Episode 104 Transcription

Welcome to Episode 104 of Behind The Mission, a show that sparks conversations with PsychArmor trusted partners and educational experts. My name is Duane France and each week I'll be having conversations with podcasts guests that will equip you with tools and resources to effectively engage with and support military service members, Veterans, and their families. You can find the show on all the podcast players or by going to www.psycharmor.org/podcast. 

Thanks again for joining us and Behind The Mission. Our work in mission are supported by generous partnerships and sponsors who also believe that education changes lives. Our sponsor this week is PsychArmor, the premier education and learning ecosystem specializing in military culture content. PsychArmor offers an online e-learning laboratory that's free to individual learners as well as custom training options for organizations. Find out more at www.psycharmor.org.

On this week’s episode, Jason Shockey is the founder of mycyberpath.com and passionate about helping people get into the cybersecurity industry and level up throughout their careers. He is a Chief Information Security Officer in the financial services industry. Prior to his CISO roles, Jason served 20 years active duty in the US Marine Corps as a technology leader conducting cyberspace operations, incident response, and cyber risk management. Three of those years he served with the Cyber National Mission Force at Ft. Meade, MD. Jason believes there is a place for everyone on the cybersecurity team.

duane--_22_01-19-2023_160848: Jason, so glad to be able to share the work that you're doing, at the intersection of cyber and workforce development for veterans.

It'd be great to hear more about your background from your time in the military and why you're doing what you're doing with my cyber path and why it's so important.

jason-shockey_1_01-19-2023_180848: Yeah, thanks for having me. It's great to be here. my journey from 1999 to 2019, was all military. in 1999, graduated with a degree in chemistry. Went into the Marine Corps, wanted to align that scientific background with something that the Marine Corps had, to benefit me, and also benefit the Marine Corps and, it operations or telecommunications.

Was that mos? Quickly followed from IT operations to computer network defense, now known as defensive cyberspace operations, then layered on offensive cyber and also cyber threat intel. and did those pretty much on my own time. So I was doing my day-to-day it job, but, going after certifications and experience that would allow me to be a better, cyberspace leader I so in 2009 I was, assigned to Norad Northcom and I was placed into something called the cyber fusion cell, and that was created to paste the ascension of cyber command. That's where I really started turning onto and into, threat intelligence, cyber threat collection,and really getting into, classified work with, cyberspace operations.

And from there I started looking at, okay, where do I want to go? , after I get outta the military, what could I do because I can't be in the military forever, right? So I looked for career pathways for, civilian work role titles, application security engineer, tech leader. and what I found was chief Information Security Officer, and I looked for the military's very good at telling you exactly what to do and where to go to be a colonel or a general, or a sergeant major.

The civilian world is not very good at showing you a pathway on how to be a chief information security officer. And so what I did was I created my own pathway and looked at certifications, experience, training, and education to pursue over a 10 year period, 2009 to 2019. That was my target, retirement date, for 20 years was in 2019.

jason-shockey_1_01-19-2023_180848: So I created the pathway, started going toward. and achieved that. And I went on, terminal leave in, June of 2019 and, walked right into my first c i o role in the financial services industry from what I created back in 2009. So I told myself a lie back in 2009 that I eventually made come true through all the work on that.

Cyber leader pathway that I made and now I'm a Chief Information Security officer. It's been three years since I've been out and, yeah, no, no stopping now. and along the way what I did was I created, which we'll probably get into later, a website that might help other people find their journey, in their cyber security career pathway.

and that's my cyber pad.com. so I made the first cyber leader pathway and then created 11 others that are archetypal pathways that map to all of the other work world titles that are in the.

