Soft Skills Engineering - Episode 527: I lost my job after 10 years and am I too old to switch to a security career?

Episode Date: August 24, 2026

In this episode, Dave and Jamison answer these questions: Hello Dave and Jamison! I’m a longtime listener going back to the early days of the podcast, and I’ve listened to every episode since. When I started listening, I was beginning my career as a software engineer. Your advice has truly helped shape how I think about work, engineering, leadership, and all the weird human stuff that comes with building software. Now I’m more than 10 years into my career, and I’ve run into a problem that I suspect many experienced engineers are dealing with right now. In episode 521, you talked about how brutal the current job market is, and the question asker from that episode had been unemployed for a year. I’m thankfully not there yet, but I recently lost my job in a large layoff, and the first couple of months of searching have been pretty discouraging. I’m applying to roughly 10–20 jobs a day. I tailor my resume to each role, ensuring it accurately reflects the skills and terminology in the job description. I usually include a cover letter too; AI gets the privilege of writing the mediocre first draft, and then I rewrite it into something I would actually say. Despite all of that, I’ve only made it past the resume screen three times so far, one of those was through a referral, and several other referral applications have gone nowhere. The strange part is that I’ve tried applying across the whole spectrum: Roles that would be a step up, where I think I could do the job but haven’t held that exact title before Roles at roughly my current level, where I can honestly check almost every box in the job description Roles that would technically be a step down, but that I’d happily take and feel extremely confident I could do well So my question is: How do you get companies to actually interview you when you’re an experienced engineer in a market overwhelmed with qualified candidates? At this point, I’m starting to wonder whether there’s such a thing as an awkward career middle age: too experienced for some jobs, not obviously senior enough for others, and competing with hundreds of people for everything in between. If you were in this situation, what would you change? More networking? Fewer but more focused applications? Different positioning? Showing up at the hiring manager’s house with a fruit basket and a printed copy of my GitHub profile? Would love to hear how you’d approach it from the other side of the hiring table. Dave and Jamison, Hit me with your dumbest, funniest, most brutally honest advice because I need it. So here’s the deal: I’m a software engineer with 30+ year in the industry, a dinosaur who’s already reinvented himself like a half-dozen times, network, dev, infra consultant, back to dev. Now I’m having a midlife-ish (okay, late-life) crisis and I’ve fallen in love with security and compliance. Like, actually excited about compliance, which I’m told is a red flag in itself. Problem is: I’m less than 10 years from retirement and my brain doesn’t bounce back from “starting over” the way it used to when I was a spry young whippersnapper. So, am I an idiot for even considering torching my comfy expertise to go be a security newbie this close to the finish line? Or is this exactly the kind of chaotic energy I need before retirement?

It takes more than yelling, product chaos monkey as you randomly close tickets in your backlog. To be a great software engineer, this is episode 527 of the Soft Skills Engineering podcast, where I'm your host, Jameson Dance. I'm your host, Dave Smith. Soft Skills Engineering is a weekly advice show about all of the non-technical things that go into the technical field of software development, like introducing the project management team to the benefits of resilience. Is your backlog resilient to random technology? ticket deletion.

Yeah. Do you have like error correction codes in other tickets so you can recover the missing ones? Yeah. Don't worry, we're helping. This implies that you need a staging Jira environment. That's right. I guess. Yeah, so you can test.

Well, yeah. What's the podcast equivalent of Chaos Monkey? I think it was what I did just before this where I had the wrong audio input. I think that's it. Yeah, that sounds about right. Dave, do you want to thank our patrons? Oh, you know I do. Let's just, this is one of my favorite things to do is I just click this button,

and up comes a list just full of joy. Okay, here it is. Thanks to those who are contributing on Patreon at a level where they get a weekly shout-out. This week, they are Tom Foolery, frivolity, and shenanagannagannery. Control, H, control, H, control, H's shall commence. Will had a wrap battle with Lattice Washroom, Seth, Jenny, What, is there a joke there? No, I just, it's, I hope that's not someone's real name that I just laughed at.

