Last year, my kid interviewed me about my job for a school project. One of the questions was "what's the most important trait for someone thinking of going into your field?" I said "natural curiosity." On reflection, I think I was wrong. 1/n
If she asked me again, I'd tell her curiosity is important. But much more important than that is "A commitment to lifelong learning, even when the subject bores the heck out of you." I've heard many talk of the need for constant learning (I do regularly myself). 2/n
What I don't think I've ever heard (or said) is "most of the stuff I learn for my job I have to choke down and I hate every second of it." Commitment to lifelong learning is easy if it's stuff you actually want to learn. I'll note that a lot of infosec isn't. 3/n
GDPR bores the hell out of me, but I can't tell you how many hours I've spent in the last 18 months learning the ins and outs of GDPR. Before that it was PCI. Next, it will be (??). Can you do infosec without torturing yourself in GDPR minutae and just "stay technical?" 4/n
Maybe, but doing so places an arbitrary ceiling on career growth. BTW, I recognize there are those in GRC who love GDPR but don't like technical infosec roles. The same goes for you (just in reverse). Embracing the stuff you don't really want to learn will make you better. 5/n
Prior to infosec, I was a paramedic. I also worked in RF engineering. Neither of those had a similar cadence for required continuing education. Both fields demanded it, but infosec is far worse in the number of immediate changes. 6/n
I've always found one of the best predictors for success in infosec is how well rounded the person is. If someone is an expert in X, I like to ask a question or two about Y & Z. Anecdotally, I feel like this works. Today I think I figured out why. 7/7
