Secure the InfoSec Bag

Six-Figure Career Guide for Women in Security

About The Author: Keirsten Brager (Kear-sten Bray-zure) went from

being a struggling single mom to security technology lead at a Fortune
500 with multiple sources of income. In fact, Dark Reading recently
named her one of ten women in security quietly changing the game.
Although she was not contacted prior to publication, the article does a
great job of illustrating that she is practicing what she preaches about
having diverse revenue streams. Therefore, she is uniquely qualified to
teach other women how to build a lucrative career like a boss.

Keirsten came from a background of zero privilege, so she is able to

relate to women who need career strategies that do not require coming from affluent families and
Ivy League schools that are out of reach for the majority of the population. She spent the last two
years working full-time and attending graduate school for her M.S. in Cybersecurity. After
finishing graduate school and engineering some work/life optimization into her life, she turned
her attention back to her life’s purpose - using technology to be a rising tide for other women.

She is on a mission to help women:

 Secure the three million open security roles that are projected to go unfilled by 2021
 Secure at least 50% of the $100 million that HackerOne plans to pay out by 2020
 Gain access to funds for scholarships covering books, conferences, and certifications
 Start and advance their careers with various sources of revenue
 Feel confident, inspired, and worthy of success

Keirsten Brager is a mom, wife, public speaker, CompTIA technical exam developer SME, and
mentor. She holds a M.S. in Cybersecurity and several industry certifications, including the
CISSP and CASP. As an active member of BWISE & ISSA, Mrs. Brager has participated in a
number of panels and public speaking engagements promoting strategies for career success. She
provides career advice, mentorship, and inspiration on her website www.keirstenbrager.tech

Copyright © 2018 by www.KeirstenBrager.Tech

Page 1 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Contents
Introduction ................................................................................................................................................... 3
Tip 1: Understand SMART Goals ................................................................................................................ 5
Tip 2: Develop SMART Goals ..................................................................................................................... 6
Tip 3: Identify Local Volunteer Opportunities ............................................................................................. 8
Tip 4: Prioritize Your Needs ......................................................................................................................... 9
Tip 5: Decide Red, Blue, or Purple Team ................................................................................................... 10
Tip 6: Narrow Scope of Target Companies ................................................................................................ 10
Tip 7: Outline Required Skills and Experience .......................................................................................... 11
Tip 8: Detect Back Doors Into Roles .......................................................................................................... 11
Tip 9: Build a Home Lab ............................................................................................................................ 12
Tip 10: Create Online Portfolio .................................................................................................................. 13
Tip 11: Be the Light .................................................................................................................................... 14
Tip 12: See the Light................................................................................................................................... 15
Tip 13: Get Your Bug Bounty On ............................................................................................................... 16
Tip 14: Other Revenue Sources .................................................................................................................. 16
Tip 15: Develop Results-Oriented Resume ................................................................................................ 18
Tip 16: Write Your Own Ticket .................................................................................................................. 18
Tip 17: How To Fire Your Boss ................................................................................................................. 20
Tip 18: Just Ask .......................................................................................................................................... 26
Tip 19: Dress for Wealth............................................................................................................................. 27
Tip 20: CISSP Prep ..................................................................................................................................... 27
Bonus: Secure the Budget Basics................................................................................................................ 31
Key Takeaways ........................................................................................................................................... 34
Call to Action!............................................................................................................................................. 35
What is your WHY?.................................................................................................................................... 36

Copyright © 2018 by www.KeirstenBrager.Tech

Page 2 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Introduction
Early in my career, employers completed “check the box” performance reviews without offering
formal talent development. As a result, I took the trial and error approach to understand which
skills, credentials, and activities provided the best return on career investment.

Since then, I have gained access to strategies that enabled me to cross the six-figure income line.
I believe that there is enough space for all of us to thrive, so I am using writing and my platform
to share what I have learned to accelerate your success.

There are gender and wage gaps in the industry, so I am sharing my experiences to make the
industry more accessible and equitable. I believe that women are more than capable of helping
solve some of the vexing cybersecurity challenges that the world is facing. I also believe that
financial abundance is a worthy cause for women to pursue so that they can contribute to
improving our communities.

With this book, I am going to teach you strategies and tools that you need to have a great career
in infosec. From defining your goals to building a network to increase your net worth, ramping
up tech skills to knowing when to walk away, I will teach you to think beyond the single income
aspect of reaching the six-figure salaries in online guides and some job descriptions. As you go
through the worksheets at the end of this guide, I challenge you to start thinking bigger and plan
for careers with W2s and 1099s. Consider this:

 Bug bounty programs pay researchers millions of dollars per year

 Security certification providers, colleges, and universities conduct ongoing content
refreshes and pay industry practitioners for their expertise
 Platforms pay security practitioners to appear on their webcasts
 Companies pay consultants for project based niche services
 Conferences pay lucrative fees to their speakers

A career in InfoSec can open doors to great base salaries and supplemental income, some of
which can be performed from anywhere in the world with an internet connection. You could also
improve the functionality of existing tools or develop better security solutions and/or services
that can be monetized.

With the right strategies and credentials, you can gain access to several sources of income
without working multiple full-time jobs. The worksheets in this guide are designed to expand
your thinking about the opportunities available to you.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 3 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

This is much bigger than access to opportunities though. Getting out of your comfort zone will
allow you to have a positive impact on those around you. The good news is that your family will
not be the only ones to benefit.

Gaining access means you can influence the direction of the industry as a whole. This includes
academia, security technology, government policy, the design of certifications, call for papers
(CFP) committees, hiring panels, implementation of codes of conducts at conferences, and much
more.

The industry needs your brilliance. We need you to show up and commit to doing the work. We
need you to make more money with us. We want to celebrate your growth with you.

Katie Moussouris (@k8em0), Luta Security CEO, bug bounty pioneer, and certified badass said,
“We should all just go out and make a s**t ton of money because they will never, ever, ever stop
telling you that you’re not qualified to do or say whatever it is that you’re doing or saying, no
matter how many years you’ve been doing it, no matter how many degrees or citations you
have.”

People will say do not do it for the money, but they do not know how many others depend on
you. They do not understand that you financially support extended family. Make more money so
you can support loved ones and donate to scholarship funds that help other women. Let us all be
okay with making a lot of money because it is a necessity for survival and achieving great goals.

I wrote this guide for women who are interested in the field, new to the industry (less than three
years), and those with experience. I know what it feels like to be a newbie trying to navigate this
field while having people make you feel that you do not belong. I know what it feels like to work
for companies that do not value your contributions. I also know what it feels like to work for
employers who review performance, but provide zero guidance on how you can excel in your
career.

I talk to women all the time who are gainfully employed but have not been exposed to a formal
career planning methodology. I also realized that strategic career planning was not taught in my
undergraduate or graduate programs, which means that women are coming out of school
unprepared to plan their careers. Therefore, I am starting this guide with setting SMART goals.
Many of the world’s best companies use this approach to develop their talent. No matter where
you are in your career, you can use SMART goal setting to engineer the professional life you
want into existence.

Aim high!

Those who refuse to place limitations upon themselves will always succeed.
~ Thurgood Marshall ~

Copyright © 2018 by www.KeirstenBrager.Tech

Page 4 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Tip 1: Understand SMART Goals

Tool required: pen or pencil. We are going old school. Take notes as you go through the
document to make it easier to complete the tables in the appendix.

When brainstorming your goals, you should consider how they fit into the bigger picture of how
you want your career to progress over the next six years. It took me exactly six years to go from
under-valued to six-figures in this industry.