so it's,it's, and I wanna say it's interesting, but it's not just interesting. It's actually unique that you were halfway through your military career when you hit 10 years, you're like, I'm at halftime. I might as well finish the game. like I've, I'm committed here. So you knew that you,or probably barring any really unforeseen circumstances that you were gonna remain in the military. But I know that it, when I hit 10 years, I wasn't thinking of what's life like after the military. I didn't start thinking about what I wanted till I was probably 14 or 15 years in, and that was even early for me. And I had my mil, I did the same thing as far as mental health counselor.

duane--_22_01-19-2023_160848: If I wanna start then how do I backwards plan? But that's not really something that is taught in the military is to think that you're not gonna be in the military.

jason-shockey_1_01-19-2023_180848: True. The military planning the military does teach you how to plan to go to war how to plan to train, how to be. Physical shape that you can be in, mentally fit. so I just applied that to my off time. Once I got off, work, I would then go to my second job and I still do that. my cyber.com is something that I do outside of my day-to-day chief information security officer work and. Starting with the end in mind was something that I found in 1999, 2000 going to training seminars, with, where I was then at, the Wing, in North Carolina. So having that mindset of always planning, I just adopted that, start with the end in mind, knowing that I was eventually going to get out.

Now, I think I'm a very small percentage of people that plan that far out. Like you were saying, what I'm trying to do is change that. I'm trying to get this in front. . Let's say when someone joins the military, they go to meps, they go get screened medically. what they get in the beginning, once they sign their paperwork and raise their right hand, they also get screened for What are you gonna do when you get out?

They don't wait for when they get to 10 years, 15 years, and then get out at 16 years, or 17 years, or at 20 years to start thinking about what they're going to do because there's a, your whole life is left after you get out of the military. Now, what I was fortunate enough to do was combine those two things.

I spent 20 years focusing on it. and cyber leadership, which I could then translate into a civilian career that was very fortunate. And if you can line that up, that, that's ideal. But what other people can do in the military is still have a lucrative, cybersecurity career because they have a defensive mindset in the military.

Regardless if, you're a cook, you're a truck driver, you are just, if you are in the. , you are trained on physical security from the start, so all you have to really do is think about how to apply those physical security concepts in the logical world. That's the beginning of thinking about cybersecurity and being in cyber.

And then from there, what I've found that's very unique with, my cyber pet.com is matching people's interests and personality traits and then matching them to those 12 archetypal cyber work roles. The reason that's I. is that most companies, most people will be asked, Hey, do you want to be a pen tester?

Hey, do you want to be an incident responder? Now, what people see in Hollywood are the white hat hackers or the, criminal hackers. And it's really exciting and it really is. When you legally get to break into a computer network, that's a lot of fun. And if you're on a team that does that, it's really fun.

but you have to have permission to do that. But my point in matching people's interests and personality traits to those 12 archetype of work roles is that it doesn't force an image into someone's mind to be marketed by what they're trying to sell. Because what, like I said earlier, in 2009, when I created the pathway for myself, I looked at the certifying bodies out there.

jason-shockey_1_01-19-2023_180848: They're real. They're great. ISE Square, Comilla Sands, all great. I have all the certifications that they offer, and they're actually in the pathways in mypath.com, but what I didn't do was just buy into their one singular career pathway because they're trying to sell certifications. And I want them to keep selling certifications.

because they go into my pathways and I tell other people about them. But if you just focus on let's say, certifications, which a lot of people do, you're missing three quarters of the other parts that you need. Certifications, experience, training, and education. All of those combined to be a whole cybersecurity professional.

duane--_22_01-19-2023_160848: it's interesting you say you're talking about education and we could talk about that a little bit more. but what I get the sense that you're doing is simply educating people just about the need to be able to do this. the, this idea of you managed your transition out of the military concurrently while you were in the military, the second half of your career, many people think of transition as a consecutive military's.

Then I transition, then I'm something else. But you and me to some extent, I really did mine concurrently over seven years where you did yours over 10. But transition, you don't have to wait until your ETS state or into service state to be able to start your transition, and that's what you're trying to educate people about

jason-shockey_1_01-19-2023_180848: Exactly. And that's, so one of the things, if I can just provide one lesson learned that was extremely valuable for me, to the listeners and to every, military, veteran, active duty reservist, spouse, child is taking. an idea and working small steps towards that goal, day in and day out.

