Debbie Sallis, Executive Director of The Cyber Guild, recently sat down with Will Markow, Vice President of Applied Research – Talent with Lightcast, to discuss his thoughts on cybersecurity as a meaningful career and hear more about his unique role in cybersecurity…

Debbie: Will, you have quite a unique role when it comes to cybersecurity. Can you explain a little bit about how you found yourself in cyber?

Will: I always say that I took a backdoor into cybersecurity. I’m not a cybersecurity practitioner per se. You definitely don’t want me securing your networks. But, I do analyze the cybersecurity workforce, and I’ve been doing that now with Lightcast for over 11 years. I started because even back then people were saying, hey, we can’t find enough people to secure our digital networks. We just don’t have enough cybersecurity workers.

As a result, many organizations were just starting to have the first wave of major headline grabbing breaches, and the workforce challenges within the industry were one of the common reasons that people were pointing at as to why we were having so many breaches. We started to analyze the cybersecurity workforce and found there was a lot of demand for better information about it so that we could better prepare people for the field.

Just to give a little bit of history on how we used to prepare people for cyber and how we used to learn about the cybersecurity workforce. The government would track only one job called “information security analysts” related to cyber, but we all know there are many different types of cybersecurity roles. You can’t just pigeonhole ’em all into one monolithic information security analyst position. Plus, there wasn’t really much information about the individual skills or credentials that were needed across the cyber landscape.

So we tried to analyze the cybersecurity workforce with a bit more granularity than what had traditionally been the case, and we found that there was a lot of demand within the industry to have that kind of information to better prepare people for jobs in cyber and expand the cybersecurity talent pipeline. You really can’t prepare workers if you don’t know anything about the jobs that you’re trying to prepare them for.

Debbie: Given your experience in and around the cybersecurity profession, what does having a positive cyber mindset mean to you?

Will: I think that a lot of it comes down to the words “perseverance” and “resilience.” For me, I think that cyber can be a tough field for a lot of people. You can work long hours and deal with some stressful situations. If you have the desire to persevere throughout that, then that’s a good trait to have.

The term resilience also comes to mind because in trying to deal with all of these difficult situations, you’re going to have to figure out how you can bounce back. Nobody in cyber gets

things 100% right all of the time. Even the biggest organizations in the world now with the most sophisticated cybersecurity teams and defenses, they’re still facing a constant flood of attacks and these organizations have to get through it. It’s not about being perfect, it’s about being resilient so that when you’re not perfect, you can bounce back as quickly as possible. And I think that’s a good mindset to have for both organizations and individuals within the field.

Debbie: Yes, resilience comes up time and time again. When you think about the challenges and also the upsides of cybersecurity, what would you offer as a top tip to people who are interested in transitioning into cybersecurity as a career?

Will: First off, it is a fantastic field to be in even if it does come with challenges. It is one of the most rewarding fields that you can transition into because the work that you’re doing is protecting some of the most important information in the world. You’re protecting both personal and organizational information, and that’s a very rewarding role. I don’t think a lot of other jobs can compete because you’re significantly impacting people’s lives by protecting their digital security.

So, I’d say just recognize how rewarding a field it can be and how it can really be a mission-driven field. It’s also worth thinking about whether or not you like working in a mission-driven field? People are motivated by different things, but if they are truly motivated by what they are doing and the underlying mission, then cyber is where they want to be.

I believe that the people who thrive in cyber and stick to it are those people who are entering it for the right reasons and saying, yes, I do want to have more of a mission-focus to my career. I believe in what I’m going to be doing by protecting people’s digital security and privacy. That can be a strong motivator when you’re up late at night trying to deal with some of the major security issues of your organization. So I would say just have that mindset going in.

No matter what you are interested in, there’s a good chance you will find a place for yourself within the cybersecurity field. In cyber, there are more jobs than just being a hacker. We have a stereotype of the hoodie-wearing hacker in the back. But, there are many other types of cyber jobs.

As a first step, take a self-inventory. What skills do you have? What are the things you like to do? What are you good at? And then do some research to figure out where that can be applied within cybersecurity, since there are many different types of cybersecurity jobs that could be a strong fit for you.

Debbie: What advice would you give to people in the formative years of their cyber career in terms of what to prioritize, what credentials or qualifications to obtain, or what skills to develop that may help them be successful in the early stages of their career?

Will: One of the first things you can do is make sure that you’re going into the right branch of cybersecurity. And this goes back to what we were just talking about: make sure that you do a self-inventory. Take an honest look at what you enjoy doing, what you’re good at doing, what skills you already have, and then figure out where you can apply those within cyber. Maybe you’ll make a great pen tester, maybe you’ll want to be part of cyber policy, or maybe you’ll want to do something entirely different within the cyber landscape. Just make sure that you have a good understanding of what that is and don’t view cyber as this monolithic field where there’s only one particular career pathway that you can take.

Once you’ve done that, there are a couple of things that you can do that I think a lot of people in their formative years within cyber would benefit from. First, figure out what are the most in-demand skill sets, both in terms of the foundational and emerging skills.

A lot of foundational skills will come down to basic networking, computer science, or programming skills. But, it’s also important to find out what some of the emerging skill sets are that you’re going to need to develop capabilities around because the foundational skills are table stakes, but it’s the emerging skills that are really going to help you stand out to employers and further your career within the field once you get your foot in the door.