There is also consensus amongst experienced peers that it takes about five to seven years to gain
the skill level required to be good at your job. Yours could be more or less, but I wanted to set
expectations for those new to the field.

One of the biggest mistakes I have observed is people pursuing an alphabet soup of un-related
certifications. Although you may have good intentions, hiring managers and team members have
expressed that this makes candidates appear unfocused. Be strategic about the goals you set for
credentials so you do not inadvertently close doors on yourself.

I have also made the mistake of being the paper pusher in the office. That is okay if your career
goal is to be the compliance or policy person. However, building technical expertise requires
finding the courage to say no to work that does not contribute to enhancing that technical skillset.
So what are SMART goals?

SMART goals are:

 Specific: What exactly will you achieve? What result will you produce?
 Measurable: What defines successful completion of this goal?
 Achievable: Do you have the time, resources, and support to achieve this goal? If not,
how will you fill the gaps?
 Relevant: Will this goal benefit the company and enhance your career?
 Timely: When will you accomplish this goal? If it is a large project, did you budget an
extra 60-90 days to account for unforeseen circumstances?

When planning your goals, you should also reflect on the following:

 Does this goal provide the highest return on investment (ROI) of all your options?
 What are the top three benefits of achieving this goal?
 Do you have a circle of excellence (3-5 people) that can help you succeed and/or hold
you accountable?

Copyright © 2018 by www.KeirstenBrager.Tech

Page 5 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Tip 2: Develop SMART Goals

The majority of your career expansion should happen through a combination of standard
experience and growth assignments that scare you to death. Let us explore these categories with
examples.

Experiences
Growth Assignments Interdisciplinary activities Increase scope of
current role
Build a personal portfolio Become a security advocate Ask your boss, “What is the
(LinkedIn posts, personal by plugging into I.T. project #1 problem you need solved
website, GitHub) to share planning meetings to ensure this year?” Then solve it. You
knowledge that security is consulted would be surprised how few
before new tech goes into people ask this question and
production become heroes.
Contribute quarterly to a Become valued liaison to Improve key performance
corporate blog covering critical business groups and indicators (KPIs) for your
security of emerging attend meetings (because the group. If you do not know
technology that could impact guys on your team only like what they are, just ask.
your company’s core business talking to each other)

Host tech user groups (product Facilitate/contribute to driving Provide support to an

companies) results on high-priority advanced technology research
company projects team

Relationship Building
Many of the activities in the experiences category can also fall under relationship building.
However, it is worth noting separately because relationships with key influencers in the
organization will determine how fast you gain support for promotions. Also, note that sometimes
those promotion opportunities come from your company’s competitor. Know your worth.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 6 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Here are some examples of activities you could be doing under the relationship-building
category.

Mentoring Networking
Volunteer for company sponsored events at Donate service to local security conferences
local schools and industry chapter meetings, including
WISP, Women’s Society of Cyberjutsu,
OWASP, ISSA, (ISC)2, and tech user groups

Train new employees on how you are using the Join an employee resource group. Start one if
tools your company does not have ERGs

Go inspire the kids in underfunded schools Find opportunities to provide automated KPIs
from security tools to relevant business groups.
They will advocate for you whether you are
present or not.

Formal and Continuing Education

Security is a rapidly changing field, so you should expect to spend the rest of your life learning
new skills. Here are some examples to help you plan in this category.

Education & Online Development Vendor Certifications

Communication
Public speaking 100 Days of Code, Building Splunk (in high demand,
(Toastmasters, meetings, small advanced algorithms supports diversity & inclusion,
group settings) has outstanding total
compensation packages)
College classes, Cybersecurity and the Internet Cisco (offers women’s
offensive/defensive of Things, master’s certificates scholarships)
conferences

Use the table in Appendix A (at the end of document) to plan how you will slay your career this
year. You should print multiple copies of the tables so you can make long-term career plans too.
Revisit it regularly to keep yourself on track.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 7 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Tip 3: Identify Local Volunteer Opportunities

In the age of information overload, you cannot solely depend on who you know. You also must
spend time investing in who knows you.

Every year, there is a frenzy to attend DEFCON, Blackhat, SANS, and other popular conferences
that are only accessible if you have a corporate sponsor or come from an affluent background. I
have even noticed an increase in GoFundMe campaigns to attend such conferences.

I love these events and go to at least one of them every year. However, if you are seeking a job
close to home, flying across the country to these large events will likely not help. Opportunities
come from building trust and relationships in your own community.

Start there.

Once upon a time, I was with a company that was willing to invest in training me to the tune of
$30,000 but would not promote me or pay me my worth. When it was time to fire my boss (see
How to Fire Your Boss section for full story), I started volunteering, publishing content, and
enrolled in a master’s program. That led to trust and access to opportunities within the
community. I am happy to report that I was recruited and lived happily ever after.

A colleague recently asked what to do if conference or meetup organizers do not publish

volunteer information. Most of the organizers are communicating about the events on social
media. I have gotten volunteer assignments by responding to tweets and sending emails. Do not
be shy, just ask!

There are more practical reasons why volunteering should be part of your career strategy. Some
women spend their entire lives in segregated environments, especially women of color. Some of
us will never attend schools, social functions, or work with the people who can help us start or
advance our careers.

Further, policies such as redlining and alternative facts like school “choice” create homogenous
environments. A 2013 study by the Public Religion Research Institute showed that for most
white people, their network is over 90% other white people. This data illustrates why it is
difficult for underrepresented groups to develop the trust and relationships needed for access to
opportunities. The industry has to work together to actively bridge these gaps, and Slack’s CISO
is leading by example.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 8 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

March 18 at 9:04 am, @geoffbelknap, CSO at Slack tweeted:

“I intentionally invest time in networking with executive recruiters that work on CISO roles, so I
can connect them to people in my network. But, I barely know any up and comers, especially
women and under-represented candidates. Is that you? DM me, let’s connect.”

I am thrilled that he admitted to barely knowing anyone who looks like you or me that he can
refer into opportunities. Some trusted women have vouched for his sincerity, so you should
absolutely connect with him and see if he can be a resource. The problem is there are millions
more just like him who are in a position to influence hiring decisions who will never admit that
their role in perpetuating the gender and racial gap in STEM. Even worse, many men will not
send the ladder back down for a woman to even get on, let alone climb it.

This is why volunteering is so important: it is one of the easiest and most cost effective ways to
put yourself at the table of opportunity. We also need more men like Geoff to do the (not so)
hard work of publicly extending a hand to people who do not look like them. Otherwise, your
favorite company’s diversity and inclusion plans are really just a form of thoughts and prayers.

Shout out to Marcus Carey @marcuscarey @threatcare who coined that term. He is also building
an inclusive security technology company in Austin and hosts hackathons at the local HBCU. I
will be watching to see how long other security technology companies wait to follow his lead.

Others are doing important volunteer work in the industry too, including Christina Morillo
@divinetechygirl, who is Harriet Tubmaning women of color in tech. Matt Mitchell
@geminiimatt is also out here doing the Lord’s work with @cryptoharlem teaching digital
security to underserved communities. He also elevates women’s voices in the industry.

Use the table in Appendix B to plan your volunteer activities for the year.

Tip 4: Prioritize Your Needs

Have you identified what you need in a role to be happy? When I decided to leave the
environments that were sucking the life out of me, I came up with a plan to find the role that met
my top four needs:

 Short commute to the office

 The flexibility to do my job from anywhere and at any time
 Prime paid time off (PTO), including volunteer, personal projects, vacation, sick,
holidays, maternity leave, and training
 Competitive base salary, with access to bonus incentives and stock

Copyright © 2018 by www.KeirstenBrager.Tech

Page 9 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

These benefits are my top priority and determine the types of roles that I am willing to pursue.
Have you taken the time to determine your top needs? It could be more than four, it could be
less, but knowing what you need is important. Being cognizant of your basic requirements will
heavily influence your career development plan.