Now, it seems very simple to do, but it's very hard in execution. It's even harder when you don't have a North Star, when you don't have a guiding light of where you're going to go, like starting with the end in mind. So what I'm trying to do with my cyber vet.com and that free matching that we have is that they take a short assessment and then they get matched to one of those 12 archetypal cyber security work roles.

What that's doing is showing them what's available. It doesn't say they have to go into cybersecurity, even though you can make a lot of money. Money's not everything, but it's very rewarding to actually secure people's. Because all of our sensitive data is stuck in these computer networks, and there's very few people that understand how to protect those and what this website shows people.

you can do this. You don't have to code, you don't have to know how to, get on keyboard and break into a network. There's plenty of auditing roles that we have, especially in the financial services industries. I work with a lot of controls and we work with a lot of audit. So it's non-technical. you have to have an understanding of what's happening in cybersecurity to apply those techniques, when you're talking to an auditor.

But you don't have to know how to code. . One of the things, is applying the knowledge that I received working after hours on the certifications and the experience and the training and the education as well, is that I applied what I learned right in my day job.

And the way I did that was I would pretend I would be speaking to, let's say, my battalion commander or updating the staff. What I would do is I would, trade. some words that I would use in the military for what I might use out in the civilian workforce. And what I did was kept practicing and practicing on how I would say these things, right?

So communication occurs on the listener's terms. So if you're relaying complex technical topics, whether to the military people in uniform or to a boardroom full of suits, you still have to understand how to empathetically deliver that message to. , let them know this is what I'm trying to tell you, and have them understand that.

So the more practice you can execute, the better. And if I can put that into a treatable comment, it's get a certification on Sunday and apply it on Monday, even if you're active duty and it's your first year on the job, because you will be able to use that 10, 15, 20 years later when you go to get a civilian job.

duane--_22_01-19-2023_160848: I really appreciate that concept. Again, that's the idea of doing this concurrently. Like at the same time, you know, you're thinking about in 10 years from now, I'm gonna need to be applying this. and that's another interesting aspect of your background. you joined the military right@that.com bubble. I don't know. In 99, they had one computer in, in my company and it was like down in the motor pool, and it was one of those old. , so like in, in 99, the concept of cyber warfare. So you had an interesting career that really bridged sort of that technological boom.

and then we're light years now in 2023 where we were even 10 or 12 years ago. So I'm interested from your point of view where you've seen sort of the cybersecurity career field come from over the last 10 to 12 years, and maybe even where you think it might be.

jason-shockey_1_01-19-2023_180848: Yeah. And I'll take that back just to where I grew up. So I grew up in Northern California, in the seventies and the eighties. So I got a good look at what analog looked like. got a good look at what being bored was, so had a really creative mind and the place that I grew up, there were a lot of people around me that were completely into computers.

It was, uh, you know, an hour north of San Francisco. So it's somewhat in, in the heart of, the tech bed at the time. but. , you're right from 1999 to 2019 was very interesting to see the exponential growth and application of cybersecurity, tools and processes, and then the people that are interested in doing that type of work.

so in first going in, you know, we're always risk minded In the military, we're always protecting the networks. I mean, that. Secure, reliable. Flexible was what they taught us at com school. So taking those concepts and then seeing those applied in different ways across, the decades.

, I could say that now. it was very interesting to see some people disregard it only to. downfall where sensitive data would be exposed. Oh, it's not that big of a deal. We can cut these corners to now. It's so pervasive. it's everything. Meaning cybersecurity is everything because technology is everywhere.

jason-shockey_1_01-19-2023_180848: Wherever you find technology, there's going to be somebody securing it because there's gonna be somebody trying to break into it if there's sensitive data there. one of the things that, just wanted to highlight. , when you're working in this space, it's a thankless job, and there's a lot of burnout and there's even worse, results when people get, depressed and things like that.

