Breaking Into Cybersecurity: Soft Skills, Networking & Standing Out in a Crowded Market

Aaron Crow: Thank you everybody for joining me on another episode of the PrOTect IT All podcast. I'm really excited about today's episode. I didn't know Rob before this whole interaction, which is one of the reasons I do this podcast. I get to meet some really interesting people, and there's always something I can learn. The goal is that anybody listening can learn from us too. Rob, thank you for taking the time. Why don't you introduce yourself, tell the audience who you are, and share a little about yourself.

Robert Whetstine: I appreciate you letting me come hang out. For anyone listening, I've been in technology for about 25 to 30 years. My whole life has been kind of a computer nerd, tech nerd, and gaming aficionado. I build movie props in my free time. And then I give back to the community a lot. That's what I'm really passionate about: doing podcasts like this, educating people, mentoring, and just being a good steward to this community. We need a lot more people giving back and a lot fewer selling cert programs or boot camps.

Aaron Crow: Before we started officially recording, we were talking about how we have these side hustles. Sometimes when I reach out to folks about the podcast, I get the first Heisman, which I understand because the LinkedIn hustle is strong. Their first message is, "Hey, I've got this stuff I want you to buy. Let me do a demo." So I get why people are hesitant when I reach out. My response is usually, "Cool, I'm not selling you anything. Here's my podcast, go look at it." Share a little of your story. You were dark, and now you're all over the place on LinkedIn.

Robert Whetstine: I was at a Fortune 100 for 20 years of my career. I got laid off like a lot of technical people. My recruiters said, "Hey, I can't find you online." I said, "Yeah, I'm a professional hacker and a social engineer. Why would I be online?" They said, "Well, even when I search your name, I can't find that you exist." I said, "Yeah, I control the top 10 results on Google. Everything that says Robert Whetstine is controlled by me. Even the people who look real are controlled by me." I had a bot I wrote that was making random posts, which became way easier when AI came around. I'd just have it randomly script stuff and repost to stay high in the algorithm.

They said, "That's great, but because of fake resumes, fake stuff, and nation-state actors, your resume looks really impressive, but everyone's going to think you're a liar." I said, "OK, what do I need to do?" "You need to build a LinkedIn account first." I can't tell you how many times I've used LinkedIn for OSINT, gaining access to people's data and building social trust. "Hey, I love golfing too." All the different things people post.

I begrudgingly called my friend and said, "I need you to build me a LinkedIn, and I need it to be terrible. Grab the worst photo you have of me, write a terrible synopsis, and send me the username and password. My autism and ADHD will kick in and I'll have to fix it." I ended up going a little too hard. Built a podcast brand, got sponsors. Now I talk all over the world. I'm not a social person. I've never been. I've had to teach myself social skills. I went from a guy who couldn't stand in front of two people to somebody last month who stood on a stage at Zero Trust World, a hundred-foot-long stage with a 30-foot picture of my own head.

I've only been on LinkedIn for three years, but it's all designed to make it look like I've been there forever. If you scroll all the way down, the photos on my original videos are me with darker hair. So it looks like I'd been there many years. I did that to create the illusion that I wasn't a new account, so people would be more comfortable having a conversation with me. It changed everything. I went from getting no callbacks to massive companies, Netflix, Amazon, Google, reaching out to me.

It both was really cool and it pissed me off, because this field attracts non-neurotypical people. If you're expecting them to be social and also have technical skills, that's a very rare combo. People who are really technical and can also get on a stage and talk are few. That's why the dockets at conferences are so hard to fill, and why you see the same people all the time. But it's so critical now, because if you're unemployed and you're not actively engaging on LinkedIn, you're going to be passed up. That first impression has become your LinkedIn, which is wild.

Aaron Crow: What I love about that story is I want to dive into it. I'm sure you get people asking, "How do I get into cyber? How do I get into this?" Half my career, more than half, I spent super technical, hands on keyboard. I did not have the best bedside manner. I'd strong-arm people because I was smarter than you. That *Saturday Night Live* "just move, get out of the way, I'll do it for you" sketch, that was me.