If you are at the beginning of your career, you may not get everything on your list. However, by
taking stock of what you need, you will be prepared to inquire about whether these benefits are
available. Many women, including me earlier in my career, did not even know that I could just
ask for more money and benefits during negotiations. Knowing your needs will also help you
make career moves that get you steps closer to a role that meets all of your criteria.

Use the table in Appendix C to document your needs.

Tip 5: Decide Red, Blue, or Purple Team

 Red team: ethical hackers, penetration testers, reverse engineers

 Blue team: everyone else defending networks (engineers, analysts, architects, legal, etc.)
 Purple team: a combo of both

If you are new to the field, you may have no idea what this even means. I am also not aware of
an online assessment that could help you decide at this time. If you are reading this and you
know of such an assessment, please email me at [email protected] and I will include it in
version two of this plan.

My recommendation is to look at the career roadmaps published by major certification providers

or industry pros to get an idea of the skillsets required for red, blue, and purple team career
tracks.

 SANS Roadmap
 CompTIA Roadmap
 NICE Cybersecurity Workforce Framework

Do not get intimidated, overwhelmed, or feel pressure to follow the exact certification paths
listed. I included these resources so that you can make informed decisions about planning your
career.

Tip 6: Narrow Scope of Target Companies

You may think that by casting your net far and wide, you will increase your odds of success.

Wrong!

Copyright © 2018 by www.KeirstenBrager.Tech

Page 10 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

This leads to exhaustion and despair. You have to narrow your search to the top 7-10 companies
that meet your needs and focus on how to secure the role. That may mean applying for get your
foot in the door types of jobs.

What companies share your values? What companies have people who look like you on their
“senior leadership” and “about the company” pages? What companies have good reviews?

Use the table in Appendix D to document companies in your target market.

Tip 7: Outline Required Skills and Experience

After you narrow the scope of the type of role you would like to pursue and have target
companies documented, do a Google search for available roles at those companies. Note the
minimum requirements and technology similarities across the roles. You also need to connect
with recruiters at those companies on LinkedIn and in person where possible.

Use the table in Appendix E to document available roles and skills.

Tip 8: Detect Back Doors Into Roles

Have you considered applying to any of the product companies listed under the required skills?
Most of them train engineers and place them onsite at large organizations. For example, Tripwire
recruited me and had me working onsite as an engineer at my current employer. My boss
recruited me from Tripwire. How is that for a backdoor?

Unfortunately, the industry is not yet mature with established paths to entry or career growth like
other professions, so your entry may still be by accident or brute force. It could also happen via a
job title that does not seem security related. Let me tell you why.

I participated in a women in security panel a few years ago and was surprised to discover that
most of the people in the audience and on the panel fell into their roles by inadvertently or
deliberately creating their own opportunities. Some of the stories included those who:

 Worked as system administrators like @swiftonsecurity

 Did work that most technical people hate: documentation
 Saved the network guy from drowning
 Helped their company pass an audit
 Built a home lab, learned free security tools, and created their own opportunity

Copyright © 2018 by www.KeirstenBrager.Tech

Page 11 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

If you are trying to break into cybersecurity as a graduate or transitioning from another career,
your strategy should include uncovering hidden job opportunities. Depending on the company,
their descriptions do not have cyber OR security in the job title because HR is often misinformed
about what the role is actually about. See post on my website “80+ Back Doors Into Cyber
Careers” including titles that you may be overlooking in your search.

Tip 9: Build a Home Lab

The type of tools you will need in your home lab will depend on your target companies and
career goals. I would love to tell you that there is a one-size fits all lab solution but there is not.
However, there are basic skills that most security professionals can benefit from having
including:

 Nmap
 Python
 Wireshark
 Command line
 Networking fundamentals
 DNS essentials

The beginner certifications, including CompTIA’s Security+ and GIAC’s GSEC, do a great job
of covering basic skills candidates should possess in their exam objectives.

 Whitney Champion (@shortxstack), Consulting Architect and security enthusiast,

published a great post detailing how she set up her home lab.
 Alient Vault also published a great list of open source network security tools.
 Another approach is to use guidance from hacking challenge sites. Tara @blackroomsec
published a great list on her website.

Since the profession is so broad, I would advise using the job descriptions you gathered earlier to
determine what skills are in high demand in your local market. Also, note that the companies
looking for niche skillsets tend to pay the most because economics determine value.

For example, Splunk is in high demand and low supply at large organizations around the world
because only big players can afford the tool. The vendor has free downloads and user guides
available on their website. They also host user group meetings in many cities. This would be a
great tool to have in your home lab and those user group meetings would be a great place to
network your way into jobs.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 12 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Do you need inspiration? See Talent Spotlight on my website “WeCyberToo: Tiffany L. Smith,
Security Analyst, Fortune 100 Company” for an interview where she discusses teaching herself
Splunk and securing the bag.

Many other product skills are in high demand. Do not try to boil the ocean. Master the basics and
build your lab with sought after tools that are in your geographic area and relevant to your career
interests.

If you are a student or someone transitioning into the industry, reach out to others who are in
similar roles. Ask them what you need to know. Most are willing to give pointers. If you are
looking for organizations that focus on supporting women’s careers, these are good resources:

 Black Women in Science & Engineering

 Women’s Society of Cyberjutsu
 Executive Women’s Forum
 Women in Security and Privacy
 SANS Women’s Immersion Academy

Use the table in Appendix F to document what will go into your home lab.

Tip 10: Create Online Portfolio

One of the lies some in the industry like to perpetuate is that women are not technical. Let them
tell it, the gender gap exists because we do not like this kind of work. James Damore, infamously
fired Google bro, even wrote a manifesto declaring us biologically inferior to do the work that
the women in Hidden Figures literally paved the way for us to do.

If you recall, Dorothy Vaughn taught herself to program the new IBM computer after none of the
men could figure it out. She did not stop there though; she trained the women under her to code
and delivered a small army of black women into technical careers. Rising tides sis, rising tides!

Having an online portfolio is much bigger than drowning out fake news about your capabilities.
More importantly, your online presence:

 Makes you visible to those looking to pay for your expertise

 Validates your tech & writing skills in ways a resume never will
 Attracts 1099-income generating opportunities
 Demonstrates that you are self-motivated
 Inspires other women and girls

Copyright © 2018 by www.KeirstenBrager.Tech

Page 13 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

So where do you start? It does not have to be complicated. Go to www.godaddy.com today and
register a domain of www.yourname.com, connect to Wordpress, and start publishing! If you do
not want to maintain a website, there is Github, Medium, and LinkedIn publishing options. Do
not overthink it. Pick one and start making your skills known.

One of the sisters in security on my mailing list said she wants to publish content, but she is
afraid of losing credibility if she does not consistently publish content. She has a full time job,
family, coaches sports, is working on a degree, and committed to community volunteerism. I am
exhausted for her!

Understand that publishing once a month or even once a quarter is better than not publishing
anything at all. It is about adding our voices to the conversation and making sure that we are
providing bytes of wisdom so our girls see what they too can achieve.

Publishing, no matter how often, is one way to control the narrative around what women in tech
are capable of doing. This one medium allows all of us to build an internet search history based
on what we want to be known for.