This sounds like kind of a silly name. It got me, I don't know. Yeah, I hope it's not so much real name, too. Yeah, okay. Jenny Kim, the stochastic pirate, Ira Chan, Jonathan King. That's all one name, by the way. How much code could a code toad load if a code toad could load code? Who even knows what their actual names are?

My actual name on LinkedIn is, Yemi debugging in the dark candy, token limit reached. Jacob's channeling a tingle-frozen barrel bees. Etymology comes from the ancient Greek etymont, what is true, and loggia, the study of. Not to be confused with Boolean algebra. Etymology Corner, software originated in 1958 as the opposite of hardware. Nice. Got a different corner this week.

Nick Malinu, Javier Gonzalez, space, chewy. Open print, salted fries, semicolon, lost episode 100. Deep cut. Didn't we skip episode 100 because we didn't want to... We did. Yeah. We didn't want to handle the pressure. The pressure was too much.

Yeah. We're not going to do a special episode. We'll just skip to 101. Yep. That is so on brand. Yep. It all worked out. Every hundred, I think we come up with some new excuse for why we didn't do anything special.

Yeah. I think that's the secret to our longevity. Oh, not recognizing milestones. Yeah. Yep. I like to think of it as dogged persistence. Okay, continuing Jameson's Nordic Country Corner, Iceland is the one with the geysers.

Nice. Won't Angel. Dan from drone deployed. Never is not just a crater on Mars. Flamingo emoji. I like chicken, I like liver. Miamics, please deliver. I can see Dodds.

Kyle Boss, the person hearing this is awesome. Kent, C. Dodds, techno, techno, oots. Jenny Kim, the stochastic parrot, Ira Chan, Jonathan King, Zain, beautiful, functional user. documentation, Adrian at kappa.a.i. I have to wonder, has anyone ever emailed Adrienne at kappa.coma.ai like to say hello? I don't know. It's very clever. I'm waiting for the day when someone puts their phone number in here and they start getting text messages from people. Okay. Angelica Cathow, where Will Angel is low on yellow science, but overflowing with space science.

Okay. This one, I think, is Rager, but without the E? I choose to believe you. Braden Keynes, John Grant, Brittany Ellick. And last. but not least, my least favorite, most challenging one to say, because I know that it'll be lossy when translated back to written text, and that is closed parenthesis, followed by a literal close parenthesis, closed parenthesis, followed by a literal close parenthesis. I wish you could see this one in writing. It just does not translate an audio form. I just feel like I'm leaving a lot of comedy effect on the table by just reading it out loud because you just can't see what's actually written there. I think that it's made up for by the joy that we get when we see it. Yeah. That one is

just for us. That's what it is. Yeah. Yeah. Well, Dave, should I read our first question? Go for it. All right. This is from an anonymous listener who says, I'm a long-time listener going back to the early days. And I've listened to every episode since. When I started listening, I was beginning my career. Your advice has truly shaped how I think about work, engineering, and leadership and all the weird human stuff that comes with building software. Oh my gosh. I'm more than 10 years in. 10?

What? Those numbers don't make sense to me, but I guess they're right. Yeah. Harsh reality just hit. Yeah, this is, you could have started your career with this podcast already going. You could be like a principal engineer now. Yeah. We need to give this podcast a level and like some kind of promotion.

Its level is fifth grade. I believe that's... That's about right. Yeah, that's a 10-year-old type of grade. In episode 521, you talked about how brutal the current job market is, and the question-asker had been unemployed for a year. I'm not there yet, but I recently lost my job in a layoff, and the first couple of months have been discouraging.

Applying to 10 to 20 jobs a day, I tailor my resume to each role, I include a cover letter, A.I writes the mediocre first draft, and then I rewrite it into something I would actually say. Despite all of that, I've only made it past the resume screen 3, time so far. One of those was through a referral, and several other referral applications have gone

nowhere. I've tried applying across the whole spectrum to roles that would be a step up, roles at my current level, or roles that would be a step down, but that I would happily take and be confident I could do well in. How do you get companies to actually interview you when you're an experienced engineer in a market overwhelmed with qualified candidates? I'm starting to wonder whether there's such a thing as an awkward career middle age, too experienced for some jobs, not obviously senior enough for others and competing with hundreds of people for everything in between.

