Category Archives: Life the universe and everything

Exit Interview

I failed upwards into management a few years ago. This means that I effectively opened an office for my employer and was responsible for finding, evaluating, recruiting, onboarding and generally looking after a team in Glasgow. This has been a privilege and for the most part the last two years has been a riot.

We build a pretty tight ship of overlapping skills with enough diversity in our thoughts to make things entertaining. It is to be expected that folks who join the crew set sail themselves to explore new shores someday. That doesn’t make it any easier when you effectively think of them as friends first.

Today is the last day for one of the original deck hands who is leaving for the best of reasons. What I know is that they are properly prepared for whatever is coming both personally and professionally. They will rock it out somewhere else.

I am learning there is a difference between intellectually knowing that there will be staff turnover, and experiencing it first hand a few times. Nobody said management was ever fun.

Reckon I am a bit like a parent waving their kid off to Uni and knowing that it is actually a good thing for them.

We will miss the enthusiasm and abilities day-to-day. But forever I will be up in your life so don’t you worry about that.

Pentesting; Failing Upwards

I was given instructions to start an office. Find candidates, filter through them, and then pick a number of them. A lot of trust and I wholeheartedly thank my employers for giving me the rope to do this.

I have never really seen becoming a manager as a career ambition. I always have, and most likely always will, call this “failing upwards”. Why? Put simply being a Pentester for me is the greatest job on the planet. Any step away from doing that *every*day* must simply be called “failing” right?

Over the years I have assisted many in the industry by offering; advice, training, but most importantly (so I am told) is TIME.

During my decade or so I have seen those I helped go from entirely green to campaign hardened professionals. Thinking back to them being straight out of university and unable to sort out their “multiple simultaneous logins” from their “session hijacking” (more common than you might expect that confusion!). They now are doing exceptional things themselves.

Usually the committed people will get there on their own and it is not necessarily my influence. In some small way I hope they do even one thing better as a result though!

Currently, I still get to do a decent number of testing days which is good. However, I see the time for that coming to an end relatively soon. The in-take for the inaugural year seems set and now we just have to focus on starting them off correctly.

Guess I will have to live vicariously by assisting my new troop during their projects. To support all of this I have been making training and coming up with little speeches in my head.

Today I am really excited to start the newest member of the team off on the route of how to be professional, and get the job done. There are a lot of myths about the industry that seem to build up. Universities seem adept at teaching some things but not in making “consultants”.  Part of the programme will be to sort those out!

The goal is not to make people ready for passing some certification like CREST. It is to make them engaged with their job, confident in doing it, aware of where to get information, and to deliver things that are useful to customers.

Remember these few points:

  • the report is the “product”. Not how amazing your technical acrobatics is.
  • recommendations are what the customer pays for.
  • talk to the customer. Not all of them are the same, some might have a preferred risk system etc.

Take ownership of your deliverables, care about your name being on it, and TALK to the customer. These things will set you up the right way.