Don’t Go to Hacker Cons

This week marks the 6th year of Thotcon, Chicago’s Hacking conference. Thotcon, and hacker conferences just like it, are great for sharing the latest exploits, techniques, and random things you shouldn’t try at home. (My favorite was using a drone to hack WiFi.)

Hacker Cons ≠ Career Growth

The problem with hacker cons is that they promote the idea that to grow your career in security, you need to be a better hacker.

We all go to a Con for different reasons. Many promote a great community. Others want to break new ground. Almost all promote the idea that to be successful in security, you should act like the speakers and community.

True Career Growth

Having spent the last 18 years both working in and consulting to security organizations, I have seen both successful and struggling security professionals. At some point in your career, to move to the next level you need to move beyond the Con skillset.

When I hire a manager or director in information security, I’m looking for:

• Ability to manage, mentor and grow people
• Ability to communicate complex security issues to non-security people
• Ability to weigh security issues against cost and business objectives

I recently talked about the difference between being broad or deep in security. The ideal person is both — which is nearly impossible to obtain. Instead of focusing on being too deep — which I feel Cons promote — we should focus on being broader.

What You Should Do

Go to Thotcon or whatever your favorite local Con is. But instead of using it to grow your career, use it to network.

In the next 3 months, instead of trying to dig deeper into your skill set, go broader. Are you an incident response analyst? Learn application security, threat modeling or Ruby. Are you a governance professional? Learn metrics, Agile or identity management.

The number of jobs for a highly proficient “hacker” managers is pretty limited. Spend a few minutes today thinking about what your next step is in your career.

Caveat

“But Jay, I don’t want to be a manager.” Fair enough. There are plenty of people who want to grow more senior without growing out of their technical role.

I still firmly believe that spending time outside your niche will benefit your career. As the opportunities get more limited the more senior you become, also spend some time thinking about your next career step. What companies need your skillset? How can you position yourself for promotion in your own company or at the next?

Don’t wait until you’re ready to jump to your next opportunity to think about where it should be.