In part 2 of this special 2-part episode, top cyber defense practitioner O'Shea Bowens joins our host Jason to continue their discussion about strategically building a career in infosec. They discuss key factors in determining the value of training and choosing the right training course for your desired career path, along with how to leverage certifications with your employer. They also discuss the necessary skills for moving into senior roles at work, and how effective communication plays a critical role in every situation.
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Jason Nickola (00:01):
This is“Trust Me, I'm Certified” brought to you by
GIAC Certifications, a podcastexploring how to conquer
imposter syndrome.
Welcome back to“Trust Me, I'mCertified.” I'm your host, Jason
Nickola, and I'm really excitedto bring you part two of our
interview with O'Shea Bowens.
In part one, we dug into a lotof O'Shea's background in how he
became interested incybersecurity.
(00:23):
So please do hop back and checkout part one if you haven't
given it a listen yet.
In this episode, we will diveright into education and
training and the role they playin preparing you for a career in
the real world.
So please enjoy the rest of ourinterview with the man himself,
O'Shea Bowens.
(00:46):
Okay, so you started to want topick up these bits and pieces
from across the differentaspects of security so that you
can really fill out your skills.
And it sounds like contact withpeople who were experts in that
area, or at least willing tohelp in that area and had some
skills, played a larger part ofit, a very large part of it.
What role would you say thattraining or certifications play
(01:06):
in that, and then just generallyfor someone looking to build out
their skills, how do trainingand certifications fit in?
O'Shea Bowens (01:29):
So I placed it in two buckets, right?
So bucket one on the trainingside, not all trainings are made
equal, so there's some that- Ifell for this before.
I remember when I was maybe 22going on 23, I went to this CEH
class because at the timeeveryone was telling me that's
what I needed.
And I was like, I don't think Ineed it, but whatever fine.
(01:52):
It's 2008, 2009, something likethat.
I was like, fine.
I'll do it.
But I paid my own money to go tothis class.
It was- I mean, I could've justtaken the test instead of paying
the money and showing up forfour weeks straight because the
professor was basically readingfrom the book, or the instructor
was basically reading from thebook.
And some of that stuff, I knew-not to say I knew everything, I
didn't- but at the same time Iwas like, okay, I'll never do
(02:12):
that again because I didn't gointo it really researching what
I should expect at the end.
I was going into it expecting totake the cert at the end.
If I would've known what I knewthen, I would have just paid for
the cert.
So really understand what valueyou can truly obtain from the
certification.
So when I say the second bucket,it's really how can you leverage
the certification?
(02:33):
Because I've managed teams andpeople that we've sent off for
different trainings or we payfor them.
We would let them take vacationfor personal development or
whatnot.
And they come back and you'relike, okay, how can we apply
this?
You know, a good example, Iremember I worked with one dude
and we sent them off, I think atthe time, we'll just say another
certification body apparentlyfocused on DFIR.
(02:54):
Okay.
And he came back, totally passedthe test.
And we had a small, smallincident.
And I was like, okay, well we’llsay his name is Richard.
I was like, all right, Richardjust got this cert, he seems
like he wants to step up andlead.
(03:15):
Let's give him a shot.
And nothing from thiscertification really helped
besides the report writing, thereport writing was on par.
But from the technicalperspective, it was almost as if
he didn't go.
And I was like, well, what didyou do when you were there?
And he goes, you know, went toclass for a week and a half or
so, and then, you know, did someexercises.
And then he took the cert, buthe couldn't apply it to work.
(03:35):
That was where the gap was.
So when I say that second bucketright around, is it applicable
in your development for work?
Can you actually use it?
And if you can answer yes toboth of those then yes, you
should totally go for it.
Like go get a certification,especially if your company is
(03:56):
going to pay for it.
Jump on that ASAP.
Jason Nickola (03:57):
So have you had other experiences where you have
been able to find training thathas been applicable or would you
really recommend trying to buildup your skills ahead of time
before you go to some kind of atraining to fill things in?
O'Shea Bowens (03:57):
No, for me SEC504 was like super helpful.
I mean, I know it’s a SANS/GIACcourse- that's not like a plug
that was intentional, but that'sjust-
Jason Nickola (03:57):
I didn't tell O’Shea to say that, he said it
on his own.
O'Shea Bowens (03:57):
But I remember actually it was when I was
looking to move more into an IRrole, I took 504 and there was
this dude I was working withthat was super great from a
digital forensics perspective,but I'd worked with him for a
year or so.
(04:44):
So I picked up bits and piecesfrom him.
And then I took 504 and then Ifelt a lot more comfortable
applying for that next tier typeof role.
That was when I started, I beganto apply for a senior level
role.
So I wasn't necessarily onlyfocused on Layer 3 security or
from an intrusion analysisperspective, just networking.
But what I began to focus uponwas, well, how do I build out
(05:05):
more like a SIEM or IDS from anarchitectural perspective to a
tune into a management?
And then how can I begin asprinkling in a bit of malware
analysis?
Luckily, this was a while back,but 504 touched on all of those
areas.
And this goes back to sayingjust that first bit of exposure,
and then you start hammeringdown on your own.
(05:27):
But for me taking 504, passingthat, then really going back and
forth to the books- I still usedthose 504 books for dang near
three years, honestly.
I still don't throw away mybooks, but I kept going back and
just rereading some things.
Or I’d look at a particularsegment, especially I remember
for volatility when I was firstintroduced to that.
I dove deep into the books andthen I began to, again, throw it
(05:49):
into my lab.
Throw some samples at it, starttaking snapshots and then start
analyzing this, right.
And starting to analyze thememory.
And that was extremely helpfulfor me to move into a senior
level role.
I remember vividly how helpfulit was because there's different
areas I could speak to and thenI can have the cert to back it
up.
Jason Nickola (06:16):
Right.
Yeah.
So not only the practical skillof being able to actually do
those things, but you shouldn'tget a certification just to have
something down on paper, butwhen you are trying to move into
a new role and you're trying todemonstrate, hey, I'm willing to
put some of the time in and theeffort and attention that's
required to do some of thesethings that you need me to do
for this kind of role.
Well, here's proof that I'vebeen able to do that.
(06:37):
So for me, I’m a knowledgehound.
I'm just going to keep trying tolearn as much as I can.
But also the validation at theend of it, like, yeah, I
actually did get something outof that, and I can prove it to
other people has been reallyvaluable in pushing myself to go
to the next step.
So when you talked about movingbeyond kind of an individual
contributor and a tacticalcomponent to being more
(06:57):
strategic and management andthat kind of thing.
Did those kinds of things play alarge role in feeling like you
were ready to push yourself intothat next step?
Or were there other things thatmaybe held you back that you had
to overcome?
And what was that process likefor you?
O'Shea Bowens (07:20):
Yeah.
So one of the something thathappened to me, at least in two
different roles whereessentially, you know, this
isn't to harp on anyone, but itwas really one of those
situations where the individualthat served as the manager
wasn't as helpful as you wouldthink they would be in a
leadership position from atechnical chops perspective.
So you would ask questions andthe response would be yeah, I'm
not sure, I used to betechnical.
(07:41):
Oh, I don't really keep up withit anymore.
It was like, dude, why am Ilistening to you then?
I just remember when thathappened to me, at least twice,
and that kind of drove me to bein this– it put this seed in my
head, like I don't ever want tobe in a leadership position and
someone asks me something and Isay, oh, I'm not technical
anymore.
Oh, I don't really keep up withit.
(08:01):
That was one of the things thatstill kind of drives me to this
day, even from like a mentoringor from a team lead perspective
or running my own shop.
I don't want to be- if I don'tknow, I don't know, but I don't
want it present it as oh, Idon't know, I'm just here for
the check, you know, I dunno,you guys figure it out.
