The Role of Cybersecurity Mentorship in Cyber Threat Intelligence (Part 1)

Blog authors: John Dolye, Selena Larson, Fletus PostonFletus Poston

“It can be hard to know where to start in the #cybersecurity field. Good news is there isn't just one way in. Listen to the 2022 New2Cyber Panel for success stories from renowned industry experts for inspiration on how to start your journey in cyber security.” -Fletus Poston, SANS Instructor Candidate BLUF:

• Mentorship is a critically important career aid designed to empower individuals looking to grow professionally.
• The most successful mentorship opportunities rely on the mentee driving the relationship; identifying and recruiting the right mentor; establishing mentorship goals and objectives; and taking follow up actions between mentoring sessions.
• Most individuals benefit from having multiple mentors, some of which within one’s immediate team or business unit while others outside of it and at varying levels to impart wisdom and provide alternative perspective that otherwise is inaccessible.
• Mentorship often requires individuals to operate outside their social and professional comfort zones.
• Mentors and mentees should approach the process with empathy, remembering that asking for help isn’t easy and we all were new at one point.
• Finding the right mentor can be tricky. Sometimes prospective mentors are already over committed and will politely decline your request. Don’t take rejection personally! It gets easier over time.

Overview

Mentorship means different things to different people and is an area not often appreciated until a later point in one's career. Mentorship, however, is an easily accessible tool that new, junior or transitioning cyber security professionals can use to jumpstart their career.

Often, little emphasis is placed on mentorship during most organizations’ on-boarding processes and is often subjectively left to individual managers to explain, encourage, and sometimes help establish a mentor-mentee connection. The lack of organizational prioritization inadvertently understates the importance of mentorship, instead leaving individuals who seek to grow professional skills and organizational reach, spending more effort over longer time horizons to find champions to help them identify development pathways, develop growth roadmaps, and foster meaningful professional connections.

In this first blog post in our two-part mentorship series, we seek to raise awareness on the benefits of mentoring and how identifying mentors from different disciplines can help further your career ambitions. We also address common barriers to mentorship that exist – some self-imposed and some organizationally imposed. In the second blog post, will provide a list of resources and areas where individuals seeking mentorship can turn to as a starting point in their journey.

Defining Mentorship

Mentorship can be defined as the relationship between two individuals -- a mentor and a mentee -- to drive professional growth, provide insights, offer perspective diverse from one's existing frame of reference, flag opportunities, or open figurative doors through introductions. Mentors draw on their experience and professional experience and, in effect, act as a combination of a coach and cheerleader while acting as an accountability mechanism to the mentee.

• Mentors and mentees should define expectations during an introductory meeting, which can serve as an informational interview to understand a mentee's aspirational goals, identify areas the mentor can assist, and determine the cadence and frequency of upcoming meetings. Often in subsequent meetings action items or homework assignments are defined then discussed.

Mentors can be within one's organization, inside or outside one's team, or can be an industry peer. Categorizing mentors by type can help a mentee identify potential gaps such as a peer mentor or senior leader. Having a mentor within the same job role in an organization can lend itself naturally to building skills to be successful in that current role while also identifying organizational dynamic worth knowing like career ladders, growth pathways, and what training opportunities exist. Expanding beyond the current organizational team or department provides additional perspective on other verticals the company operates in; how the roles, responsibilities, and culture vary; and potential integration points for collaboration and innovation.

• For example, to the variety of skills and experience applicable to cyber threat intelligence (CTI), valuable mentors can be found outside CTI or digital forensics and incident response (DFIR) teams. This can include those with experience in national security, customer relations, writing and editing, engineering, or communications. Such relationships can help develop or improve skills and provide unique insight or feedback applicable to a CTI role.
• Having a mentor in a  management or leadership role outside of your existing reporting chain of command can provide historical perspective and context on the inner workings of the organization to help better plan for what comes next, explaining elements that are often not codified like what transpires in promotion panel discussions, why certain career tracks were defined the way they are, and how to align idea pitches to resonate with the business' direction. It is beneficial particularly later in one's career to have mentors at multiple organizational levels and across different parts of an organization or industry. Mentors at this level can assist by recalling stories from their experience, providing general advice, or can be a partner in sound boarding to devise one or more solutions to a particular problem set.