What would you do in my situation? More networking? More focused applications, different positioning, showing up at the hiring manager's house with a fruit basket and a printed copy of my GitHub profile. I would love to hear how you'd approach it from the other side of the hiring table.

Oh, man, this, wow. Sorry, I've got a lot of empathy for this person. And I'm just thinking about the 10 years story arc of this person's career and of the podcast and how different the world is today than it was when we started a podcast whose tagline was quit your job yeah yeah and all the context that went into why it was a funny thing to say quit your job back then because it was just such an easy thing to go get a new programming job yeah and now look at us boy good thing we didn't call it quit your job engineering quit that that would not be

not have aged well. No, unlike our hundreds of episodes of the backlog where we did say, just quit your job, it's fine. Yeah. You'll trip and fall into more money. Right. Oh my goodness. It is such a crazy hard time right now. Yeah, I feel for you. Yeah. So references, referrals have always been great for getting a job, not always as important, but I think the combination of the tough job market, meaning lots of people are applying. And the explosion of tools to help craft and spam resumes around means that the cold application, while never excellent, is now worth the effort you put into it with all these AI generated tools. Or not even the effort you put into it. No, it's worth less. You could put a lot of effort into it. Yeah. It's worth the effort it would take someone who is trying

to put the least possible effort in. Yeah, which is not hard. Not a lot. Yeah, it's probably like pay $10 for some SaaS product and then you get 10,000 applications spammed or something. I don't know what it is, but those do exist. Yeah, they do. As a person on the other side, it is soul crushing to look at an inbound applicant queue and say, most of these are probably spam. Right. And I will now turn through 10,000 of these applications to find the five that are real people. Yeah. Like, I don't know.

Those numbers are hyperbolic. It's probably more real people than five, right? It probably is. But more qualified people that, yeah, I don't know. You've always opened applications and it's always been some kind of filter of like, okay, we get enough people to apply and then we'll find people that fit our skill sets and it seem like have enough, I don't know, spark of whatever it is we're looking for. Like, you always kind of acknowledge, yeah, and some people will apply that aren't a good fit

or don't have the skill set. But I have never trusted the contents of people's applications so little as I do now. You can always lie, but you can now lie at scale with AI. And people do. And it's actually horrible. They absolutely do. Yeah, we found hiring side tools are being created and augmented to combat this. And the end of this arms race is everybody's AI looking at everyone else's AI.

like but there's there's stuff to identify duplicates by um content or similarity that isn't like oh they just use the same email address but that does get through also some people literally just use the same email address for a bunch of different applications with different content on it and yeah so part of the difficulty you're seeing is uh unfortunately that the trust being eroded and employers responding to that yeah tough tough situation so let's see here he this listener says, I've only made it past the resume screen three times after doing 10 to 20 job applications per day for months, plural. So that means three times past the resume screen out of approximately, call it 500 job applications? Yeah. Rough. I don't have a ton of advice for how to

get past the resume screen. And that's pretty hard. All my advice is more like once you actually have an in-person interview scheduled. I have tons of ideas for you. But how do you get past that early screen? I guess you have to sidestep the process. Yeah, you have to double that. Good news, you have a 25% conversion rate for references. That's incredible. That's like, yeah, if you were looking at Google ads, you'd be making a bajillion dollars. So instead of saying, oh, I've had, I've had, oh, no, okay, I got my numbers wrong. But anyways, one through a referral. Made it past the resume screen three times. Several other referrals gone nowhere.