There was a part in my career where the company brought in a third-party consultant who created this thing they called Leadership Circle. They took a hundred people out of our company, all engineers, technical people, and said, "What got you here won't get you there. We want to teach you these softer skills." Man, I hated it. Book reports, public speaking, case studies. I despised it, but I was good at it. I didn't like it and it was uncomfortable, but I was good at it. They promoted the top 10% to the second year, went harder to the paint, and I ended up doing three years. Looking back, it was one of the most pivotal things in my career trajectory. I went to EY as a consultant, senior manager, on partner path, became a CTO at a software company. I never would have done those things, not because I wasn't smart enough, but because I wasn't able to have those conversations. Those softer skills became my superpower. I can talk technical, and I can also talk the other side. Most people don't think about that.

Robert Whetstine: For anyone listening, it is becoming the most critical skill. I work as an executive for a Fortune 500. I've hired multiple people over the last few years. I will hire someone with less technical skill but a better personality, who can express what they like and shows more passion, over anything else. I can teach you technical. I can't teach you not to be a jerk.

I have what's called *all* of the HD. Autism and ADHD. I get really engaged in the conversation. I'm interrupting, talking over people, coming off very aggressive. I didn't realize it in my twenties. I had a leader, and I still love her for this. She pulled me aside and said, "Everyone hates you." I said, "I need more context." "Every time someone's struggling, you jump in and help them immediately. Every time someone's wrong, you correct them to make sure they're right." "I'm such an ass. I'm helpful, and I don't want people to be wrong."

Then she asked a pivotal question that still sits with me. "Rob, what is your greatest teacher?" "Failure." "What are you taking away from people when you just instantly help them? The ability to fail. Why do you think you're so smart that just because you failed, they're going to fail? That's arrogance and hubris."

"Everyone hates you because you outwork everyone. You don't stop working. You absolutely kill yourself for the job because you don't operate like normal people do." I said, "Let me understand what you're asking. You want me to stop being an overworker and let people be stupid and wrong?" She said yes. "Why?" "You will get further in your career supporting people and allowing them to fail than you ever will bowling them over trying to push your agenda. If you're wondering why your mobile and IOT policies have not been accepted yet, it's because they're *your* policies."

"So what if I give just a partial idea and actively pretend to be dumber than I am?" "Then people will be more comfortable around you. They'll feel like they're part of the solution, not bowled over." That was a moment. I had actively alienated people. I had insulted people without realizing, and was completely unaware.

Fast forward to my diagnosis of autism in my forties. I literally didn't understand social skills. I spent the last decade studying micro expressions, body language, understanding when I was upsetting someone. I used that in my social engineering career too. I could tell if I was pushing too hard, if I was about to break someone to get access to a building. Those skills became invaluable. I'd thought people were idiots, but the reality was I was the idiot. As a leader, if you come to the table with a completely thought-out plan that's perfectly executed, everyone will agree, even if it's a stupid idea. But if you come with a partial idea, "Hey, I'm trying to do X," you can work on it together. Then it's a plan everyone is invested in.

One of the biggest things on my team: I create an environment where failure is not only accepted, it's expected. We're trying to break boundaries, trying to do innovative things. We fail with style. Buzz Lightyear: falling with style.

Aaron Crow: I built out teams, large and small, and had to work with people. Way back, before my OT days, I was at AT&T as a global domain admin. We were doing Exchange 5.5 to 2000 migrations. I joined, and right after, three people quit, one got laid off. I ended up the only man standing, managing 300 Exchange servers in the data center. This was before remote work was a thing, and even if you had it, physical servers had to be swapped. I was racking, stacking, doing the whole thing.

We went through a hiring process. My manager hired a person from Microsoft who had worked on Exchange, one of its designers. Amazing on paper. But the question she didn't ask: at Microsoft, in that SDLC process, this person was the best in the world at one tiny sub-component of Exchange. She'd never done onboarding. She'd never supported Exchange. She supported this one little sub-function. I didn't need that. I needed somebody who could rack a server and migrate user accounts.

