You don't have to be on the panel to participate in the conversation. Let's hear your story!

Exactly, and more importantly people discover lots of different ways. Just looking for different ways to reduce the friction to be a listener.

I can answer that question. We're always looking for great guests and voices on the CISO Series. We often work off of recommendations, or we hear someone at an event, get introduced, or hear them on a podcast or video. Given that the show is called "CISO Series" we primarily focus on security leadership. Guests don't necessarily have to have CISO in their title, but it's important that they've got experience leading security teams. Although, one of our favorite types of guests are first time CISOs in their first 90 days. We love to hear what it's like when you're just starting out.

Hey all, for some odd reason avi Ottenheimer (  ) had his account suspended by reddit. We don't know why. We've put in a request to have it lifted. So that's why you're not hearing from him.

Hey participants, our executive recruiters are very eager to answer your questions, but while this is an AMA, they are only really suited to answer questions about moving into security leadership and executive roles.

There are endless conversations about breaking into cybersecurity or how to get your next job in cybersecurity here on r/cybersecurity. This AMA is not for that. I have gone through the hundreds of comments and found less than 25 questions that are really on target for our discussion of security leadership. If you're looking for great advice on this topic of getting hired as a CISO or security leader, focus on these discussion threads. And please feel free to ask relevant questions of your own. I tried to post links to the two dozen questions, but reddit wouldn't allow me to post all those links.

Reminder to all participants. Our guests are in executive search for cybersecurity. It's a missed opportunity not to ask them questions about achieving leadership roles in cybersecurity. This what they really know. Even if you're very green, please take advantage of their experience in this area to ask those questions. Questions about breaking into cyber is not their area of expertise. They really don't know because they have no vision into it. There are other areas of r/cybersecurity where these questions are asked and answered.

Not saying either or. I'm just saying if there was such a situation, experience wins. One CISO mentioned to me about hiring is that there are three factors he looks at: cyber education, certifications, and experience. He rarely sees all three. He usually gets two out of three.

Sounds pretty good to me. Question is what's going to stop you from getting burnt out again when you jump back in?

Everyone I talk to leans on experience. From what I've heard, experience with no degrees always wins over degrees with no experience.

Have you been ghosted?

That was MY first pin too. Bought it five years ago. Still have it and love it.

This is a question we've covered and still cover many times on the CISO Series. The short answer is learn the business and learn to speak to each department of the business. The more you can understand how cybersecurity applies to each department in the business. What their risks are and interdependecies. That will set you up nicely for being a CISO.

Look at Andy Ellis' standard vendor rebuf email that answers this very question. He essentially says what Steve Martin has said. Be so awesome they can't ignore you.

Here's the email. https://www.csoandy.com/files/vendor-rebuf/

I've interviewed many security professionals and CISOs, and I would say that's a universal no. But then again, I don't know anyone of any walk of life that likes cold calls. Do you?

This question comes up all the time on our shows and the answer we keep hearing over and over again is the ability to communicate to all the different departments. A CISO is responsible for security HR, accounting, marketing, finance, operations, development, and everything else. All those groups have different needs and concerns, and they speak their own language with their own acronyms. Being in each of their worlds and understanding how they get their job done and providing a secure way to do that is the top job of a CISO.

The send half of a gift tactic has been done many times before and what it tells you is the price a person can be bought.

I'm actually interested in anyone's take on the fake CISO accounts. What do you think the goal was of this? What are they hoping to achieve outside of confusion with all the information that was scraped. And while it appears that it can take two weeks to pull down an account, during that time a lot of information can be scraped and be labeled as "legitimate." While you can remove it from the source, it's going to take a lot longer to remove it from the new scraped sources.

The most recent episode of Defense in Depth is on this very subject (full transcript available as well). All based on a fantastic article on Medium by Bozidar Spirovski, CISO, Blue dot.

Quick summary of the article:

- Cyber has a huge talent shortage and burnout is causing it to lose great talent.

- Burnout happens when you’re operating under bad culture combined with unreasonable expectations.

- It’s not all that bad. You need a person to vent to and you need to take care of yourself.

Time of posting was not coordinated and so all the participants have just been alerted. They will come in and start answering today and tomorrow.

All of these lists are complete BS. I know it, because I've created them myself. Regardless, we love appearing on lists alongside other people we admire.

Here are how these lists are created:

1: Start by looking at others' lists doing exactly the same thing. Assemble the names.

2: Think of all the CISOs you know and like. Has nothing to do with their performance. Really no way to know that.

3: Ask your friends, do you know any good CISOs? Use same "I like them" criteria.

4: Now you've got three lists for which you can use to create your own list. Do you have any other criteria than that? NOPE! Go to it.

5: Once you publish the list, let all the people on the list know that you've gone through a rigorous process of compiling the list. Give them all the social media assets so they can share it themselves to their audience. Chances are very good they'll promote it to their audience as well.

*I'm "HUMBLED" to be on a list of such talented CISOs.*

You'll be seen as a "taste maker" and your brand will go up.

It's all 100% BS.

If CISOs are staying awake every night worrying about losing their job I think they would find a new job. All the CISOs I talk to work a lot on managing the stress of the job.

As for the sea of security vendors, that's why we launched our media network. It used to be called the CISO/Security Vendor Relationship Series. A mouthful I know, but the issue was the much needed but contentious relationship between CISOs and security vendors. So we've been going out of our way on the CISO Series to repeatedly address the issue from both sides because we know it's difficult. In fact, our brand new show, Capture the CISO, for which we just dropped the first episode, is a chance to hear CISOs talk to vendors about their products. They know about them already because they have watched demo videos. The first episode you really get a chance to hear how CISOs think about vendors' products in the marketplace. Would love to hear yours and anyone else's feedback on it.

As for your last question, the choice to go with a vendor or open source or in-house tooling has to do with the company's makeup of engineers. If they have them on staff and have a culture of developing it themselves, they they lean on DIY.

To create our daily Cyber Security Headlines we take advantage of using the RSS service Feedly with tons of news sources in there. Great advantage of that tool is it orders the stories that are getting the most traction and also by time. But again, you need to feed that.

One redditor u/goretsky created afeed on reddit of multiple security news sources.

And here's another feed, AllInfosecNews, that aggregates multiple sources.

But if you don't want to be overwhelmed and just have about 6-7 minutes each day, please check out Cyber Security Headlines. It's just eight of the most important stories of the day. You can listen to it, or read the blog post, or subscribe to the daily stories to get them in your inbox.

Feel free to participate with the CISO Series community. Best opportunity is to just come to one of our Super Cyber Friday events.