I've gotten a lot of good feedback form the most recent episode of the Exploring Information Security podcast, "How I got into information security." People seem to like the solo podcast. More importantly a lot of people identify with my story. Some had a similar story. Others appreciated the story as they were in the process of getting into information security.

One such person is Josh Huff. Whom I've gotten to know the several months personally. He's a regular at our ColaSec meetings and recently found his own way into infosec. He shared his story with me.

"I was raised on technology.  I was computing on Commodore 64 at the age of 5 and playing Atari 2600 video games.  So growing up I saw, used and played with most forms of technology as it developed into what it is today. (Does anybody miss Palm Pilots?)  I wasn’t sure what I wanted to study in college.  Since I was comfortable with technology and I liked math and science mechanical engineering was my choice.

Although I learned some awesome things about the business and manufacturing world being an engineer was NOT my calling. I changed my major to business.  I changed colleges a couple of times. Then at some point in my part time college job, I took a promotion into full time retail management.  Now my comfort level with technology was used to teach and sell technology to customers and train my sales staff.  Retail management wasn’t perfect as a career by any means, but it was a good fit for my skill set and I was good at my job.  I was good at it for about 13 years in fact. 

As my son grew older and family time became a much higher priority I had to make a career choice that would get me off the retail work schedule.  So in May of 2015 I started studying everything InfoSec related I could find.  At this point I also quit my job and enrolled in technical college.  I realized all my old college credits weren’t far off from an Associate’s degree.  In just under 2 semesters I got my degree and started looking into how I could land a job in information security.

Podcasts, blogs, an InfoSec twitter feed and security books were my source of guidance.  The biggest challenge with learning this way was “drinking from the fire hose” which means taking in way too much to learn anything.  I was reading about pen testing, malware, lock picking, network sniffing and cryptography.  I researched coding, firewalls, forensics, open source intelligence, networking, vulnerabilities and social engineering.  Everything I read was interesting, but I didn’t know how I proceed to this magical job in security.  I needed to network with real people that were working in security and find out what they do and how they got there. 

I looked online for local meetups.  There were some community groups like a Linux user group, open hack Columbia and something called ColaSec.  ColaSec had a meetup 3 days later.  Plus they said it was an open invitation group, so I just decided to show up to the September meeting.

I wouldn't call myself shy, but getting out of your comfort zone and just going out to meet new people can be tough.  If you are looking to get into security find your local city ‘Sec’ meetup and go!  If the people you meet are half of what I found at ColaSec it will be worth your time.

I walked in, introduced myself as a tech and security enthusiast.  People said hi and gave me pizza and beer.  They were hanging out talking about random security news then a speaker gave a talk about building a security framework.  There was a table in the back with practice locks and lock picks and people were drinking an adult beverage or two.  I HAD FOUND MY PEOPLE!

Once the meeting was over everybody was kind of hanging out so I introduced myself to a few of them.  I met a few people that worked in a Security Operations Center. There was several help desk managers and a technology course instructor present.  There were also people on the job search like me.  A conversation about security conferences led to an invitation to one in Kentucky called Derbycon.  Tickets sold out, but I managed to snag one last minute and headed out of town to my first security conference.

On the way to Derbycon I checked the speaker list. I found that a few authors of my security books plus people from my twitter feed were going to be at this conference.  I decided to meet as many of them as I could.  Derbycon itself is worthy of its own write up, but in short it was awesome. I got to keep meeting and talking with real security professionals. They were open to answering questions and connecting on twitter and I continue to stay in touch with many of them today.  I learned a lot of other people’s career paths that led to information security.

When I got back from Derbycon I felt like I had direction.  I started applying to some help desk and technology jobs to try and get my foot in the door.  I revised my resume and evaluated my past skills into how they could help me in a security related position.  This started a roller coaster process.  As applications and interviews started to pile up frustration started to settle in.  Repeat… wait… apply… repeat.  I had one interview that I thought went well and a few pings on my resume that had placed me into consideration. I felt things were looking up again. The promising job lead fell through.  Then the 'under consideration' jobs decided not to fill the position.  

This is the point in the story where desperation may have kicked in.  I took a hard look at what I wanted from a security job and it wasn’t a help desk spot that I could work my way up from. Open source intelligence (OSINT) was my favorite subject so I decided to find people I could talk to again.  It seemed that military or law enforcement background was a prerequisite for a job in OSINT.  I thought about who I could talk to about this and I looked up private investigation firms in Columbia, SC.  Through the ‘contact us’ part of the PI websites I shot a quick introduction email. I gave a brief description of who I was.  I described what I was studying and asked if they were hiring. I also said if they weren't hiring I would be happy to just talk OSINT and find out how they used it as investigators.  I got a phone call from a private investigator 1 day later. 

I chatted with the investigator for a few minutes and he asked for my resume.  It turns out the background in law enforcement or military wasn’t an issue.  So a few hours later I was called for an interview.  The position wasn’t exactly OSINT, but they had need of a digital forensic analyst.  My technical background led me through the interview with ease.  1st interview led to a 2nd interview which led to a tryout in their computer forensics lab.    The tryout went well and I am now over 3 months into my role as a digital forensics analyst.  I get to work in a forensic lab doing cool stuff with all types of technology and in between cases I talk OSINT with the other investigators.

I’ve listened to a lot of stories about how people got their InfoSec job.  There doesn’t seem to be a defined path or perfect guide out there, but this is my path. I hope by sharing my path that somebody finds some facet of my story that they can apply to their own career path.  If I could re-iterate just once point of my story it is to go out and talk to people.  Information security is about the people that drive the technology.  If you don’t know how to apply information security it in real world scenarios go talk to the people that do.  It will likely be a fun journey."

This post first appeared on Exploring Information Security.