Jason Nickola (08:25):
Right.
So in moving from someone who isan individual contributor to
wanting to have more effect onpeople and strategy and
processes and those kinds ofthings, were there- there are
definitely technical challenges,right, because what you're
describing is your urge to wantto master the details so that
(08:45):
you're never in that kind of aposition, but were there other
challenges for you?
Like as I think of it, maybethings like remaining a member
of the team and yourinterpersonal relationships and
some of the other byproducts ofbeing driven and trying to get
ahead in those kinds of things.
How did that process go for youas you started to transition
outside of just being a tacticalkind of resource?
O'Shea Bowens (09:12):
I think, and I know, one of the big areas for
me was really diving deeper intohow I communicate.
Like I have no problem speakingwith people.
I'm a fairly sociable person.
But hat kind of takes a backseat sometimes at work, because
I'm there to solve a problemwhile I'm there to actually
work.
So at times I can be a bit, Iguess, short with people at
(09:34):
work, earlier.
I'm very aware of it now, butyou know, five or six years ago,
it really wasn't the case.
So it came off as, you know,maybe O’Shea is rude.
O’Shea doesn't have muchpatience, which even with the
patience I'm still working onthat daily.
My wife will tell you that, butI had to really take inventory
of how I communicate and what inmy presence, how did my presence
(09:55):
affect the team from overallperformance perspective, but
also from inclusivity, right?
Like if you are the person thateveryone feels is rude, or maybe
you're short with an individual,no matter how talented or smart
(10:15):
you are, people aren't going towant to work with you.
That’s just the truth of it,right.
And so then I realized, Iparticularly had a case at one
point.
I remember there was an event wewere investigating and if I
recall correctly I was analyzingsome PowerShell.
And just trying to walk throughwhat the calls were actually
touching, looking at a couple ofthe IPs, they're a part of this
(10:36):
campaign.
And I was very drilled into it.
And I guess a couple of peoplewere asking me questions and I
was like, dude, just DM me.
So I was like, stop talking tome while I'm trying to work.
And I remember afterwards, Iwent out for drinks with some of
the team members.
This was like a week later orsomething after everything was-
(10:57):
we had to report, we went to thefull-on stages of IR, I had the
report done that was presentedto senior management, incident
was cleaned up.
We had our patches and countermeasures in place.
But a buddy of mine, while we'rehaving drinks, that was on the
team was like, they kind ofthink you're rude, bro.
I was like, what are you talkingabout?
They're like, it just seems likeyou don't want to talk to people
(11:18):
at times.
I was like, well, okay, I canunderstand where you're coming
from, cause I know I get into azone.
Once I'm in that zone, I don'twant to be interrupted.
But yeah, I remember it made methink I need to be a bit more
aware how I communicate withpeople.
So now I always take the time.
Even normally when I'm sociable,I look everyone in the eye, but
now I take the time to look upfrom the keyboard.
(11:39):
I'm conscious and aware that ifsomeone's speaking to me, stop
typing.
Look up at them.
Don't just keep typing away andanswer questions.
Cause it seems like you're veryunconcerned or you can't be
bothered.
But when you take that time tolook up, acknowledge someone and
then continue along the lines ofcommunication, you're much
better received.
But particularly as a leader, atleast for me, I want to leave
(12:02):
the impression that, okay, Ihear you, your opinion is
definitely valued, how can Ihelp you?
You want to have like thatfeeling.
It'd be like walking into arestaurant and your server is
texting while taking your order.
You're not paying attention.
Jason Nickola (12:24):
Yeah.
And especially with your team,it's so important for your team
to feel like they can come toyou with things.
And the more you, even if it'snot intentional, the more you
make them feel like you're notpaying attention or that you
have better things to do, itseverely diminishes the
likelihood that they're going tocome to you and keep you
informed of the things betweenjust task-based work that are so
(12:47):
important when you're leadingpeople and you have some role to
play in careers.
So I agree that that's superimportant.
So as you're going through thistransition and you're trying to
build your career and you'revery analytical of not only the
outside world, but yourself andtrying to work on yourself, talk
about the role the culture of acompany plays in trying to
foster people who are reallytrying to go that route where
it's you know, I'm not trying tostay static.
I'm not trying to breeze out ofhere or anything, but my goal is
to grow and I want to growtechnically, but I also want to
grow in terms of the things thatI can do in my career.
(13:31):
Have you been in environmentswhere that wasn't so fostered
and have you been in otherswhere maybe they did a better
job of it?
O'Shea Bowens (13:40):
Yeah.
Actually, that's kind of whatled me to starting my company.
I've had it on both sides,right?
I've had it on one side where Ithink leadership makes the
biggest difference, at least inmy reality, in my experience,
when you have leadership thatencompasses something that
you're striving for, it makesworking so much better.
I remember I had one CISO Ithink he was, if I remember
(14:05):
right, he was a formerintelligence officer or
intelligence analyst at the AirForce and moved more into DFIR,
super, super smart person.
And really personable.
I kinda shaped my leadershipafter him in reality, but he was
super personable and reallyapproachable.
And it was really great justhanging out with him and talking
with him, right.
(14:32):
He was a really cool person.
And he had so much knowledgethat he could pass out,
especially during theinvestigations, but on the flip
side, I've had some managersthat made it almost as if you're
in this position where they areplaying this very unnecessary,
(14:53):
but strategic long game of, Ican't allow someone to highlight
how knowledgeable they are andhow good they are because it may
overshadow me.
It's that type of thing.
And it took me a while to noticeit, but it was just a very
strange occurrence.
I specifically remember therewas this one particular role
where I had the support ofpretty much 90% of my technical
(15:15):
peers.
And they're all pushing me tobecome a manager.
And then I'm told, oh, well,you're not managing material.
Even though I'd been a managerand a director before this role,
I took this role because Iwanted to become stronger and
stronger in IR.
But it was a very weird thing.
It was like, well, is itactually me?
(15:37):
Is there some deficiency in mytechnical capabilities or maybe
the way I communicate?
And this was well after thepoint where I realized how I
made those mistakes previouslywith communicating with people.
So I didn't think it was that.
So it was really one of thesethings of maybe it's not me,
it's them type of situations.
Maybe there's something going onwith this individual, this
(15:58):
particular manager where he'snot going to promote anyone that
he feels, I guess you could say,they could take his job.
Right.
Let's just be honest.
People do think like this incorporate America and probably
corporate Europe, corporateAsia, also-
Jason Nickola (16:20):
Corporate Earth.
O'Shea Bowens (16:20):
Right.
That’s hilarious, corporateEarth.
Jason Nickola (16:20):
I’m gonna put it on a t-shirt.
O'Shea Bowens (16:20):
But if they view you as a potential threat down
the line, they're less likely toroot for you to climb up that
ladder.
And that was just a very weirdoccurrence for me.
And then around that time, itmade me think it may be time to
try your own thing out.
Jason Nickola (16:45):
Right.
So I don't know if it developedinto this for you in that
specific case, but a lot oftimes when that kind of thing
happens, people start to wonderif it's time to look for the
next role, the next company.
If you feel like your path haskind of blocked where you are,
then go see if there's somewhereelse where there's a better path
for you.
But that, in my experience, justfor me, and from things that
I've heard of other people isone of the more anxiety-inducing
(17:07):
processes that you can gothrough.
Cause it's like a grass isgreener kind of thing, but it
could always be worse when youget to the next place.
It's really hard to gauge thatahead of time.
Have you had that kind of asituation where for whatever
reason you've gotten to what youassumed was the end of a logical
path with a place and you had toput yourself out there and
(17:27):
expose yourself a little bit togo find where the next step is?
O'Shea Bowens (17:37):
Yeah.
And there needs to be moreclasses on this.
