How to Hack your Career Building a vCISO Business with Ayman Elsawah

So if you are lucky enough to get just advisory clients, you have a bunch of clients, they're on retainer, times are good, they're able to pay your retainer, and they have you on standby, you could be working 10 hours a week. I don't know, right? It really depends. Who says tech can't be human?

Yeah, same here.

All right. Thanks, Ron. Thanks, Ron. Yeah, my name is Ayman Elsawah. I'm calling in from the SF Bay Area. And I've been a vCISO for almost five years now. I've worked with some big brand name companies, but also a lot of smaller ones and personally with founders. I also run a newsletter called Last Week as a vCISO where I share, you know, some of the sawdust, some of the inner experiences as a vCISO so that others can just benefit. And in the past, I've hosted a podcast called Getting Into Infosec and written a book called Breaking In where to help people get into the industry because we all know there is a shortage out there. 2:36 We need some more folks. Overall, my mission is I just love sharing and helping people and organizations kind of level up their cybersecurity and their careers. So we're all better off.

Yeah, you know, I was always an enterprise security person. So I was working with large companies, enterprises, helping them with their security and, you know, transitioned to cloud security as well full time. But I was also helping startups on the side. People came to me and I always had this entrepreneurial trait, even since high school. So people came to me and said, oh, you know, there's a company that needs some help with their cybersecurity. Are you willing to help me? Yeah, sure. 3:36 So that's where it started, helping out companies. And I was doing that on the side, but, you know, working full time. And I realized that a lot of companies are making the same mistakes, you know, over and over. I'm encountering other companies and they're just rinse repeating the same mistakes. And then I also just in work life encountered some different like fractional roles, like fractional CTOs and fractional CFOs. I'm like, oh, that's interesting. So I'm like, the cybersecurity industry needs that. 4:08 Like, what if I could clone myself and get out there? Because we all know there's a shortage of cybersecurity folks. And, you know, it's hard to find someone, let alone a small company can't afford one for whatever reason. We're not going to blame them. And so, you know, I just came up with the idea and started going from there.

Yeah, I think in general, any sort of entrepreneurial endeavor requires a little bit of insanity. So, you know, you have to be insane to leave this cushy job and go do something. So again, you know, for me, I was trying to solve a big problem where like a lot of companies were doing cybersecurity wrong. And for me as a recovering perfectionist and just, you know, cybersecurity, you know, we have this altruistic part of us that we don't like seeing things done the wrong way. 5:25 So that was the idea. And so, but to answer your question, you know, I actually had a false start. So I had a start. I tried to do this early in like 2016. I connected with someone, had this idea, and this is, nobody even heard of the term virtual CISO at the time. And, you know, tried to make a startup and all this kind of stuff, still working. That didn't work out. So, you know, I was a little, you know, taken aback by that or bruised by that. So I just kind of went back and then, You know several years later people still approached me about this and you know it came at a crossroads where the job i was working out at the time was not working out it was a you know a disconnect 6:10 And so I put this out there and I said, hey, you know, there's a company that needed help. They were going public and they needed help with their security roadmap and getting ready for that. So, you know, I put it out there and, you know, it's been turtles all the way down from there.

So I actually got into it at 2019. So I've been a full-time CISO, which is kind of full-time fractional CISO, which is kind of like, you know, play on words, since 2019.

Are they a vCISO? Are they a fractional CISO?

Yeah, that's a really good question. In fact, I wrote an article this past weekend on this topic. It was the second article in the series on last week as a vCISO. So there was a, you know, the first one, I had a picture of MacGyver on there. And, you know, the second one was kind of just going digging into a little bit of vCISO. So vCISO, fractional CISO, what is a vCISO? For me, you know, a vCISO at the end of the day is someone that's going to come in and help a security leadership with their security program. 8:12 Now, the term has been abused. There's a lot of people that have some discontent with the term vCISO because it has been abused a little bit. A security analyst may call themselves a vCISO and they're actually just a security contractor. Now, I don't want to belittle the term vCISO or anyone that's going out and becoming a contractor. So I want to keep that, make that clear. However, Because vCISO is a Swiss army knife, they function at all different levels. 8:44 They can report to the board. They work with executive team and founders. They work with engineering management. They'll work with engineers and they'll work with analysts, right? For the most part, they kind of hover between like engineering and executive team. Okay, for the most part, most vCISOs will not do a lot of hands on work. Some are technical and are willing to hop in and do some things. But for the most part, you know, a vCISO will function at like the higher level. 9:20 But you know, the thing is, Sometimes, and then, you know, there's also the fractional CISO term. So fractional CISO has a little higher of a term where, you know, you are a CISO, maybe you've been a CISO in the past, and you're trying to help a company with their board and their insurance or incident response, whatever it may be, planning. So there's a variety there. I'll stop there and ask any questions, but I can keep going.

