Security Confidential S4 E2 Rob Oden

Manoj Tandon:
Hello everyone, welcome to another episode of Dark Rhino Security’s Security Confidential. Today we are honored to have Rob Oden join us. Rob is an Air Force veteran and a cybersecurity architect with over 16 years of experience evaluating, defining, advocating, and driving adoption of policies, programs, strategies, and technologies that advance cybersecurity.

He has multiple talents. His expertise includes cybersecurity, information protection, information rights management, insider threat risk management, certification and accreditation, enterprise architecture, risk management frameworks, and compliance, and some things we can’t talk about because of his background. But we’re honored to have him for two episodes. In the first part today, what we’re going to talk about is Rob’s background and his journey into cybersecurity, because as talented as he is, I think his journey is a unique one and an inspiring one. It would be great for everyone out there that is thinking about transitioning into cybersecurity or wants to make a career of it to take a listen to some of his guidance, roadmap, thoughts, and insights. Welcome to the show, Rob.

Rob Oden:
Thank you for having me. I appreciate it.

Manoj Tandon: Rob, we know you have a great background as a security architect, but what people may not know is a couple of interesting facts. You were on House Hunters, right? That’s a side note, but anybody who wants to search for Rob there… You grew up in Alabama, yeah?

Rob Oden:
South Alabama, or as we know it, LA, Lower Alabama.

Manoj Tandon:
And you spent your first stint with the Air Force. Describe a little bit of this journey. How does someone with a humble beginning get to the place that you are?

Rob Oden:
Well, it’s interesting. When I started my senior year of high school, I had an expectation. I wanted to be a pilot because that’s what I wanted to do. I had applied for the Air Force Academy, and I was looking at some ROTC programs because I was like, “I just want to fly.”

And as happens, a friend of mine and I had a relationship, and a little girl came about from that. So life just changed right in my senior year. Unfortunately, it is a very common story in South Alabama, but I knew that for the life that I wanted to provide for my child, I needed to do something a little bit more. College and the Academy were no longer a viable option.

Talking with my family, I joined the Air Force. It kind of provided, and this is probably common, you know, I had the traditional South Alabama experience. For a long part of my childhood, I did grow up in a trailer park, so much so that I knew the different qualities of trailer parks, from the ones that the cops get called to, to the ones that are a subdivision of themselves.

And so I knew that I wanted to provide for this new child that was coming in. I wanted to give more, and so I joined the Air Force. When I first joined the Air Force, I didn’t know anything about computers. The internet was a thing that rich people had. We didn’t have a computer in the house. There was no Wi-Fi or anything. I had to go to my aunt’s house to have dial-up internet.

Manoj Tandon:
What era was that?

Rob Oden:
This was the 1990s, early 2000s. When I graduated, it was in the early 2000s. DSL and those types of things were coming to the Northeast, but really for Alabama, you had dial-up, and only for those who could afford the computer. So when I joined the Air Force, they asked me, “What do you want to do?” and I made a joke. I’m like, “Well, I want to make money.” So what can I do to make money? And they’re like, “What do you think about computers?” I’m like, “Let’s do it.” That got me an introduction from being this redneck from the sticks to kind of a crash course. Think of it like every week you’re doing a midterm and learning all things about computers. And the Air Force was just like, “If you have a willingness and a desire, we’ll give you the skills.”

Not only did this give me my start for information technology and becoming a technologist, but there was a final class that you take in about a six- to seven-month program. In the final class, they give you a room full of containers. Two rooms, okay? You get split into two teams, and this was my first taste of and desire for cybersecurity.

They said, “Okay, you have to set up a network. Here’s your pipe, your connection. This one’s Langley, this one’s Hickam.” So Hawaii and Virginia, to kind of replicate a couple of known Air Force bases. And you have to build everything. You have, I think it was either four or six hours, to build up the entire network, set up routers, which is the entire infrastructure. And the team who finished first and completely checked off got extra points, about 10 extra points per hundred. And so we did that. We connected everything. The first thing we did was plug in the cable to the line and started setting everything up.

Manoj Tandon:
And this was from ground zero. There was nothing.

