Hello world: on finding my voice

I originally published this blog post on my personal blog, and now that I’m at Red Canary, I wanted to reshare it here because I’ve heard from many people that they’ve found it helpful. My hope is that by sharing my story, I’ll help others find a little more confidence in themselves, especially other women and underrepresented minorities working in infosec.

I started working in cybersecurity close to ten years ago, and for most of that time I’ve worked as a cyber threat analyst. I contributed to my teams and my small community of partner organizations, and I’m confident that those who worked with me would vouch that I was a great analyst. However, it wasn’t until a couple years ago that I realized something: I was holding back my ideas. Sure, I spoke up often, but for anything big/new/controversial/risky/challenging, I tended to keep my mouth shut.

One day, I had an idea to give a really cool briefing at a community meeting about research my team had done that I thought would be useful to share. But almost as soon as I had the idea, I rejected it in my mind. “There’s no way I’ll get permission to brief that,” I thought. “And even if I did, the presenters at that meeting are too good, I wouldn’t live up to that.” A couple months later, I mentioned the idea to some trusted teammates. “Um, yeah, that would be an awesome briefing,” they told me. “Why don’t you ask if you can do it?”

So I did. As it turned out, my leadership supported me, I gave an awesome briefing, and I was then asked to give it again because someone in the audience liked it so much. More importantly, I shared knowledge and insight with the community that they wouldn’t have heard if I hadn’t given the briefing.

After that, something started to shift in me because I had seen what happened when I had an idea and acted upon it.

A few months later, I decided to devote more time to my role on the MITRE ATT&CK® team. Being on the ATT&CK team happened to be the perfect place for me to try out what would happen when I spoke up about an idea. Once I started speaking up and putting myself out there, it was amazing to see what happened. Within a few months, I had spoken at conferences, recorded podcasts, and written blog posts. It was all a bit surreal to me, and it still is!

And why did all this happen? Some of it was because I was talking about something of interest to the community (ATT&CK), but it also happened because I was willing to put myself out there. I decided to get out of my own way.

What else had I been holding back?

I started to reflect back on all the times I had something to say in a meeting but didn’t. All the times I never brought up an idea because I feared people would hate it. All the times I defeated my own idea before giving myself a chance to mention it to my teammates. When I thought about this, I realized how much I sold myself (and my teams) short over so many years. I told myself how ridiculous it was to hold back out of fear, and that I would start using my voice as much as I could.

I have a sneaking suspicion that I’m not alone in having held back my ideas, and I suspect this self-defeating pattern is particularly prevalent among women and underrepresented minorities in this field. I’m not gonna lie, it can be especially tough to speak up when you’re the only woman in the room. But if we don’t start speaking up, we risk getting left behind even more—so we have to change this.

What do I think others can learn from my experience?

1: Seriously, just get out of your own way!

Don’t defeat a thought you have before you’ve even said it out loud. Have you ever been in a meeting and thought “I have a much better idea of how we could do this,” but not said anything because you weren’t sure how people would react, or you were scared, or you weren’t sure if it would work? That’s what I’m talking about. Work to identify times when you defeat yourself before you’ve even tried. I started watching out for these moments, and I was shocked at how often I did this to myself. You can start small with something like speaking up at a meeting. As you practice the skill of ignoring that voice of doubt in your head, you’ll find it becomes easier to do.

2: Surround yourself with people who lift you up.

A key reason I gave that briefing in the first place was that my teammates encouraged me when I brought up the idea. I’ve had success on the ATT&CK team because my teammates and leadership have supported and advocated for me. I realize not everyone is so lucky to have coworkers that are this supportive, so I encourage you to find the people who support you. Maybe it’s someone you met at a conference, a teacher from a class you’ve taken, or someone who responded to a Twitter DM. In spite of the toxicity that sometimes bubbles up in the infosec community (and we’ve seen that as of late), there are good people who want to lift others up and help them succeed. It may take some searching, but work to find those people who will listen to your ideas and help turn them into reality.

3: Be persistent.

It won’t always be smooth going as you try to suggest ideas. I was rejected from the first conference I submitted to, and I know there will be many more rejections in my future. Sometimes your ideas won’t work or the people you suggest them to won’t be interested. And that’s okay! Keep at it and keep trying — just because you fail once doesn’t mean you’ll fail every time. If you have a great idea, it’s often a matter of suggesting it to different people at different times to find the right fit.

Finding your voice

I hope this post helps you remember that your thoughts and opinions matter, and sometimes all you need to do is get out of your own way to find your voice to allow yourself to share them. I also hope you’ll remember that we all have a role in amplifying the voices of others—think about how you can help lift someone else up.

I recognize that everyone’s journey won’t be the same as mine. Many of you don’t want to have a public voice or present at conferences, and I respect that. Regardless of your path in infosec, I encourage you to stop holding back your amazing ideas because you’re fearful of failing. Our field has too many challenges for any of us to defeat ourselves before we’ve even tried. Who knows what idea you’ll have that could change this industry? We need you too much for you to stay quiet.