Robert Whetstine: And could have a conversation with an engineer without making them feel like an ass. That skillset is something technical people have to learn. It's not inherent. If you're looking for opportunities and not getting up, presenting, putting yourself in uncomfortable situations and growing as a human, you're going to really struggle during interviews. 80% of managers don't get leadership training. Most leaders are technical people who were told at some point they should lead. They have no concept of what leadership looks like, so they become authoritarian. Do it my way and shut up. They don't understand the value of servant leadership.

The people interviewing you have limited social skills. They're very technical, and they're going to go off vibe. "How do I feel with this dude? Could I have a beer with this lady? After a 10-hour day, am I going to want to strangle them?" It has nothing to do with your technical. It's, "Do I want to hang out with you?" And it's become more of a popularity contest because there are so many people applying. My senior role got 800 applications in the first three days. My junior role got 900 in the first 24 hours. I hired an entry-level person at a Fortune 500 with zero experience. We interviewed 15, and 10 didn't even do the research on the job. One used ChatGPT. Just be genuine, be honest, and just be yourself. We can see right through it.

Aaron Crow: And it's 100 times worse than it was. I was laid off a while ago, and because of the presence I have on LinkedIn, things worked out. Am I the smartest person in the world? No. But people know who I am, and I have this podcast. You've talked to me off and on camera, I'm the same person. I'm not pretending.

Robert Whetstine: You and I are more genuine in our approach. There are a lot of people in our field who practice what I call security theater. They're very good at pretending they know what they're doing and telling you that you're wrong, but they don't have an original thought. They're so adamant on protecting themselves, they're not willing to lift others up.

Being relevant as we age out of cyber, and there *is* an age-out, 40-plus, finding a job is going to be exponentially harder. The hacker I hired recently for my pen-test team had interviewed for a bunch of places. They loved him. The second he got on camera and they realized he was a 40-50 year old with gray hair, the tone changed. Ageism is real. In senior leadership it's a little okay because leadership roles go to internal people. If you hire someone outside, they better be the best of the best, or the internal candidates who applied will look at that person's pedigree and think, "I'm smarter and better than that guy." You've now lost one or two people.

It's a weird environment. People believe being smart is enough. It was 10 years ago. It's not anymore. It's so much about social skills and being able to talk. I can't tell you how many engineers are brilliant, but if I ask them to explain a firewall as if to a child, they go, "Well, a packet travels through." "I don't know what a packet is." "You build out the DMZ." "I don't know what a DMZ is." They keep going because they only know how to talk to techs. Even if you're leading an engineering team, you have to position your story, talk to people, not talk down to them. That's human decency. You want people to feel like a partner, not inferior.

There was a moment. For my 40th birthday, we went to an escape room. All my friends are non-neurotypical, evil geniuses. We grabbed my one friend who's a smart guy, but he's more the normal dude. We get in, my friend who used to be a code breaker looks at the wall and says, "That locker over there, try 17-15-22." Boom, unlocked. Then we do this, then that. We're sitting there for an hour. Someone comes in and says, "We couldn't beat it, how the hell did you solve these things?" "Solve what?" "This puzzle requires you to solve three other puzzles to get the codes. If you don't solve those, you don't get the pieces." "Your puzzle's broken, then." "No one can just look at a code on a wall and figure it out." "Well, this freaking dude can." "You broke the game."

It's the perfect situation where having somebody who takes you through the steps, as opposed to the smartest guy in the room going, "Hey, try this," really matters. We broke a hard escape room, and they said no one had ever solved the fourth puzzle without solving the other three. We assumed we were smarter than the puzzle, and we were, but we still ended up stuck.

Aaron Crow: I'm fortunate in my career path. Early on, it was about being the smartest. Somewhere along the way, Leadership Circle, then Ernst & Young Big Four consulting, there are so many soft skills you're forced to do. When I look back, there's not a job I can remember applying for blindly. Every job I've had is because I knew somebody who said, "You'd be a good fit," or "I want to hire you, let me build a role." I've had both.