This is the interpersonal, extrapersonal side of communication
and cyber.
So yeah, I've definitely been ina position before where you hit
a wall, right?
You’re not moving up, you're notmoving down, you're not moving
ladder, you're kind of just inthis position where you can't
move at all.
And it's nothing against thepeople you work with.
I was working with some prettycool people at the time, but
(17:57):
there was just no growth.
The one individual who had thelargest amount of knowledge in
the areas that I was interestedin in security, he had moved on.
So he goes out the door, I'mstill working with people that I
like, but not that many people Ican learn from.
(18:18):
So now you have to go on thatquest of interviewing and
something that I rememberspecifically from this was, and
I try to tell this to juniorindividuals or people I mentor.
I was like, when you interview,it's not that you're lucky.
You can't take the approach thatyou're lucky to have the job, a
part of it should be they'relucky to have you.
(18:40):
And that sounds maybe tooegotistical.
But I remember, I specificallyalmost took this job after the
job I was leaving, I almost tooka role out that was almost like
a fear based decision, it waslike, well, they offered it,
it's a bit more money.
I'm not entirely sure what'sgoing to happen at this role.
And it's here and it's in frontof me right now.
(19:03):
So do I just take the role?
Yeah.
Maybe I don't get to doeverything I want to do, but I
make a little bit more and theysaid I can do some things in the
future, so I'd be lucky to takethe job, you know?
And then I questioned myselfover that and I passed on the
role and about two or threemonths later, I found something.
But something I realized wasfrom that day, going backwards,
maybe some of the roles I hadtaken on were fear based.
(19:25):
Cause you're thinking, oh myGod, I'm so lucky to get this
job, you know?
What I've learned from that timeperiod, especially when I
interview even now, beforeconsulting engagements or
whatnot, before I pick a clientI'm going to work with, I try to
drill down into what theexpectations are.
How can I learn from this?
(19:46):
And is it a good relationship?
When I interview, if I can't hitall three of those, it's
probably not the best decision.
So yeah, maybe the money isgreat.
But are you going to be able tolearn the things that you're
interested in, or maybe youcan't learn the things you're
interested in, but the peopleyou're working with are awesome.
So you're kind of in thisbalancing thing, this balancing
game of trying to determinewhat's the best thing for me to
hit all three areas or what am Iwilling to substitute?
(20:08):
And I think when you startplaying the substitution side of
things, that's when you findyourself in roles where a year
or two down the line, you'relike, wait, what did I do?
Jason Nickola (20:17):
Right.
And it, it sounds like it tookyou a while to develop this
perspective and really figureout what your main bullet points
are.
I want to learn, I want to grow.
I want to be with people that Ireally enjoy and work with
technology that I'm reallyinterested in.
But earlier on, especially maybecoming out of your first role,
people are often just going totake what they can get to get
their foot in the doorsomewhere.
But I find that coming out ofthat, I have two or three years
of experience, I'm looking forthe next place that doesn't
consider the intern that washired in and to move into the
next thing.
There is absolutely thatfear-based perspective that
you're talking about.
And I think it's really valuableadvice to say, independent of
any individual role plot outwhat's important to you and then
look at everything through thatlens.
It's scary and it can bedifficult to do in the time
because these are our lives andwe have to pay bills and some of
(20:37):
us have families and those kindsof things, but ultimately even
if it's a little less money, Ithink I definitely agree with
you if you're making thosedecisions for the wrong reasons,
two or three years in if you'relucky, with six months or three
months, if you're not so lucky-
O'Shea Bowens (20:48):
Could be 90 days.
Jason Nickola (20:51):
Yeah, absolutely.
You're going to realize thatmaybe you're not in the right
position.
And that does a lot more damageto your confidence going through
the process again, then maybejust slow playing it a little
bit ahead of time and trying toprioritize the right things.
O'Shea Bowens (21:39):
Yeah.
Most definitely.
And something else that I didlearn from interviewing is also
if you don't meet the team,there's something up.
That happened to me before Iinterviewed, and I only
interviewed the hiring managerand I was like, this is strange.
Why am I not speaking to anyoneelse?
And it turns out he was justvery disliked among the team.
So it was a very weird thing towalk into.
But now I know, if you'reinterviewing ensure that you
(21:59):
meet other team members, thisgoes back into they're lucky to
have you too.
So it's not just you courtingthem, it's vice versa.
Jason Nickola (22:13):
For sure.
So that's in moving from onerole to another at companies
that other people own and run.
Did you have the same kind ofdynamic in making the decision
to go off and start your ownthing?
O'Shea Bowens (22:28):
Innocence.
So when I began down the thoughtprocess of starting Null Hat, I
was actually in Sweden at thetime- I moved to Boston from
Sweden like three years ago.
I was in Stockholm and my wifegot pregnant and we ended up
moving to Boston where she'sfrom.
Cause we didn't really knowanyone in Sweden anyway.
So it wasn't that big of a loss,but I was communicating with a
(22:49):
dude that I met there.
We became buddies and we werelooking to start an MSP out
there.
And when I thought about thosethree areas, am I going to grow?
Is it a good person to workwith?
Yes, I can definitely grow andyou know, kinda make a decent
income from it.
(23:09):
Like all three of those are hit.
It's just I ended up moving backhere.
When I say here, I mean back tothe US, but when I moved back to
the US and I was working in thisrole for a big pharmaceutical
company, lead in IR, that ideanever went away about kind of
forging your own way, but alsoensuring that you can follow up
in different areas of work thatare just crazy interesting to
(23:30):
you.
I think that's the one benefit.
I'd say consulting in general isyou're exposed to so many broad
environments and broadtechnologies that it's hard to
get bored.
You know what I mean?
It's super hard and it's supervaluable too.
I spent most of my careerconsulting.
(23:50):
And so most of the things Ilearned kind of ramp me up to
move into more advanced rolesbecause I was exposed to so much
in a short period of time andyou have to learn fast.
There's no time to- you don'thave someone to hold your hand
when you're walking intoconsultancy engagement.
That's not what they're payingyou for.
They're paying you for yourexpertise in a very short time
period to solve these complexproblems.
So when I started Null Hat, itwas those three things.
(24:13):
I envisioned those three markersthat I'd like to hit for moving
into a different role.
And of course it's super scary,but at the same time, it's like,
well, what do I actually gainfrom it?
Am I really going to learn more?
Am I really going to push myselfand challenge?
And can I make a little bit ofchange?
Okay, great.
And the main reason I wanted tostart the company was to build
(24:34):
out something for the communitywhere I could help train
individuals, especiallyspecifically communities that
aren't really represented orunderrepresented in tech and
people of color and minorities,like I could I find a way to
carve out a bit of my time tobuild out a way to communicate
with them and help train andintroduce my knowledge base, but
can I also make some money?
(24:55):
And if I can do both of thosethen great.
Jason Nickola (25:01):
Right.
Yeah.
For sure.
So one of the things that I'vealways really respected about
you since our paths firstcrossed is you stay super active
in lots of different things,including Twitter, and where
you're at lots of events andyou're very connected in the
community and you're startingyour own conference, SkiCon,
which is coming up here soon injust a bit.
Has that then a hallmark of youthroughout your entire
(25:25):
professional and technicalcareer?
Is it something that you've morestarted to do, like work on your
own personal brand, as you'veventured off into starting your
own thing, and what role hasbecoming a citizen of the larger
technical and security communityplayed in your own development?
O'Shea Bowens (25:45):
Yeah.
I mean, I think a part of it wasonce I began to travel a bit
more, one of the things I didmaybe four years ago was really
start to ask questions of what'sgoing on outside the US.
There’s a conference in Praguecalled QuBit.
And I remember I went to QuBitfor the first time and I was on
(26:06):
a panel there.