Rod Oden:
Nothing. But that was the expectation, that we would go get deployed and set up an entire infrastructure from bare minimum or tap into whatever was locally available. So we connected right into the line to connect us to the other sites, started getting everything set up, and one of the other team members from the other side completely deleted our profiles. They were able to log in. We still had “admin/admin.” They logged in and just started deleting stuff. And we threw our hands up like, “What’s going on?” And the instructor was just like, “If you do that in the real world and somebody does that to you, which they would, you’re going to blame yourself. You did that to yourself.” And I think of that almost 20 years later after that test, and I look at SolarWinds, right? That just had the, “Well, one of our interns shared our very generic, very known password.” And that lesson that started my career as an information technology specialist, and laid the foundation for what I would build for security, was really prevalent. I can’t be mad at the other guy for attacking me if I myself am starting off with open vulnerabilities or my configuration is not right.

Let me first shut my door and lock it before I put valuables in there.

That got me started. I was very lucky. I got to work with some amazing people. I primarily worked with aircraft such as intelligence, surveillance, reconnaissance, so the U-2, the Global Hawk, the Predator. I got really big into UAVs. I got to go to Korea and Iraq and just have an experience where you’re dealing with all information sharing for different levels of sensitivity that need to be protected in some of the craziest climates in the world, and having multiple missions for why you need that information and sharing. So that really started my foundation in information technology. And then all throughout that, cybersecurity was a component of my job, from certification, the Rainbow Series to the DCID 6/3 for those government heads, and then transitioning to what we know as the NIST 800 series and ISO 27001, and some of your PCI and those kinds of compliance requirements. All those things were starting to get built into and getting more thought, instead of just a system checkmark or QA, but more of an enterprise look at how do we do this at scale, and not so much “I got hit, so let me block it,” but taking a step back and going a little bit longer.

Manoj Tandon:
Rob, what you’re describing, one thing that is just occurring to me, is that you took a great deal of responsibility, both personally and professionally, for the situation and made the best of a situation that many others might find very difficult to navigate.

Do you attribute that really to mindset that got you out of that trailer park in Alabama, or is it something more? Is it taking that responsibility and having such a positive outlook and doing it, or is there more to it?

Rob Oden:
I’ve had these conversations. My daughter is now 17 years old. We’ve been able to have some real conversations, and of course I talk to her about her own opportunities and her own challenges that she has in life. And there have been some really deep conversations about, “Do you regret that…?”

I’m like, “Look, yes, it was harder, it was a struggle, and it made me grow up quicker. But being in that situation, where I saw my peers and other classmates have so much more, and me wanting to do that and wanting to do more…”

And then my parents, who, again, we started… I want to clarify, the trailer park is long gone, but both my parents worked, worked, worked. And then by the time that I was graduating, they were able to buy their first home and continue to build their life. And so I saw really great examples of just hard-working men and women trying to carve out a little American dream.

And I also saw my own parents saying, “Look, this is your responsibility. This isn’t something you can shirk.” My father said there’s one qualification to be a man, and that is owning your responsibility. Nothing else. Not how you dress, not how you act. What really makes a man a man is taking your responsibility and owning it.

And I think that drove me to want to do better for myself, for my daughter. I am married now and have two other children, so I’m very lucky to have three beautiful children. But that drive really did come from that.

There’s a concept of the crucible, right? There was the story during the Puritan age of taking an experience at high pressure, high heat, high stress, and taking those impurities inside of you and rising them to the top. And that’s usually the only way we can really find who we are as individuals and people, is by putting us in those high-pressure situations, putting us in situations that make us work. It takes those impurities out of us and it makes us a better version of ourselves.

And I believe that experience did that for me. It made me more focused, more dedicated, and take more ownership of both myself and my career development.

Manoj Tandon:
I think that’s a wonderful, wonderful story. The ideation that tests in life are not meant to destroy us, they are very much meant to be opportunities to evolve, both as people, to a much higher level. And that power rests within.

I think a lot of that, certainly in the school system, is never taught that way. I don’t think that kind of responsibility is taught. And I think sometimes kids who are in those disadvantaged situations have all the talent and the skillset, but they don’t have the guidance on how do I make it.