Robert Whetstine: I always joke, "I've never applied for a role I actually qualified for." The mobile IOT role at the Fortune 100 is a great example. I got the job specifically because of how I answered one question. I went through eight hours of interviews at Disney. The question that got me the job was, "Which role do you want? You applied for the mobile IOT role and the PC desktop role." I said, "I could do PC desktop in my sleep, but I'll be bored in two years. I didn't even know what IOT meant when I applied. I've spent the last three weeks researching and I'm absolutely obsessed." "Tell me a story." I told her about the Coke machine hacked at a school through default IOT credentials. "I just became obsessed with the technology." That 10 seconds out of nine hours of interviewing got me the job. She wanted passion. It was the first role they'd ever hired for IOT security. I got to work on MagicBand, do the cool technology at Star Wars Land. An unbelievable opportunity. It required a very specific, obsessive mind.

Most people in technology are in it for the paycheck, not the obsession. I talk to kids, "Why do you want to go into technology?" "I was told I could get six figures." "That's not going to happen for years. Entry level is $35K-$55K. You can make more as a barista. Why are you going in? Do you like terrible hours? Does your spouse understand what that looks like? Are you going to get on a podcast at 7:30 in the morning? Continue to build your brand and career? Dedicate all that time to educating and teaching?" "No, I just want to make six figures and work 40 hours." Cool. This isn't a career for you. It's a rough job. The reason it paid so much for so long is nobody wanted to do it. Now everyone wants to do it, and it doesn't pay that much anymore.

When I was going for job interviews, I got offered a CISO role at a top-1000 company for $160K with a $30K bonus. Sounds like a lot, but that same role five, six years ago was a quarter to half a million. The market is so oversaturated, they don't need to pay.

Aaron Crow: That passion matters. If you're just looking for a paycheck, go be a plumber or an electrician. You'll make way more.

Robert Whetstine: Electrician. That's where the cash is going to be long-term. College is rigged. I was a poor kid. My option was eating or college. I wasn't going $100K in debt to show I had the skills. I was already in IT. I'd already built my own company by 20. What was I going to do? Go to college for four years, spend $100K to come out making the same money I'm making now? It's limited my growth because certain leaders really are specific about a degree. Those leaders normally graduated from fancy colleges and believe a degree truly matters. That mindset, I call it "schoolism," is not going to be in charge forever. The new brood, people like Aaron and me, is moving into senior leadership.

I have not opened a single role in my entire career that required education. I'm not going to put barriers between myself and somebody who can't afford it. As a dude who was living on the street at 18, I'm not going to be the one who says, "Sorry, you couldn't afford an education, you're never going to get an opportunity."

But there are a lot of leaders like that. Disney has implemented a new policy: if you don't have a bachelor's, you can't apply for a senior role, unless you have a bachelor's or 15 years of experience. The role I previously held as head of security DevOps, I can no longer apply for. It's just another gate they're doing to make it harder, a filter for lazy companies. Education is not a requirement for this field. Curiosity is. Passion.

Aaron Crow: There's a back door too. Same thing. Big Four consulting, I don't have a degree. Every step, HR would say, "We can't put you in that because you don't have this checkbox. We can hire you at this level, but you'll never make it to the next level." I denied them. They ended up hiring me at a higher role a year later. Within a year I was promoted to senior manager, which I was told I'd never be able to do because I don't have a degree.

Robert Whetstine: I was told I'd never be an executive. I was sat down with my leader and given a stern talking-to about how I need to prioritize education. Look at me now. I'm a Fortune 500 executive, something less than 10% of the world gets to do. This punk kid who was homeless with a high school education is there. It's not by chance. It's not by luck. I was prepared, and when preparedness meets opportunity, I was able to crush it.

I had turned down the manager role for the role I'm in now. I wasn't vibing with the director. I was about to accept it anyway. I'd been laid off a month or two, super depressed, crying all the time. I was financially fine, but mentally I'd tied so much of my self-worth to my career that I was lost. My wife said, "Honey, you've put us in a situation where we don't need you to accept it. Why are you settling?" "We don't have insurance, we have two kids, you don't work. My severance will run out in two to three months, then we're borrowing from retirement." "Yeah, but that can last us years." "Fair, but you're insane." "But you've worked so hard. Why are you settling?"

I turned down the opportunity. Then I turned down four others because they didn't feel right. I started to panic. Severance was about to run out. I got a message from someone following my content who said, "Did you apply for this director role?" It was the director I didn't really want to work for. He was now gone. I messaged the senior director I still had the email for, "Does this role report directly to you?" He responded one word: "Yes." I said, "That changes everything. I'd love to interview." I got the job. Because I took a chance on myself and wasn't willing to settle.

