The first part of our Life After Law Enforcement series talked
about the decision to leave. In this installment, I’ll compare and contrast
life in the consulting world versus the corporate world. Before I do that,
however, it’s important to discuss a couple concepts that drive the differences
between life in the public sector and the private sector.
One of the biggest differences is there is virtually no
unionization in the private digital forensics world. At least here in the
United States, most law enforcement jobs are going to be unionized civil
service positions. This means that the
relationship between the government entity and the employee is doing to be
defined by a collective bargaining agreement. Even if an officer isn’t covered
under a collective bargaining agreement, they’re almost certainly going to be
under some sort of civil service type protection.
This means that there is much more job security compared to the
private world in that you can be thoroughly mediocre, but unless you are really
screwing up in a well-documented way, you get to keep your job. It also means
that your compensation is largely just a function of how long you’ve managed to
stick around rather than how much value you add to the organization.
Not so much in the private sector, where your job security and
compensation will be primarily a function of the value that you provide your
employer rather than how long you’ve managed to go without egregiously screwing
up. You’ll certainly see your fair share
of mediocre people in the private sector, but they tend to have stagnant career
paths and they’re the first people out the door when a re-organization comes or
revenues are down. Since collective bargaining and civil service generally aren’t
in play in the private digital forensics world, your relationship with your
employer is going to be individual rather than collective and revolves around
the value you provide.
This is very good news for people who are motivated and want to
excel. One of the reasons I left law enforcement early in my career is that I
recognized that no matter how good I was at my job, my career path and
compensation would largely be a function of time rather than talent. This is very bad news for someone who just wants
to do the minimum and punch a clock.
Another important difference is that many private sector digital
forensics jobs will put you in the position where you are a necessary evil to
the organization rather than someone driving the primary mission of the
organization. Law enforcement agencies
are put upon this earth to put bad people behind bars. Whether it’s a police officer in patrol car arresting
baddies or a digital forensics detective putting some evil wretch in prison
until shortly after mammals are extinct because of something they did to some
child, police officers are primary people advancing the goal of that
agency.
In the private sector, unless you are in a consulting type
position, digital forensics people are a necessary evil to an organization and
are the dreaded
indirect spend. Direct spend is spending that is aligned with delivering a
product or service to a customer. Indirect spend is everything else. Spending money to create and staff a
manufacturing line to build cars that are then sold to customers is direct
spend. Spending money on information security people to keep that manufacturing
line from getting hacked and stopped is indirect spend. Indirect spend is important to an
organization, but it’s a big fat juicy target for cutting costs and increasing
profits. The closer you are to impacting the profit and loss of an
organization, the more important you are. The more important you are to an
organization, the more you will be paid, the better your promotion chances, and
the better your job security.
There are some similarities in that large bureaucracies whether
they are public or private tend to follow the late Jerry Pournelle’s Iron Law
of Bureaucracy more often than anyone would like to admit. I’ll just quote
directly from the Jerry Pournelle website when
it comes to explaining this:
Pournelle's Iron Law of Bureaucracy states that in any
bureaucratic organization there will be two kinds of people":
First, there will be those who are devoted to
the goals of the organization. Examples are dedicated classroom teachers in an
educational bureaucracy, many of the engineers and launch technicians and
scientists at NASA, even some agricultural scientists and advisors in the
former Soviet Union collective farming administration.
Secondly, there will be those dedicated to the
organization itself. Examples are many of the administrators in the education
system, many professors of education, many teachers union officials, much of
the NASA headquarters staff, etc.
The Iron Law states that in every case the second
group will gain and keep control of the organization. It will write the rules,
and control promotions within the organization.
The good news is that this isn’t as universal as the name Iron Law
would imply. I’ve worked for
organizations where the first group of people ran the show and the health,
effectiveness, and morale of the organization reflected that. The organization
I work for right now is one where the Iron Law doesn’t even remotely apply, but
I’ve gotten to know the Iron Law of Bureaucracy all
too well during various periods of my career.
Let’s add another common element in private sector life into all
of this and that’s organizational change.
I’ve long since lost track of how many reorganizations I’ve lived
through in the private sector, but it’s a constant part of life in large
private organizations. About the time
you get comfortable with an organizational structure, someone will come along
and blow it up. Change is such a
constant in the private sector that top business schools like can demand
wheelbarrows of cash offering training
in organizational change management.