That's a really good question. So, for example, a deputy CISO, are they a CISO? Right? Some people say yes, some people say no. But in some places, a deputy CISO does all the work, almost all the work that a CISO does. But the CISO is kind of like that figurehead or that firewall, you know, between the board and whatnot. There's been engineers, GRC managers, whatnot that have worked on board decks with CISOs, right? So they've done the legwork. So you may realize, you may not realize it, but you may have a lot of the experience that is required to become a vCISO. 10:46 Because like I said, a vCISO is a Swiss army knife. So think about like there's all these things that have to be done. And then here's what the client needs. And so the client may need only SOC 2 and, you know, board deck and then sales enablement. OK, can you do that? Right. So ask yourself, can you do that or can you grow into it? OK, because it's not rocket science. Let's let's be let's be clear, you know, you know, being You know, in tech, how many times, you know, even coders, developers, right? 11:19 How many times are we Googling and trying to learn things, right? Yeah, so it's not rocket science. Now, I don't want to belittle the term. Now, being a CISO is very important, especially when it comes to an incident or things like that. But that goes back to the entrepreneurial part where you need to have some, a little bit of craziness, a little bit of confidence in yourself to get to that next part. Now, for example, you know, you know, I had worked on incidents in, in previously being the VCs. 11:51 So I had the experience, but, and nothing gives you more experience than being on the job. Right. But I just happened to have in 2021, there was a lot of supply chain attacks, if you remember. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, So I had different aspects of like audit experience, security management, whatnot, at least understanding. 12:27 So not to say that a certification is the only thing that you need, but I think, I hope this is coming clear. You can grow into certain roles. And, but, you know, don't lie, right? Don't lie. And then there's also opportunities where if you can't do the work, then just say you can't do the work. Like, don't BS. Don't BS and don't, you know, lead anyone on. But they, you know, you need to have some experience in some areas, but a vCISO doesn't have to have all the experience.

Yeah. Good question. So I just talked to someone about this recently. So if you were to come ask me that you wanted to be vCISO, here's a few things I would ask. One, what's motivating you to be a vCISO? I've heard folks say, I'm not happy with my job. A lot of folks are laid off. So there's been CISOs that have been laid off. There are CISOs that have burned out. You know, I believe it's a kind of hypothesis I'm working on. Talk on information security covering CISO, vCISO, vCISO, vCISO, vCISO, vCISO, vCISO, vCISO, vCISO, vCISO, 15:34 We're all humans at the end of the day. We need to, you know, we may have kids, we may not have kids, people relying on us, mortgage, whatever it may be. So when you start a business, any business, whether it's a restaurant, consulting business, whatnot, there's a risk of failure, but also some time to ramp up. For me, I actually tried this early on. I tried this a couple of times, a few times where I was like, okay, let me go all in and get this working. But I wasn't on Twitter. I wasn't anywhere. I was like, you know, that security person that wanted to hide and not everybody know who you are. 16:09 And so I had no brand equity out there at all. And so I was trying to build this up and I'm like, this is not working out. You know, I need to I need to make some income here. So, you know, that was a false start. And I learned a lot, you know, learn a lot. So that's, those are some things to work on. Like if you want it to be, if you're working a full-time job and you think, you see yourself as a vCISO in the future, then get started working now. Build up your brand, get out there, learn the intricacies. 16:39 There's a lot of details and minutia. In fact, I tell everyone this. Whether you're a wedding photographer or a vCISO, business, like running a business, 80% of it is not that thing. Right. It's like the sales, accounting, bookkeeping, marketing, contracting, dah, dah, dah, dah, dah. And then you have the, like the delivery. So, you know, as you know, a lot of wedding photographer, they're into photography and they become a wedding photographer as a business. 17:10 And they just hate it because they have to do all these like different things. Some love it, you know, they, they love the game. So it's just something to keep in mind.

Yeah, perfect question. LinkedIn. So simple formula. And it's the same if you're looking to get a job or you're in an existing career and you want to boost your brand equity. Post on LinkedIn daily. Okay. It could be a listicle. Just post some thoughts that are helpful out there. And then comment, you know, three comments a day. If people have like this, post one once a day and comment on three different other posts three times a day, for example. Get yourself out there. 19:01 And then, so that's going to effectively grow. And then start connecting with people, you know, start connecting people. Don't, you know, be, don't necessarily be salesy and say, you know, don't DM them and ask them like for something right away. Just Have them add them to your network. So you want to, it's all, it's a whole network effect. So, and that same applies to Twitter, whatever social media platform you're on. Ad something that's valuable out there. Be yourself because everyone has a large body of knowledge that's useful to someone else. 19:32 And something to remember is that you don't have to be a super expert. You just have to be one day, one book, one lesson further ahead than someone else. So there's always someone out there that could benefit from your experience. Your information. So that's that's something to understand. Also to, you know, work on some areas that may be a gap for you. So if you're not a social person, then go to more networking events and get yourself out there. 20:08 If you're not good at writing, then start writing. And writing like, you know, writing the post is going to help you with that. If you haven't presented before, then present. So there's a whole, you know, there's a couple of courses out there. I think one person out there, I'll send the link afterwards, has a course on just building your brand. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 20:45 Before when I first started on this journey, I want everyone to know Ayman and cloud security, right? Because I was a cloud security expert. I was deep in AWS. Nobody else was doing it. So, you know, I was out there. And then as I expanded into vCISO, now everyone is like Ayman and vCISO, or Ayman, vCISO, or fractional CISO for SaaS or startups. Because, you know, there is some... Just with any CISO or any other person or any industry, you may have CISO experience, but not like startup experience. 21:18 So the more you can niche, the better, right? Are you a CISO for AI? Are you a CISO for telcos or whatever it may be? So the more you can niche, the better it is going to be from a sales, branding, whatever it may be.