I was invited by the CEO ofLIFARS.
It's a digital forensics companyin Manhattan.
And just being around that manypeople from Eastern Europe or
that part of the world that hadtotally different perspectives
on what security actually is,and also the type of threats
that we're facing.
I found that fascinating.
And around that time I began to–you know, I’ve been to DEFCON
(26:28):
multiple times, but I began tolook at other conferences
outside of DEFCON.
And as I did that, something Inoticed specifically was there
weren't a lot of people thatlooked like me that were
speaking.
So that kind of ignited a firein regards to the representation
side, like how do I get moreAfrican Americans speaking?
How can I kind of help changethat dynamic?
(26:49):
And then you add into the factabout two years later, I began
thinking about starting NullHat, and then around this time I
started communicating on Twitterwith other individuals that are
doing awesome work and justseeing what they're up to and
sharing stories with them.
And when you start to combineall three of those, I think it
was a big driver for me.
had this conversation withsomeone last year, I remember.
(27:16):
And I was like, I don't envisionmyself trying to become some
quote unquote rock star in thecommunity.
I just envisioned myself asbeing like a resource.
Like if someone has a question,they know, hey, O’Shea will try
to help me out if I ask this,I'm approachable, but also how
do we become a more inclusivecommunity?
Cause you know, let's face it,it's not as diverse as it could
be.
And that's not a dig againstanyone or any entity.
(27:36):
It's just one of those thingsthat certain communities cyber
isn't something that they'reintroduced to at a younger age.
Luckily I was because of theschool I went to, but how can I
use what I know to reach out toother individuals and bring them
into the community, you know?
(27:59):
And when you start to kind ofcombine all these weird facets
or these weird times in history,or presently really, it kind of
equates to what I'm doing now.
So when you're doing all thesedifferent things, you're kind of
busy, I guess is what I'msaying.
You find yourself like, oh,there's a conference going on
and I'm not going to that justto speak, I'm going because I
(28:20):
know XYZ is going to be there.
And I know I really enjoy havingconversations with them and
maybe I can listen to one oftheir sessions and then from
speaking at conference you'rebuilding out your company, so
you're networking and you'retrying to figure out who else
can you work with?
(28:42):
I'm a big proponent of it'sgreat to make money, but it's
great to make money with peopleyou can make money with again,
you know?
So it doesn't make sense to meto have an engagement with
someone that I truly, truly justdon't like.
I want to work with people thatI can become a resource to that
I actually like, that I wouldhang out with.
How can I make that repeatable?
And that's where traveling andspeaking at conferences, helping
(29:03):
organizing things, like youmentioned and thanks for saying
that, I'm organizing and foundedSkiCon and that's a conference
here on February 21st and 22nd.
And that's a much smallerconference cause it's the first
time we had it, but I just hadthis idea of, I like to
snowboard, there's other peoplethat like to snowboard and ski,
why don't we just meet up andhang out on a mountain?
(29:27):
We can have a couple of smalltalks at night.
And then during the day, insteadof us all sitting in a room at a
conference, waiting for coffeebreaks to speak to each other,
why don't we just take some runstogether?
And then just hang out and getto know one another and meet
some new people.
You’re physically active, you'rehanging out at the top of
mountain taking some runs.
And you're just hopefullycommunicating with really chill
people and really awesomepeople.
(29:49):
And so I was like, yeah, screwit, I'll make it a conference.
You know, let's see how it playsout.
Jason Nickola (29:58):
Cool.
So somewhere, someone listeningto the show is either just
starting their career or maybethey've moved past the first
couple of years and they'retrying to plot out where they
want to get to and trying totake some of the steps that
you've described here taking inyour career in order to get
where they want to be.
What's some parting words forthem just as encouragement as
they go through that process?
O'Shea Bowens (30:21):
I’d place it in two, I guess I would say
buckets, two buckets.
One is just stay curious.
The minute you find yourself notquestioning what you know, is
kind of the minute you're notgrowing, right.
If you're not really looking tocontinue to build out your
knowledge landscape or grow andgrow and grow, it's maybe time
to do a bit of self-reflection.
(30:43):
The second one, I guess reallythree, the second would really
be mutual respect.
Finding a way to communicatewith other individuals, no
matter how big or how small,just in a respectful manner, can
go such a long way.
What I don't like to see in ourcommunity is just people that-
even from a younger perspective,like I've run across individuals
(31:05):
that are fairly young.
They're fairly talented, butthey're fairly cocky, right?
Like ridiculously cocky.
So it makes me think, yeah,you're a really talented 23 year
old, but you are not the bestperson to have a conversation
with.
So I don't see myself workingwith you and I’d love to help
(31:26):
you out more, but you're goingto have to work on just the
personality aspect.
And it's not my place to tellyou who or what you should be.
But I think in our community,especially when you’re coming
up, if you have that mutualrespect for other individuals,
it makes you a bit moreapproachable, people will be
more likely to help you out.
But also I think it's almostlike- this sounds weird, it's
(31:47):
almost like a samurai payinghomage, like you meet other
individuals that have moreknowledge base, like your
master, not to say that there'sa master, I shouldn’t say it
like that.
But it's almost like you respectthe game.
You know what I mean?
Like you respect the game, youunderstand it and you want to
grow, so you seem like theperson that I want to help out,
you know?
But when you come in with thisvery cocky attitude, it doesn't
seem like an individual that'seven open to listening to what
(32:08):
I'm saying.
Jason Nickola (32:15):
Right.
O'Shea Bowens (32:16):
And the third one is just map out what you're
truly interested in.
I think it's easy– I shouldn’tsay easy.
It's inducing due to some of thesalaries in different areas of
security and not just securitytechnology in general, of what
you could potentially makeversus what your passion truly
is.
I've seen this countless timesand individuals that are mostly
(32:38):
a bit older than myself, butthey've been in these roles
where they're making a decentamount of money, but also they
kinda want to do something else,but they wouldn't risk the money
that they're making to follow adifferent chart, right.
Different chart or differentpath.
And I think when you when youmap out what you truly want to
do, you don't really hit a wallbecause that's constantly
(33:00):
updating, like when I mentionedthe yearly goal, the daily
goals, or weekly goals, when youcontinuously find yourself in a
habit of mapping out what yourprofessional life looks like,
there's kind of no limit towhere you can go.
Like cyber is vast.
A personal goal of mine islearning ICS this year.
(33:20):
And I’m a total newbie with ICS.
Cause that's not anything I'vereally focused upon.
But slowly, slowly, every twoweeks I’ll spend an hour
reviewing research papers orjust analyzing what other people
have published to kind of up myown knowledge and that's the
path for 2020, that's one of thepaths and one of the goals for
2020 for me, but mapping outwhat you want to do for the
(33:44):
future is immensely helpful withyour current decision making and
kind of your day to day decisionmaking.
Jason Nickola (33:55):
Yeah.
I couldn't agree more.
I think all of that is greatadvice.
And I think that there'll besome people listening to the
show that hearing your story isdefinitely gonna help him out.
So thanks so much for coming on.
It's been a blast.
I appreciate you chatting withme.
O'Shea Bowens (34:16):
Yeah.
Thanks for having me.
Jason Nickola (34:17):
Thanks so much to all of you for listening to the
show and to O'Shea for joiningus and sharing his story.
It was a ton of fun to spend somuch time with him and listen to
his thoughts and advice.
We'll be back in two weeks forour next episode, please do
remember to subscribe to theshow at giac.org/podcasts and
whichever app you choose inorder to get updates about new
episodes as soon as they hit theair.
Thanks again for listening andwe will see you soon.
This is“Trust Me, I'm Certified” brought to you by
GIAC Certifications, a podcastexploring how to conquer
imposter syndrome.