I've seen that before too. but the reason that I focused on interest and personality traits was because of that. Now I get up every day and do information security work because I truly enjoy it, and I think it aligns to. , what my immutable personality traits are, how I am as a person and what I'm interested in, and basically interest in personality traits drive me every day to continue to do what I do, especially after hours working on the website and trying to help people.

 instead of, I would say there's a place for everybody on the cybersecurity team. If you use tools like my cyber path.com, it has the free matching part. It can show you what's available out there cuz you can be in cybersecurity. I would say start as early as possible, but having that end in mind where you're matched to your perfect work role and then seeing across foundational, intermediate, and.

jason-shockey_1_01-19-2023_180848: Steps, what certification, what experience, what training and education to pursue relative to that matched role is a whole lot better than just shooting in the dark and going through a bootcamp and hoping that you land the job at the end of that. Cuz I've seen that not work.

it's really interesting. Obviously you're talking about how pervasive technology is. We all know how it is and obviously,younger generations than ours that, that grew up in this uh, technologically data world. It's just, it is so pervasive. But like you said, this is, how they say is, the undertaker's always gonna have a job, right?

there's never not going to be a need unless they come up with some amazing new invention that is the Unhackable network or Uncrackable piece of technology. that this is a career field that is always going to be in.

jason-shockey_1_01-19-2023_180848: Very true. I worked at the National Cyber Investigative Joint Task Force, which is run by the fbi. It's a whole of government, cyber Space Operations Task force. And I was speaking with somebody from the defense industrial base there and they asked, if we ever gonna build or if there ever will be a 100% completely secure system.

And I said, no, because humans are imperfect and. Create those systems. Until AI comes around and builds a secure system, we will always have jobs . Robert Herge says, I if you know cyber, you can get a job for life. that quote is very apt. it is very true. And, all veterans, and all, all people should be aware of where they might fall within, the cybersecurity career kind of realm.

duane--_22_01-19-2023_160848: I mean I think that's absolutely, clear. And I think that really leads us to, to now back to talking about my cyber path, is your goal is to help people get into the cybersecurity career field. I really like that analogy of, if you are a private, you know, there's a path to go to a sergeant.

Not everybody's gonna be a sergeant major, but you know that there is. To be from the lieutenant to the general. different things go along the way, but you're right, in post-military life, there is not a clear path. And so that's really your goal with my cyber path. there's probably a lot of misconceptions about cybersecurity.

You've talked about some of 'em where people only think it's about hackers. what you need to get into at certifications, what kind of misconceptions are there about the queer field and how does my cyber path help folks navigate.

jason-shockey_1_01-19-2023_180848: Yeah, the two biggest ones are I can't code and I'm not good at math. Those are the two biggest misconceptions. here's a good story. I majored in chemistry. So one of the hardest classes, across the country is physical chemistry. So my physical chemistry teacher told me in our class that sometimes he has trouble.

solving math problems, solving math equations when he is working in the lab. And we were surprised at that because he's teaching, one of the hardest courses across the country. And it was funny to hear him say that, but it was, he was being completely genuine about it. And the end of that story was, if I have a math problem that I can't solve, I go give it to the math department.

And what I took from that, I don't even know how many years ago it was. , if I have a problem that I need to be developed, if I need some code written, I take it to a developer. There are people that do that, and they do it very well. And when you match someone's interest in personality traits and they train long enough to become a competent developer, they'll be able to handle your problem very easily.

here, let me say this too. Don't focus on what you can't do. Focus on what you can. I know that I can lead people, I know that I can speak and I can have one foot in the engineering camp and one foot in the boardroom to explain concepts up, down, and to my peers.