In case you did not know, your future employers and teammates will Google you, view your
LinkedIn profile, and click on your website. What do you want them to find?

You must make your value and skills known by actively managing your online presence.

Tip 11: Be the Light

Every few months, two types of comments spark interesting dialogue on social media:

1. I do not want to talk about being a woman in tech; I want to talk about my
expertise.

Every time I see some version of this comment, I always wonder: do those women know
that it is entirely possible to use those opportunities to talk about what they are building?
I have never participated in a women in tech event where I was not allowed to talk about
my work. In fact, my work is what led to the invites to share my experiences.

Yes, the industry needs to do a better job of recruiting women for speaking roles without
the “hey, we need a woman to come speak”. It can feel like your expertise is diminished
if you are the afterthought. However, these are opportunities for you to show up and
invite other women on stage with you to talk about the important work you are both are
doing. It is perfectly okay to take those misguided invitations to lift up another woman’s
work along with yours.

Be the light!

Copyright © 2018 by www.KeirstenBrager.Tech

Page 14 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Tip 12: See the Light

2. I question the credibility of people with certifications/InfoSec degrees.

As a person with zero privilege, this always perplexes me. Credentials are one of the
main tools available for people who grow up in underfunded and segregated school
systems to gain access to opportunities. Many professional doors stay shut without
certifications. Even if you do manage to get in, promotions tend to be reserved for those
with formal credentials.

I am an advocate for women approaching their careers from multiple angles in order to
best position themselves for success. Therefore, my message to you is simple. When you
see these comments, do not get discouraged. Do not question whether you are making the
right decision by arming yourself with another tool. Pursuing credentials is not about
impressing anyone on social media. It is about getting what you need to make yourself
eligible for multiple sources of income.

#Facts

 That six-figure role you want is limited to women with credentials

 Certification providers and universities pay women with credentials to develop
content
 Businesses want women with credentials advising them for handsome fees
 Companies want women with credentials on their board of directors
 Vendors want to sponsor women with credentials

So when you see comments that make you question whether you should pursue any tool
that gives you a competitive advantage, remember that those of us with certifications
have access to paid opportunities that those without them do not. Whose opinion matters
most, the direct depositors or the person on social media who probably will not write you
a check, like ever?

Lesley Carhart @hacksforpancakes also has a great post on her blog where she
interviewed industry veterans about College and Infosec: To Degree or Not To Degree.
There was consensus amongst those interviewed that credentials are valuable.

Do you see the light?

Copyright © 2018 by www.KeirstenBrager.Tech

Page 15 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Tip 13: Get Your Bug Bounty On

Many of the world’s top brands operate formal bug bounty programs. If you are not familiar with
the term, companies pay researchers (ethical hackers) who find bugs in their software and go
through the proper channels to properly disclose them before unethical hackers exploit the
weaknesses for gain.

HackerOne plans to pay out $100 million by the year 2020, according to their “from the CEO
Blog” published recently. Hackerone.com also maintains a directory of the bug bounty programs.
I am a big fan of not boiling the ocean. If you are interested in being paid for finding bugs in
software, HackerOne is a great resource to start investing time in.

Tip 14: Other Revenue Sources

When I participated in my first CompTIA exam-writing workshop, one of the coordinators told
me that I was the first woman to apply and attend in seven years. SEVEN! People made similar
comments when I secured course development and technical consulting opportunities. A
colleague at the FBI also told me that women never apply to the roles he posts. My boss said
women do not apply to the roles he posts either.

I cannot figure out if it is a lack of awareness, skills deficit issue, or that women are worn down
by the hostility in the industry that we all encounter at some point. However, women are not
applying for W2 and 1099 roles. This is leaving money on the table.

I am an advocate of women having multiple streams of income for many reasons:

 The job of your dreams could be outsourced because an investor demanded budget cuts in
your department
 The dynamic of professional relationships change when people know you’re all about the
benjamins baby; they EXPECT to pay you your worth
 Personal relationships come with an added layer of respect when you are bringing just as
much or more to the table
 You feel more confident leaving toxic environments, whether it is a job or unhappy home
 Most important of all: you can help others

When planning your career, it needs to be about more than getting a good job. Effective career
planning is crucial to helping you define success on your terms, including positioning yourself
for opportunities to fund the end goal of entrepreneurship. With this in mind, understand that
InfoSec pros have multiple ways to generate revenue that can help them advance in corporate
roles or fund side hustle dreams. Here is what I know from personal experience:

Copyright © 2018 by www.KeirstenBrager.Tech

Page 16 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

 Companies need security talent to protect their assets, corporate reputations, and
individual careers.
 All the security certification providers conduct ongoing content refreshes and pay
industry practitioners for their expertise.
 Platforms pay security practitioners to appear on their webcasts.
 Colleges and universities need course developers to keep their cybersecurity curriculums
relevant and competitive.
 Alternative training providers, such as InfoSec Institute, Coursera, Pluralsight, and others
need content producers to keep their platforms alive.
 Magazines (digital and physical) need writers for engaging research and think pieces.
 Boards of directors at for-profit and non-profit entities are under increasing pressure to
add security professionals to their ranks.
 Universities that offer security programs need staff to fill those teaching roles. Schools
like UMUC, my alma mater, even offer 100% remote opportunities.
 Conferences pay lucrative fees to their speakers.
 Companies pay technical consultants for short-term projects at exorbitant hourly rates

Between my husband and me, we have been fortunate to earn income from almost every
category above. Sometimes we apply, but most of the time, people refer us into these
opportunities. We receive ongoing solicitations for paid projects and accept them as time
permits. Therefore, I can tell you with confidence that there is money out here to be made from
these avenues.

When I started my career, I was only knowledgeable about the “get a job” aspect of the industry.
I want women to know that all of these opportunities exist and more.

Now, I obviously do not know your skillset, location, travel limitations, or credentials, so I
cannot tell you exactly what opportunity to pursue. However, I believe that awareness is key to
designing lucrative careers. I want you to be able to make informed decisions and position
yourself to qualify to make as much money as you can stand. In all of this, remember that
networking will be the key to gaining access.

Use the table in Appendix G to document 1099 income opportunities you want to pursue.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 17 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Tip 15: Develop Results-Oriented Resume

Snapchat is not a skill. Instagram is not an app that an infosec hiring manager cares about. The
non-technical aspects of your internship or unrelated job tasks you performed in other roles that
are not relevant to the employer’s current challenges should not be on your resume.

Likewise, IT buzzwords with no indication of how you applied that knowledge can hurt your job
search too.

 What did you build, automate, or improve?

 Reduce costs by x amount of $$?
 Minimize risk or vulnerabilities by x percent?
 Improve OS or app security by x percent?
 Build a home lab and teach yourself one of the many commercial tools with free
downloads available?
 Implement, upgrade, or integrate technology?

Your resume should tell a story of results of applied knowledge to relevant business scenarios,
not just knowledge acquired. If the hiring manager cannot determine how you had a positive
impact or produced results, you will continue going to the do not call pile.

A better approach is to fill your resume with both InfoSec skills keywords and action verbs. Tell
a story that shows you get the job done. When someone in your network forwards your resume,
you want to make sure he or she looks good for referring you and you want to get the callback.

Show that you are more than a woman with theories and a history of tasking. Focus on results.

Tip 16: Write Your Own Ticket

One of the ways I give back to the community is using my writing to be the resource I wish I had
earlier in my journey. I have constraints on what I can publish due to the nature of my work, but
I am passionate about sharing career advice that can positively impact the industry.

