On Moving from industry to consulting

As some of you know, I moved from industry to consulting within the security space just over a year ago. My focus has been and will continue to be Data Protection. Most of what I've done has been design and implementation but will move towards strategy. I'm also getting my feet wet with Security Analytics, hence the sudden interest in Splunk.

My experiences are different from most I've met in security consulting. It's been a refreshing change from me and I'm definitely not regretting it. In fact, I wish I'd done it sooner.

-Most folks I've met are road warriors that travel nearly 75 %. I'm between 25-50% tops.
-I'm working a ton less. I was averaging 50-60 before I left my last company. Now I'm at a pretty consistent 40 hour week. Huzzah for work-life balance.
-My last company had a pretty nuanced view towards remote work which is bonkers while at a global firm and having calls consistently with other corners of the globe. With a little planning, I'm able to work anywhere I've got an internet connection.
- I get to work on all kinds of projects and engagements so I'm developing more professionally. My last year and change at my last company I was in a rut where I wasn't growing.

#consultantlife

Career Realization and snap decisions

So I was recently very lucky in having to deal with two awesome opportunities within my company in the same department:

1. A new role in the same city as my brother and sister-in-law. Since we're all grown up, we haven't lived in the same city for around 10 years, so that'd be cool and interesting. But I just moved and I'd be doing the same thing I'm doing now. This opportunity came to me first and forced me to really consider what I want out of my career in the short term.

2. A role in my current office but my responsibilities would change slightly. I've now got global ownership/major involvement of several large workstreams like DLP, Virtual Desktop, and privileged account management just to name a few. It feels really strange to say that I'm the global lead for initiative xyz as a 20 something that's new to information security but it's really cool and kind of an ego-trip. Also the role is more technical, which is really what I want in the short term.   

I ultimately chose the the role where I'd become the global lead. I wasn't excited about the first opportunity and that's the dead give-away. The more I found out about the 2nd opportunity the more excited and interesting I found it. I actually made the decision in about a day and a half. I know I'm going to be working my tail off but I was anyways so that's nothing new. At least I'll enjoy doing it.

Image credit: Flikr/Somemixedstuff

IT Risk position update

I've been in this role for roughly 3 months now and I'm enjoying it so far. It's kept me challenged and busy the entire time. In my prior roles, I haven't had that. I'm also studying for the CISSP, so that's eating up my free time, but I think it's a worthwhile investment. I've been involved with everything from reports development to working with vendors on security solutions. So this is a great position for a 20 something person that has an interest in IT Risk.

The confusion now is what direction do I want to go in. I mean do I want to focus on governance, resilience, or risk consulting?

That's the next question

UPDATE:Transition to new role

So I started my new role about 3 weeks ago, and so far so good. I'm already getting exposure to the regular issues of the department like IT asset management, vulnerability and audit reporting, working with/pestering PMs on audit issue remediation.

 I'm also working through my transition plan. I did that after reading the First 90 Days. The book talks about how to be successful in any sort of new role.

A few books that I'm reading or in the process of reading that I have found to be interesting/helpful are:

• The First 90 Days - Watkins, Harvard Business Press
• The 7C's of Consulting- Mick Cope (e-book available on Safari/O'Reilly)
• Managing the Unexpected, Weick, Sutcliffe, Jossey-Bass, part of the University of Michigan Business School Series
• several Harvard Business Review readings such as
  Reclaim Your job-Ghosal and Bruch
  Managing your Boss -Gabarro and Kotter
  Managing One's Self-Drucker

Also it looks like I'm going to be taking the CISSP and the CISA by the end of the year. So I'm going to have a very, very busy year.

Transition to new role

I'm transitioning to a new role within my company. I'm moving from the application development area where I work as a Business Analyst to an IT Risk Management role within the same company. This is the field/career path that I really want to get into; but is very different from what I'm doing currently.

I'm excited but a bit scared. Because I'm a 20 something, and I'll be working with people that have a lot more experience than me and consulting on projects for them. I'm just afraid I won't be taken seriously, I guess that means I will have to work twice as hard to be effective.

My old manager has been very supportive of me making this change, but she's sad to see me leave after coming onto the project about 1 year ago.

My new manager is having me put together my transition plan based off of someone that recently joined the group and the organization and tweak it according to my needs. He also had me read a couple of books: The First 90 Days and Career Warfare. I highly recommend The First 90 Days, though Career Warfare is a much easier read.