One of the primary drivers of organizational change are changing
business conditions. Markets are dynamic
so organizations have to adjust their products, services, and how they operate
to adjust to changing market conditions.
As organizations change, the security portion of the organizations have
to change to continue to securely enable business operations. Security leaders who can’t manage change and
keep up with the business leaders don’t last very long. And when they get whacked you can expect
another reorganization.
This brings up another potential driver of organizational change
and that’s the Ides of
March. Politics are part of any
organization whether they are public or private, but in the private sector, the
stakes can be very high because of the amount of money involved especially if
an organization is highly profitable.
There is quite a bit of careerism in the private world. I define a careerist as someone who puts
their own career goals ahead of the needs of the organization or their people.
They’re an odious fact of life in the private sector. They exist in the public sector, but union
rules and civil service protections blunt the impact that they can have on
individuals in an organization.
Executive political life can be pretty…staby in the private
sector, but the rewards can be great especially when you factor in that
successful security executives in large organizations can make over a million
dollars a year in compensation. In many cases, you will have reorganizations
that have no real functional purpose, but have everything to do with palace
intrigue and who got knifed
on some senate steps.
So why am I telling you this? Because with change comes both peril
and opportunity. If you play your cards right in knowing how to obtain and
retain power in organizations, there could be new opportunities during a
reorganization to advance your career as new teams are created, new positions are
created, or even more money floating around for things like training or tuition
assistance. In security organizations,
one of the best times for funding can be after a major breach when the senior
executives (and they may be the new ones that just replaced the now fired ones)
are scared straight and start throwing immense amounts of money at the security
organization.
Power in organizations translates not only to career progression
and increased rewards, but also to survival. While you certainly can gain power
by moving up the organizational ladder and increasing your influence and
responsibilities, you can also gain power by the value you add to an
organization through your individual abilities.
Some of the most powerful people in a security organization are the individual
contributors who have skills that are mission critical and hard to replace.
The more value you add to an organization, the more power you have
to influence things around you, the greater your rewards, and the less you have
to worry about job security. The less valuable you are to an organization, the
less power that you have which harms your ability to change things around you,
your compensation, and your job security.
The less value you add to an organization, the greater your risk during
one of the inevitable reorganizations or if your organization hits hard
economic times. It’s not the highly
skilled individual contributors who are going to be marked for termination when
costs have to be cut in an organization or the inevitable next reorganization
comes along.
Let’s talk about two broad categories of private sector jobs. The first I’ll talk about is the consulting
world and then I’ll address corporate life.
I’m not going to directly talk about non-profit type organizations like
where I work now because depending on how they are structured they can
essentially act as a government organization or they can feel more like
consulting or corporate. It depends on how their mission, funding, and
management.
Let’s start with consulting.
Consulting can be an immensely rewarding experience that can greatly
increases your knowledge, job satisfaction, and value or be a joyless
dystopian hellscape where the living envy the dead not. I’ve seen a couple golden eras of consulting
during my time in the industry. The
first was the eDiscovery golden age that started roughly near the year 2000 and
ended, the best I can tell, about the time of the financial crisis. During this time, eDiscovery consulting
organizations where shaking down corporations and law firms for confiscatory
prices for providing eDiscovery services.
There were countless eDiscovery consulting firms spread across the land
and they were desperate for consultants who they could put into the field and
their labs so that they could crank out as many billable hours as they could
get away with. Life as a consultant
during this time involved burning an immense number of hours traveling and
collecting mountains of data. The data
was then brought back to some lab somewhere and either the same consultants or
different consultants then processed and hosted the data for attorney
review. Since the primary billing model
was consultant hours, consultants were basically just another commodity to be
used up. I saw a lot of burn out during
this era and more than a few very unhappy police officers enter this space
thinking they were going to be doing interesting digital forensics analytical
work and catching bad guys when all they were doing was just endless grunt work
slinging data around from one place to another.
If you were an eDisco manager during this era, your life was constant
pressure to make sales goals, making sure your faceless commodities
consultants were being fully utilized for billing purposes, and plenty of stuff
that had nothing to do with chasing bad guys and solving digital forensics
mysteries.
The golden age of eDiscovery went bust because the industry
overplayed its hand and their customers starting to bring those services inside
of their organizations. The result was quite a few of these consulting firms
going out of business or being purchased by larger consulting firms that were
better diversified and positioned to survive the bust. I also think the legal
system generally just responded negatively to the high costs and how things
were being done. Cost containment started to be a big deal in the legal world since
even in an adversarial legal system everyone could see that the consultants
were saddling up their customers and taking them for a very expensive
ride.