I have made my desire to be a resource public, so people ask me for guidance all the time. Most
of the responses stay in my inbox because they are links to questions that have been answered.
However, I occasionally receive an inquiry that compels me to publish a response that I hope
inspires creative new solutions to move the discipline forward.

I get really excited when students reach out with thought provoking questions like the one below.
I wanted to share it to help others who are also contemplating security testing tools or looking for
general direction on where to focus research for the best post-graduation outcomes. I also hope
this sparks important dialogue between academia, the public and private sector.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 18 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Question:

I am a third year IT Security student thinking of a security test tool. On what aspect of security
should I think about in order to avoid recreating the wheel?

My Response:

Although a student asked this question, I believe that newbies and experienced professionals
could also benefit from keeping this conversation going. I hope it plants seeds for years to come.

When I was in graduate school (2015-2017), I always pursued research opportunities that would
increase my knowledge about the sector that I am most passionate about - critical infrastructure.
To prepare for future projects, I was trying to educate myself on secure architecture and
engineering strategies for advanced metering infrastructure (AMI). To my surprise, available
research on securing AMI was very limited. At the time of this writing, this is still an emerging
challenge that could benefit from new creative solutions.

Speaking of advances in technology, companies like Georgia Power are building the future of
energy with innovative Smart Neighborhood Projects.

They are building entire neighborhoods while integrating future functionalities into the design.
According to Southern Company COO Kimberly Greene in the article, these research projects
will allow them to understand “how distributed energy resources interact with the electric grid
and how emerging technologies will improve customer’s lives.

I am willing to bet a certification voucher that security is not in the architecture process. I would
love to be proven wrong. The key here is to view emerging technology as opportunities for
security research.

Other areas will continue fueling the need for skilled security talent well into the future
including:

 Industrial protocols
 Cryptocurrency mining
 Internet of things (IoT) security
 Autonomous vehicle security systems
 Rapid quarantine of polymorphic malware

One approach is to evaluate the type of company you want to work for or create after graduation.
I work in critical infrastructure, so I am an advocate for young people to consider ICS/SCADA
security as a career option.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 19 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Since Russia is actively targeting our critical infrastructure, there will be several career
opportunities in this sector for the foreseeable future. If you are interested, Robert M. Lee wrote
an excellent blog post about getting started in ICS/SCADA security careers.

If you have no interest in critical infrastructure, that is okay too. What is most important is you
choose an emerging issue and create a viable solution. I encourage you to think past today’s
challenges and focus on improving the security and/or testing of products that have/are slated to
ship to market with functionality as a priority and security as an afterthought.

When you develop a tool to solve any of these problems, do not keep it behind the walls of
academia. In fact, I encourage you to engage with people in your local security community to get
constructive feedback, mentoring, and build mutually beneficial relationships along the way.

When you are able, share your work with the community in person and on social media. If you
do not have a blog, LinkedIn is a great place to share progress and lessons learned.

Submit to CFPs at security meetups and conferences near you. If you are not comfortable with
public speaking yet, go sign up to be a volunteer.

People hire and refer opportunities to people who they know and trust. Therefore, building your
network is just as important, if not more than, finishing your education and building that tool.

Being an active contributor will also make you stand out as a results-oriented problem solver and
position you to write your own ticket prior to graduation.

People earn degrees and certifications all the time. Very few take the initiative to build tools,
produce content, volunteer, and share their work with the community.

Stand out from the crowd.

Follow through.

Do not just ask about it.

Be about it.

Tip 17: How To Fire Your Boss

Apparently, the industry needs a good purge because I receive too many messages from women
wanting to quit and pursue another profession due to how they are treated. Since this is the case,
I want to help women fire bad bosses all 2018. I have been where you are, and I want you to
know that what you are dealing with is not indicative of the industry as a whole. What you are
experiencing are all the signs of it being time to fire your boss. Let me tell you a story.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 20 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Once upon a time, I was with a company that was willing to invest in training me, but would not
promote me or pay me my worth. On top of that, others were being hired with better paid time
off (PTO) benefits that I did not even know were available to me. Since I have kids, PTO is a top
priority for me, so this was more offensive than being under paid.

I learned the hard way. Therefore, I want women to understand that PTO benefits are negotiable
and can have a positive or negative impact on your family, personal projects, and ability to
advance your career.

Like most people with no safety net, I was not in a position to just leave. I was dating my now
husband, but truth be told, I was technically still a single mom. We were not married, so he had
no obligation to stay with me through the thick of unemployment if I just walked away from my
job before I had another one lined up.

On top of that, the struggle was real when I could not provide for my children at a level that was
acceptable to me. I was only a few years removed from hitting that brick wall when we started
dating, so those hard times were still fresh on my mind. I knew that regardless of what would
happen in my relationship, as the mom, I am ultimately responsible for these kids. Therefore, I
had to be strategic about making my next career move.

"A goal without a plan is just a wish." - Antoine de Saint-Exupéry

Instead of just quitting my job, I came up with a plan to find the role that met my top four needs:

 Short commute to the office

 The flexibility to do my job from anywhere and at any time
 Prime PTO, including volunteer, vacation, sick, holidays, maternity leave, and training
 Competitive base salary, with access to bonus incentives and stock

These benefits are my top priority and determine the types of roles that I’m willing to pursue.

Step 1: Network My Way Out

The first step in my exit plan was to research local security conferences, tech user groups, and
chapter meetings for ISSA, OWASP, and (ISC)2. Next, I mapped out a plan to get involved
through volunteering, helping organize events, and presenting to groups as a way to fist fight my
fear of public speaking. I gave back before I needed a job and continue to do so. Giving back
should be on your career development plan, but you must be strategic.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 21 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Step 2: Train My Way Out

Fun fact: some companies are staffed with IT departments that have separate budgets for
technical training, education, and conferences….but NO ONE IS SPENDING ANY OF THE
FUNDS!

First of all, I had no idea that some orgs use accounting magic to allocate these resources to
different buckets. I also assumed that people are taking advantage of the continuing professional
development benefits since the employer covers the costs.

WRONG!

Ladies, I discovered that unused funds just sit there and get rolled over to the next year because
very few people want to spend time learning new skills or going above what is required of them.
This is especially prevalent in companies that have longer-term employees (more than 5 years)
working in the same roles.

Some folks are content with just a paycheck, and that is ok. However, this presented all kinds of
opportunities for me and it can for you too!

After discovering the three buckets, I mapped out a plan to take advantage of ALL of them.

I requested funds for books, lab access, conferences, travel, certifications, online training,
coaching, test prep, coffee, a corporate hot spot, a degree, professional association dues,
technical pocket guides, and everything else that I thought might be eligible.

Because why not?

I also started doing more proof of concepts with new security technology vendors, which turned
out to be excellent learning AND networking opportunities.

A quick note on proof of concepts if you have a target tech in mind that you want to tinker with:
DO A PROOF OF CONCEPT AND LEARN IT ON THE JOB! Ladies, this is a thing and totally
normal in IT!

Back to the story…

Lots of training, networking, and $30,000 later…..

I had a dilemma, one that I am sure men NEVER have: I felt guilty about the company’s $30k
investment in me. Therefore, I felt obligated to stay and make it work because I had gained so
much from the three magic buckets of money.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 22 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Then I received an email from Robert Half Technology with their updated salary guide.

Are you on the mailing list to get this annual salary guide? Google Robert Half Technology
Salary Guide and sign up stat!

Sis, I dug into the salary guide…then my guilt turned into rage!

Step 3: Time to Make Moves

So now, I am the single mom contemplating jumping ship, but I am lacking confidence in my
ability to succeed in another environment. I am also thinking that at least I know what I am
dealing with here.

