[Courses] [Careers] Computer Security career path

[Elwing]

This might get long and rambling, so the first paragraph is the bare 
minimum, and if you want more details, continue reading :)

The short story:

Started with my first computer at 3, went to a high school with no 
computers, went to college, got a job as a sys admin while in school. 
Went to grad school, worked as a sys admin parttime there.  Got hired on 
by Foundstone, learned lots of stuff, took another job with a small 
consulting company.

The longer version:

My dad worked in accounting, they like crunching numbers fast, so he 
always had access to computers, and once I showed an interest in them, 
he bought me one.  From then on I always had a computer, technically it 
was the family's computer, except I was the only one who used it.  We 
moved to a small town in south Texas, and the school had no money, so we 
had no computers.  We still had typewriters for our typing classes (this 
was 1992-1996, so not that long ago).  Friends and I used computers 
outside of school though, and I was introduced to BBSs (until my parents 
discovered that the closest BBS was a long distance phone call).

I got lucky living close to a university, they offered something called 
TexPREP - Pre-Freshman Engineering Program 
(http://w3.panam.edu/~texprep/)  I spent 3 summers in High school being 
introduced to various types of math, engineering and computer science. 
This is where I learned that I could "do computers" for a living.

I went on to graduate from high school, and started at Texas A&M 
majoring in Computer Engineering.  I later changed to majoring in 
Computer Science and minoring in Electrical Engineering, mostly because 
I could take the chip design classes that I wanted to, without having to 
also take Statics and Thermodynamics :)  Against the wishes of my dad, I 
found a job as a lab assistant helping answer questions about FORTRAN. 
I also had my first introduction to UNIX, and I was hooked.  A guy I 
dated introduced me to Slackware, and I've been a unix convert ever since.

That first summer, I worked as a "temporary employee" on the graveyard 
shift babysitting two AS/400 minicomputers.  They were OK, I wasn't 
terribly impressed, but it was work, it paid, and I could study while I 
was at work - and be wide awake for the 7:30am class I had signed up for :)

In the summer of '98 I accepted an internship with INRI - now part of 
Northrup Grumman.  I did some software development on Windows NT, 
porting their existing software from HP-UX to NT.  I was doing mostly 
GUI work, and while I was OK with the job, I wasn't happy for multiple 
reasons: 1) I was working with windows, 2) I discovered I have no 
concept of design, so my GUIS never looked "right", and 3) I discovered 
that while I like coding, it's not something I wanted to do every day 
for anextended period of time.

At the end of the summer, a friend recommended me for a "programming 
assistant" position with the math department at A&M, and I started 
working with them.  I was basically a jr sysadmin with some programming 
thrown in.  I learned a lot about Solaris and Red Hat, and basic 
adminning skills.  I loved it!  Through this position and the remaining 
classes I had, I developed an interest in security.  Primarily host and 
network security, and I took every opportunity to practice my skills.

I also signed up for a graduate level crypto class, which was 
interesting, but a struggle for me since my math background wasn't the 
strongest.  Luckily, I knew exactly where the professor's office was, 
and he was willing to answer a lot of questions - working in the math 
dept had it's advantages.  At this time, I also started taking some of 
the more theoretical computer science classes, and discovering that I 
really didn't like them, kinda sterring me away from "traditional" 
computer science.

My dad was big on education, and once I finished undergraduate, I had 
already been accepted into graduate school at Carnegie Mellon in their 
Information Networking Institute (INI).  The degree of Master of 
Information Networking consisted of Computer Science, Electrical 
Engineering, Business (ick) and Public Policy classes.  I figured, well, 
I like most of it, there's only two classes required in the "business" 
part, I think I can handle this...

I handled most of it.  I went through your stereotypical hell first 
semester.  It was both fun and exhausting at the same time.   I was 
"working" this semester as an admin.  I say "working" because it was 
only 10 hours a week of required work, and usually, we only ended up 
wokring about 3-4 as was needed (I ran the Linux systems, it was a lot 
less work for me :) )

In the following spring, summer and fall, I worked on my thesis and TAed 
for several classes: two Open Source (Linux and Apache) graduate level 
classes, and two undergraduate classes: Java and C.  I got lucky with 
the C class.  I had worked for the professor for a while with his Java 
classes, and he trusted me, and he also ended up having surgery and was 
out for 4 weeks, and I "took over" the class for those 4 weeks.  I 
discovered how much I really enjoy teaching that semester.