You had great parents that set a fantastic example and showed you how responsibility works. We do a lot of work with disadvantaged school systems. We try, and cybersecurity is, right now, we have a flipped demand/supply curve. So it’s a great way for a young person starting out to look at it as an opportunity to get out of that situation that they find themselves in right now.

But they oftentimes don’t have that mindset. So I think there’s some interesting things there. One, how do we talk to people about what is possible?

Rob Oden:
Right. So in the trailer park and in the South, there was this crab effect, right? My mama’s family, she’s from New Orleans, and we used to go, when I was a really young child, we used to go on the bayou and get crabs. You take some meat, pull them up, and you put them in a bucket. That’s going to taste fantastic. But the crabs would pull each other down and keep them all in the bucket.

And I actually had a conversation when I first joined the Air Force. I was stationed in Langley Air Force Base in Hampton, Virginia, and I did Big Brother Big Sister. There were some children that I was working with in Section 8 housing, and there was a conversation like, “Well, how can you really relate to me? We have such different backgrounds. You’re from South Alabama; I’m here from Virginia.”

There were discussions about race, the background, all these things. And I was saying, “Look, the mentality, the struggles… absolutely, there are struggles that you have that I’ve never had, and that I can’t relate to as well. But I can share the struggles and the relation of the challenges. And if I’m an example of ‘here’s how I did it,’ take it as just one voice. If what I did doesn’t work for you, look for something else. But know that there are pathways to better yourself, to better your situation.”

I have been very grateful and lucky. I’ve had a lot of people come out and say, “Hey, I see something in you. I’m going to spend a little time. I’m going to share some guidance. I’m going to share some words of wisdom.” They gave me a chance.

And there have been many opportunities where I had failed and I had fallen down, but I think throughout my life I’ve been very grateful to have a lot of people come and say, “I see something in you. I think there’s potential.” And I think for kids to say, “Hey, someone sees that in me,” instead of just being like, “Oh, you’re the trailer park trash. Go get a… you’re going to just do this manual job. You’re in this bucket.”

And I think for kids being able to see that, like, “Hey, if you let someone else tell the story, you’re a supporting character in your own novel.” So you have to be able to take that more on yourself.

But I think people don’t know that they can do that, or feel like it’s so daunting. It’s steps, minor steps. But again, I’ve been very grateful and very lucky for the opportunities I’ve had, and I’ve tried to maximize them. Sometimes I did, sometimes I didn’t, but it’s continuous.

Something else is, and I have conversations with young men primarily for mentoring, and I share my experiences. Life is not a race; it’s a marathon. It’s not a sprint. You’re not going for speed. And it’s not the distance; it’s the competition. A marathon runner is not competing unless you’re like the top three.

Most people who do a marathon aren’t trying to rank with other people. Their biggest competition is themselves. All these people are running, but the person that they’re competing against is not the guy or woman beside them, but themselves.

And I think changing that mentality… I don’t want to generalize, like, “Oh, kids today,” but I do think with social media, this idea of, “Oh, my life isn’t as good as this person on Facebook or Instagram,” instead of focusing on… someone else’s life is their life, and you’re not always going to see what their life is.

The values of somebody else, that’s like trying to wear your dad’s suit; it’s not really going to fit for you. But taking your own life and then running that marathon of what do you want out of your life, how are you trying to build and grow from there, I think is really important.

I think a lot of times we talk about comparison and keeping up with the Joneses, but what’s going to make you happy? Is it more time with your wife and kids? Is it a life adventure? Is it having an impressive title? None of those are better than the others. It’s just what is it you, as an individual, what is your primary goal and driver?

Understanding that and then pursuing that, I think that for me, having that hunger is a constant reminder. I am not better than anyone in this world, but I am better than the man I was yesterday, or at least I attempt to be. And that drive is internal.

Manoj Tandon: I would say maybe you have to have a little bit of an environment that can catalyze that thought process. If you grow up in a household where people are… where the child is abused or they’re constantly exposed to drug use, they may never have the chance. They just may never have the chance.