Welcome back to“Trust Me, I'mCertified.” I'm your host, Jason
Nickola, and I'm really excitedto bring you part two of our
interview with O'Shea Bowens.
In part one, we dug into a lotof O'Shea's background in how he
became interested incybersecurity.
(00:23):
So please do hop back and checkout part one if you haven't
given it a listen yet.
In this episode, we will diveright into education and
training and the role they playin preparing you for a career in
the real world.
So please enjoy the rest of ourinterview with the man himself,
O'Shea Bowens.
(00:46):
Okay, so you started to want topick up these bits and pieces
from across the differentaspects of security so that you
can really fill out your skills.
And it sounds like contact withpeople who were experts in that
area, or at least willing tohelp in that area and had some
skills, played a larger part ofit, a very large part of it.
What role would you say thattraining or certifications play
(01:06):
in that, and then just generallyfor someone looking to build out
their skills, how do trainingand certifications fit in?
O'Shea Bowens (01:29):
So I placed it in two buckets, right?
So bucket one on the trainingside, not all trainings are made
equal, so there's some that- Ifell for this before.
I remember when I was maybe 22going on 23, I went to this CEH
class because at the timeeveryone was telling me that's
what I needed.
And I was like, I don't think Ineed it, but whatever fine.
(01:52):
It's 2008, 2009, something likethat.
I was like, fine.
I'll do it.
But I paid my own money to go tothis class.
It was- I mean, I could've justtaken the test instead of paying
the money and showing up forfour weeks straight because the
professor was basically readingfrom the book, or the instructor
was basically reading from thebook.
And some of that stuff, I knew-not to say I knew everything, I
didn't- but at the same time Iwas like, okay, I'll never do
(02:12):
that again because I didn't gointo it really researching what
I should expect at the end.
I was going into it expecting totake the cert at the end.
If I would've known what I knewthen, I would have just paid for
the cert.
So really understand what valueyou can truly obtain from the
certification.
So when I say the second bucket,it's really how can you leverage
the certification?
(02:33):
Because I've managed teams andpeople that we've sent off for
different trainings or we payfor them.
We would let them take vacationfor personal development or
whatnot.
And they come back and you'relike, okay, how can we apply
this?
You know, a good example, Iremember I worked with one dude
and we sent them off, I think atthe time, we'll just say another
certification body apparentlyfocused on DFIR.
(02:54):
Okay.
And he came back, totally passedthe test.
And we had a small, smallincident.
And I was like, okay, well we’llsay his name is Richard.
I was like, all right, Richardjust got this cert, he seems
like he wants to step up andlead.
(03:15):
Let's give him a shot.
And nothing from thiscertification really helped
besides the report writing, thereport writing was on par.
But from the technicalperspective, it was almost as if
he didn't go.
And I was like, well, what didyou do when you were there?
And he goes, you know, went toclass for a week and a half or
so, and then, you know, did someexercises.
And then he took the cert, buthe couldn't apply it to work.
(03:35):
That was where the gap was.
So when I say that second bucketright around, is it applicable
in your development for work?
Can you actually use it?
And if you can answer yes toboth of those then yes, you
should totally go for it.
Like go get a certification,especially if your company is
(03:56):
going to pay for it.
Jump on that ASAP.
Jason Nickola (03:57):
So have you had other experiences where you have
been able to find training thathas been applicable or would you
really recommend trying to buildup your skills ahead of time
before you go to some kind of atraining to fill things in?
O'Shea Bowens (03:57):
No, for me SEC504 was like super helpful.
I mean, I know it’s a SANS/GIACcourse- that's not like a plug
that was intentional, but that'sjust-
Jason Nickola (03:57):
I didn't tell O’Shea to say that, he said it
on his own.
O'Shea Bowens (03:57):
But I remember actually it was when I was
looking to move more into an IRrole, I took 504 and there was
this dude I was working withthat was super great from a
digital forensics perspective,but I'd worked with him for a
year or so.
(04:44):
So I picked up bits and piecesfrom him.
And then I took 504 and then Ifelt a lot more comfortable
applying for that next tier typeof role.
That was when I started, I beganto apply for a senior level
role.
So I wasn't necessarily onlyfocused on Layer 3 security or
from an intrusion analysisperspective, just networking.
But what I began to focus uponwas, well, how do I build out
(05:05):
more like a SIEM or IDS from anarchitectural perspective to a
tune into a management?
And then how can I begin asprinkling in a bit of malware
analysis?
Luckily, this was a while back,but 504 touched on all of those
areas.
And this goes back to sayingjust that first bit of exposure,
and then you start hammeringdown on your own.
(05:27):
But for me taking 504, passingthat, then really going back and
forth to the books- I still usedthose 504 books for dang near
three years, honestly.
I still don't throw away mybooks, but I kept going back and
just rereading some things.
Or I’d look at a particularsegment, especially I remember
for volatility when I was firstintroduced to that.
I dove deep into the books andthen I began to, again, throw it
(05:49):
into my lab.
Throw some samples at it, starttaking snapshots and then start
analyzing this, right.
And starting to analyze thememory.
And that was extremely helpfulfor me to move into a senior
level role.
I remember vividly how helpfulit was because there's different
areas I could speak to and thenI can have the cert to back it
up.
Jason Nickola (06:16):
Right.
Yeah.
So not only the practical skillof being able to actually do
those things, but you shouldn'tget a certification just to have
something down on paper, butwhen you are trying to move into
a new role and you're trying todemonstrate, hey, I'm willing to
put some of the time in and theeffort and attention that's
required to do some of thesethings that you need me to do
for this kind of role.
Well, here's proof that I'vebeen able to do that.
(06:37):
So for me, I’m a knowledgehound.
I'm just going to keep trying tolearn as much as I can.
But also the validation at theend of it, like, yeah, I
actually did get something outof that, and I can prove it to
other people has been reallyvaluable in pushing myself to go
to the next step.
So when you talked about movingbeyond kind of an individual
contributor and a tacticalcomponent to being more
(06:57):
strategic and management andthat kind of thing.
Did those kinds of things play alarge role in feeling like you
were ready to push yourself intothat next step?
Or were there other things thatmaybe held you back that you had
to overcome?
And what was that process likefor you?
O'Shea Bowens (07:20):
Yeah.
So one of the something thathappened to me, at least in two
different roles whereessentially, you know, this
isn't to harp on anyone, but itwas really one of those
situations where the individualthat served as the manager
wasn't as helpful as you wouldthink they would be in a
leadership position from atechnical chops perspective.
So you would ask questions andthe response would be yeah, I'm
not sure, I used to betechnical.
(07:41):
Oh, I don't really keep up withit anymore.
It was like, dude, why am Ilistening to you then?
I just remember when thathappened to me, at least twice,
and that kind of drove me to bein this– it put this seed in my
head, like I don't ever want tobe in a leadership position and
someone asks me something and Isay, oh, I'm not technical
anymore.
Oh, I don't really keep up withit.
(08:01):
That was one of the things thatstill kind of drives me to this
day, even from like a mentoringor from a team lead perspective
or running my own shop.
I don't want to be- if I don'tknow, I don't know, but I don't
want it present it as oh, Idon't know, I'm just here for
the check, you know, I dunno,you guys figure it out.
Jason Nickola (08:25):
Right.
So in moving from someone who isan individual contributor to
wanting to have more effect onpeople and strategy and
processes and those kinds ofthings, were there- there are
definitely technical challenges,right, because what you're
describing is your urge to wantto master the details so that
(08:45):
you're never in that kind of aposition, but were there other
challenges for you?
Like as I think of it, maybethings like remaining a member
of the team and yourinterpersonal relationships and
some of the other byproducts ofbeing driven and trying to get
ahead in those kinds of things.
How did that process go for youas you started to transition
outside of just being a tacticalkind of resource?