So that's my area of expertise. Incident response, cyberspace management, identifying cybersecurity risk are, something. Some of those others have financial statements also, cuz, being a, a chief, you have to be business minded, but, People hold themselves back. So I think they need to get over that.

And that's why I wanted to focus, and this is the free part. I keep harping on this. Peop anybody can go and get screened for this. It's interests and personality trades, it might work. And what if you don't want to go into cyber? That's fine. Go be a truck driver. Go be a doctor. But this allows people to at least get screened to see what's available.

so yeah, really trying to get the word out. It. It's basically a human screener to help people see what's available, especially in today's age when a lot of people don't like their jobs. Cybersecurity is a very interesting field to be in. There is always something happening.

duane--_22_01-19-2023_160848: and I think this is,and you may have seen it, maybe this is, you alluded to it, when somebody says, I go through a bootcamp, service members get out, they become veterans and they're like, I don't know what to do. I'm gonna take a shot at this thing over here, and it's not really a good fit.

And then they end up, wasting time or money or both. in that whole idea of, the first job out of the military usually lasts about, you're there for about 18 months because you just took the first thing that comes along this, the, what I like about my cyber path is it helps answer some of those questions to say, Hey, this might not be right for me.

or, this is something that I might want to do.

jason-shockey_1_01-19-2023_180848: Yeah. In the assessment, there's never a time where it says you shouldn't be. In cyber, there's always a best match of the 12 archetypal work roles because everyone has interests and everybody has immutable traits that's in every human being. So that's where the every human can get screened to see what they match up against.

The 12 archetypal work roles. there's something else that. I created this for myself because I wasted a lot of my time and money, going after certifications that ended up not being worthwhile. One, the certification wasn't worth anything. Once I got it, I couldn't really apply it where I needed to.

Maybe it was good for somebody else, but not for what I was doing. time, energy, money, and emotion is the equation. is used for everyone's personal budget. How much are you willing to sacrifice by not having a guiding light? How much energy and time and money are you willing to put forth to go in the wrong direction?

Now, you might navigate that's why I say North Star and heading a lot because you know they're nautical terms and it's seafaring coming from the Marines. But what that means is you might go a little bit left, you might go a little bit right, but at least you're heading in the same direction.

End goal. And that's what I'm really trying to get across with these foundational, intermediate, and advanced steps where it's very clear for people to see that when they're in the military, not just abstract a little bit, pick your head up when you're at home after work and think about what you wanna do when you get out.

What would make you happy. so it's spiritual, what makes you tick during the day because that's gonna make. Keep going back to the job and be, I don't wanna use the word happy, but satisfied with the work that you're doing. Yeah,

duane--_22_01-19-2023_160848: No, I think that this is, this is amazing. definitely we will link to my cyber path,in the show notes. So if folks wanted to reach out to you, maybe find out more about the work that you're doing,in things like that, how can they do that?

jason-shockey_1_01-19-2023_180848: yeah, easily. They can use the, email on uh, mypath.com. Contact my cyber path.com. best way. and I mentor a lot of people. Please reach out, to me on LinkedIn. It's, jason-shockey, on LinkedIn. I'm one of the only ones there, but you'll see me as,the founder of cyber cloud.com and also a Chief Information Security Officer.

duane--_22_01-19-2023_160848: That's great. Thank you so much for coming on the show today.

jason-shockey_1_01-19-2023_180848: Yeah, thanks for having me.

Once again, we would like to thank this week's sponsor, PsychArmor. PsychArmor is the premier education and learning ecosystem specializing in military culture content. PsychArmor offers an online e-learning laboratory that's free to individual learners as well as custom training options for organizations. 

