I feel like half of working in the cybersecurity industry is just cultivating your social media persona. It's bizarre. I left a viral up-and-coming startup over it. It was mixing into everyone's personas at work in weird and uncomfortable ways, as someone who doesn't use traditional social media.
Yes, the cybersecurity industry definitely oversells itself on every (social media) channel it can find. But to be fair, it kind of has to. Many people and companies are notoriously lazy about secutity and patching until something goes wrong. So you have to cause a stir, oversell the risk, and create a sense of urgency, to get them to act.
Obviously, there are also some people in cybersecurity who oversell not for the greater good, but only to further their careers... and even those who are honest and would prefer not to self-promote like that, are sort of forced to, because visibility can matter as much (if not more than) expertise when trying to find a job in cybersecurity, as you'll look like an underachiever if you don't oversell yourself like everybody else.
It’s not. Social media personas is most of what gets seen, hence your understandable conclusion. What most don’t see are those who do not give a damn about that and just do the work.
Unfortunately part of some cyber sec jobs is literally doing sales. I remeber in the begging of my career I was offered cyber sec job and the guy hiring me said you will be doing sales and will be reaching out to people on top of your job. I just declined.
So I have been failing to do half of my career this whole time?
The people you hear from are famous personalities... That's the nature of being a famous personality. There are plenty of us who are just normal people with opinions of our own and no desire to cultivate a public name or face for ourselves...
There are a few “social media famous” cybersecurity folks really worth their salt who didn’t immediately dumpster their morals and skills at the first sign of an ego boost.
People like Krebs, Allison Nixon, Joanna Rutkowska.
Most of them though are just addicted to likes as it’s become a core part of their self worth.
I would argue that Krebs is exactly the type of guy who will do anything for a good story, whatever it costs. I saw him lying more than once and this eroded my trust completely.
Most cybersecurity is performative, like war, cybersecurity is mostly boring and if you are doing your job, zero drama. If you want to stand out you need piercings and hot takes.
The pop culture makes you think cybersecurity is wearing black clothes, having wild tatoos and jacking-in the matrix with a dripped up thinkpad while at the back of a nightclub. Turns out, its wearing suit, and showing slide to corporate begging them to have a review process for their firewall and a decommission plan for their 20 years old services made in java 6 and never updated.
True, but I am talking about the whole vibe of security as an industry and how the corporatization of defcon shapes it. The primary issue with security, it is difficult to show efficacy. It is akin to proving a negative. If you are doing your job, no one notices until they have laid you off. You need to be loud, flashy, dangerous, brash to stick around. So now the ecosystem breeds for a signal isn't related to how qualified one was at security.
Yep. First few years is just getting a read on who is accurate, who is precise, and who is both. Lots of alarms going off all the time in this industry.
you'll find egomaniacs in any industry. From experience the people who actually speak regularly at cybersecurity conferences do tend to have a "cult of personality" aura about them. Part of it is industry incentives too. If you have a bunch of stuff on Github / technical blog posts / social media presence it helps a lot finding a job. So I wouldn't necessarily entirely blame them for cultivating a social media persona.
I actually rather like 'SOCMED', given that social networks these days can be weaponized in various ways, so it deserves a name akin to 'OPSEC' and other military-like terms