O'Shea Bowens (09:12):
I think, and I know, one of the big areas for
me was really diving deeper intohow I communicate.
Like I have no problem speakingwith people.
I'm a fairly sociable person.
But hat kind of takes a backseat sometimes at work, because
I'm there to solve a problemwhile I'm there to actually
work.
So at times I can be a bit, Iguess, short with people at
(09:34):
work, earlier.
I'm very aware of it now, butyou know, five or six years ago,
it really wasn't the case.
So it came off as, you know,maybe O’Shea is rude.
O’Shea doesn't have muchpatience, which even with the
patience I'm still working onthat daily.
My wife will tell you that, butI had to really take inventory
of how I communicate and what inmy presence, how did my presence
(09:55):
affect the team from overallperformance perspective, but
also from inclusivity, right?
Like if you are the person thateveryone feels is rude, or maybe
you're short with an individual,no matter how talented or smart
(10:15):
you are, people aren't going towant to work with you.
That’s just the truth of it,right.
And so then I realized, Iparticularly had a case at one
point.
I remember there was an event wewere investigating and if I
recall correctly I was analyzingsome PowerShell.
And just trying to walk throughwhat the calls were actually
touching, looking at a couple ofthe IPs, they're a part of this
(10:36):
campaign.
And I was very drilled into it.
And I guess a couple of peoplewere asking me questions and I
was like, dude, just DM me.
So I was like, stop talking tome while I'm trying to work.
And I remember afterwards, Iwent out for drinks with some of
the team members.
This was like a week later orsomething after everything was-
(10:57):
we had to report, we went to thefull-on stages of IR, I had the
report done that was presentedto senior management, incident
was cleaned up.
We had our patches and countermeasures in place.
But a buddy of mine, while we'rehaving drinks, that was on the
team was like, they kind ofthink you're rude, bro.
I was like, what are you talkingabout?
They're like, it just seems likeyou don't want to talk to people
(11:18):
at times.
I was like, well, okay, I canunderstand where you're coming
from, cause I know I get into azone.
Once I'm in that zone, I don'twant to be interrupted.
But yeah, I remember it made methink I need to be a bit more
aware how I communicate withpeople.
So now I always take the time.
Even normally when I'm sociable,I look everyone in the eye, but
now I take the time to look upfrom the keyboard.
(11:39):
I'm conscious and aware that ifsomeone's speaking to me, stop
typing.
Look up at them.
Don't just keep typing away andanswer questions.
Cause it seems like you're veryunconcerned or you can't be
bothered.
But when you take that time tolook up, acknowledge someone and
then continue along the lines ofcommunication, you're much
better received.
But particularly as a leader, atleast for me, I want to leave
(12:02):
the impression that, okay, Ihear you, your opinion is
definitely valued, how can Ihelp you?
You want to have like thatfeeling.
It'd be like walking into arestaurant and your server is
texting while taking your order.
You're not paying attention.
Jason Nickola (12:24):
Yeah.
And especially with your team,it's so important for your team
to feel like they can come toyou with things.
And the more you, even if it'snot intentional, the more you
make them feel like you're notpaying attention or that you
have better things to do, itseverely diminishes the
likelihood that they're going tocome to you and keep you
informed of the things betweenjust task-based work that are so
(12:47):
important when you're leadingpeople and you have some role to
play in careers.
So I agree that that's superimportant.
So as you're going through thistransition and you're trying to
build your career and you'revery analytical of not only the
outside world, but yourself andtrying to work on yourself, talk
about the role the culture of acompany plays in trying to
foster people who are reallytrying to go that route where
it's you know, I'm not trying tostay static.
I'm not trying to breeze out ofhere or anything, but my goal is
to grow and I want to growtechnically, but I also want to
grow in terms of the things thatI can do in my career.
(13:31):
Have you been in environmentswhere that wasn't so fostered
and have you been in otherswhere maybe they did a better
job of it?
O'Shea Bowens (13:40):
Yeah.
Actually, that's kind of whatled me to starting my company.
I've had it on both sides,right?
I've had it on one side where Ithink leadership makes the
biggest difference, at least inmy reality, in my experience,
when you have leadership thatencompasses something that
you're striving for, it makesworking so much better.
I remember I had one CISO Ithink he was, if I remember
(14:05):
right, he was a formerintelligence officer or
intelligence analyst at the AirForce and moved more into DFIR,
super, super smart person.
And really personable.
I kinda shaped my leadershipafter him in reality, but he was
super personable and reallyapproachable.
And it was really great justhanging out with him and talking
with him, right.
(14:32):
He was a really cool person.
And he had so much knowledgethat he could pass out,
especially during theinvestigations, but on the flip
side, I've had some managersthat made it almost as if you're
in this position where they areplaying this very unnecessary,
(14:53):
but strategic long game of, Ican't allow someone to highlight
how knowledgeable they are andhow good they are because it may
overshadow me.
It's that type of thing.
And it took me a while to noticeit, but it was just a very
strange occurrence.
I specifically remember therewas this one particular role
where I had the support ofpretty much 90% of my technical
(15:15):
peers.
And they're all pushing me tobecome a manager.
And then I'm told, oh, well,you're not managing material.
Even though I'd been a managerand a director before this role,
I took this role because Iwanted to become stronger and
stronger in IR.
But it was a very weird thing.
It was like, well, is itactually me?
(15:37):
Is there some deficiency in mytechnical capabilities or maybe
the way I communicate?
And this was well after thepoint where I realized how I
made those mistakes previouslywith communicating with people.
So I didn't think it was that.
So it was really one of thesethings of maybe it's not me,
it's them type of situations.
Maybe there's something going onwith this individual, this
(15:58):
particular manager where he'snot going to promote anyone that
he feels, I guess you could say,they could take his job.
Right.
Let's just be honest.
People do think like this incorporate America and probably
corporate Europe, corporateAsia, also-
Jason Nickola (16:20):
Corporate Earth.
O'Shea Bowens (16:20):
Right.
That’s hilarious, corporateEarth.
Jason Nickola (16:20):
I’m gonna put it on a t-shirt.
O'Shea Bowens (16:20):
But if they view you as a potential threat down
the line, they're less likely toroot for you to climb up that
ladder.
And that was just a very weirdoccurrence for me.
And then around that time, itmade me think it may be time to
try your own thing out.
Jason Nickola (16:45):
Right.
So I don't know if it developedinto this for you in that
specific case, but a lot oftimes when that kind of thing
happens, people start to wonderif it's time to look for the
next role, the next company.
If you feel like your path haskind of blocked where you are,
then go see if there's somewhereelse where there's a better path
for you.
But that, in my experience, justfor me, and from things that
I've heard of other people isone of the more anxiety-inducing
(17:07):
processes that you can gothrough.
Cause it's like a grass isgreener kind of thing, but it
could always be worse when youget to the next place.
It's really hard to gauge thatahead of time.
Have you had that kind of asituation where for whatever
reason you've gotten to what youassumed was the end of a logical
path with a place and you had toput yourself out there and
(17:27):
expose yourself a little bit togo find where the next step is?
O'Shea Bowens (17:37):
Yeah.
And there needs to be moreclasses on this.
This is the interpersonal, extrapersonal side of communication
and cyber.
So yeah, I've definitely been ina position before where you hit
a wall, right?
You’re not moving up, you're notmoving down, you're not moving
ladder, you're kind of just inthis position where you can't
move at all.
And it's nothing against thepeople you work with.
I was working with some prettycool people at the time, but
(17:57):
there was just no growth.
The one individual who had thelargest amount of knowledge in
the areas that I was interestedin in security, he had moved on.
So he goes out the door, I'mstill working with people that I
like, but not that many people Ican learn from.