If I go elsewhere, will the misogyny be worse? Is there a James Damore on the team? Will the
“women don’t belong in the workforce” crowd be bigger or smaller in the next I.T. department?

Is the company protecting a Morgan Marquis-Boire because he is their top security resource
despite sexual harassment allegations against him?

Is there a Richard Spencer or Stephen Miller on the team? If I join a team that turns out to have
characters like them, is H.R. a safe place or a cover for the white supremacist aggressions that
await me?

Is the team led by a Mitch McConnell? Will I be silenced when trying to voice concerns about
high risks to the company? Even worse, is the new boss trying to take us back to the 1950s?

When I have to stay home with sick kids, will my mommy guilt be compounded by the words or
actions of the coworkers above who do not feel I belong on the team anyway?

There was a chance that all of my worst fears would be realized. I stared them all in the face and
said, you know what, what if the opposite is true?

What if I end up on a team that is supportive, inclusive, and exceeds my top needs (short
commute, flexibility, great PTO options, and competitive compensation?)

I convinced myself that the latter existed and went after it! Instead of being consumed by the
worst that could happen, I decided to focus on the best that could happen. This shift was a game
changer for me!

Remember earlier when I mentioned finding technologies that you are interested in learning?
Well, my OSINT showed that tech companies met most of my top requirements AND the bigger
companies that pay higher salaries all use a similar suite of security products.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 23 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Perfect, I can kill a few birds with one stone: learn the tech, get to know my local community
better, and get a few vendors’ feet through doors that had been closed. After getting buy-in from
the boss, I scheduled demos and/or proof of concepts with Splunk, FireEye, and Tripwire.

Guess what that led to? Direct connections to tech hiring managers AND product knowledge.

I was also volunteering, publishing content, and ended up enrolling in my master’s program that
was starting a year later.

Guess what that led to? Trust and credibility in the community.

I was not asking anyone for special considerations because I am a woman. Quite the contrary, I
was working on multiple fronts: being a connector, gaining skills, completing certifications to
validate said skills and pass H.R. checkboxes, pursuing an advanced degree, and sharing
knowledge with the community. I did all of this with small kids at home. If anything, I raised the
standards, not lowered them.

*sips drink*

When I was ready to make a move, I worked up the confidence to start telling people.

Then something amazing happened: a weight was lifted off my shoulders. I no longer felt the
need to convince my boss of my value. I stopped questioning my own worth. I did not feel the
desire to work just a little harder so X person would see that I deserve respect for my
contributions.

Instead, I felt empowered by what I had to offer to the right team: a great attitude, skills, formal
education, a love of lifelong learning, and passion for the discipline itself.

After this shift in mindset, I stopped beating myself up, crying about my job, and questioning
myself. Those self-defeating actions were replaced with higher self-esteem, motivation to do the
best in school, and laughing at the people who actually thought I would stay in a toxic
environment just to have a paycheck.

I fired my boss in my head.

IT.WAS.SO.LIBERATING!

Now, I could have spent hours filling out applications and dealing with rejection. I had a full-
time job, family, and was in school, so I did not have the time or patience for the usual job
search. I had to do something different.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 24 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

In the past when I would talk to people, I would only wax poetic about my current projects.
When I decided to make a move, I started discussing what was doing now AND what I would
like to be doing in the future. One cool aspect of working in tech is that most companies offer
referral bonuses to their employees, so your peers can get paid for helping you get out of toxic
environments. They have financial incentives to bring in the right talent. How cool is that?

Step 4: Fire My Boss for Real

All my hard work paid off. I landed the role that met all my qualifications, so I fired my boss.
My resignation letter was one sentence long:

My last date of employment is _________.

In hindsight, even that was too much. I should have summoned my inner Beyonce and wrote just
two words:

BOY, BYE!

I contemplated writing a detailed explanation of what happened and suggestions for

improvement. I also considered doing an exit interview.

But you know what I did?

Reclaimed my time.

Listen.

Some jobs are just a chapter in the book of your life. YOU are the author of your story!

Do not let toxic environments distract you from the great work that you are capable of doing. If
your boss and/or HR department has played a hand that was not in your favor, now it is your
turn.

Instead of giving that dead end any more energy, focus on activities that can lead to new
opportunities. Come out and network. Get that certification that has been on your to-do list.
Connect with tech vendors and recruiters. Share your work and accomplishments everywhere.
Get involved in the community.

Hanging on to a role that is not meant for you means that you are missing better opportunities.
Listen, I know what it feels like to need a paycheck. Remember, I am the first generation college
graduate with ZERO privilege.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 25 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

But I also know that just like staying in toxic personal relationships can have you off balance and
questioning your worth, staying in business relationships with toxic employers can stifle your
career.

Your talent will make room for you.

I have experienced the worst this industry has to offer. I wanted to quit too. There were days
when I experienced the rejection and obstacles related to restrictions around where I could work
because I am the primary caretaker for our kids. It can all be so exhausting!

Instead of giving up, I kept going. I overcame. I skilled up and networked as often as I could. I
made time to publish content and put my best self forward. I chose myself over the jobs and
people that were ruining my self-esteem.

I experienced the worst in the industry and am now experiencing the best it has to offer. I am
launching the book you are reading at HouSecCon. If I had not kept pushing, I would not be
publishing books that will help millions of women. If I had not kept pushing, I would not be able
to inspire other women. If I had not kept pushing, I would not have attracted the role I wanted on
an inclusive and supportive team.

If your boss or company is sucking the life out of you, I need you to pull yourself together and
make an exit plan.

Stop working for them during lunch and after hours and focus on YOU, INC. You have gifts that
need to be shared with others. You are capable of making as much money as you can stand. An
employer will value you and pay you your worth. Do not let anyone take that from you,
especially a company that would have your job posted before your dead body reached the
morgue.

Tip 18: Just Ask

 Ask for the sign-on bonus
 Ask for the maximum PTO available
 Ask for stock options
 Ask for $10k more than you want
 Ask for an internal sponsor or mentor
 Ask for specific performance goals that will earn you the maximum incentive

Closed mouths don’t get fed. Ask for whatever you want. The worst that could happen is they
will offer an alternative or say no. At least you will not have left money or other valuable
benefits on the table because you did not ask.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 26 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Tip 19: Dress for Wealth

I have a love-hate relationship with Twitter, but there are always nuggets of wisdom gracing my
timeline. One of the ongoing debates is about how women in tech should dress. I have the same
philosophy about dressing as I do about credentials: do what attracts opportunities to generate
wealth and makes you feel good about yourself.

In case you needed another opinion, @jwatkins_jim, a tech executive, recently tweeted:

“As a CIO, I don’t care how you dress on any given day. But, I would hesitate to put anyone,
man or woman, in front of a customer or upper management if they weren’t appropriately
dressed. And that’s where recognition and promotions are born. And you don’t always know
when that will be”

I wear a blazer to work with black dress pants almost every day. It is an easy way to survive the
55-degree office temperatures and never have to worry about whether I will be dressed for the
occasion if I end up in front of executives without advance notice.

It is better to be prepared for doors to open at any time than risk the alternative.

Tip 20: CISSP Prep

Depending on who you ask, the CISSP certification is either the best credential in the industry or
the bane of the industry’s existence. My perspective is it continues to be the most recognizable
and sought-after credential for many mid to senior level roles. Therefore, it benefits women to
have one more way to increase their odds of success.

In all the debates around whether it makes sense to pursue credentials, you must remain focused.
The goal is to increase your access to opportunities. Even if you are new to the industry, the
Associate of (ISC)2 credential is also opening doors for women. Yes, many people find industry
success without this certification. But, may you set yourself up so that the winds of opportunity
are constantly blowing in your direction.

