.
If I change my resume that way, I'm not gonna be telling the truth of who I really am. Right? So there's this impulse that they're trying to place in front of you that you have to look x y z in order to fit into it. Mhmm.
We need to address that. And also that part of where people they are very we had people on the call where they have so many certificates in cybersecurity, so many of them, and they don't even have a job. Why? Because the industry created this imposter feeling, you have to have x y z certificate in order to launch into cybersecurity to get into it.
So addressing such and people some majority people, even I myself, did not even know I had imposter syndrome until, you know, when somebody explained to it. So it's something that we are unaware about it, but the more we talk about it, it gives an awakening and a mindset awareness. And people are becoming to be self aware and say, I'm gonna stand for myself. I'm gonna advocate for myself.
I'm gonna present the best of myself out there. And when I get that job, when I launch into cybersecurity, I'll do my best.
Nice. Another way that I've seen it, manifest is, so as a as a the kind of security analyst that I am is I go out to companies, and most of the time, I'll I'll take a either a standard or or a law like, PCI, HIPAA, the CIS, controls. And then compare what they have going on in their environment against whatever standard it is that they want to compare against, either for compliance or or just to to, get a good security risk assessment, those types of things. Right? Right. And so, a lot of the times, they'll ask me questions about, does this tool implemented in this way meet x y z in a compliance or, you know, standard situation?
And I I don't know all of the tools out there. Right? I don't know all of the right configurations.
And so when someone asks me that question in the moment, I have learned to say, I don't know, but I'll find out.
So most of my job is I research it.
Yeah. I talk to people during the day and I get to research some of the most, like, detailed things, at night. And sometimes I still don't know. But that doesn't mean that I don't know security.
Right? And this is something that I I asked. I'm the only woman on a team of, twenty five something auditors that that go out. And I ask questions like these in our in our, team meetings and it it shakes people up because I'll say, who here has, imposter syndrome?
And everybody goes, are we talking about imposter syndrome?
I know, right?
But but how can you not feel these things if if this is your daily experience, right, to to being asked things about it. And sometimes I'll be asked about tools I've never even heard the names of, and then I find out later it's because somebody else bought it and they've changed the name and I did know what I was and so a lot of, you know, knowing that I know how to find out Mhmm. Is is what it's about in security. But at the same time, if you feel like you have to know things in the moment without going and researching and and diving deep into it, then that can give you that sense of of imposter syndrome that a lot of people experience.
And and a lot of people are very uncomfortable with that, and so they don't want to be in security for those reasons. But if you just know how to find out, you can get past it. Yes. It's okay.
Right. Yep. And I I I second that too because I talked to people when I told them when they were talking about how they applied for jobs and they didn't get them, and now they feel they are not qualified for cybersecurity career. Right? Yeah. And my take is, let's analyze one by one. So did you get back to them to ask them why they didn't give that job?
Did you ask them for feedback so you can better improve on your next, you know Sure.
And and I usually tell them, when you're applying for that job, before you leave that interview, just ask them what what what part of my interview qualifies or disqualifies me not getting that job?
Right.
So don't wait for that phone call.
Just get your answer right there so that we can remove this imposter syndrome In the moment.
From you.
Yes. In the moment.
A university degree can be helpful. It's not necessary.
Exactly. Certifications can be helpful. They're not necessary. One of the one of the colleagues that I have who who he's my go to guy when I have Linux questions. Doesn't have a university degree. And and it has gotten to him a few times and sometimes I I kinda yell at him and say, who do I go to when I need information?
He's like, okay.
So stop getting down on yourself if you don't have these things. But at the same time, if you really feel like you need a specific certification, hey. No one's stopping you. Go get it.
Go. Yeah. And certification is a topic that a lot of people keep asking about it. And my take to them usually say, first figure especially the ones who are entering the industry. I always tell them, maybe go take the courses that have a certificate of completion, where you don't have to pay the money upfront to pay for your cert because the certificates are very expensive. Right? Mhmm.
So go study one where you have a certificate of completion, which are free Mhmm. Or maybe very cheap, maybe like Udemy offering maybe nine ninety nine, nineteen ninety nine as opposed to five hundred or whatever Yes. Thousand dollars. And then that way, that gives you an idea of, do you really wanna pursue that certificate or not. Right?
Right.
And, also, the as we said, cybersecurity industry keeps changing. The certification you had three, four years ago, they obsolete. Then you need to renew. Right?
Sure. Mhmm.
So don't don't embrace yourself with so many certifications when you're starting this journey. And then once you get in, you get some and you get bored, you don't wanna do that career, you wanna transition something else, that's money down the drain. Mhmm. And you can get so easily frustrated.
Sure. It's it's, the certifications I think and the the university degrees are helpful to HR because it's like a it's like it's like their shortcut to go, I need to hire somebody for this position. I'm gonna throw out I need Yeah. This specific letters after your name, and then they then they pull you in. But and so in some ways, getting a new job, it can be it can be useful. But not everyone not everyone takes that approach to hiring. And so, I think that, again, the mentoring program and the networking that people do can give people an an avenue in when they don't have those certifications, but do have the knowledge.
Yes. And, also, I also advise them, if you don't have the education, you don't have the certificate, what are you doing right now to help yourself?
Write a blog. Right?
Read an article and reply to it, and use that as your as your tool when you're interviewing and talking to that hiring person, say. I may not have the the the degree you're asking or certification. But here are couple blogs I wrote, and this is what people responded to. Right? Showing that you're doing something right now as we speak, And that that speaks volume as opposed to just sitting and just saying, oh, sorry, me. I don't have any education or certification. Right?
You wanna be a pen tester? Go get some CVEs.
Right? Right?
Well, Noreen, this has been so great talking to you. Thank you again for coming and talking to us. I'll make sure that we put links up to, the mentoring program and the things that you have going on in our show notes.
Is there anything that I missed that you wanted to mention before we, say goodbye?
No problem. Thank you for having me and I appreciate this, what you guys are doing to showcase cybersecurity talent in the industry.
Keep up and I look forward to keeping in touch with you.
Thank you. I look forward to it too. Thanks, Noreen. Thanks again for joining us. It was terrific having Noreen George on with us today. And, make sure you check out the show notes for mentoring information and talk to you next time.
Thanks for watching. To watch more episodes of Security Metrics podcast, click on the box on the right. If you prefer to listen to this podcast, it's available on all your favorite podcast platforms. See you on the slopes.
.svg)