One of the first takeaways from my conversation with Jason is the unique situation of Jason planning for life after the military, while he was still in the military. and my personal experience that rarely happens. And if it does, it's only within the year or two before someone leaves the military. There are a lot of reasons for that when you're in the military, you're busy and you do important things you're preparing for training or deployment or supporting critical ongoing missions at your duty location. And we don't often consider what life is going to be like outside of the military. So, like I said, in the conversation, planning for transition is often done consecutively. I do my military job. Then I leave the military. Then I do the next thing. Even in my time in service while taking advantage of education benefits, we're generally encouraged. It's encouraged through a lens of improving your prospects for promotion within the military are used as a retention tool for continued service. Service members may go into the military, thinking that they're going to fulfill their minimum service obligation anywhere from four to eight years. And some get out and some stay in. I think by the time I was in for six years, I knew that I wanted to make it a career. there were times that I thought about getting out before retirement, but not seriously, and definitely not with the plan. But the idea of planning for what's after, instead of what's next is something that's not often done. Uh, service members are often focused on a career pathway based on duty assignments or promotion potential or in service opportunities. Jason provides another concept to consider while you are serving in the military, set yourself up for future success. By knowing that at some point, anywhere from two years to two decades from now, you're not going to be in the military. The sooner you start planning for that inevitable day, the easier the transition is going to be. 

The other point that I would like to bring up is the importance of exploring a career field, learning all you can about it, and the necessity of getting critical advice and important stages of your journey. Like Jason said, when we're in the military, we know that there's a career pathway. Sometimes it's clear, like at this rank, you go to this school or at that rank, you go to that school. Other times it's less clear, like accepting the right job at the right time to prepare for future promotion And again, like Jason said, it's not like that in post-military life. Here's an example from my own experience, I was still active duty when I decided that I wanted to be a mental health professional after I got out, and knew that I had about five years to go to school. I was still in, so I could work as soon as I got out. The thing was there. Weren't a lot of mental health professionals around to give me good advice. I remember at one point that I'd finished my bachelor's degree and was considering my next step. I had two options. One program where I would get a master's degree and another program where I would get a doctorate each from two different schools. 

Both programs would take about the same amount of time. And of course, I thought the doctorate program would be preferable. To enroll in these programs. I needed to work with an education counselor at my local military education center. I decided to make a walk-in appointment, to see someone to start the enrollment process for the doctoral program. And it just so happened that the counselor I was seeing was a temporary counselor who was only with the education center for two weeks before he started his permanent job as a substance abuse counselor At the on post drug and alcohol program. He was a retired army noncommissioned officer who had gone to school and then become a licensed mental health counselor. Exactly what I wanted to be. He explained to me the difference between the two programs, the master's degree program I was looking at was an accredited program while the doctorate program was not, he very clearly said to me, 

If I have an applicant in front of me with the degree for the master's program and another, from the doctoral program, I'm hiring the master's degree applicant every time. I receive critical advice at a time where I could have made a disastrous choice simply because I was uninformed. But think about that even more. What if I had gone to the education center two weeks earlier, or two weeks later, right? I'd seen another counselor who wasn't as familiar with the differences in mental health counseling programs. 

I would've wasted both time and money on the wrong degree program and wouldn't have been able to do what I wanted to do. I consider myself extremely lucky to have gotten that critical piece of advice. And that's what Jason's trying to do to share his critical advice at a time when it's still actionable when people are still exploring options, rather than when it's too late. We shouldn't have to rely on coincidence and serendipity for career success. Although it's often like that instead we can create opportunity for serendipity to occur, which is exactly what Jason is doing with my cyber path.com. 

So, hopefully, you appreciated this episode. If you did, we would appreciate hearing from you. So if you do have some feedback, let us know, drop a review in your podcast player of choice, or send us an email at info@psycharmor.org. We're always glad to hear from listeners, both feedback on the show and suggestions for future guests. 

For this week, PsychArmor Resource of the Week, I'd like to share the PscyhArmor course, the job search, this course provides service members, Veterans, and their families with practical ideas for beginning the job search as well as ways to jumpstart their career by networking and apprenticeships. You can find the link to the resource in our show notes.