Either way, referral hit rate for even making it past the screen is great. And I would focus there. Yeah, it's way higher than your just cold application. Yeah, versus your like sub 1% of spamming resumes. So, okay, I'm going to give some advice on how to get past this heinous, horrible process. And then I do have some advice for once you get in person, what you can do in 2026. to stand out as a candidate. But I think you're going to want to start connecting with people

that you probably have resisted connecting with in the past. And that is recruiters. I think having a good relationship with a recruiter for, like let's just say you figured out a company you want to work for, figure out a way to make a personal connection with a recruiter there. The recruiter is dealing with this spam problem in a big way. Like they're getting hundreds, maybe thousands of resumes a week. And so if, and I'm just speaking from experience in a small company,

where I've opened one or two positions and I get 400 applications in a week. So if you can find some way to get on the phone or get an email address or even in person, meet the recruiter who's responsible for hiring at a company that you want to work for, that'll be a big leg up because they know how to navigate the system. They know how to get your resume right to the top of the pile for phone screens or for whatever the next stage is. Yeah, I think recruiters are maybe, at least for now, one of the sneaky, sneaky implies some degree of ill intent. I think they're kind of like accidental beneficiaries of this explosion in AI spammy applications

because a recruiter talked to them and verified they at least seem somewhat real is a more valuable screen than it used to be. Yeah, totally. Still not a great signal, but. But it's a good signal to get that 800 resumes down to like 50. Yeah. No? Yeah.

So I would do that. I try to connect with recruiters. There are headhunters who are free agents who will deliver candidates to companies and then charge an exorbitant finding fee. Those are not the kind of people I'm talking about. I'm talking about corporate recruiters who are employed at a company who that's a strong signal that that company is actually hiring if they have a recruiter on staff. So if you could search LinkedIn, you know, find all the companies that you know that have job openings. Then, you know, you've already done hundreds of these applications. This sounds like a great job for an agent, by the way, but go on to LinkedIn and find out.

and find people who belong to that same company who have the title of recruitment or recruiter or hiring manager or talent, something like that, and find those people and try to do personal individualized outreach to them. And I got to tell you, I've worked with a recruiter this year, and I was actually,

I hired five engineers and a product manager this year. And I hired a recruiter to do all the sourcing and to go do proactive outreach to candidates because I stopped trusting the information, flow of all the applications like you were just talking about Jameson. It was just too much. Yep. Couldn't find good ones. And I just, I didn't, it's just so horrible. It's a horrible experience. Which sucks because there, I mean, there probably are still some good ones in there. It's just, if it's one out of a thousand, now it's, is it worth the cost for you to look through

the other 99? Yeah, exactly. The soul crushing, like, waste of time that will be. It drained my energy more than anything else I do. Like I would read through resumes and I'd be like, okay, I've probably reviewed 100 resumes. It's probably been two hours. And then I look at the clock and it's been 20 minutes and I've reviewed eight.

It was horrible. So I got this recruiter and she was so good. And I'll tell you, these recruiters, they pick up on signals. They really, really like it when candidates are proactive and reach out and make contact and communicate on a human-to-human level.

every time someone did that, the recruiter would pull that person's name to the front of my queue and say, hey, this person's very proactive. Because it turns out a really strong predictor of whether someone will be good on the job is if they really want to work at your company with you. And so people share that signal by doing a bunch of proactive outreach beforehand. And every time someone did something special, like, hey, this candidate just sent me a special email with a, you know, a message for the hiring manager. And I feel, they feel obligated to pass it along. Now, if a thousand people are doing that, then it won't work. But in the case of my recruiter, you know, probably 1% of applicants would do something special like that.

Yeah. So they would all get passed along. Yeah. Yeah, I mean, it feels so pithy, but you need something to stand out from the pile of cold applicants. Yep. Just get famous. Not easy to do, but they're like tech famous people and then it's easier for them to get jobs if you have, that gives you kind of a network. It's very easy.

just go create like go back about 18 months and create clod code yeah you'll be you'll work anywhere you want i would have more questions if you were able to do that but that would probably work i would be curious how you how you did it um you could probably get more jobs than just like a cool programming position if you invented a time machine yeah that part i thought you're talking about writing clod code i'm like it's not that hard james no well yeah in hindsight but also you had to build a time machine to take advantage of it. Yes, that is interesting. Go back to 2022, get a great offer. Easy. 21 maybe.

