topic Re: Seeking PhD education advice in Career Discussions

Seeking PhD education advice

BMwine — Thu, 09 Jul 2020 18:21:14 GMT

Hello,

I am in a bit of a dilemma and I am seeking advice from the community.

I am a 40+ security professional wondering whether it is worth it pursuing a Doctor of Philosophy in Information Security. I graduated with a Masters degree in information security a couple of years ago, and since then, I can not seem to find a job that matches with my qualifications. Even the additional certifications do not seem to help ...

I know it is a very costly venture, but is it worth the dare just for job satisfaction ?

Regards,

Brian.

Re: Seeking PhD education advice

JKWiniger — Thu, 09 Jul 2020 18:39:55 GMT

@BMwine After completing my Master's in Information Security and Assurance I considered going on as well. What came to be me deciding factor was searching for jobs that required it, and I found very very few. Even now I find that most jobs only ask for a Bachelors degree and a Masters is a plus. The only place I feel a further degree would have been of value would be in an academic setting and that is not a direction I would have wanted to go.

As far as matching your qualifications, what are you finding you don't match in? It seems like you may have or may become over qualified for many positions. A lot of times job titles and descriptions have gotten very messed up and it's almost like an art form to figure them out. I remember someone sharing with my that their company just fired someone that only matched 20% of what they were looking for, but they were the best fit they could find. I once asked a recruiter why the job description looked so crazy and he told me first they ask for a requirements list, then a wish list, and then they have them throw in the kitchen sink! I was told if I match at least 50% I should apply for anything I was interested in. I have also heard it is best to ignore most of what is written and just look at the responsibilities section and see if it fits and is something you want to do.

Just me .02

John-

Re: Seeking PhD education advice

CraginS — Fri, 10 Jul 2020 13:54:24 GMT

Brian, @BMwine said:

-=-=-=-=

I am a 40+ security professional wondering whether it is worth it pursuing aÂ Doctor of PhilosophyÂ in Information Security. I graduated with a Masters degree in information security a couple of years ago, and since then, I can not seem to find a job that matches with my qualifications. Even the additional certifications do not seem to help ...

I know it is a very costly venture, but is it worth the dare just for job satisfaction ?

=-=-=-=

Brian,

To set the stage for this reply: I started a doctorate in IA at age 61, while working full time, with goal of completing before 65. I made it by 11 months. By the time I earned it, the degree name had changed to Cybersecurity. I am very happy I earned it as a personal goal and accomplishment. And my wife thinks my title is cool!

First, to answer the question, "is it worth the dare just for job satisfaction ?" No, not at all worth it for job satisfaction. However, it may well be worth it for personal satisfaction, or other reasons.

I recommend you answer some questions for yourself, and consider a few things I throw in below.

Why do you want the degree? Unless your current employer has an incentive for you to move up to that degree, there is close to no job benefit of getting the degree. You might get your resume looked t with a PhD on it, but you will not get a job because of it; they will still look at your skills and accomplishments in the field for the hiring decision.

Do you want to teach at the college level? For adjunct appointment, the MS is fine. However, if you want to go for full-time and possible tenure track, then yes, get the doctorate.

There are other legitimate reasons for getting a doctorate: personal accomplishment, score keeping, prestige of the title, even as a personal merit badge.

Understand clearly that a doctorate is not a “deeper knowledge” degree per se. Rather it is all about learning to do and proving you have and can do research. I have talked to a few who think it is like a masters but with more heavy duty course work. Nope, not at all. If you really want to get into funded cybersec research, then yes, the doctorate is a good thing.

If you want to learn more about the various ares of our field, a plan for more masters degrees and other certifications, like SANS, is better.

Next, are you considering school while working full time, as I did, or as a full time grad student? If you go full time at a research university, you will be diving deep, with lot to learn and also have to be “free” labor for one or more professors on their grant funded research programs. If you go into a program aimed at working adults, your experience will be much more limited, and may not have the money for extensive tech capabilities for the research. On a research university you will likely be a contributing author in several published papers before allowed to publish your personal stand-alone dissertation. If you are in a working adult program, your dissertation may well be your only publication, and be limited by funds.