Because what you describe, that journey… one role that a lot of people love to play is the victim, because it’s the easiest role in the cast, right? You are not responsible for anything. Whatever happened, happened to you. You had no control over it. “Woe is me,” right? That kind of becomes their mantra.

But to become your own hero, you have to take responsibility, and you have to realize exactly that you are your own person, and you have an extraordinary skillset that other people may not. You have to discover what that is and then go for it. The titles don’t matter. The job won’t matter. If you’re passionate about it, I think you will be successful. I’ve never seen a case where someone’s been really passionate about something that they engage in, and they don’t reap some rewards for that extraordinary effort resulting from that passion that was put forward.

Rob Oden:
I would agree with that to a point. One, everybody has different journeys. Everybody has different struggles. And to compare myself to someone who has seen similar economic situations but, as you mentioned, didn’t have supportive parents or had drug issues or had racial inequalities that get added on to it, or even women in IT, from the opportunities that were opened up for me, there are struggles that I had, and then there were a lot of opportunities that I had.

The exception doesn’t make the rule. Just because I’ve been successful from my background doesn’t mean that everyone’s going to be successful. But I think, to your point, that’s just this generic version of successful. I think everybody can take on some level.

If it’s a title or something like that, there are going to be struggles, and you might have to work harder than this other person right beside you, even though you have a similar background. But I do think that you can be your own hero. You’re going to have struggles. Everybody has. And some people are going to have a lot more struggles than I’ve ever faced.

There are people who have… there’s Dr. Kim, who was the Navy SEAL, the doctor, and is now an astronaut, who’s just been phenomenal. If I try to compare any of my successes to him, he went to Harvard. He’s a mere mortal. And I think sometimes we get into that. We look at our struggles and then compare with our peers.

I love having conversations with my peers and checking in. “Hey, how are you doing?” And there are successes. There are a couple of guys I work with that are CISOs of small- and medium-sized organizations and even large ones, and have had phenomenal careers. And I look at that and I’m like, “That’s awesome,” and it motivates me to do what I want to do.

But my success in my career path is all going to be based on what I put into it. And I don’t ever want someone else to look at their career path and be like, “Well, it’s not as good as Rob’s.” Don’t. I’m just a reference. I am not your judge.

And so I think having that internal, “What do you want? What are you going for?” You might have more struggles than me or the next person, but that doesn’t matter. You’ve got to keep churning through it. And I think if you have that mentality, some version of success, as you define it, you will find.

Manoj Tandon:
Let me change direction just a little bit here, then, and ask you: Do you think that to be very successful in the field of cybersecurity, you have to follow a traditional path of education: high school, college, masters, becoming a computer scientist?

Rob Oden:
Absolutely not, with a caveat.

So, I got out of the Air Force and I didn’t have a bachelor’s degree. I was very successful. I had training, I had certificates, and I had a clearance, so there was a job that I was able to take that somebody who had a master’s in science was failing. But that was as far as I could go for my pay scale and the job title I could do without having at least a bachelor’s.

So I went to school full-time. I was doing about 18 credit hours a semester while working full-time to finish my bachelor’s. And then I went straight into my master’s at UVA. And then even now, I’m finishing an MBA at the University of Florida because I want to be an executive in cybersecurity.

To speak where I think the C-level has to be, speaking as peers, I wanted to be able to understand the business, the financial impact, the strategic, all of that. Now, that’s the direction that I want to be in my career. Those things, maybe the formal education process might not be a requirement in some organizations. In some it is. But I thought it would better serve me for that.

But if you’re somebody who wants to be in incident response or reverse-engineering malware, one of our best guys on my team doesn’t have his bachelor’s, but he is wicked smart. He has OSCP, OSCE. He has the certificates. He is just a phenomenally smart guy who understands incident response and can just crawl a network. When he talks, I shut up, and everyone else does as well.

My education doesn’t mean anything from the diplomas or whatever I have when this guy speaks about a problem. I want to understand it because he understands it.

So, depending on how you want to take cybersecurity, there are a lot of different avenues. If you want to be more of the offensive or pen testing or incident response, you can have a lot more leeway on your education and getting your hands dirty. If you want to be DevSecOps, where you’re creating better code or helping people create better code, having more experience actually writing code that you can develop is more beneficial.