I had a point. Now it's gone because I distracted myself. What was my point? The time machine does it every time. There's just, yes, the time machine. Of course, of course, the time machine. No, there's, there's just the standard stuff about networking that I think is even more important. I think COVID killed in-person conferences or smushed them quite a bit. It didn't kill them, but they definitely died down. I think the value for you as an attendee is higher than it has been in the past because the value of in-person networking is higher. Like user groups and I don't know, Discord channels and whatever, whatever, there's a million different ways to do it. But if you meet people that you do not already work with in some genuine way, you get to soullessly mind them for potential future opportunities.

especially this question asker right you've you've uh you've been around 10 years you got laid off you have 10 years of former co-workers yeah i think it's not weird to reach out there's there's probably some percentage of them that you think i like this person i think they probably liked me just reach out and and say hey i'm looking for work do you know of anything totally it's worth doing you totally should i've gotten lots of lincoln messages over the last year or two and all of this layoff stuff's been happening and a lot of them have been Hey, I lost my job looking for work. If you know anything, let me know.

Not a problem at all. And it's nice to hear from people, too. I think sometimes it feels like, oh, is it going to be, is it going to seem mercenary? Like, well, you didn't talk to me before you were looking for work. I don't feel that way. I, as a poor, long-term, like, I don't know, relationship, follower, upper. I appreciate people reaching out even if it's just, hey, can you help me with this thing? it's still nice to see old faces.

Well, have we answered the question? I mean, we've answered the first part of the question, which is how do I get through the resume screen? And I think that's probably 80% of the question. And I have a bunch of notes on what you can do once you get past that screen, but maybe send in a new question when you get past that. Just in the interest of time. That was a teaser.

Yeah. But I do want to say one thing that you can definitely be doing right now is developing your expertise with AI development tools. Like get really good with these tools. Unfortunately, that costs money these days and money is something that's not coming into your life as much since you lost your job. But it's, I think, easy to be perceived as being left behind if you're not doing that stuff right now. And that'll definitely come to bear in like the post-resumies phase right away. It'll probably be one of the first things. Yeah, I love it. All right. On to the next question. Yes, please.

Okay, this comes from an anonymous listener who says, Dave and Jameson, hit me with your dumbest, funniest, most brutally honest advice because I need it. So here's the deal. I'm a software engineer with 30 plus years in the industry, a dinosaur who's already reinvented himself like half a dozen times. Networking, development, infrastructure consultant, back to development.

Now I'm having a midlife-ish, okay, late-life crisis, and I've fallen in love with security and compliance, like actually excited about compliance, which I'm told is a red flag in itself. Ha. Problem is I'm less than 10 years from retirement, and my brain doesn't bounce back from starting over the way it used to when I was a spry young whippersnapper. So am I an idiot for even considering torching my comfy expertise to go be a security newbie this close to the finish line? Or is this exactly the kind of chaotic energy I need before retirement? Ooh, an interesting question.

My brain doesn't bounce back. Do you think this means cognitive slowdown, kind of harder to learn new stuff? Or is it more about the jump from just a senior role to a junior role or something else? I was thinking it was more learning new things in kind of a reboot. Yeah, well, you don't have to learn anything because AI can do that for you. Yeah, good news. Good news. It will learn for you.

I think this is a great time to be in. security. I have never cared as much about security as I do right now. Yeah, this is really interesting. You know, I agree, Jameson. I think now is a great time to make that change. Now, I think that's probably not so much what the question asker is wondering. Is security a good industry to go in? But rather, at this phase of my career, is it right to switch? But I want to talk about why now is a great time to get into security. Yeah, let's, all right, let's pull a class. It can change the question. I mean, everyone I know is having major security problems now. Things that just weren't a problem before are now becoming problems.

And it's everything from fraud that we've seen, like, you know, the resume fraud that we talked about in the last question is definitely happening in other areas too. Like people getting hired, but they're not actually who they say they are, where they're hiring a stand-in to do their interviewing and then working remotely, but they're just phoning it in and working four jobs at a time. That stuff is even more rampant now than it was right when COVID kicked off. which is surprising. Like, I thought we'd have,

I thought we would have that under control by now, but we're not. And then also just the straight up technical, like cyber attacks that we're getting, those are definitely on the rise. I'm hearing about breaches all the time. And so never has there been more of a need for security in the industry than ever before? Or has, did I say that right? Never has the need been so great? Yeah.