In this community of laid-off people, you get what I call battle buddies. Military term. They'll ride or die with you. When you're crying, when you're sad and don't want your family to see it, and you're crying in your garage, you can call your buddy. The battle buddies ended up getting the jobs I'd turned down, and every one of them got laid off three to six months later. That's the environment of cyber right now. There is no job security. No stability. If you don't have side hustles, the second you get laid off you're going to struggle. If you don't have a social presence like Aaron's and mine, hundreds of hours giving back to the community, you simply will not get opportunities. That's the reality. It's garbage and it sucks, but that's how it is, because there's so much talent and so few jobs.

Aaron Crow: AI is great, but when you post jobs, you get inundated because there are so many AI tools that auto-apply. You get thousands of responses. There's no way to go through them.

Robert Whetstine: The resumes are perfect. I interviewed 10 people, seven literally had none of the skills listed on their resume. I was not very professional, Aaron. I may have been a bit of a raging asshole. Applying for a role where you don't have the skills, I'm totally cool with that. Go for it. Lying on your resume to position yourself better, I will eviscerate you. I will destroy you to a point where you will never do that again. I get you're struggling. I get you're about to lose your house. People have broken down and cried in interviews more than once when I busted them using GPT. I understand the struggle, but don't compromise your integrity. It's not going to go well.

Being unemployed right now is like going into the ER bleeding out, and the doctor says, "I don't really have time to triage you. Just tell me what's wrong." The average time to hire is three to six months from your interview. Leaders chase unicorns. They want the perfect person, no investment required.

I recommend people, and my recommendations come hard. Only the best of the best. I'll message the recruiter, "Any feedback? Why didn't they get the job?" "The team loved him, they thought he was awesome. Then they told me, 'We're going to see what else is out there.'" They make you wait months. My hiring process is two interviews. One with the recruiter, two with me and my team. Then we make you sit on the call, I tell you whether you're moving forward and where you messed up. Nobody does that because they're afraid of lawsuits. We have to be more kind. These are people giving you 30 minutes of the best of themselves, then spending the hour before the interview crying because they're about to lose their home, their car. You as a manager who's been employed for five to 10 years don't understand the market. If you can't take a few moments to educate them on how they could do better, you have no business being in leadership.

Aaron Crow: Half the time you don't even get a response.

Robert Whetstine: HR will tell you, "Don't give feedback." It opens you to lawsuits. If you're a good human and not saying, "That guy's too old," it doesn't matter. But 80-plus percent of people don't know how to interview. They'll say things like, "We're a younger crowd here." I had that multiple times. You know what they mean. The insult erodes your soul. I can't tell you how many 45, 50-plus year old men I've talked to who've just decided they can't be in technology anymore. Started their own company, retired early.

Aaron Crow: That's why this value, and you don't have to have a podcast or be at the level you or I are at, your presence online matters. I talked to a recruiter yesterday on my podcast. He said, "I'd rather hire somebody. Show me what you've created. Your GitHub. Even if it's not perfect. What are you doing to differentiate yourself?" Having the perfect resume isn't it. Create something. Have a YouTube channel. Make yourself stand out.

Robert Whetstine: Embrace the uncomfortable. That's my life motto. If you're not uncomfortable, you're doing it wrong. When I got laid off, I built an intro video. It's still on my LinkedIn, the very first video I posted. I sent it to 1,900 people manually. It created advocates. People looking out for me, sending me opportunities. I only applied for maybe 15 or 20 jobs before I realized the game was rigged. After that, only places where people said, "Apply for this, I'll make sure you get an interview." That's the reality. This month alone, four people have texted me, "Do you know somebody for X?" Having relationships and mentors matters. It's not how smart you are. It's how others perceive you and how much they'll represent you when you're not in the room.

Aaron Crow: I'd argue it's always been that way. It's just exasperated now because you're flooded.

Robert Whetstine: There's only one role and 700 buddies. How many friends do you have right now who are unemployed in technology?

