BSides SF 2025 Vlog - Interview with Ayman ElSawah + Meeting Jason Haddix & Tanya Janca!

I'm super excited.

Good, how are you? Good, how are you? How are you doing?

Well, like every year, I wish I could go to more of the talks, but I didn't get a chance. So I actually brought my kids yesterday. So I was just kind of showing them around and getting them some swag. And today, but you know, it's great. I love the theme and a lot of friends are giving talks. So I'm looking to catch up on their talks later.

You know, it's interesting. For the first time, there's so much to take in. Conferences like this, there's so much to take in. So I think do a little bit of everything is a good approach. A little bit of talks. A little bit of the villages. Talk to some of the vendors. See what's out there. Meet some random people. Talk to random people online, you know, while you're waiting for lunch or whatnot. I encourage all that kind of stuff. And that way, you'll have a wholesome experience at any conference.

No, mostly like, so say you go to an event. Say you don't know anybody there. You just go. I mean, of course it's nice if you have a friend with you, but that's not always the case. And so, attend a talk. Great. And then, go to the villages. There's all different kind of villages. Lock picking village, AI village, whatnot. And then, while you're in line, Just randomly waiting for say lunch or whatever it is, talk to the person behind you or in front of you. Start up a conversation. And that kind of like real world networking, you might make a friend from that. 2:17 That's what I'm trying to say.

That's a good question. I'm looking for someone that can, one, bring skills to the table, so brings existing skills to the table, but also has an ability to adapt, sorry, has an ability to adapt. So they need to learn a new environment, they need to adapt to what's going on, and not be just siloed in one, like say, their particular position. I work with a lot of startups, so I'm coming from that lens, and so I'm looking for someone that could, you know, Not necessarily hitting the ground running is also good, but also someone that can adapt and wear multiple hats and learn quickly. 3:01 I think if you could learn quickly and adapt, you'll be great in any field.

That's a really good question. I think you could, I mean, you just need to have, so generally, if you're going to start from 2025 now, I don't know where they're coming from. Are they already employed? Are they students? It's a big question. Do you have like an area maybe?

Yeah, so try to learn, you know, get a broad sense of the security field. So that's always just good. Some of the basics. Always stay on top of news, okay? Learn how breaches happen because if you're going to, you know, most of the jobs are defenders. So if you're going to be a defender, you need to learn how a breach happened. You know, also keep your expectations realistic. So, you know, a lot of people are really attracted to the pentest part of the field. But unless you're doing pentesting already, which I encourage anyone to do, go hop on and do some bug bounty and things like that. 4:25 But a lot of people are attracted to that and I encourage doing that. But there's so many areas, so many more areas to the field, as you know, than just pentesting. There's, you know, even just from like, say, SOC analyst, Program managers, engineers, architects, building tools, things like that. Those are all really good skills. And then from there, I think you mentioned AI. It's really important to leverage AI to the best of your ability. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 5:11 You know don't do it for the money necessarily although the money is attractive but you should like this kind of you should like the job and like i said before there's so many areas to the field so keep trying different things in the field until you find something that you like maybe you're a builder maybe you're a breaker maybe you like both maybe you like social engineering maybe so there's so many different areas

Wow, this is an excellent question. And it's an important question. You have the folks that say it won't affect it. You have others that say it's going to totally change it. Listen, the reality is AI is here, like I said before. And a lot of companies are now adopting AI into their platforms, right? And then new companies are coming up with AI right from the beginning. So AI is going to affect everyone, from the analysts all the way to the CISO. What I would say for those looking to get into the field, listen, AI, there's a lot of stuff in cybersecurity that's not glamorous, that's a lot of grunt work, that's boring, that's annoying, that stuff's going to get replaced right away. 6:17 I think sooner than later. The analyst stuff, the compliance stuff, that's going to at least get augmented. Everything is going to begin, the first stage is going to be augmented, right? Not necessarily fully replace teams, but start augmenting or maybe someone, say they have a budget and they have to decide, should they open a headcount for a SOC analyst or should they get a tool to see if it could do 80% of that SOC analyst's job? What is that person going to do? At the end of the day, it's a cost decision. 6:48 Look at RSA last year or two. AI is all over the place. Whether it's actually being used or not, that's debatable. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, IAM, OAuth, phishing, ransomware, pentest, OSCP, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, IAM, OAuth, phishing, ransomware, pentest, OSCP, red team, threat modeling, You're still going to need humans because every environment is different and why not but i think for those looking to enter the field it's just more pressure on them to really increase their skills and know what they're talking about in fact i talk to students and they're like kind of like hooked on ai in computer science and they're you know using ai to leverage their classwork 7:43 A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, A talk on information security covering CISO, vCISO, red team, threat

All right. Thanks for having me. Of course.