(18:18):
So now you have to go on thatquest of interviewing and
something that I rememberspecifically from this was, and
I try to tell this to juniorindividuals or people I mentor.
I was like, when you interview,it's not that you're lucky.
You can't take the approach thatyou're lucky to have the job, a
part of it should be they'relucky to have you.
(18:40):
And that sounds maybe tooegotistical.
But I remember, I specificallyalmost took this job after the
job I was leaving, I almost tooka role out that was almost like
a fear based decision, it waslike, well, they offered it,
it's a bit more money.
I'm not entirely sure what'sgoing to happen at this role.
And it's here and it's in frontof me right now.
(19:03):
So do I just take the role?
Yeah.
Maybe I don't get to doeverything I want to do, but I
make a little bit more and theysaid I can do some things in the
future, so I'd be lucky to takethe job, you know?
And then I questioned myselfover that and I passed on the
role and about two or threemonths later, I found something.
But something I realized wasfrom that day, going backwards,
maybe some of the roles I hadtaken on were fear based.
(19:25):
Cause you're thinking, oh myGod, I'm so lucky to get this
job, you know?
What I've learned from that timeperiod, especially when I
interview even now, beforeconsulting engagements or
whatnot, before I pick a clientI'm going to work with, I try to
drill down into what theexpectations are.
How can I learn from this?
(19:46):
And is it a good relationship?
When I interview, if I can't hitall three of those, it's
probably not the best decision.
So yeah, maybe the money isgreat.
But are you going to be able tolearn the things that you're
interested in, or maybe youcan't learn the things you're
interested in, but the peopleyou're working with are awesome.
So you're kind of in thisbalancing thing, this balancing
game of trying to determinewhat's the best thing for me to
hit all three areas or what am Iwilling to substitute?
(20:08):
And I think when you startplaying the substitution side of
things, that's when you findyourself in roles where a year
or two down the line, you'relike, wait, what did I do?
Jason Nickola (20:17):
Right.
And it, it sounds like it tookyou a while to develop this
perspective and really figureout what your main bullet points
are.
I want to learn, I want to grow.
I want to be with people that Ireally enjoy and work with
technology that I'm reallyinterested in.
But earlier on, especially maybecoming out of your first role,
people are often just going totake what they can get to get
their foot in the doorsomewhere.
But I find that coming out ofthat, I have two or three years
of experience, I'm looking forthe next place that doesn't
consider the intern that washired in and to move into the
next thing.
There is absolutely thatfear-based perspective that
you're talking about.
And I think it's really valuableadvice to say, independent of
any individual role plot outwhat's important to you and then
look at everything through thatlens.
It's scary and it can bedifficult to do in the time
because these are our lives andwe have to pay bills and some of
(20:37):
us have families and those kindsof things, but ultimately even
if it's a little less money, Ithink I definitely agree with
you if you're making thosedecisions for the wrong reasons,
two or three years in if you'relucky, with six months or three
months, if you're not so lucky-
O'Shea Bowens (20:48):
Could be 90 days.
Jason Nickola (20:51):
Yeah, absolutely.
You're going to realize thatmaybe you're not in the right
position.
And that does a lot more damageto your confidence going through
the process again, then maybejust slow playing it a little
bit ahead of time and trying toprioritize the right things.
O'Shea Bowens (21:39):
Yeah.
Most definitely.
And something else that I didlearn from interviewing is also
if you don't meet the team,there's something up.
That happened to me before Iinterviewed, and I only
interviewed the hiring managerand I was like, this is strange.
Why am I not speaking to anyoneelse?
And it turns out he was justvery disliked among the team.
So it was a very weird thing towalk into.
But now I know, if you'reinterviewing ensure that you
(21:59):
meet other team members, thisgoes back into they're lucky to
have you too.
So it's not just you courtingthem, it's vice versa.
Jason Nickola (22:13):
For sure.
So that's in moving from onerole to another at companies
that other people own and run.
Did you have the same kind ofdynamic in making the decision
to go off and start your ownthing?
O'Shea Bowens (22:28):
Innocence.
So when I began down the thoughtprocess of starting Null Hat, I
was actually in Sweden at thetime- I moved to Boston from
Sweden like three years ago.
I was in Stockholm and my wifegot pregnant and we ended up
moving to Boston where she'sfrom.
Cause we didn't really knowanyone in Sweden anyway.
So it wasn't that big of a loss,but I was communicating with a
(22:49):
dude that I met there.
We became buddies and we werelooking to start an MSP out
there.
And when I thought about thosethree areas, am I going to grow?
Is it a good person to workwith?
Yes, I can definitely grow andyou know, kinda make a decent
income from it.
(23:09):
Like all three of those are hit.
It's just I ended up moving backhere.
When I say here, I mean back tothe US, but when I moved back to
the US and I was working in thisrole for a big pharmaceutical
company, lead in IR, that ideanever went away about kind of
forging your own way, but alsoensuring that you can follow up
in different areas of work thatare just crazy interesting to
(23:30):
you.
I think that's the one benefit.
I'd say consulting in general isyou're exposed to so many broad
environments and broadtechnologies that it's hard to
get bored.
You know what I mean?
It's super hard and it's supervaluable too.
I spent most of my careerconsulting.
(23:50):
And so most of the things Ilearned kind of ramp me up to
move into more advanced rolesbecause I was exposed to so much
in a short period of time andyou have to learn fast.
There's no time to- you don'thave someone to hold your hand
when you're walking intoconsultancy engagement.
That's not what they're payingyou for.
They're paying you for yourexpertise in a very short time
period to solve these complexproblems.
So when I started Null Hat, itwas those three things.
(24:13):
I envisioned those three markersthat I'd like to hit for moving
into a different role.
And of course it's super scary,but at the same time, it's like,
well, what do I actually gainfrom it?
Am I really going to learn more?
Am I really going to push myselfand challenge?
And can I make a little bit ofchange?
Okay, great.
And the main reason I wanted tostart the company was to build
(24:34):
out something for the communitywhere I could help train
individuals, especiallyspecifically communities that
aren't really represented orunderrepresented in tech and
people of color and minorities,like I could I find a way to
carve out a bit of my time tobuild out a way to communicate
with them and help train andintroduce my knowledge base, but
can I also make some money?
(24:55):
And if I can do both of thosethen great.
Jason Nickola (25:01):
Right.
Yeah.
For sure.
So one of the things that I'vealways really respected about
you since our paths firstcrossed is you stay super active
in lots of different things,including Twitter, and where
you're at lots of events andyou're very connected in the
community and you're startingyour own conference, SkiCon,
which is coming up here soon injust a bit.
Has that then a hallmark of youthroughout your entire
(25:25):
professional and technicalcareer?
Is it something that you've morestarted to do, like work on your
own personal brand, as you'veventured off into starting your
own thing, and what role hasbecoming a citizen of the larger
technical and security communityplayed in your own development?
O'Shea Bowens (25:45):
Yeah.
I mean, I think a part of it wasonce I began to travel a bit
more, one of the things I didmaybe four years ago was really
start to ask questions of what'sgoing on outside the US.
There’s a conference in Praguecalled QuBit.
And I remember I went to QuBitfor the first time and I was on
(26:06):
a panel there.
I was invited by the CEO ofLIFARS.
It's a digital forensics companyin Manhattan.
And just being around that manypeople from Eastern Europe or
that part of the world that hadtotally different perspectives
on what security actually is,and also the type of threats
that we're facing.
I found that fascinating.
And around that time I began to–you know, I’ve been to DEFCON
(26:28):
multiple times, but I began tolook at other conferences
outside of DEFCON.
And as I did that, something Inoticed specifically was there
weren't a lot of people thatlooked like me that were
speaking.
So that kind of ignited a firein regards to the representation
side, like how do I get moreAfrican Americans speaking?