Aaron Crow: Oh gosh, 20 to 30 easily, off the top of my head.

Robert Whetstine: I have at least 40 or 50. Every security professional has 20 to 30 buddies they're going to recommend before you.

Aaron Crow: How do you short-circuit that?

Robert Whetstine: Become a buddy. Be genuine. Don't reach out because you think I have contacts. Reach out because you want to shoot the shit, learn who I am, become my friend. Don't go in with an agenda. Don't tell them, "Hey, if you see a job..." Let your video do that. I did a quick two-minute video. "Hey, here's a little about me. I'm a big nerd. I build movie props. If you're looking for an executive or management leader, let me know." Recruiters loved it. I showcased my soft skills, that I was personable. Most people just send a block of text selling themselves. Start with hello. It doesn't have to be that serious.

Aaron Crow: AI has video too, but text is so hard because I don't know if you created it or copy-pasted. With video, it's not fake. Yes, you can fake it, but you can tell.

Robert Whetstine: I had a dude wear someone else's face in an interview. I busted him. That's becoming more common. A recruiter's account got compromised. The attacker used their photos to create a deepfake, got one of my mentees on a call offering them a job opportunity, wearing the recruiter's face. That's our reality.

When I have people join my call, I say, "I'm going to have you do a few things that are going to seem weird. Put your hand in front of your face. Turn fully to your left. Turn fully to your right." Because ears have not been perfected with AI yet. If they won't do it, that's a very good indicator they're probably not real.

Another thing Gerald Auger talked about on Simply Cyber: how can you stop people from using ChatGPT in interviews? Hold a piece of paper up with your question and say, "Do not say this out loud. Just answer it." I'm using that next time I hire. We were trying to hire a senior engineer for my buddy's team. Ten interviews, people were using ChatGPT. "Bro, we've already put these into a chat engine. We know the chat response. We want a human response."

People are so desperate they're giving up their integrity. They've never really been a security person to begin with. If they were, they wouldn't give up their integrity for anything.

Aaron Crow: The irony is, giving the wrong answer that is yours and thoughtfully thought through actually stands out and is better than the perfect answer that's obviously fake.

Robert Whetstine: I'd rather have that. If you don't know, simply say you don't know. I don't expect you to know everything. What I expect you to know is the question you don't know. Answer it clear and concise: "I have no idea, that's not in my wheelhouse." When I was interviewing for the red team for that IOT role, they peppered me with questions. I finally said, "Guys, do I really need to know Kerberoasting for this role? Honestly, I don't even know what that is." They started laughing. "We were just curious when you were going to break. We wanted to see how you answered a question you didn't know." What you don't know also says a lot about your integrity.

Aaron Crow: This is a valuable conversation because so many are struggling. Maybe you've got a job but it's not the one you want. You're trying to promote. You look online and it's, "I'll take this class, get another degree." None of those things are going to guarantee it, or even really increase the probability.

Robert Whetstine: Instead of getting another cert, connect with another person.

Aaron Crow: Go to the networking. Go to the happy hour. Go to the conference, and don't worry about the talks. Talk to the people in the hallways.

Robert Whetstine: I can't tell you how many people I've invited out to cyber brunches and dinners who want to get into tech who don't show up.

Aaron Crow: I go to conferences a lot, speaking, presenting, volunteering. I rarely go to a talk. Black Hat, DEF CON, RSA, you name it. Not because I'm not interested. My schedule is engaging with people in hallways and happy hours. There's so much value. That's why I built this network. Why I built this channel. When I was laid off last time, within a week I had five different interested parties. Day one, I just messaged, "Hey, by the way, this happened." "I want to hire you, let's talk." It's that muscle I've forcibly done. Go to conferences, go to happy hours. Depending on where you live, there's a happy hour in your neighborhood. There are low-cost or no-cost conferences. Go.

Robert Whetstine: Join your local ISC2 chapter, go volunteer at BSides. The biggest thing Aaron just said was volunteer. Stop expecting handouts. No one is going to help you get into cyber but yourself. For every person who says, "I've got an opportunity for you," 90% are just never going to be an opportunity. It's not that they don't want to help. They can't. Companies are going, "We could hire Aaron, or we could hire seven guys in India or Poland for the same cost."