But depending on where you want to take your career, and depending on the industries that you want to join, there may or may not be more checkmark-type requirements for you to get past a recruiter. But I do think myself and my peers, as we come into more leadership positions and talk about hiring, there has been an honest conversation about what a degree actually brings to you.

Some places, yes, absolutely, the degree is important for certain positions and titles. But a lot of times it’s having a willingness to show that you have a passion for this. You can show you have a familiarity with how code is provided, IT infrastructure, and the tools. If you want an analyst position, you know how to do that.

And I think that’s growing more and more. But again, there is a caveat that certain industries or even certain companies might have that just because they’re in that mentality. So having degrees isn’t going to hurt you, and they might give you something to differentiate yourself. But I wouldn’t say, “If you don’t have a degree, I can’t do cybersecurity.”

That might be a hurdle where you either have to have additional years of experience, or maybe that company, that’s going to be their hang-up and you have to go to a different company.

Manoj Tandon: I think shattering that myth is really important because we’ve seen it. Some of our best engineers don’t have a college degree, and they’re brilliant. They know the topic inside out, and I would put them up against anybody, against any one of their peers in the industry.

The experience that they’ve had… I follow a lot of people on Twitter, and some of these men and women are just… I feel like I’m drooling over myself. I’m like, “Okay, what are you talking about? Securing Kubernetes?” And they specifically say, “Look, I don’t have a degree. I taught myself how to do this.” And you’re like, “I’m not smarter than that person. Just because I have a degree doesn’t make me better.”

I do think that is a mentality that’s having to change. But with the understanding that I personally don’t think you need a degree to get into the field, that doesn’t mean that it can’t be a hang-up, especially if there’s a specific company you want to work for.

There are going to be certain companies, if you’re going for the Big Four consulting firms, you might have a problem. Or if you’re going into management consulting, you might have some issues there. And again, if you want to have management of cybersecurity, the personnel, the resources, there’s going to be an expectation that you have a college education, and that you have a higher-level college, some type of master’s.

Not required, but there is more and more expectation, especially as the CISO becomes more of a C-level role here. Some of that pedigree might be expected for that position. But Twitter, Netflix, some of these organizations are doing phenomenal work. I’m sure that they’re like, “Yeah, this is the person we want because they’re the most qualified,” not because they went to this MBA school.

It’s been a personal mission of mine to get people educated, quote-unquote, no pun intended there, on this topic. That if you have the desire, the passion, and the talent, don’t let that lack of a degree stop you from pursuing it.

Let me ask you this as well, being an Air Force veteran. We work with an organization called the Seven Eagles Group because we have a lot of veterans inside of our company, and we try and do our best to support the veterans and their transitions from military to civilian life. What we have heard is that it is not easy for veterans to find jobs in the civilian world. Was that your experience, or not?

Rob Oden:
So I was very fortunate, and the Air Force, out of all the branches, their job descriptions, how they describe them, is more of a civilian equivalent, especially if you have an IT background.

First and foremost, getting out of the military is the scariest thing you’ll ever do. I’ve been shot at. I’ve had bombs blow up around me. Getting out of the Air Force was scarier than anything like that.

Manoj Tandon:
Really?

Rob Oden:
Yeah, because it’s like the safety blanket, right? You’re in it. You’re going to go through the “suck.” There are times when you’re just like, “I don’t really like this.” But you have your pay. You’re not going to get fired unless you’re guilty of gross negligence. There’s a stability and expectation of how things are laid out.

You don’t have to worry about putting in for my next duty assignment and getting a resume shot down by multiple companies. You don’t deal with that. And so when you’re transitioning, first and foremost, if you have something that isn’t a one-for-one, it’s hard to show like, “Hey, I have some really valuable insight and experience.” There is almost a different language between vets and civilians, how we describe things. We get into acronyms, and there’s almost a lexicon for all these different things. And for that transition, it’s, “How do I get… I have to change my mindset that I’m no longer in the military. The military doesn’t matter.” I have those experiences, and now I need to convert them to what the civilian sector is looking for. And so much so, it’s not even just the sector; it’s the industry that you’re looking at.