So, to summarize: why do you want the degree, and what do you expect to do to earn it, and then use it afterward.

Feel free to contact me directly for more discussion.

Good luck!

Craig

Re: Seeking PhD education advice

AppDefects — Thu, 09 Jul 2020 22:34:12 GMT

The moto "be all that you can be" applies. Is it worth it? Yes. What new knowledge do you want to create? What do you write/teach about today? What are your research interests? What schools/professors do you see as a good fit?

Re: Seeking PhD education advice

rslade — Fri, 10 Jul 2020 00:56:40 GMT

> AppDefects (Community Champion) posted a new reply in Career on 07-09-2020 06:34

> The moto

Hello moto ...

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Every man is guilty of all the good he didn't do. - Voltaire
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://community.isc2.org/t5/forums/recentpostspage/user-id/1324864413

Re: Seeking PhD education advice

emb021 — Fri, 10 Jul 2020 13:19:19 GMT

@JKWiniger :

"I once asked a recruiter why the job description looked so crazy and he told me first they ask for a requirements list, then a wish list, and then they have them throw in the kitchen sink! I was told if I match at least 50% I should apply for anything I was interested in. I have also heard it is best to ignore most of what is written and just look at the responsibilities section and see if it fits and is something you want to do."

50%?? I was always told and operated on matching 80% and been upset that companies seem to want someone who matches 100%, or pull out one item and treat it as a must have skill even tho it wasn't so marked. ("Oh, do you know X? You don't. Sorry, that's a must have skill, we aren't interested in you")

But I'll agree on the craziness of job descriptions and thought of posting some of these on my blog and critiquing them. Then companies wonder why they can't find people after looking for months because they are searching for unicorns/purple squirrels...

Re: Seeking PhD education advice

CISOScott — Fri, 10 Jul 2020 13:42:33 GMT

If you thinking that getting a PHD is going to get you a job you will be disappointed. A degree may fill a required checkbox but your personality and job skills is what usually get you the position. As someone who has been in the hiring manager position I looked at several things:

From the resume:

1) Does the person have a skill set that is crucial to being able to perform the role successfully? Basic skills I need for the job. (i.e. I would look for someone to have server experience if I was hiring for a server administrator)

2) Has the person held positions that provided opportunities for growth? I don't mind seeing lateral moves but usually like to see progression over their career. I see a progression of responsibilities in careers as an indication of ambition.

3) Education is usually just a check box for HR. I do not weight someone with a PhD more than someone with a Master's. I note the effort required to go for the PhD is extreme and admirable, but like another poster said it usually means you have spent a lot of time on research. I have had excellent employees who did not have degrees, so that is why I don't automatically assume that a candidate with a PhD is going to be excellent.

In the interview I look for:

1) Passion and ambition. The best employees I have had were very ambitious and eager to learn and grow. They were always learning and willing to take on new tasks and seek out new opportunities.

2) Honest. I would rather you tell me that you don't know something than try to lie and give a fake answer. Once I see falseness in your interview, you are done. Even better say you don't know it but are willing to learn it is even better.

3) Do you have the ability to adapt. I want to hear of the challenges you faced and how you came up with solutions to overcome or deal with them.

4) What kind of self improvement have you done? If you have spent the last 6-8 years in school you may not have the hands-on experience I am looking for. Book knowledge is important but experience is better. If you have only been in school (and not in the workforce) expect me to ask what have you been doing in your "spare" time to better your skills. If the answer is partying or "relaxing" in your down time don't expect to be selected.

So my questions to you are these. There seems to be a lot of information security jobs out there. You say the jobs in the job market do not match your qualifications. Does this mean that you can't find a job that pays you what you think you should be paid? You can't find the job in a location you want? Are you looking for a very specific job that does not have a large number of postings (i.e. forensic specialist)? If you can't find a job with your current skill level/education/certifications etc. getting a PhD won't help. I would be interested in seeing if your search area is too small or if there are other restricting factors in order to help you more.