Now, if you are considering taking the CISSP exam, understand it is not a “read the Official
Guide and pass the exam” exercise. In my humble opinion, you cannot just take a prep course
and pass the test either.

The questions are not worded so users can answer a with just rote memorization of facts. The
new version presents test takers with real world scenarios in simulated environments to perform
actual tasks. Therefore, you need to be adequately prepared to do more than choose the best
option.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 27 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Test Prep Strategy:

When delivering CISSP accountability coaching for women, I walk them through developing a
pass the test the first time plan that includes:

 Identifying core domain & subdomain weaknesses

 Developing a study plan to fill in knowledge gaps
 Establishing a realistic exam timeline based on results

The success plan is based on the domains (and subdomains) defined by (ISC)2 Official Guides.

Yes, the rumors about the exam being a mile wide and an inch deep are true. The subject matter
is broad and it is deliberately designed that way to validate that candidates possess the requisite
experience to understand security from a holistic perspective.

The downside of the experience factor that people fail to appreciate (or discuss) is the difficulty
of gaining hands on experience in the domains within four to five years. Let me tell you why.

Security teams in large companies typically have people focused on specific areas with little
opportunity to cross train. Therefore, the network security engineer may never get exposed to
software application security or perform enterprise risk assessments. Likewise, the patch
management team will likely never be involved in architecture design or performing penetration
testing.

Employees who have only worked at small companies will also be at a disadvantage in terms of
gaining the depth of exposure necessary to prepare for the exam. The scope of experience in the
subdomains will be limited simply due to the smaller size of security operations and other factors
driving business decisions.

It is important for women to understand these dynamics because meeting the experience
requirement does not guarantee you will have the depth of knowledge necessary to pass the
exam.

The CISSP guidelines call for having a minimum of five years of hands on experience in only
two of the domains. However, I always advise women that sufficient preparation and
knowledge in at least six of the eight domains is the best route to passing the exam the
FIRST time.

To help you determine your level of preparedness, you can use the high-level domain assessment
below to understand your weak areas. I recommend using an official study guide when
performing this assessment. It provides a complete understanding of items covered in each main
category.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 28 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Review the domain and subdomain for each area. Mark your hands-on experience level next to
each domain as “Sufficient or Insufficient.”

Domain Experience Level

Domain 1: Security & Risk Management
Domain 2: Asset Security
Domain 3: Security Architecture & Engineering
Domain 4: Communications & Network
Security
Domain 5: Identity & Access Management
(IAM)
Domain 6: Security Assessment & Testing
Domain 7: Security Operations
Domain 8: Software Development Security
*Source: CISSP Certification Exam Outline Effective Date: April 2018 https://isc2.org

Take your time doing this exercise. By accurately identifying the domains where you have
insufficient hands on experience, this will help you target your weak spots with supplemental
labs, videos, and other preparation activities.

After identifying your knowledge gaps, the plan should include spending at least one month on
each. You can certainly cover the weaker domains in a shorter timeframe. However, why put
that kind of pressure on yourself?

Learning new subject matter in areas with insufficient hands-on experience requires a time
commitment. Having a 30-day window allows you to focus on one area at a time and removes
the stress of trying to both learn and retain information that may be completely new. Also, note
that some of the topics will be harder to grasp without the context that comes along with prior
immersion in the subject. Therefore, it is better to give yourself space to acquire new awareness
of the kind of work industry peers do while gaining valuable context along the way. .

Once you have identified your knowledge gaps, you should have a better idea about how far out
to schedule your exam. In a perfect world, you will schedule your exam date three to four
months from now because life is perfect and you will not encounter any unforeseen
circumstances.

Wrong!

All the women who rushed to schedule their exams despite my advice to take their time studying
ended up failing.

Why?

Copyright © 2018 by www.KeirstenBrager.Tech

Page 29 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Because life happens.

 Important projects pop up at work

 You have to invest time in saving your marriage
 You have to leave a toxic relationship and start over
 The nurturer in chief takes on more than originally planned
 The kids or other family members get sick
 Mental health issues take over for a while
 Motivation to study for the CISSP comes and goes

There are so many scenarios that interfere with the best of intentions. For this reason, I
encourage you to give yourself the time and space to plan for success.

So how much time should you allocate? Well, it will depend on your experience level and
personal circumstances.

For the sake of simplicity, let us assume that the personal domain assessment you took earlier
reveals that you have insufficient knowledge in five of the eight domains. That is a minimum of
five months just for those (a month for each weak area).

You still have three other domains to review. Even though you may feel confident in your grasp
of those domains, you still need to set aside at least two to three weeks for studying. Again,
depending on your circumstances, you could need a full two months or more to review the
domains where you scored sufficiently in your assessment.

Five months for insufficient domains plus two months for sufficient domains equals seven
months of CISSP prep time.

This is just an example for you to follow. Go through the assessment and develop a realistic
study plan that you can commit to based on your circumstances.

I cannot stress enough that studying helps, but the hands-on experience adds the required
context to enable success.

My Preparation Materials and Activities:

 Read the BIG BOOK, listened to the free MP3 downloads, and took daily practice exams
from Shon Harris, author of the most famous CISSP preparation guide on the market
 Listened to audio files and completed the two 250 question exams multiple times by
SANS instructor and author Eric Conrad
 Read The Official (ISC)2 Guide To The CISSP CBK and took all practice tests at the end
of the chapters (hard copy)

Copyright © 2018 by www.KeirstenBrager.Tech

Page 30 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

 Attended SANS Training Program for CISSP Certification (MGT414) and utilized the
prep materials from the course for the two months leading up to the exam
 Sought clarification/illustrations on my weak domains and had verbal practice sessions
with my mentor

Note that there are many more options available since I sat for the exam, so I encourage you to
find the right mix of learning resources to fit your needs.

Stress and Sanity Management

The day of the test, I ate a protein heavy breakfast and brought two protein snack packs, two
bottles of water, and two protein shakes with me. I aimed to take breaks after every 75 questions,
marking the really long and difficult ones for review until the end. This helped me manage my
stress while also giving me the confidence to keep moving through the test as I breezed through
simpler questions.

After my third break, I came back and answered all the questions I had marked for review. I then
took one last break to clear my head before reviewing my answers to all 250 questions.

I took a little over five hours because I chose to manage my stress with several breaks and
perform a thorough review of answers to all of the questions. However, I was recently notified
that the test has changed to an adaptive model that is three hours long and 150 questions.

Adequate preparation, difficult jack-of-all-trades type job roles, and stress management were the
key to passing the exam. I am rooting for you to pass the first time too.

Good luck!

Bonus: Secure the Budget Basics

Due to my background and volunteer activities, I regularly interact with women who have not
learned basic principles of survival - money and budgeting. Since I am writing a career advice
book for marginalized groups, the assumption is that there will be readers just like me who did
not learn financial literacy in their underfunded school systems.

Minorities historically spend years in school districts that never teach basic personal finance.
According to a 2017 study conducted by the non-profit Next Gen Personal Finance:

 Almost 80% of millennials lack basic personal finance knowledge

 Less than 6% of schools in low-income U.S. school districts require personal finance
 Less than 17% of American students need personal finance courses to graduate

Copyright © 2018 by www.KeirstenBrager.Tech

Page 31 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

While it is easy to assume parents teach money management at home, a 2017 survey from
financial firm T.Rowe Price revealed that almost 70% of parents are hesitant to talk to their
children about money. It’s almost a given that parents in low income neighborhoods lack the
financial literacy necessary to even teach their kids these skills.