How can I kind of help changethat dynamic?
(26:49):
And then you add into the factabout two years later, I began
thinking about starting NullHat, and then around this time I
started communicating on Twitterwith other individuals that are
doing awesome work and justseeing what they're up to and
sharing stories with them.
And when you start to combineall three of those, I think it
was a big driver for me.
had this conversation withsomeone last year, I remember.
(27:16):
And I was like, I don't envisionmyself trying to become some
quote unquote rock star in thecommunity.
I just envisioned myself asbeing like a resource.
Like if someone has a question,they know, hey, O’Shea will try
to help me out if I ask this,I'm approachable, but also how
do we become a more inclusivecommunity?
Cause you know, let's face it,it's not as diverse as it could
be.
And that's not a dig againstanyone or any entity.
(27:36):
It's just one of those thingsthat certain communities cyber
isn't something that they'reintroduced to at a younger age.
Luckily I was because of theschool I went to, but how can I
use what I know to reach out toother individuals and bring them
into the community, you know?
(27:59):
And when you start to kind ofcombine all these weird facets
or these weird times in history,or presently really, it kind of
equates to what I'm doing now.
So when you're doing all thesedifferent things, you're kind of
busy, I guess is what I'msaying.
You find yourself like, oh,there's a conference going on
and I'm not going to that justto speak, I'm going because I
(28:20):
know XYZ is going to be there.
And I know I really enjoy havingconversations with them and
maybe I can listen to one oftheir sessions and then from
speaking at conference you'rebuilding out your company, so
you're networking and you'retrying to figure out who else
can you work with?
(28:42):
I'm a big proponent of it'sgreat to make money, but it's
great to make money with peopleyou can make money with again,
you know?
So it doesn't make sense to meto have an engagement with
someone that I truly, truly justdon't like.
I want to work with people thatI can become a resource to that
I actually like, that I wouldhang out with.
How can I make that repeatable?
And that's where traveling andspeaking at conferences, helping
(29:03):
organizing things, like youmentioned and thanks for saying
that, I'm organizing and foundedSkiCon and that's a conference
here on February 21st and 22nd.
And that's a much smallerconference cause it's the first
time we had it, but I just hadthis idea of, I like to
snowboard, there's other peoplethat like to snowboard and ski,
why don't we just meet up andhang out on a mountain?
(29:27):
We can have a couple of smalltalks at night.
And then during the day, insteadof us all sitting in a room at a
conference, waiting for coffeebreaks to speak to each other,
why don't we just take some runstogether?
And then just hang out and getto know one another and meet
some new people.
You’re physically active, you'rehanging out at the top of
mountain taking some runs.
And you're just hopefullycommunicating with really chill
people and really awesomepeople.
(29:49):
And so I was like, yeah, screwit, I'll make it a conference.
You know, let's see how it playsout.
Jason Nickola (29:58):
Cool.
So somewhere, someone listeningto the show is either just
starting their career or maybethey've moved past the first
couple of years and they'retrying to plot out where they
want to get to and trying totake some of the steps that
you've described here taking inyour career in order to get
where they want to be.
What's some parting words forthem just as encouragement as
they go through that process?
O'Shea Bowens (30:21):
I’d place it in two, I guess I would say
buckets, two buckets.
One is just stay curious.
The minute you find yourself notquestioning what you know, is
kind of the minute you're notgrowing, right.
If you're not really looking tocontinue to build out your
knowledge landscape or grow andgrow and grow, it's maybe time
to do a bit of self-reflection.
(30:43):
The second one, I guess reallythree, the second would really
be mutual respect.
Finding a way to communicatewith other individuals, no
matter how big or how small,just in a respectful manner, can
go such a long way.
What I don't like to see in ourcommunity is just people that-
even from a younger perspective,like I've run across individuals
(31:05):
that are fairly young.
They're fairly talented, butthey're fairly cocky, right?
Like ridiculously cocky.
So it makes me think, yeah,you're a really talented 23 year
old, but you are not the bestperson to have a conversation
with.
So I don't see myself workingwith you and I’d love to help
(31:26):
you out more, but you're goingto have to work on just the
personality aspect.
And it's not my place to tellyou who or what you should be.
But I think in our community,especially when you’re coming
up, if you have that mutualrespect for other individuals,
it makes you a bit moreapproachable, people will be
more likely to help you out.
But also I think it's almostlike- this sounds weird, it's
(31:47):
almost like a samurai payinghomage, like you meet other
individuals that have moreknowledge base, like your
master, not to say that there'sa master, I shouldn’t say it
like that.
But it's almost like you respectthe game.
You know what I mean?
Like you respect the game, youunderstand it and you want to
grow, so you seem like theperson that I want to help out,
you know?
But when you come in with thisvery cocky attitude, it doesn't
seem like an individual that'seven open to listening to what
(32:08):
I'm saying.
Jason Nickola (32:15):
Right.
O'Shea Bowens (32:16):
And the third one is just map out what you're
truly interested in.
I think it's easy– I shouldn’tsay easy.
It's inducing due to some of thesalaries in different areas of
security and not just securitytechnology in general, of what
you could potentially makeversus what your passion truly
is.
I've seen this countless timesand individuals that are mostly
(32:38):
a bit older than myself, butthey've been in these roles
where they're making a decentamount of money, but also they
kinda want to do something else,but they wouldn't risk the money
that they're making to follow adifferent chart, right.
Different chart or differentpath.
And I think when you when youmap out what you truly want to
do, you don't really hit a wallbecause that's constantly
(33:00):
updating, like when I mentionedthe yearly goal, the daily
goals, or weekly goals, when youcontinuously find yourself in a
habit of mapping out what yourprofessional life looks like,
there's kind of no limit towhere you can go.
Like cyber is vast.
A personal goal of mine islearning ICS this year.
(33:20):
And I’m a total newbie with ICS.
Cause that's not anything I'vereally focused upon.
But slowly, slowly, every twoweeks I’ll spend an hour
reviewing research papers orjust analyzing what other people
have published to kind of up myown knowledge and that's the
path for 2020, that's one of thepaths and one of the goals for
2020 for me, but mapping outwhat you want to do for the
(33:44):
future is immensely helpful withyour current decision making and
kind of your day to day decisionmaking.
Jason Nickola (33:55):
Yeah.
I couldn't agree more.
I think all of that is greatadvice.
And I think that there'll besome people listening to the
show that hearing your story isdefinitely gonna help him out.
So thanks so much for coming on.
It's been a blast.
I appreciate you chatting withme.
O'Shea Bowens (34:16):
Yeah.
Thanks for having me.
Jason Nickola (34:17):
Thanks so much to all of you for listening to the
show and to O'Shea for joiningus and sharing his story.
It was a ton of fun to spend somuch time with him and listen to
his thoughts and advice.
We'll be back in two weeks forour next episode, please do
remember to subscribe to theshow at giac.org/podcasts and
whichever app you choose inorder to get updates about new
episodes as soon as they hit theair.
Thanks again for listening andwe will see you soon.
Popular Podcasts
On Purpose with Jay Shetty
I’m Jay Shetty host of On Purpose the worlds #1 Mental Health podcast and I’m so grateful you found us. I started this podcast 5 years ago to invite you into conversations and workshops that are designed to help make you happier, healthier and more healed. I believe that when you (yes you) feel seen, heard and understood you’re able to deal with relationship struggles, work challenges and life’s ups and downs with more ease and grace. I interview experts, celebrities, thought leaders and athletes so that we can grow our mindset, build better habits and uncover a side of them we’ve never seen before. New episodes every Monday and Friday. Your support means the world to me and I don’t take it for granted — click the follow button and leave a review to help us spread the love with On Purpose. I can’t wait for you to listen to your first or 500th episode!
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com