It's Not All Ninjas and Anonymous Masks

The talk gives a candid look at what working in security is like day to day, drawing on years on internal teams at healthcare, finance and utility organizations and later as a consultant. It sets out the range of roles, from penetration testing and compliance to incident response and management, and notes that meetings, scoping and documentation take up much of the job. The speaker argues that time pressure and getting stuck on a problem are common hazards, and suggests timeboxing work and documenting as you go.

The middle of the talk covers tooling and communication. Open-source and commercial tools each have trade-offs, and endpoint detection and insurance requirements can block tools or demand admin rights, which pushes teams toward separate test laptops, virtual machines or advance notice to the monitoring team. Reporting gets significant attention: findings should explain business impact in terms non-technical stakeholders understand, and clients should receive a way to retest fixes themselves. Stories from past engagements illustrate how a test can accidentally disrupt systems and why collaboration between red and blue teams helps.

The closing section compares internal and consulting work, including travel, follow-through on remediation and how each setting shapes a practitioner's approach. The main takeaway is that the role rewards communication, patience and continuous learning as much as technical skill, and that people should choose a specialty they genuinely enjoy.