Irrespective of the mentor's role, it is incumbent upon the mentee to drive the relationship. This is often one of the more misunderstood elements when one is initially introduced to the concept of mentorship. To get the most out of a mentor-mentee relationship, it will require the mentee being open, transparent, and sometimes vulnerable, addressing existing deficiencies to determine strategies and pathways to address them. The cyber security industry has no shortage of talented individuals in it that take pride in their work, which makes this sometimes a bit of a challenge because a deficiency is perceived as a weakness, though it shouldn't be. In any of the sub-disciplines in cyber security it takes years to amass the knowledge base and experience across its breadth and depth. This stigma of imposter syndrome fades the further one gets in their career and, instead is used as a form of self-awareness, allowing individuals to engage peers with complementary skills that augment their own.

Barriers to Mentorship

At its core, there are three primary factors that act as impediments to mentoring: awareness, accessibility, and approachability. Common reasons we have come across on why individuals don’t engage in mentoring corroborate this line of thought:

• “I don't know where to begin though it sounds important.”
• “I've never had one, so I don't know how to approach it.” (Authors’ note: You probably have, but just not coined it as such.)
• “It sounds like it will take effort and planning.”
• “It's hard; it's scary.”
• “What if I don't carry my own weight.”
• ”What if I am not  good enough to have a mentor?”

As practitioners, especially starting a new job, it is natural to emplace a bulk of one's focus on learning the role; its responsibilities; the technologies and systems used; team members and team operating processes. If you are lucky, there will be a team on-boarding guide that acts as a documented, knowledge capture designed to help new members integrate effectively, reducing time needed to otherwise spin up to become an active contributor.

• Such a guide may contain links to organization centric websites that could include communities of interest, such as Employee Resource Groups (ERGs). which can be used to build informal mentorship. More often than not on-boarding guides won't contain much on mentorship and, in the rare cases they do, it won't be representative of industry community, organizational, and organic mentorship conduits. 

One common barrier to mentorship is imposter syndrome. This manifests in self-doubt, uncertainty, and anxiety in one’s role and career progression despite typically being a high-performing individual. Imposter syndrome can cause negative self-talk and beliefs including someone thinking they are not deserving of mentorship or time spent with a leader in an organization. There are many ways to manage and overcome imposter syndrome, and in fact having a positive mentor/mentee relationship can be one of them. Just remember, we all started at the same place, and everyone is on their own journey of personal and professional growth and development.

Finding individuals that can serve as mentors and then approaching them tend to be the hardest part of the mentorship process. While we save the discussion on opportunities to find them for the next blog post, it is worth spending a moment on approachability.

Smart individuals, particularly those who may have very deep knowledge that you want to figure out how to grow in may sometimes appear unapproachable due to mannerisms or because they are socially obtuse. Try not to let this turn you off. John, one of the authors of the blog, has been told he is very stoic and hard to read and sometimes not the best at conveying himself in written text; however, he is quite passionate and always willing to help others how he can.

• You are likely to find others like John within your organization or at industry events. Your best bet is to not let it dissuade initial contact and gauge a feel for their character, willingness to help out, or your desire to interact based on one or more direct interactions.
• One thing we all share in this field is that we did not magically find ourselves with deeply rooted skills overnight. Instead, most of us spent several years working to hone our craft and, as such, empathize with the plight others face to do the same. That lends itself naturally towards having an altruistic drive towards helping grow the next generation of practitioners. If you are interested in exploring this and related elements of the role of empathy in this field, check out this blog post.

Conclusion

Mentorship is a critically important career aid designed to empower individuals looking to grow professionally, irrespective of if you are just starting your career journey or are a seasoned practitioner. Everyone can benefit from mentorship and finding a mentor earlier in one’s career can help springboard their career journey. Often having multiple mentors in different places and at different levels will provide an array of perspective to help inform your career decisions. The focus of the second blog in this will be on how to find opportunities to meet mentors with a particular eye towards those in the cyber threat intelligence field.