It also sounded like a cool speech you could give in the House of Lords or something like that. if you never has the need been so great, that just has a flare to it. Yes. Is this exactly the kind of chaotic energy I need before retirement? I mean, based on everything I know about you from the few paragraphs you submitted, I feel like this kind of fits the vibe. The question is written in a humorous, chaotic way. So maybe that works.

Maybe it's risky financially, right, if you're, I don't know, you didn't bring that up. So I'm assuming you're super rich already. And I think I have a, a lot of unknown unknowns about security. So there's a ton of hard stuff I just don't know about and we'll say dumb things. Can you say exactly how many unknown unknowns you have? I will ask an AI to solve some advanced frontier mathematics problem to prove that real quick.

Okay. Get back to you. But the stuff I do know, I think having extensive software experience is super valuable. And it's more about the lens that you apply it to. Does that make sense? Like if you know in depth how containers work and cloud infrastructure and how software is written, great. You can attack stuff Blackbox without knowing that, but knowing a lot about, I don't know,

having it. You've implemented Oath. Like, cool, you probably have some hints about what could go wrong there. Yeah, what is the question? Is the question, am I dumb? Like, no, you're a listener. Of course you're not dumb. You passed the not dumb gate by just subscribing to the podcast.

Nice work. Yeah. Nice work. But what is the brutally honest advice you would give someone? Let's say you're, okay, I'm going to just go out on a limb here and name some ages. So I am less than 10 years from retirement. So I'm going to arbitrarily pick retirement age of 65, which means you are older than 55. And I can tell you, not from, I'm not quite 55 years old yet, but I can tell you from

personal observation of people I know who are that that is not a problem. In fact, I have a team member on my team right now who is in his mid-60s, who, what, three, four years ago, pivoted from management, after a long management career, pivoted to individual contributor engineer, and he's doing great. And I think there has never been a better time to pivot your engineering career within engineering. So here we're talking, you know, staying within the confines of software engineering or kind of information technology in general. never has been a better time because you have all of this AI assistant stuff that can help you ramp up so fast and get so good. And, you know, my engineer friend who's working in his 60s as an individual contributor engineer is using AI so, so much. And what that means is that the things that are normally associated with aging, like my memory is, I have struggled to remember things or I can't

think as fast as I could before. These things are almost all offset by a, combination combining AI assisting with tons of experience where you've got like all this spidey sense about you, you know, where you're like, I know this is a bad idea. I don't know for sure why, but I'm going to consult with my AI and sure enough it is, you know, and all the little details that are hard to remember as you age just aren't as important anymore, I think, because AI can help you with that. And one of the things that AI is just so great at is where you can say, hey, here's a scenario, what else should I be thinking about? You know, and it just gives you five things. You're like, wow, I never would have come up with that list on my own. And boom,

that's something that's hard to do for an aging brain, but for an aging brain that has AI as a buddy, I think it's great. I wouldn't hesitate at this age to make a switch like this if I really love, love the area I'm going into. Yeah, yeah. Maybe stereotypically you would imagine an older brain to have a harder time generating those five things, but all the wisdom and experience makes it easier for you to give reasonable evaluations of them. Yes. I don't know. Maybe your evaluation is wrong because it's, I don't know, it hasn't kept up with

the times or whatever. Yeah, maybe. But I think, yeah, judging AI output is important still, very important. Totally. And someone really experienced should be really good at judging AI output. So good news. I think that's so right. In fact, one of the scariest things I find is people who are totally inexperienced

or totally uninformed in an area, like maybe a brand new programmer or maybe someone pivoting into programming who hasn't ever done it before, they use AI and they come up with just the dumbest things. Boy, I don't want to hurt any feelings here, but I had an experience with this just today where someone said,

