One journey ends, another begins

A number of years ago, I began to get requests from people and small businesses to do work for them. I was already gainfully employed, but the work often sounded interesting. So in 2010, I started a small business and made the deal kosher with my then-employer (Booz Allen) by signing some paperwork approving my outside employment and agreeing to avoid conflicts of interest.

To be fair, I never intended to make much money off of this, what was then, a side business. But it would be nice to write a book chapter and get paid, or give a talk and get paid, and have it all be above board. And the work, frankly, was more challenging to me on a technical level. So those two things were really the point of my business.

About a year and half ago, due to a confluence of factors, I started looking to do my business full-time. This was a huge leap of faith for me (as I expect it would be for many people). Going on your own is risky and fraught with potholes. But I needed to do it. So I did--I quit my perfectly good and well-paying job to do it all on my own.

Much of the past year, I had so much work that I had to turn down more work on a regular basis. The infosec industry (at least in the DC metro area) is a buyer's market; the demand for work outstrips the supply. Within reason, you can ask for (and usually get) what you want. In fact, I had three separate contracts ongoing: one which was basically full-time, and two others that were part-time (and one of them, all remote work).

A few months ago, that full-time gig ended rather suddenly. I still had the other part-time work, but it wasn't enough to keep me busy (or pay the bills for very long). So I started looking.

My requirements started out pretty high: #1: 1099 work (many companies won't even look at you if you ask for this) at a comparable rate to what I was already making), #2: MD/DC work; northern VA is increasingly difficult to get to from where I live in MD due to traffic, construction, etc., although remote work would be ideal), and #3: exclusively focused on penetration testing. I have a background in SIGINT and CNE and a clearance, so all those folks jumped aboard, but very few of them met requirement #3. In fact, virtually all of the literally dozens and dozens of people I talked to met one or two of my requirements, but not all three. Asking for just one or even two of these requirements (instead of three), I have absolutely no doubt in my mind I could have found work within a week or two.

But there's another thread to this story, which began in 1997. I was graduating from Bloomsburg and decided to go to law school. I applied to, and was accepted to American University's law school. Very late in that process, I switched gears and decided to get my Master's Degree at Georgetown. So that was the first time I was accepted to law school, but didn't go

Toward the end of my time in the Navy, due to the shrinking size of my community, I decided to do a JAG transfer. Again, I was accepted to law school, but the Navy didn't approve my transfer package. That was the second time I was accepted to law school, but didn't go.

So over the last few years, having regretted not going before, I've been looking for opportunities to go back. And finally, the third time I was accepted to law school, I'm going. Part time, so it'll take four years instead of three, but I refuse to turn it down again.

Back to the present: independent contractor work and school don't get along well. There's travel sometimes, but mostly there isn't always a "regular" workday. Sometimes over the past year, I have worked nights and weekends. When you don't have something else going on, that's not a problem. But again, not really compatible with a school schedule.

So I essentially dropped my 1099 requirement and decided that I could be OK with it in return for the stability of a somewhat regular day job. I'm going back to Booz Allen, but in a different role: I'll be leading one of their penetration testing efforts. Sure, there will be some travel and other issues, but I'm going into it with full visibility and support from my boss, so I know I can make it work.

I will miss the challenges of working on my own--giving all of that up is a sacrifice--and given the circumstances, I would do it again in a heartbeat.

When I was single, I looked at guys who were married (and with kids) and wondered how they did it all. Now I look back and wonder, how could I have done it all without Tracy? She has always been my bedrock of emotional support; never wavering a second. Of this I am truly confident: I could not have done this without her.

In one of those unique circumstances that just seems to work out that way, I start law school and my new job on the same day. How's that for a new journey!

The new job

Almost four years ago, my time in the Navy was quickly coming to a close and I was anxious to find a job.  I gave my first-ever talk at DEFCON about my counter-IED work in Iraq, and in the small crowd of people asking questions, a man flashed his Navy ID card, handed me his contact information, and told me that we needed to talk.

I have to admit at the time I was slightly frightened that somehow my talk had attracted the wrong sort of attention (I was still on active duty at the time, and my talk, while unclassified, was nonetheless pretty aggressive). Ultimately, my apprehension was misplaced; he was in the Navy Reserves but more importantly, he worked for Booz Allen and he was offering me an interview.  I went through a couple of interviews (my first one didn't go so well, but they saw potential and invited me back for a second), and by December I was thrilled to get (and accept) a job with Booz Allen.

Over the past three plus years I have worked with an amazing team of analysts that would be difficult to top. Through the highs and lows, this team has done amazing work and I am proud to have been a small part of it.  Over the course of barely two years, our six member team grew by leaps and bounds (we're about to pass 40 by next month), and it has been a remarkable run. That being said, it was time for a change.

Today, I am happy to announce that I've accepted a new challenge. Effective June 20, I will be working as a Security Engineer and Penetration Tester with TDI Security, a computer security consulting firm based in Washington, DC. I'm working not as an employee of TDI, but as a independent contractor.  Going out on my own and being self-employed is a step I've been looking to make for some time now. While my business (Leverage Consulting & Associates) has been around for over a year now, this move effectively marks the beginning of full-scale operations.

For a while now, I have been looking for the right opportunity to move into more direct full-scope penetration testing work, and I believe that this is that opportunity. Additionally, I already know some of the people I will be working with and I am extremely excited for this new direction.

I've very much enjoyed my time at Booz Allen, and I hope to be able stay in touch with those of you who I've met during that time. I am especially looking forward to meeting new folks through this new role.

See you in Vegas!