In order to advance my career I have had to move from a small job market to a bigger job market. I have had to make some moves that were considered lateral or a downgrade, but I had good reasons for them (i.e. family sickness). Overall I have shown progression in my career and it shows on my resume. I recently considered taking a position that would have taken me out of management and in to a more hands-on role, my justification? A 25K a year raise! It didn't work out but I had a justification for future interviews about why I left a management role and took a "downgrade" in position title. What does your resume say about you? Does it show progression or just bouncing around with no clear path? Have you considered a professional resume writer to look at what you are putting out to potential employers? How do you interview? Have you looked at that possibility that you might be a poor interviewer? There could be many factors that are affecting your ability to be hired, having a PhD might not be one of them.

Re: Seeking PhD education advice

BMwine — Fri, 10 Jul 2020 13:58:11 GMT

Hello CISOScott,

Thank you for your candid and reflective response. I truly have a lot to questions I need to ponder upon.

Regards,
Brian

Re: Seeking PhD education advice

BMwine — Fri, 10 Jul 2020 14:04:42 GMT

Hello Dr. Cragin,

Thank you for your response. Your story is really inspiring and I will definitely engage you directly as I continue to think about my future.

Regards,
Brian

Re: Seeking PhD education advice

rslade — Fri, 10 Jul 2020 20:59:24 GMT

> emb021 (Contributor III) posted a new reply in Career on 07-10-2020 09:19 AM

> @JKWiniger : "I once asked a recruiter why the job description looked so
> crazy and he told me first they ask for a requirements list, then a wish list,
> and then they have them throw in the kitchen sink! I was told if I match at
> least 50% I should apply for anything I was interested in.

Must be a lot of people giving that advice. When recruiting, I generally know what I need, and put that in the ad or posting.

Funny thing: I get lots of resumes from guys who are unqualified. I don't get as many resumes from women--but when I do get a resume from a woman, she is qualified.

> Then companies wonder why they can't find people after
> looking for months because they are searching for unicorns/purple squirrels...

Indeed ...

Re: Seeking PhD education advice

JKWiniger — Fri, 10 Jul 2020 21:07:20 GMT

@emb021 It really shows the mentality of a company. One places wants to find a person who knows EXACTLY what they need, which rarely happens. Then better companies understand that if a person knows one firewall, but it's not there firewall the clearly understand all the concepts and and learn their firewall easily, or they look at your background and see all that you know and all that you have done and get that you have done enough so you can learn and do anything that is needed! These companies looking for these perfect UNICORNS will rarely find them and if they do they don't want to pay them! Deidra Diamond founder of CyberSN has been doing a good job simplifying job descriptions and streamlining things. Her only problem is that she need to be in more areas! Do more fast Deidra! hahah

John-

Re: Seeking PhD education advice

rslade — Fri, 10 Jul 2020 21:13:10 GMT

> CISOScott (Community Champion) posted a new reply in Career on 07-10-2020 09:42

> If you thinking that getting a PHD is going to get you a job you will be
> disappointed. A degree may fill a required checkbox but your personality and job
> skills is what usually get you the position.

I was asked to give a "what to expect from the job market" type speech to a class from [fairly famous school].

I started out by asking how many want jobs in tech support.
Not many.
I told them that nobody would much care if they went to [fairly famous school]: they just wanted warm bodies, good diagnosis and communications skills.

How many wanted jobs in network admin?
Not many.
I told them that some companies *might* care that they went to [fairly famous school].

How many wanted jobs in programming/development?
Almost everyone.
I told them that nobody would care that they went to [fairly famous school], they would all want to see code. So how many had developed a program they could show off?
Almost nobody ...