okay, I want to do this thing, and then I want to base 64 encode the text. And I said, oh, that's interesting. This is not an engineer, by the way. This is like a, I'll just say not an engineer. And I said, why do you want a base 64? it. And the person said, well, the AI said to do that. And I was like, yeah, but why? Like, it's just, you're taking, you're taking text and you're not doing anything with it that would

justify a base 64 encoding it, like if it was binary or something or not printable, or if you, you're putting it in a URL or something where, you know, it's going to get weirdly encoded. None of that was applicable here. But they couldn't explain it. And that was the thing that troubled me because you put AI in the hands of someone who doesn't have the experience to know when the AI is telling you to do something that doesn't make sense. Yeah, they just couldn't have base 64 encoded it before. So, problem sort of averted. Yeah, exactly.

Now they can. There was a natural barrier to entry to do many wrong things in the past. They wouldn't, like in the past, they'd never even heard of base 64, you know. But now the AI is like, well, you should base 64 encode that. And it's like, oh, yeah, of course I should. But then when someone with even a modicum of more experience than them shows up and says, why they're just lost. So, but if you're a 55 year old and you've been writing software for 30 years and the AI says,

you should base 64 and code this, you're going to be like, why? And then you're going to tell it. Yeah. You know, you're going to tell the AI like, hey, why are you wanting to do this? Because that's just going to raise alarm bells. And the AI will be like, oh, well, here's what I was assuming. And then you can say, well, that's not right. So, you know, here are the actual, here's the actual context.

And then the AI will probably change its mind. Or it'll double down. I don't know. Sometimes does that. One of the things I've most admired about security professionals is the, to me, outrageous lengths they'll go to to pursue something. And it always feels like brilliant puzzle solving of, okay, I found this tiny clue through exhaustive effort and then discover this tiny clue if you do this wild sequence of events, then leads to this other thing. Like, the cost of exploring that is so much lower now. Oh, yeah.

It's so great. Which is behind a lot of the spooky headlines of felony bench. Have you seen that? No, what's that? Like all these different AI providers have sheepishly yet sort of excitedly announced how their newest agent has hacked some systems. So someone keeps posting on Twitter like, oh, Anthropic is at 7 on felony bench? Oh, look at that. Meta's at 1.

Hey, they're catching up in felony bench. They're committing more crimes. I love that. I love that so much. I actually saw kind of a meme about that how they were bragging like, hey, isn't it? cool that we've also got an AI that escaped a sandbox now? I can't look away. I get it. I get why they do that because it is fascinating and horrifying. They're bragging about security incidents now. They've got my, I mean, it's working. They have my attention. I cannot look away. I suck in all the

details I can about these things. It's so true. Now, I will, can I give a piece of advice on moving to security just in general? Yeah. There really are, in my experience, two categories of so-called security people. There are the people like the ones you just talked about, which are extremely skilled. They go into the details. They're the ones that discover the amazing breaches that took place, and they unravel the clues and figure out how to reconstruct what the attacker did, and they do really cool audits, and they find vulnerabilities, and they publish research, and they, you know, that's one category of security person. And then there's a second category. And you might already know what I'm going to say. Let's just say, I refer to the second

category as checkbox security, where maybe you work for some giant corporation and someone three levels up from you has created a policy. By the way, the policy consists of like 75 checkboxes that must be checked every time you're going to onboard a new vendor in the company. and you have found that your job, you're a security and compliance person, but your job is to then check those boxes for every new vendor that comes online that does business with your company. Yeah. These are very different jobs.

And I think if you're looking at switching into the security world, you need to know which one you're going into. Because I think those two categories of people don't talk much with each other. I worked with a really good compliance security engineer, and he was the most collaborative and friendliest compliance-oriented person I've worked with. It was actually really nice because I have felt that, uh-uh, uh, like a lot of finger wagging and clucking and, but his advice included, imagine you have been sued and you're in a deposition. Yeah.

Is the thing you are about to say about what you did going to make you feel really stupid? Yes. And I know compliance is way more than that. But it kind of boils down. Yeah, it boils down to that. Yeah. Something has gone wrong. You are being sued.

