The Lucky List

A friend of mine recently shared an article about the role luck plays in people’s lives and how it’s not always appropriately recognized. As I reached the end of the article, I got to thinking how luck has contributed to my success, specifically my career in information security. As I typed this list, I realized that while I certainly work hard, I’ve also been incredibly lucky. Sharing this list feels a bit self-serving, but maybe it will inspire others to think about luck in their own career.

• I grew up near several magnet schools that offered technology programs, specifically in Cisco networking. Had it not been for these schools, who knows what I would be doing now.
• After being unimpressed with the robotics, and unsure of culinary, I stumbled into networking as a last choice and was instantly hooked after someone demoed sharing files between two networked computers. If I was just given an explanation about networking, I highly doubt I would have enrolled in the class.
• My networking teacher was one of the best instructors I’ve ever had the pleasure of learning from and later moved on to help direct the larger Cisco Academy program. I goofed off a lot in class and had she given up on me, I may not have pursued the degree path I chose.
• A local community college professor visited the networking classroom and explained how security was going to be the next big thing––what we were learning was incredibly powerful. This gentlemen inspired a few of us to take night classes and dive head-first into security. He has since progressed education around security forward through a number of events, programs and large-scale exercises.
• Several community college administrators were willing to waive pre-requisite classes and let me define a schedule that fit around my life. Without this flexibility, there’s no way I would have graduated as fast as I did.
• One of my graduating class friends joined the NSA directly after high school and later transitioned over to a small defense contractor. He helped me land an introduction with a surface mount technology lab. They took a chance and hired me to help quality inspect circuit boards and train machines to spot defects. I had no experience in this field.
• This same defense contractor just so happened to conduct training for military operators and needed people experienced in more technical networking to simulate target environments. My friend was supporting this group and cleared the way for me to help support their efforts.
• Our supervisors were military officers, but gave us the freedom to explore ways to optimize the lab as long as we got our work done. This is where I first got exposed to writing code and tools for others to leverage.
• While performing work, a sub-contractor instructor took note of the work we were doing and was impressed with our skill sets. When my clearance later failed to pan out as expected, the sub-contractor offered me a job as a private sector consultant.
• With no commercial experience, the new defense contractor sent me all over the United States on a number of different projects. I worked with defense contractors, military groups, large cooperations and small non-profits. My boss at the time was an amazing mentor and helped me improve my behavior, verbal skills and overall delivery––both in life and in work. The company also supported me as I obtained my bachelors degree.
• Later on, I was given complete ownership of designing the corporate network and moving all our assets to a virtualized setup. This was incredibly complex and tested a lot of what I had learned from the previous years. The company took a big risk in letting me do this and could have easily given the work to someone else. This work later become indispensable in future jobs I did at other companies.
• Others within the company encouraged me to continue programming and learning within the industry. They helped me study for certifications and supported research ideas that later turned to talks at conferences. When I was nervous to speak, they showed up and supported me.
• Research, blogging, and tooling I built later landed me a number of interviews at big companies I never dreamed of working at. This led to my next position at an academic institution where my new boss was a previous co-worker. He shared his code projects with me and let me collaborate to move them forward.
• Our department at the academic institution shielded us from a lot of the annoying work, so we could focus on submitting research to speak at conferences. Many of the talks we did were in different states and countries and work paid for us to go. This was my first exposure to travel and changed who I was as a person.
• Some of my research later became popular in the community and allowed me to connect with researchers I respected from all over the world. These researchers plugged me into different communities and eventually introduced me to cyber espionage.
• Research, tools and conference talks I had done allowed me to land a position completely focused on advanced threat actors for a private sector business. While at this company, I met some of the smartest people I’ve ever worked with who were willing to share their knowledge. Their problems became something I was interested in solving through code. I honed my development skills and was able to see how I could impact someone’s workflow. My co-workers tested my code, provided feedback and were amazing in helping me grow.
• Espionage research literally took me all over the world. I spoke at conferences, identified threat actors, briefed agencies and met with security individuals from all different backgrounds. Work paid for all my expenses and gave me complete freedom over the focus of my work.
• Recognizing that I could solve problems with code, I later quit to pursue my own idea of an analyst platform. I partnered with a former co-worker and friend to create PassiveTotal. This platform later turned into a commercial product and was sold to the company I support today.
• While selling PassiveTotal, friends in the industry asked if I would be willing to help them take their job platform idea and make it scale. I accepted their proposal and rewrote the project that has now helped hundreds of people get jobs in the industry.
• After the acquisition of PassiveTotal, I was given the freedom to make an impact in the company any way I could. The leadership team later asked me to run product despite having no experience and was patient as I learned how to structure our operations.

If I had to break the type of luck into categories, I’d say it ends up in two core buckets––timing and people. The people I’ve met throughout my career have helped me grow as a person, offered me opportunities to learn, encouraged me to explore and trusted me with responsibility that was far beyond my skill set. If you take anything away from this, recognize that you as a professional may be able to help others out much like people did for me.

Today, I still run product for the company I sold my business to and have learned countless lessons about scaling a business. I’m grateful I’ve been entrusted with such a big responsibility and am no doubt lucky to be where I am today.