First and foremost, I think there has been a concentrated effort, and one that needs to grow, about working with vets and saying, “What is it you want to do? What have you done? Let’s use a translation service and put it in terms where you’re not getting automatically filtered out by HR systems or HR personnel because we didn’t use the right word or the right phrasing expected for this particular industry.”

Also, I’m hoping it’s changing, but there was a concept of PTSD and potentially military members being too rigorous and not being able to conform and transition to a civilian workplace. Which is funny, because most of us got moved into all these different groups where you have to go and relearn. You have to be moldable. The military is like, “I want you to do X, Y, and Z,” and then next week, you’re doing something completely different. So there is already that, but they’re providing you a detailed playbook on how to do it. Often in the civilian world, you don’t have that. Sometimes, yes, absolutely. Sometimes you have technical orders or processes and procedures. The military was all AFIs, Air Force Instructions, even how you dressed yourself. But there’s a difference. I would say, I used to make the joke that the difference between a consultant and a contractor is you pay a contractor to provide you answers, and you pay a consultant to provide you questions. And as the transition happens, “Okay, here’s what we’re supposed to do.” But if I’m a mid- or senior-enlisted personnel, yes, the order came down, “Do this.”

How that gets implemented, why that gets implemented in a certain way, are there any changes that need to be done? These are strengths that military members can bring to the table. Yes, we are used to standard structure and trying to bring that standard structure. But if you go into a battlefield, if you go to Iraq, that mentality is like, “Yeah.” And that has to break because the plan meeting first contact with the enemy and not surviving is a thing.

So having that flexibility of thought. There are some things about, “Well, this is what the TO says, the procedures say,” and it is a safety blanket. But you take away the benefits that the military culture can bring to it.

If a service member who’s transitioning can just understand that, and understand that from the view of not “this is what I did” but “this is what they need,” and how do I communicate what I’m good at or what I’ve learned to be able to apply for that, I think if we can do better for our service members there, the numbers will be better.

Obviously there’s issues with if you were infantry and trying to be in cybersecurity, there’s a technical skill shortage. But there are members like myself, anyone who’s seeing this who has questions about this, please reach out, that can say, “Hey, go do these online trainings. Go get awareness.” If you like… there are truckers that I follow that, when they stop at rest stops, they’re practicing code and they’re learning Java and all of this. Nathaniel Hawthorne, who wrote The Scarlet Letter, was very famous for quoting, “Any man can educate himself; most just lack the discipline to do so.” Those technical skills we can build, we can share. And those things that made you great in the military can be easily transferable if they know how to communicate how they can be transferable, and are willing to have the constructive criticism on, “Hey, communication has got to change; the expectations are going to change.”

Manoj Tandon:
I’m interrupting you actually, and I probably shouldn’t, but one of the founders of Dark Rhino Security, a gentleman by the name of Tyler Smith, spent a lot of time in Afghanistan in the infantry. And what you were describing there, from infantryman to founder of a cybersecurity company, it was an interesting journey. He understands threat, understands risk, and how to prioritize and lead people. Again, there’s a lot of skillsets. It’s just usually we get hung up on the technical, either you didn’t check this box or what have you. But that can be learned if you show a willingness. You’re right. Often, as an employer, when we’re looking for people, and I’m going to pick on sales because that’s been my background, so I’m just going to pick on that for a second, I can teach someone how to sell, but I can’t teach someone how to be personable.

If you have that, I’m looking for an outlook on life and your approach to dealing with people, your ability to empathize with people, to understand people, to listen, all those soft skills. Your ability to write. I would say one of the great, if you want a great job, know the English language amazingly well. That would be requirement number one. Can you write complete sentences that make sense?

If you can be articulate and you have that mindset, then I can teach you the rest. I can teach you the technology; I can tell you what we sell; I can tell you where it matters and where it doesn’t matter. All those things can be taught. But I can’t teach you the human element of it.

Rob Oden:
That’s interesting because I actually do follow a number of sales personas online. I’m the guy who usually gets hit up with like 30 to 50 emails a day. I get at least five to ten cold calls a day. But I follow this because there’s a partnership. Technologists can’t survive without sales, and sales can’t survive without technology.