AI is not taking jobs. Statistically, there's nothing that shows that. Maybe 100,000 jobs have been lost to AI. Many have been re-acquired by a human because they realized AI couldn't fill the role. Multiple companies invested in AI and pulled it back. Oracle, hopefully they're not a sponsor, sent out a message laying off 30,000 people by email. They did it under the guise of saving money, when they were at 90-to-95% profits last year. They did it so they could invest in AI without a risk. "I can throw money into AI and building data centers, and we don't have to take a financial risk because we just fired 30,000 people." Anyone who says different hasn't done the research. Companies aren't doing it because they need to. They're doing it because they don't want to take the risk on AI, so they stack the deck for profits. You could be at Oracle for 20 years and be terminated via email that says, "Upon further investigation, today is your last day." It's the most inhumane, morally bankrupt thing, and it's becoming standard.

Aaron Crow: What's the future look like? What keeps you up at night? What are you excited about?

Robert Whetstine: I don't really have anything scaring me. AI is an amazing tool. There are negatives, but like any tool it can be used for good or bad. AI is beautiful. A guy recently put his dog's DNA into an AI, and it helped him create a cure. We're at the precipice of technology. But look at data center projects over the last year. They've all been canceled or stalled because we can't support the infrastructure. AI is going to become cost-prohibitive. OpenAI has literally lost billions of dollars month after month, year after year. They're not crushing anything. They're loud, their marketing is great, their product is great, but at substantial losses. As companies invest, they'll realize running AI models can be cost-prohibitive very quickly.

My concern is infrastructure. How do you grow and protect yourself when the infrastructure needed can't support it? Unless we start bringing manufacturing back to the United States, our dependency on offshore is astronomical. Our job as cyber professionals is going to be to do more with less. Companies shift hiring heavily to India, Poland, other areas. As leaders, you have to justify hiring in the US. I can't just say, "I want to keep jobs in the US, I'm an international company." The most arrogant thing I could say. When I can hire five developers for the cost of one in the US, the cost of US workers goes down, inflation goes up. That keeps me up. The only real roles hiring right now are IAM and AI. Recruiters ask, "Do you have AI skills? No? Sorry." The roles go to people like Aaron and me who've built this huge network. You're not even going to get an opportunity to interview. That's not fair, but it's reality.

The thing I'm excited about is also the thing I'm scared about: AI. I have a rare neurological disorder called Charcot-Marie-Tooth. How cool would it be if AI sequences my DNA and says, "Take this shot and you're cured"? Your muscles no longer deteriorate. You can walk without assistance. We're not far from that. That's the most exciting thing. But the scary part: we don't truly understand what it's doing. The Claude chats that leaked where they said, "We don't really know what it's going to do," that's real. That's the reality of this race to the front. We're doing things recklessly, trying to become world leaders. Very similar to IOT. IOT suffered from rushing to market: lack of security, lack of hardening, no password policies. They rushed to be first to market, and that's how you get a doorbell you can log into, or a lock you can unlock with any phone.

You've got to have patience, and at least a year of savings to be in technology. If you're looking to pivot into this career field and don't have a year of savings, don't. It's too volatile. Unless you're willing to invest hundreds of hours constantly staying relevant, it's not going to be worth it. If I get laid off tomorrow, I'm going to message Aaron. "Hey man, you know of anything?" He'll do the same to me. It's an unwritten law between cyber professionals. We look out for each other. This job is hard.

Aaron Crow: Just to wrap this up, you just hit on something really important. I have an ulterior motive. I volunteer at ICS Village and Building Cybersecurity, both nonprofits. Yes, I enjoy giving back, but it also gets me in the door. Introduces me to people. Same reason I do this podcast. If I didn't have this, you and I probably wouldn't have met. Now I have this connection, which helps me, the audience, everybody. I'm doing this for myself.

Robert Whetstine: And it helps your soft skills. Huge. You and I are both presenters. Talking to different people at their level and switching your approach is a skill. If I get a slow talker on my podcast, it takes a lot to be able to match them. That's an important skill.

Aaron Crow: What's your call to action? How do people find you?