The data clearly illustrates that many people are entering adulthood with no concept of money
management. Therefore, I am ending this Secure The Infosec Bag Career Plan with foundational
information about being a good steward of resources. It is important to learn how to manage
what you have now so you are prepared when you start earning larger sums.

Know the basics:

 The total cost of monthly necessities

 The total cost of discretionary expenses
 The car broke down savings fund
 Three to six months of living expenses
 How credit scores can impact careers

Here are some examples to add perspective:

 Necessities: housing, utilities, food, insurance, transportation, cell phone, personal

hygiene, other requirements unique to your situation
 Discretionary: daily Caramel Macchiato
 Car died fund: $1,000-$3,000
 3-6 months living expenses = Where do you live? Add up your basic necessities and
multiply times 3 to 6 months to get this number (ex. $2,000 x 3 to 6 months = $6,000 to
$12,000 in emergency living expenses needed).
 Credit and careers: Some states have passed laws preventing employers from
discriminating against candidates based on credit scores. However, know that a low credit
score can be used to derail your professional goals. Know where you stand and how to
use credit wisely.

See the simple spreadsheet template on the next page to help understand cash flow. Many banks
offer online tools integrated with checking, savings, and investment accounts as well.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 32 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Rent 700 Job 2000

Car Note 300 Side hustle 200
$
Car Insurance 200 Total Income 2,200.00
Gas in car 100
Health insurance 40
Lights 100
Water 40
 Income minus
Gas 40 expenses = $1.00
o This is what remains at the end of the
Netflix 9 month
o This assumes no emergencies or helping
Cell phone 80 the family
Internet 40
Groceries 100
Restaurants/fast food 100
Toiletries 30
Beauty (nails/hair) 100
Student loans 100
Miscellaneous 1
(movies) 20
Miscellaneous 2
(clubbing) 100
$
Total Expenses 2,199.00

If you are looking for personal finance or investing guidance, some of my favorite resources
include:

 Ellevest.com
 thebudgetnistablog.com
 hisandhermoney.com

Use the blank template in Appendix H to understand where you are financially so you can create
a plan for improvement if necessary.

Copyright © 2018 by www.KeirstenBrager.Tech

Page 33 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Key Takeaways
The internet is a bottomless pit of knowledge, so it can be overwhelming to know where to start
or how to plan your career accordingly. I curated the content in this guide to help you
strategically approach your career moves for maximum success.

 Develop SMART goals and create your own opportunities

 Network strategically to increase your net worth
 Narrow the scope of companies and skills
 Have a home lab, online portfolio, and results driven resume
 Fire bad bosses and invest in financial literacy
 Establish a circle of excellence
 Do not leave money on the table
 Be bold, ask for what you want
 Embrace financial abundance
 Send the ladder back down for another woman

I had to learn through trial and error so I published this guide to accelerate your success. Read it
several times. Create your plan. Tweak it as often as necessary. Do the work and go make lots of
money for your family!

Copyright © 2018 by www.KeirstenBrager.Tech

Page 34 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Call to Action!

Sign up for my newsletter and follow me on social media for ongoing career advice and updates
on the progress of the book I am releasing in summer 2018! My next project will teach you other
strategies to advance your infosec career, including interview prep, negotiating pay, overcoming
impostor syndrome, and much more! It will also include inspirational stories from other women
in industry who are thriving despite all the odds stacked against them!

I also have over 50 articles published on my website and around the web, so I encourage you to
explore those if you are looking for guidance or just need inspiration to keep going.

I would love to get your feedback on this eBook! Please do one of the following:

 Post a recommendation to my LinkedIn profile (https://linkedin/in/kbrager)

 Tweet how this resource helped you using hashtag #SecureTheInfosecBag

@keirstenbrager

 Send constructive feedback to [email protected]

The benefit of releasing a digital resource is that I can update it and send revised versions to
readers! I am a firm believer in continuous improvement and I am treating this resource like
software with regularly scheduled maintenance. Feel free to let me know how I can make this
better. If there is a topic you would like covered in the physical book being released this summer,
I would love to hear that as well!

One final note: I did not do this alone! I have a phenomenal mentor who helped bring this project
to life, so I wanted to pay it forward by sharing her info with others who want to publish a book.

Want to self-publish your book in less time and convert your expertise into profits?

Pen To Profits Book Coaching Program is a six-week training incubator designed to teach
Aspiring Female Authors the proven system to write, self-publish, and launch a profitable book.

Work with published authors Eryka T. Johnson and Dr. Kimberly Ellison as they walk you step-
by-step from book idea to launch strategy.

Interested? Join us for the next class by visiting www.pentoprofits.com

Thank you for supporting this project!

Copyright © 2018 by www.KeirstenBrager.Tech

Page 35 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

What is your WHY?

What is your passion?

Why do you want to earn six figures or more?

What will keep you motivated to keep pushing forward if/when the industry temporarily gets
rough?

Who is your circle of excellence?

Who are you going to help when you reach your income goal?

Who are the five people that you are going to tell to buy this book?

Copyright © 2018 by www.KeirstenBrager.Tech

Page 36 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Appendix A: Smart Goals

Enter your SMART goals and dates in the table below. Set mini-goals and calendar reminders to
stay on track. Ask a partner to keep you accountable.

SMART Goal Category Your SMART Goals Date to Complete

Growth assignments

Interdisciplinary activities

Increase current role

Mentoring

Networking

Education

Online Development

Certifications

Copyright © 2018 by www.KeirstenBrager.Tech

Page 37 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

SMART Goal Mini SMART Goals Date to Complete

Apply to speak at first my 1) Write abstract for CFP May 1
conference 2) Get feedback from May 30
@ISUnlocked, @wisporg
or @cfp_time
3) Finalize and submit CFP June 15

Appendix B: Local Volunteer Opportunities

Event Contact Date of Event

Appendix C: Your Needs

What do you need in a role to be happy?

Copyright © 2018 by www.KeirstenBrager.Tech

Page 38 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Appendix D: Companies In Your Target Market

Company Name Recruiters/Employees You Know/Are Connected

Copyright © 2018 by www.KeirstenBrager.Tech

Page 39 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Appendix E: Available Roles and Required Skills

Available Roles & Company Skills Required If lacking skills, any backdoor
in? (product company,
helpdesk, tech support,
sys admin, IT Admin)

Copyright © 2018 by www.KeirstenBrager.Tech

Page 40 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Appendix F: Your Lab

Based on skills in job descriptions, which tools do you need to add to your lab?

Tool Function Date Added to Lab

Appendix G: 1099 Income

Document opportunities that you are interested in, i.e. creating content for certification providers
or universities, participate in bug bounties, speaking engagements, consulting, a board position
etc.

Role Qualifications Contact

Copyright © 2018 by www.KeirstenBrager.Tech

Page 41 - First Edition
 Secure the InfoSec Bag
Six-Figure Career Guide for Women in Security

Table H: Budget Template

Rent Job
Car Note Side hustle(s)
Car Insurance Total Income
Gas in car
Health insurance
Lights
Water
 Income minus $
Gas expenses= -
o This is what remains at the end of the
Netflix month
o This assumes no emergencies or helping
Cell phone the family
Internet
Groceries
Restaurants/fast food
Toiletries
Beauty (nails/hair)
Student loans
Miscellaneous 1
(movies)
Miscellaneous 2
(clubbing)
Total Expenses

Copyright © 2018 by www.KeirstenBrager.Tech

Page 42 - First Edition