You're in court. Can you say, yeah, but it's, we didn't do something horribly stupid. Like, yeah, it's bad. But it's not like I texted my CEO everyone's credit card number because that's our import process. Yeah. Yes. I've dealt with some real. gems of security people and some of these checkbox security folks, they sometimes try to extend their

influence into areas where maybe it doesn't belong. And I have one example that I'll share with that, but we were migrating our application servers from Azure to AWS. And we had servers running in one of the Azure regions, which was in Ohio, no, sorry, Iowa. That's where the Azure Midwest region is. and we were migrating the servers to the AWS Ohio region, US East 2. But we had this problem because the database was still running in the Iowa region. And so, of course, like, I immediately knew there's no way it's plausible for us to move the application servers and not the database, you know, and somehow just keep the database in Iowa and have the application servers run in Ohio. Yeah, just like hopping cloud providers.

Exactly. And there was like 30 milliseconds of latency between those two regions. So there's just no way that an application server that makes hundreds of queries every time a person visits the app in the web browser, there's no way that that will actually work and create a good experience. But one of our security compliance people was indeed researching this really cool like VPN solution that connects regions together. And he tried to convince me that using this tool, we could connect these regions together and we could leave the data. database behind in Iowa and run the application servers in Ohio, and that way we wouldn't have to take any downtime when we do the migration cut over to AWS. And I remember he pushed on this

really hard. And I'm like, dude, we're dealing with the speed of light here. Like, there's no VPN you can buy that is going to make these electrons travel faster than the speed of light between Ohio and Iowa. But he just couldn't get that. And anyway, so I guess don't be that kind of security. and compliance person is the basic takeaway. And I think that's one of the great things about pivoting from a software engineering career to security and compliance is you're going to be a bright, shining star in a lot of ways. When you bring your experience to bear and when you can say basic things like, hey, there's a 30 millisecond latency between these two regions and we do 100 database requests

for every page loads. That means you're going to add three, what I do that right? Yeah, three, no, 30 seconds of latency for every page viewed. Like, are you sure this is acceptable? You know? So I think it would be a great thing to pivot. And I wouldn't worry one bit about the age. Yeah, I love the idea that you could have a lot of empathy and be a partner for the people you work with.

If you're in compliance, your job is to mitigate risk. And mitigating risk always has a cost. And so I think the poor compliance experiences we've had felt like the cost doesn't matter to the people imposing the cost. But good ones are like, cool, you partner on. it. Okay, here's some trade-offs. And yeah, some investment means we're less likely to be in violation of this regulation when interpreted this way. And is it worth it or not? Is it a much different conversation than this popped on my scanner. Yeah. It will take an act of a deity to get any kind of exception from this. Yes. Exactly. I mean, it's great. I think, you know,

you'll, you'll have empathy around things like deployment pipelines and unit tests and security issues you've dealt with. And you'll know all the sneaky things that developers do when they're like, all right, if we just, we just set up a secret other secret prod environment. And it's really easy to deploy to. Wait a minute. Hold on now. So you're saying not only can you be a great partner to developers because you have empathy, but you also know where they hide the bodies. Yes. That's, yeah, that's your, that's your stick. You got the carry, you got the stick. It's the perfect combination. Yep. All right. Good luck. I think. This will be exciting.

Oh, yeah. I think it's great. Yeah, you could just dwindle into senescence, but doesn't it sound cooler if you're the type of person that would write this question to, like, cartwheel, somersault, catapult your way into this new career at the very end. And I don't know, that sounds kind of fun. If you're up for it, which I gather you are, then. I think so.

Sounds like an adventure. I would do it. All right. Did we answer the question? What can people... We did. We did. We did.

so much that I assumed we did and didn't even ask you. But I'm, yeah. Now moving on, Dave, what can people do if they want their own questions answered? Go to softskills.Odio and click the Ask a Question button where you can fill out our little form and we will read it. We will consider it. We will think about it. And then we will answer it eventually.

We appreciate all of you who have done that. We get so many wonderful questions every week and we love reading them. Thank you so much for doing that. It keeps the show going. Yep. Thank you. We will catch you next week.