We need each other because your product might be able to augment myself or my team to be either more effective or efficient for a problem set, or address it completely greenfield. But that’s never a decision where I’m going to be like, “You know what, I just had this random scripted email that was sent to me, so yes, this is the thing.” It’s building the relationship.

It’s not being “salesy.” Just like all relationships, if you force it, it’s not going to go. But I do agree. I think there are some salespeople that I’ve found it really beneficial to get to know, either on LinkedIn virtually or just in person. And just the understanding that it’s not about a quarter. It’s not about like, “Hey, I’m downloading all this information and you should know it.” But it’s a partnership for, “Hey, here’s a difficult decision, and can I help you lead this?” And I honestly believe that my product or whatever is best.

I’ve never been in a sales job other than scripts, but I hear stories of Mitt Romney and talking about how being a Mormon and going door to door and hearing the rejection, and having that personal connection, helped him be a better businessman and better salesman. Because it’s understanding what you are offering. Understanding rejection is part of it, and building that personality to reach out.

And I do worry… it’s funny, I think cybersecurity is the same way. I can give you the skills, but if you’re not curious, if you’re not wanting to make stuff better, if you want to do status quo, this is not a status quo industry.

Manoj Tandon:
That’s right, not at all. It is the same way I feel that this industry is like you jump into a river that’s going downstream. If you don’t keep swimming, you have to keep swimming just to stay where you are. And you have to put in a significant amount of effort to go upstream.

And if you’re not willing to put in that effort, you’re not willing to constantly be learning, constantly have the humility that you could be wrong, there is no “wise man on the hill” in cybersecurity, because the domain keeps changing second by second.

Rob Oden:
Yeah, absolutely. So if you don’t want to do that, which in some industries, you don’t have to, then don’t get in it, because you’re going to get burned out really quickly, and you’re going to get pushed out.

I could imagine, again, I hear the same thing about sales, having that same thing: “Look, it is just a constant grind.” But I feel like cybersecurity is rewarding in that if you have the drive, you have the curiosity, and if there’s something about just getting it right, that is the most rewarding thing I’ve ever had.

I love my job. I love what I do. I do work some crazy hours sometimes. I do have some challenging problems where I’m just like, “Man, I just need to recharge.” But I love what I do because I feel like I’m providing value. There’s a mission I can support. I have a team of people that I work with, that I learn from and I grow from. My peers also in the industry are so much smarter than me, and so it’s always passing information back and forth.

And even though there’s that constant challenge with constant growth, having that is the most rewarding thing I could ever do. Even if I was a Wall Street broker and just making 10 times the amount of money I was making right now, I don’t think I’d be as satisfied as working what I’m doing right now, for the challenge and just the personal success that I feel.

Manoj Tandon:
It keeps the sense of wonder alive. Absolutely. It’s the whole Sword in the Stone where Merlin goes and says the only thing that you can look forward to in life is that there’s always something for you to learn. And I think that’s very relevant, and it’s driven me in my own career.

Ten years ago, I didn’t think this is what I was going to be doing. Five years ago, I didn’t know which industry. And as I grow, as I learn, as I take advantage of opportunities as they come to me…

Rob Oden:
If I can pass on any words of wisdom, it’s that I believe I’ve had the success, or whatever success I’ve had in my career and what I’ve been able to do, is because I never let my past expectations shackle me to a path.

Sometimes we start off and say, “I have to do X, Y, and Z,” and if I don’t do that, then either I’m a failure or that’s not the right path. Having a North Star, having a goal, and having a desire is fantastic.

But if you want to progress, if you want to grow, and if you want to be fulfilled, you as an individual are going to change throughout your life. Whether you’re 20 years old or 40 years old, the things that are important to you change. They might stay the same, but being able to check in with yourself, with your peers, and with your family, and having the flexibility of saying, “Well, you know what? Maybe this isn’t exactly what I thought I wanted to do, but I’m going to try it. I’m going to have the courage to step out and grow.”