So what are some of those skills right now? Well, we still see that cloud security is huge. Obviously, everybody’s talking about AI and the intersection of AI with cyber, so learning how to work with new AI-enabled tools is important. And then we also still see that just having more of a risk management mindset as opposed to a compliance or checklist mindset is still highly prioritized by many organizations. Figure out what foundational and emerging skills you can develop to stand out from the crowd.

In addition to that though, I would also say look at different credentials. There are a lot of different certifications or related credentials that can signal to employers that you have some foundational capabilities within cyber and that you’ve put in the effort to earn those credentials. Whether it’s security plus, some of the GAC credentials, or others, there are many excellent entry-level certifications that you can focus on that many employers demand and will help you show that you are motivated to be part of the cyber workforce.

Debbie: You are a great supporter of our annual flagship event, Uniting Women in Cyber (UWIC). What motivated you to get involved in UWIC, and what advice do you have for anyone who’s planning to attend to make the most out of this phenomenal day with people like you?

Will: What motivated me to get involved with UWIC is that it really takes a village. And I think that The Cyber Guild has built a very strong community of like-minded people who are all very supportive of one another and who really want to expand the aperture of the cybersecurity talent pipeline to as many people as possible and really make it as welcoming as possible to different people from different backgrounds. I think that’s really what the field needs. I think for

a long time, there’s been a bit of a branding issue in cybersecurity like what we talked about earlier. There has been a stereotype of the hoodie-wearing hacker typing away in a basement somewhere. And that’s not the only type of person who can thrive within cyber.

Also what you’ve done really helped to build a very welcoming community to as many people as possible. And that’s the kind of community I want to be a part of and I want to support.

One of the main things that I found, as well when I went last year for the first time was just how warm everybody is. I think that sometimes you go to these conferences and it’s very professional and businesslike, and certainly there was plenty of that as well, but everybody was just very welcoming and considerate.

I told somebody afterwards, I don’t think I’ve ever seen so many people hug at a conference before because everybody was just so friendly with one another, and it was just a really, really welcoming environment. That’s exactly what cybersecurity needs, so that we can bring as many people into the field from as many backgrounds as possible so that they feel welcome within the industry.

Debbie: Thank you. I’m really looking forward to this year because we’re going to get hands-on experience with the new Hiring for Skills Toolkit that you helped develop for cyberseek.org. Will, what would you tell your younger self if only you knew then what you know now?

Will: Well, I don’t think we have enough time to list all of the things I’d like to tell my younger self, but I think I would probably just say, be kind to yourself. You’re going to make mistakes, and it’s okay. There’s always going to be some bumps along the road. You’re going to make some really, really dumb decisions, as we all do when we’re young.

Also it’s being able to be resilient, like I talked about earlier, figure out how to bounce back from that and don’t expect to be perfect. Be kind to yourself and accept your faults and try to learn from your losses and come back stronger the next time.

Debbie: Who would you say have been the biggest influencers for you in terms of the way you live your life now and the career trajectory you’re taking?

Will: A great question. I also don’t have enough time to list all of the people who have contributed to where I am today. Like I said, it takes a village, but I think one or two people who stand out to me, one is my grandmother. Growing up, I was very close with her, and I think she was a very inspiring woman for many reasons.

She was a bit of a trailblazer back in her day. I mean, she was my grandfather’s boss back then, and she was an engineer. She was one of the arguably most successful women in her company. She eventually decided to go a different route. When she married my grandfather, she became a homemaker, but she was still a bit of a force of nature, whether it’s in PTA meetings or wherever

it may have been, I’m told that nobody within the school administration and my father’s high school wanted to interact with my grandmother because they knew it was not going to go well if they disagreed on something.

And so I think she’s just somebody who, A, I think had no interest in conforming to stereotypes, and B, really demonstrated what a petite 95 pound, five foot one woman can really do when she sets her mind to something. So she’s definitely somebody who I always looked up to. She was also just an incredibly kind person and was one of the people I was closest with throughout my childhood.

Debbie: Oh, that’s really nice. And what are you reading right now that you can share?

Will: I have what most people would probably call a boring taste in books, but I actually really enjoy reading textbooks and some of the most boring academic literature out there. I just find it fascinating.

A lot of the things I’ve been looking at recently actually relate to the benefits of diversity and diverse thinking within organizations. And there’s actually a little bit of research out there that is starting to use mathematics to explain why more diverse perspectives can actually lead to better outcomes.

I find it fascinating. I won’t go into all of the equations, not that I understand them anyway, but I think one very simple thing that I took away from it that I thought was a good way of describing why diversity can be better than just always hiring the people who do the best on tests or look the best on paper, is that let’s say you give a 10 question exam to three people, and you want to choose the two of those people who are the best.

And let’s say that two of them get eight of the questions and one of them gets six of them right. Most people would say, you want to hire the people who have the eight questions, but what if those two people got all of the same eight questions and the other person got the other two, right, that they got wrong. With diverse perspectives, you can answer all the questions correctly. And so I think that’s something that I’m trying to find ways to apply in some of the work that I do now.

Debbie: Wow, that’s interesting. Well, you’re reading the right things for the job that you’re in! And is there anything on your bucket list that you still haven’t done?

Will: Well, I amazingly have never been to France and I really want to go, so I think I’m probably going to go next year. I guess another thing on my bucket list, maybe I should have led with this, is getting married, which I’m doing in October.

Debbie: Oh, I didn’t realize it was this year. Congratulations!

Will: Yes, thank you. So we’re thinking about going to France for the honeymoon, so maybe I can get two of those checked off the bucket list.