Re: Seeking PhD education advice

JKWiniger — Fri, 10 Jul 2020 21:15:45 GMT

@rslade Funny you say that, when I lived in Boston I was at a women focused meeting at the CIC (Cambridge Innovation Center) and the talked about the difference between how men present to VC opposed to women. They said men basically walk in toss stuff on the wall and say give me money, where as the women tend to take the time to cross the Ts and dot the Is, so what you said makes a lot of sense. I think the difference is it sounds like you created the job posting yourself opposed to having a recruiter do it, and this put you ahead of most! I saw a cop description just lately where in it said in one part you needed to know how to migrate checkpoint firewalls, but then in the requirements they said you needed to know Palo Alto, umm ok, so which is it? I want to say if they list just what is need and what is a plus it would be so much easier, but like you said you will still get unqualified people applying. I guess I would rather deal with weeding out unqualified people opposed to scaring away great people over an extreme description.

John-

Re: Seeking PhD education advice

emb021 — Fri, 10 Jul 2020 21:24:53 GMT

@JKWiniger It really shows the mentality of a company. One places wants to find a person who knows EXACTLY what they need, which rarely happens. Then better companies understand that if a person knows one firewall, but it's not there firewall the clearly understand all the concepts and and learn their firewall easily, or they look at your background and see all that you know and all that you have done and get that you have done enough so you can learn and do anything that is needed! These companies looking for these perfect UNICORNS will rarely find them and if they do they don't want to pay them!

Actually, my example was worse then that.

I'm pretty good about putting my skills in my resume. Never having worked with firewalls, there is no mention of them in my resume, which is why when the company's "technical recruiter" (yes, that was his position) I was a little taken aback.

I was a bit miffed about being rejected for what I figured was a minor thing AND if this was such a critical must have skill, it should have been so noted.

A few months later I was chatting with the guy who got the position (yeah, I know a lot of folks in the local infosec community, and so either know or have met people who got the jobs I tried for and sometimes even interviewed for. I get along with many of them). Anyway, I told him of my experiences with this recruiter, and about the rejection over firewalls. He then tells me the position has nothing to do with firewalls and was all about IT Risk, which I do a lot with. So don't know if the recruiter was an idiot or using the firewall thing as an excuse to get rid of me as a candidate. But I've seen similar stupid behavior with many companies. I've come to call it the porridge syndrome. You know, 'too hot, too cold'. I've gotten that I'm too security, too risk, or too compliance when it came to certain roles. Whatever.

Re: Seeking PhD education advice

JKWiniger — Sat, 11 Jul 2020 11:10:59 GMT

@emb021 I think the "technical recruiter" title was an attempt at having a recruiter who actually understands some of the technology they are hiring for. From what I have heard a lot gets lost going from the hiring manager to HR to the recruiter. It seems to be hard to find good recruiters. I had a recruiter contact me about a position and I said yes please submit me. After some time I still had not been submitted and asked why. I finally found out that they had sent a bunch of candidates before who had all been rejected so they were a bit slow to submit now. They waited so long the job got pulled.They should really make a job description like we make a resume, when listing things start with the most important at the top and go down from there.

I remember seeing something on how all the weird interview questions used by places like Google yelled no actual results and did not improve retention. I think it comes down to is a person a good culture fit within the company, are they honest and can be trusted, and do they have a willingness to learn what is needed, that's it. Back in the day it was possible to find a really close match but now a days things are so diverse I think they need to realize if they get people who simply have the fundament knowledge in the required area they will be ahead, or maybe directly match a few area but don't have others. What make it really laughable is they make these crazy description but them don't want to pay for it! It really kills me when I see higher level management positions and they are looking to pay less that they are paying lower level positions!

I guess I should digress because it seems that for both of us and probably many others the broken recruiter situation can easier get one a bit heated... give me a recruiter who knows that BIND and DNS are basically the same thing or that the CISSP is a management certification so don't ask for it for an engineer position... silly people...

John-

Re: Seeking PhD education advice

JKWiniger — Sat, 11 Jul 2020 11:38:46 GMT

@emb021 It's just sticking with my that the firewall issue is a pain point for you, so let play a little game as I will call it...

Do you understand and grasp...