A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. I know folks, you know, I mean, you could make as low as like, say, 200k, for example, depending on how well you're booked up to an average of like, say, three, I think getting anything past like, say, 500k is going to be really difficult unless you start becoming like an MSSP, right? Or anything past 300k, depending on the market. 23:38 Right now, it's a tough market, but it's going to recover eventually. And again, it depends on your brand and the type of clients you're able to win and everything like that. And who you have working with you and how much you can fill your pipeline. But, you know, So back to the MSSP thing. I know one person that offers some sort of cloud services or some security things, add-ons. And so he has people working for him. 24:08 And it's a nice model. And he's making in the upper limits. Not seven figures, but upper limits. But that's some work. And that takes time to build. But one thing I want to tell you, you know, one thing to understand is like, if you take $200K, let's take $200K because, you know, America is pretty big and I think $200K is a good salary for, you know, many folks out there. Not in the Bay Area, but... Definitely not there. 24:40 No, no, no. So say you take $200K as a full-time job. When you take $200K as a business person, you're already saving 10 to 15%. And don't quote me this, check with your tax professional and your finance advisor. But you're already saving a lot of money in taxes, right? Because you could expense certain things and you could spend money on the business. So even though the gross income is the same, there's a lot of money that you'd be saving. Now, there's a pitfall. I mean, having a business in America, especially as a solopreneur, is quite difficult because if you have a family, you want to have health insurance and you got to get that on your own. 25:18 That is such a mess and don't get me started on that. And I talk about that in the course because, again, this is about the person. I don't want to give you everything that you need to know, but then neglect you as a human, right? Are you a single family household? Are you the breadwinner? Whatever it may be. These things are important because you have to live, right? We need people to live and thrive and succeed. So, you know, knowing these things because, you know, you get out there and then you're like, oh, health insurance. 25:50 Oops.

You know, full inventory 30 to 40. It really depends on how you structured it. So, you know, anywhere at 20 to 40, 30 to 40. By the way, JustWorks was a client. So I'll plug JustWorks. I love the people there. Great company. So, Yeah you know that's so it really depends on how you structure it so you know if you if you got stuck doing the hourly thing in the beginning which i don't recommend but it you know unfortunately some companies only understand hourly it really depends on how you structure you might not you might not be working that much so if you are lucky enough to get just advisory clients you have a bunch of clients they're on retainer times are good they're able to pay your retainer and they have you on standby 27:31 You could be working 10 hours a week. I don't know, right? It really depends. But these days, you know, people want to have more work done, whatnot. So, you know, you could have a couple tiers for your service. You can have a small tier where you're not really doing stuff. You can have a larger tier. And with the larger tier, you may only want to take one or two clients at a time. So that's another downside is like, you know, in good times, you may have a big pipeline and you'll have to turn away clients. 28:01 Okay, because you don't want to oversubscribe yourself. A lot of folks will oversubscribe themselves. And that's a that might be okay for you if you're okay with that. But just acknowledge you might burn out. You know, your brain, the context switching between like more than three or four clients is really difficult. Even three or four clients so at one point i was working for another firm and i was you know i had they assigned me to like multiple clients and my brain was mush man mush like i was just on like all these different slacks and getting pinged and yeah you know like or working with the east coast client and i'm getting pinged 9 a.m 6 a.m over here i'm like oh i need to have my coffee please like 28:41 So these are some of the intricacies to consider even when times are good, is it good for you? Is it good for you? And I think as an entrepreneur, it might be okay to take that risk, to oversubscribe yourself for a little bit, but it's not sustainable over the long term. And so what you want to do is figure out how can I sustain this or design my service model that fits your lifestyle, right? And your expertise that you've built over time.

Yeah but here's the thing you have to spend time on sales and marketing too okay so that's the trick is sure you may be spending all this time on delivery but then what if the client's like oh i'm gonna cancel yep now you haven't done sales and marketing for a few months And now you're behind and so you got to get out there and go you know get out there so that's that's the trick is you know you have to do sales and marketing constantly figure out what business model it goes back to the beginning why are you becoming a vc so if this is just an in-between thing then you know my advice is going to be different go to a vc so shop and apply to them and 30:18 You know, have them take care of all the business fundamentals. If this is your life calling and you want to do this and you've done the CISO thing several times, you're good and you're not really dying or, you know, not really relying on income or you have a good runway. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 30:54 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria

All right. Thank you. Take care.