I won't mention my thesis other than the experience was miserable, and 
I'm not sure I would ever do it again, primarily due to my advisor.

I finished all my classwork, but not my thesis, so I took a programming 
job at CMU, and I hated it.  I just didn't fit in very well with the 
personalities of the group, and it was extremely nerve wracking.  I did 
get a lot of experience working with network routing protocols, and 
TCP/IP though.  I had continued work on a friend's thesis which allows 
you to take an active TCP connection, "pause" it, and restart it with 
one of the hosts being changed. 
(http://www-2.cs.cmu.edu/~softagents/migsock.html)
I wanted out of this environment more than I could imagine.  I was even 
considering working jobs I knew I wouldn't like, but could do, just to 
be out of there. Luckily, an opportunity came up.

Other students in our program had finished their thesis a semester 
before we did, and one of them was working for Foundstone.  He referred 
me, and they made me an offer to work in DC.  I did penetration testing, 
teaching other people how to crack into machines (the Hacking Exposed 
classes), host configuration reviews, and some source code reviews.

I really enjoyed working for Foundstone. I liked the work, I liked the 
people, but I really hated the travel.  I was a consultant, and we'd be 
travelling about 2 weeks per month, sometimes more, sometimes less.  I 
did it for almost a year, but it took it's toll on me.  I wanted to be 
home to play with my boyfriend and my cats.  I started sort of looking 
for a new position, I wasn't in a hurry though, and I figured I'd wait 
until I found that "perfect" job.  My boyfriend was also looking for a 
job at the time, and I'd scan the Washington Post for positions that he 
might be interested in, and I found one titled "Computer Hacker wanted".

I was extremely intrigued, and I applied.  The President of the company 
sent me an e-mail about two days later wanting to set up an interview. 
The company was Gemini Security Solutions, a small consulting company 
outside the city.  They specialize in PKI, but do software development, 
documentation development, security audits, and pretty much anything 
that has to do with computer security.  I was up front at the interview, 
that I was mostly happy with Foundstone, and I was putting feelers out 
to see if I could find the "perfect" job.  I was also upfront about why 
I was thinking about leaving Foundstone.  I don't mind *some* 
travelling, but the 1-2 wks/month was a bit much.

He told me a lot about the company, what he wanted to do with it, where 
he wanted it to go, how he wanted to get there.  I thought that was 
extremely important because when I interviewed with him, there were 3 
employees including himself :)

I thought about it long and hard.  I was leaving a stable company with 
good benefits, good pay, good people, and going to an unknown smaller 
company, not so great benefits, and unknown stability.  I decided to 
take the chance, and I'm so glad I did.

I've been here for almost a year and a half, things are going well, I 
still like my job, I love the people I work with - kind of important in 
a small group, and I couldn't imagine working anywhere else now.  Some 
of the highlights of the environment: very casual - shorts, jeans, 
t-shirts - unless we're at a client site or clients come visiting, then 
it's usually business casual.  Relaxed work hours.  As long as I work at 
least 40 hrs/wk and get my work done, I can pretty much come and go as I 
please.

The only bad thing about the job is it's in Virginia, I live in Maryland 
- it's a 35mi drive one way, with public transportation not an option - 
it just doesn't come out this far.  Moving to VA might be in the future, 
but I tend against it because of politics and a nesting complex :)

Someday, I'd love to try teaching at the university level again, but I'm 
in no rush.  I'm currently in the part-time faculty pool at the local 
community college, so I may get to teach one or two classes at some point.

I had also flirted with going to law school at one point, enough that I 
had taken the LSAT to get in.  My scores are good for another 3 years, 
so it may still be possible...


Lessons learned:
1) Who you know is more important than how you answer job ads.  All but 
one of my positions was obtained via people I knew. Network, Network, 
Network!
2) Sometimes you gotta get out of a position no matter what it takes.
3) Smaller companies have more leeway in the environment than in pay and 
benefits
4) There are some things you may be good at, but you don't particularly 
enjoy.



Elwing