NAT - you can have 1 public IP that can be translated into a lot of private IPs

Ports - different programs run on different ports to keep things separate

Ports can be changed so that incoming port 8080 can be converted to port 80 at a certain internal IP

If a connection starts from inside the firewall the response will be allowed to come back in

You can allow things to come in and be directed to certain IPs and ports

It's just some quick things off the top of my head, but if you understand those things I would say you would understand firewalls and it wouldn't take much to have you fully understand the brand that is used. I have been certified on Checkpoint, yes it's now an outdated certification and version, but the basics will always be the same with just different topping on top. To me it's less about knowing the exact details and more about understanding the basics and fundamentals.

John-

Re: Seeking PhD education advice

BMwine — Sat, 11 Jul 2020 16:46:05 GMT

Hello,

Those are some good points there. A lot of companies need to collaborate with the HR departments to seek the IT personnel they want. I got some really good skilled friends of mine still job hunting ... Why? Because HR want a candidate who is anti-kryptonite material.

Superman too had weaknesses .... Kryptonite and Louis Lane.

Some changes, I pray got to happen.

Re: Seeking PhD education advice

CraginS — Sat, 11 Jul 2020 23:28:27 GMT

"Superman too had weaknesses .... Kryptonite and Louis Lane."

Oh no!, You mean Metropolis has gone WOKE, too?

I had not heard!

(And I always thought Clark and Bruce were a cute couple.)

Re: Seeking PhD education advice

Caute_cautim — Sun, 12 Jul 2020 06:48:42 GMT

All a very good set of points, I also considered doing at PhD myself, but from a personal note, having gone through a hybrid MSc/MBA, which one could either tackle it from the technical end or from the business end to the other side. Working in collaboration with the sponsoring organisation for three years and coming out successfully. I learnt a great deal, but it took a personal toil on my family at the time. Resulting in a break up. So this alone put me off not doing a PhD I have also observed others who have committed them to four years of long weekends, and again seen the personal effects on the family.

However, one of the best skills I learnt via the Open University, due to the fact I was travelling for years, was Richard Checkland's Soft Systems Thinking Methodology. I was very fortunate to be taught be the Professor himself. This has been invaluable throughout my career. https://link.springer.com/chapter/10.1007/978-3-319-07635-5_48

The same methodology was again promoted in the my MSc, and actively applied to different scenarios.

I think you have to want to work as a dedicated researcher, or an inventor to put that PhD to work.

But personally I have seen a change in attitude within organisations, the drive towards immediate skills, based, on short courses, Agile, Cognitive thinking, Hybrid Cloud, People skills and emotional intelligence being the immediate soft skills that are required right now at the moment. The use of Augmented Intelligence and Machine Learning, and New Collar Workers, being taught side by side, gaining skills on the job and through mentoring. Then we have edge computing, IoT, cloud migration, and applying these to digital transformation and consultancy, 5G and many other facets which keep spinning out. So by the time, a certain young person I know currently who is doing a PhD on 23 Cm aerial design, we will be carrying out 6G design factoring, and beyond. I do not regret my decision not to pursue a PhD, I know I have the ability, and I have the support, but simply do not have the time to balance the family and dedicate myself to the task.

Regards

Caute_cautim

Re: Seeking PhD education advice

emb021 — Wed, 15 Jul 2020 14:33:07 GMT

@JKWiniger "It's just sticking with my that the firewall issue is a pain point for you, so let play a little game as I will call it..."

Actually, its not the 'firewall issue' that is the pain point for me, but how it was used.

I was asked if I had worked with firewalls, not if I understood them. Since I have not worked with firewalls, which to me means either setting up one or maybe reviewing the firewall rules, I had to be honest and said "no". Had I been asked if I understood their purpose, I would have given a high level answer.

My issue with the exchange was that this recruiter pulled out something I hadn't worked with, then when I said I had no experience with, said that since they had spoken with the hiring manager, and thus knew exactly what they wanted, that this particular skill was a 'must have' for the position, and rejected me.

Then when I spoke with the person who got the job, found that the position had nothing to do with this so called must have skill.

So I have to wonder why the recruiter did this? Were they looking for something they could use to reject me? They probably assumed I wouldn't find out.

This more points to some of the lousy behavior I've seen with too many recruiters and hiring managers then a lack of skill/knowledge on my part.