Robert Whetstine: Bowtiesecurityguy, all one word. That'll find me anywhere. LinkedIn, YouTube, everywhere. I'm even on TikTok. A 45-year-old man posting TikTok videos. As somebody who was vehemently against social media, I've embraced it wholeheartedly.

I do a ton of content to help and mentor people. If you're looking for a mentor, I charge you nothing. Reach out. Looking for help with your resume? I charge nothing. If you're struggling, I'm here for you. There are so many people who will take advantage of you. I don't believe in getting blood from a stone. If you're gainfully employed and want mentoring, I do charge for that. But if you are unemployed and struggling, hit me up. I'm happy to help.

Don't be upset if I send you a video, because I've answered a lot of these questions before. I have hiring videos, a local ISC2 talk about the job market. Multiple job-search things on my YouTube.

I also work with a charity called Ginger Hacker Initiative. We pay for certs. If you can't afford a cert, we'll buy one for you. Just show us you want to put the effort in. GHI has already sponsored multiple certs. We do a charity fund drive every year. All the vendors who make me get on calls to sell me swag, I send that stuff to Ginger Hacker so we can sell it in our charity auction. It's a great Discord community.

And BowTieSecurityGuy After Dark is my podcast. It's very much for new people. I talk to security professionals like Aaron, and I really go back to the roots of their career. I'm going to end up having Aaron on, because now he's had me on. Unwritten law. One question I always ask: "Is the cyber shortage real?" Surprise, it's not. I go above and beyond to educate on what the job looks like, the mental struggles, how hard this career is, how it's different than what you've been told.

Aaron Crow: This is the thing. People don't see all the work that goes in behind the scenes to be relevant. We have to continually focus on those things. I work nonstop, and I'm sure you do too. I'm watching TV with my wife and I'm on my laptop.

Robert Whetstine: I'm eating lunch with a mentee. ThreatLocker is a sponsor of my podcast. They're doing a hiring event today. One of my mentees is flying down just to interview. I said, "Let's go get lunch." It's all about supporting people. We need future generations. Leaders like us are dying. There aren't a lot of us who actually care and want to see other people successful. My success is your success. I don't care about my title. My boss is going through a big reorg. They asked, "What do you want to do?" I said, "Give me your worst-performing team. I'll prove to you it's the leader, not the team." There's so much toxicity. People feel stuck, and they are.

There are no opportunities. There are no jobs. You have to put yourself out there. Get uncomfortable. Go to networking events. If you're not willing to adapt, you'll continue to struggle. Semper Gumby. I'm not military, but I've worked with a lot of military guys. You have to be highly flexible. I talk to people all the time: "I need full remote. I need over $150K. I need Monday through Friday, nine to five." None of those things are going to happen. Let's reality-check you. You're going to make $40K less. You're going to be on-site three days a week minimum. You might find a higher salary at a startup, but you might also get fired in two months. Turn the dial from fantasy to real. You'll be more successful and less depressed when you get told no.

The last thing I'll leave people with: every time you get a no, think of it as your next dream job being only 50 more nos away. All you have to do is suffer through 50 more gut-wrenching nos, and then you're going to land your dream job and rock it until the end of your career. Focus on creating positivity. Stay positive. The mental game is the most important game right now. You've got to be ready and prepared. When opportunity meets preparedness, that's when you crush it.

Aaron Crow: Freaking gold today. I appreciate you. Everybody, reach out. If you need a mentor, Rob is there. Check out his podcast. You're not alone in this. Everybody's struggling. There is opportunity out there. You just have to differentiate yourself.

Robert Whetstine: Anyone I know who's really talented and really good isn't unemployed. They don't stay unemployed for long. You have to adapt and make concessions. If you're not willing to do that, school's going to be real hard. The other thing people hate: most jobs won't let you negotiate salary anymore. That's kind of dead. All the job offers I got, not a single one let me negotiate. "This is the offer. You have 24 hours." "But I need more time." "That's nice. You have 24 hours, because we have six other people who will take the job."

Aaron Crow: Take it or leave it.

Robert Whetstine: Exactly.

Aaron Crow: Awesome, dude. I appreciate you, brother.

Transcript lightly edited for readability.