Another thing that really hurt the eDiscovery industry was the
rise of the golden age of cyber security consulting that continues to this
day. The eDisco consulting industry
faced increasing pressure from the cyber security consulting world for talent
and customer money. This golden area of
cyber security consulting has been partially a response to the near
impossibility of defending networks from persistent skilled attackers. There have been legions of high-profile
breaches and the rise of public disclosure laws has meant that many of these
incidents end up in headlines that result in great financial loss,
embarrassment, and senior executive careers coming to an end. This has provided powerful incentive for organizations
to greatly increase their cyber security capabilities which lead to an immense
amount of money being thrown at cyber security consulting firms.
This golden age is meat on the table of enterprising and skilled
law enforcement officers who are looking for their second career. There are countless consulting firms who are
looking for talented people to come help them serve their customers both by
offering proactive services such as penetration testing and threat intelligence
and reactive services such as helping them detect, respond, and remediate
incidents. Some of these firms are going
to be nightmares to work for where your life will be similar to what I
described above, but many others have learned that retaining critical talent
requires providing a reasonable work-life balance, rewarding work, and a career
path.
This gets back into the point I made earlier about the more power
you have in an organization, the more you can influence you have about the
world around you. One of the things I
learned as a police officer is that trauma comes from lack of control. A great
way to have a traumatic consulting experience is to have minimal technical
skills and to land in a job where you’re traveling nearly constantly doing low-skilled
grunt work. The best way to have a
rewarding consulting experience is to have in-demand job skills (and a security
clearance is worth crazy bonus points in this space) where you are being used
for high-end work that your employer can charge near-confiscatory prices to
customers.
Which gets us to life in the corporate world. In the consulting world, you’re generally
going to be direct spend which means the money an organization puts into you is
directly involved with the service that is being provided to a customer. In the corporate world, you’re indirect
spend. You’re a necessary evil when the
money that is spent on you doesn’t involve making or selling a product or
service to a customer. That’s the bad
news. The good news is that because we’re
in this golden age of cyber security, corporations are just fine (for now) with
this sort of indirect spending. I spent most of my career building and leading
high-performance digital forensics and incident response teams for a couple
Fortune 100 enterprises. Landing on one
of these teams can be a very rewarding experience as long as you do your
homework and find a team and organization that is a good fit for your skills
and temperament.
Corporate digital forensics jobs can take several different forms
but the primary tasks that you’ll see in the corporate world are also the same
that are being offered up in the consulting world such as eDiscovery, threat
intelligence, incident response, security operations, digital forensics,
malware analysis, and the like. That
which is necessary in the cyber security world is either going to be brought in
internally (which creates corporate positions) or purchased externally (which
creates consulting positions) or a combination of both.
Life in the corporate world will be more predictable that in the
consulting world since corporate jobs tend to be more of a normal business
offer hour situation with nights and weekends as necessary when things get
busy. There are some exceptions such as
corporations that have 24/7 security operations centers that require shift
work. I don’t see too many people from
the law enforcement world doing security operations shiftwork, but that isn’t
to say that it can’t happen and those security operations roles can be very
rewarding and educational. I’ve seen
many people start in security operation centers and used that time to build a
skillset that led to very rewarding career paths.
I think one of the biggest shocks for law enforcement people going
into the private sector is the concept that you are now a salaried employee and
there is rarely such a thing as overtime or compensation time. You’re expected to get your work done and
that frequently involves working over 40 hours a week to do that. You are also now competing with other people
in your organization. Remember what I
said earlier about gaining power in an organization. Having a reputation as someone who just does
the minimum is a great way to undermine your corporate career even if you are a
highly skilled person. A good attitude
and a strong work ethic will go a long way in the private world.
There is also another aspect of the private sector which is going
out on your own and starting up your own business. Frankly, this is one of the areas where I
have the least amount of experience with and I think the best way to handle
this will be for me to just pester someone to do an interview here on the
blog. If you have any suggestions on who
you might want to see interviewed, let me know.
I’m at about 3,000 words on this blog post and I think I’ve
covered a decent overview of life on the private side. I’ll still continue to
address some specifics as the series progresses especially in the next blog
post where I talk about what you should be doing as a law enforcement officer
to prepare for life on the private side.