Because growth is never a linear path. It’s messy and all these things, but if you can have that, I feel that your personal satisfaction with where you are isn’t going to be artificial. It isn’t going to be about the Joneses. It’s going to be about you as an individual, what makes you, yourself.

Obviously, keep your true North Star. I look at my career and, as of right now, where I want to progress is I eventually want to be a CISO of a large international organization, having a seat at the table and having the ownership of that mission space. Because it is something, and that is my true North.

Manoj Tandon:
We have no doubt that you’re going to be there sooner than later. And then you’re going to have to come back, and I want to know: Did you really want this? Is it as good as you thought it was going to be?

Rob Oden:
You know, I’ve had some CISOs ask me, “Why?” I’ve had some really great… my own boss, Michael Higgins, who I work for now at L3Harris, over the last eight or nine years, he’s been a wealth of knowledge for me.

And there have been opportunities to take on things that I didn’t think I really wanted to do, but I’ve done that, from working on the presidential task force that I had the opportunity to work on, to taking an opportunity coming down to Florida to work for an aerospace defense contractor.

Taking a “green door” assignment… what it is, is don’t let your path block you into a box. It’s really easy. And just having that humility and flexibility, like if you have a great opportunity, go for it. And the other thing is, never wait for the opportunity to prepare for the opportunity.

If you wait to say, “Okay, I’m going to do this,” and then you’re going to change jobs in three to five years, and then you wait until the fourth year to prepare for that opportunity, if you do that, it might be too late, because when an opportunity comes, it comes. And if you’re constantly waiting for the opportunity to come before you prepare, then it’s already too late.

And I see that for kids, for their curiosity and where they want to grow. Because if you say, “Hey, I’ve done this…” Maybe you’re not quite ready-ready, but doing that preparing sets you up so that you can learn on your feet. Whereas if you just wait, the opportunity comes and you’re trying to do a learning curve and prepare for that as well as do the job, then you’re either not going to feel confident to take it, or you’re setting yourself up for failure.

Manoj Tandon:
And on that note, we’re actually coming up right on the hour here, so we want to be cautious of that. This has been a wonderful discussion.

But what you just stated, that you might not take the job, I’ve seen a lot of people do that. They shouldn’t. Don’t be afraid. Take the job that you might be least comfortable with, if that is the direction in which your compass is taking you. Don’t wait for it. If that opportunity comes, go for it.

Rob Oden:
I actually had one of my mentors speak to me. It was about growth and comfort levels. And I jumped in because I was like, “No, no, I want to do X, Y, and Z.” And he’s like, “Why would you say no before…?” You don’t know if this is, it’s not guaranteed to you. So why would you shut it down before you even have the conversation? Why would you shut down the chance to even fail?

And so I joked. I was like, “Man, you know, I usually tell other people that same advice,” and then I get burned by it myself.

And even for this opportunity here, I was like, “This is truly what they need for this position. It’s really exciting; it’s what I want to do.” But I can see all the areas where I’m lacking, or the imposter syndrome. We can’t talk on cybersecurity without talking about imposter syndrome.

It comes into place and it says, “No, no, you’re not ready yet. Be prepared.” And if you fail, you fail. But if someone’s talking to you and showing interest in you, then you have at least something that they think is worth enough that the other things they can get through.

You’re going to fail in your career, but don’t allow yourself to shut down your own success before you even attempt it.

Manoj Tandon:
I completely agree with that. I think that’s very prevalent, especially for the younger side of us. Actually, younger and then the older, because then we start getting into a comfort level. And I know people who started their career in cybersecurity in their 40s and are phenomenal now.

So just take that chance. Worst case, you fail, but you can learn from that. And you constantly move forward. Fail forward. Just keep moving, and you’ll be just blown away, based off my own experience, of what you can achieve when you just keep moving forward.

That is a great note to end this segment on. And when we come back for part two, everyone who’s listening, stay tuned because we’re going to get into some really interesting cybersecurity topics.

But Rob, thank you so much for providing these insights. And I hope, to everyone that’s listening, there’s some inspiration, and you can find the passion in yourself to pursue.

Rob Oden:
That’s exactly right. Thank you.

Manoj Tandon:
Thank you.

Rob Oden:
Thank you.