After making that realization all that was left was to make it a reality.  A couple of weeks ago I was able to do exactly that as I got myself re-assigned to focus on Application Security.  This role is much less technical hands on and much more “lets look at the big picture of application security”.  I love this role, and love the new work I’m doing.

For those wondering – this isn’t a promotion so much as a lateral move. I still work within the same team as I have for the past two years.  The main difference is that my focus is wholly on AppSec.

Very good things are coming – very good things.

Security is not supposed to be about making it difficult for a business to get things done.  If that’s what’s happening then something is not right.

Security is about making it easy for a company to achieve its goals in as secure a fashion as possible.  We’re here to protect data and assets – not prevent work.

My job?  To make doing things securely easy.   I’m good at it.

The major drawback for people like me is that I quickly feel burnt out and numb to work because I’m subjected to it constantly (even if I am subjecting MYSELF to it), which makes it difficult to find motivation and much harder than it should be for me to focus on getting the job done.  The issue isn’t so much that I don’t like what I do – I like most of it – but more a manifestation of an imbalance in the work – life balance.   I realized that I am causing a lot of that imbalance myself (a realization that Ann doesn’t know she helped me make, even if I won’t admit that out loud).

Last weekend I tried an experiment – Ann and I took a long weekend trip up to Kalamazoo Michigan to tour the Lake Michigan Shore Wine Trail, and I decided that I was going to remain as unconnected from work as I could manage.   I took a laptop, but only for the purpose of being able to map out daily plans and look up info on the wineries.   The laptop stayed, unused, in my bag the whole trip.

I looked at email far less frequently than “normal”, and left nearly all work related emails unopened.

So how did this work out?    Honestly – incredibly well.

Our trip took us up to Kalamazoo, where we stayed at the Kalamazoo House Inn,  an 1870′s Victorian house that was converted to a bed and breakfast.  The inn keepers were incredibly friendly and welcoming and really made the experience a great one.   The inn itself is quite charming (yes, I said charming) and felt very open, welcoming and inviting.  If you’re ever looking for a place to stay in or near Kalamazoo – you owe it to yourself to check this place out.  (The food, btw, was quite excellent).

As I mentioned, we were there with the intention of visiting area wineries on the Lake Michigan Shore Wine Trail.  There are 12 wineries on the trail, and we ended up visiting 8 of them and sampling wine (more on that in a minute) – as well as some chocolate shops, and a cider mill.

We started off our day Saturday by heading to the wineries farthest away from Kalamazoo.   There were 6 of them clustered pretty close together and we figured we could hit those Saturday, and visit the closer wineries on Sunday.

Most of the wineries we visited had wines we liked (a couple did not),   and most were very welcoming and friendly (a couple were not).   Each place allowed us to try up to 6 of their wines, which was plenty to be honest – lots of them were sweet, but each place had a few dry wines as well (which Ann and I prefer).   What struck me most on Saturday, though, was how absolutely beautiful the area was.   Easily half the fun was just driving around the back roads of rural Michigan and enjoying the scenery with Ann.

Sunday was more of the same – enjoying time out at the wineries closer to Kalamazoo.   The chief difference was that we stopped first at Grandpa’s Cider Mill for doughnuts and apple cider.   Ann still talks about how great the doughnuts were and I’m positive we’ll be stopping by there on our next visit.    From there we went to the Chocolate Garden,  makers of handmade chocolate truffles.   It was a little disappointing in that it was quite small and they didn’t seem overly friendly.  The truffles are good, at least.     From there we went to another chocolate shop just down the street (I can’t remember the name) where they have all kinds of homemade chocolate items.   In contrast the the Chocolate Garden they were incredibly friendly and welcoming – letting me sample some of their fudges.  Their chocolate items are all hand-made as well, and were absolutely delicious.  We will definitely be going back there as well.

For those who are wondering – yes we did visit Bells Brewery.

The weekend was exactly what I needed – a nice peaceful relaxing weekend with Ann where we got to enjoy  each others company, good food and good wine.  The best part was that I felt unencumbered by work – I felt no obligation to be connected there and because of that I was better able to enjoy the time I spent with Ann.  The lesson I’ve learned is that I need to ensure that the work – life balance is more evenly balanced.  The last thing I want is to find myself 30 years into the future and realize that I spent all my time working and never got to enjoy life.

In the course of considering my career – both where it’s been and where it’s going – I’ve come to a very important realization:  I don’t want a career in information security.

Let me say that again, for those of you who are shocked:   I do not want a career in information security.

I do realize this may come as a surprise to many, given that my current profession is information security.  It came as a mild surprise to me, too.  I realized, however, that information security is just not what I want to do for the rest of my life.  I do enjoy it, and I am happy in my current job (and really like my employer), but when I look down the road 5 to 10 years,  what do I see?   I see either being in the same type of position I’m in now (whether it be here at my current employer, or at a different employer),  or managing information security somewhere.   I’ve done both,  and am capable of doing both,  but am not sure that’s what I want long term.

Instead, when I look long term at what I would LIKE to be doing, I see myself using my technical abilities in conjunction with more business related work.  While I’ve got the technical abilities part down,  the business side is where my foundation is a little shakier.  I’ve owned businesses, which helps, but I lack any sort of formal training in that regard.   I have some experience,  including some valuable experience being in tough situations and having to make difficult decisions.   I’ve helped shape and steer a company from a strategic perspective, and have learned some valuable insights from that experience.  I haven’t, however, been schooled in many of the aspects of business, and management, that would benefit me further down the line in my career.

With that thought in mind, I’ve decided that it would be in my best interest to pursue an MBA, in an effort to shore up my business knowledge and abilities so that I can combine them with my technical capabilities and make myself more desirable for the types of work I would enjoy moving into.

Having said all of that, however, I don’t plan on changing employment anytime soon.   The plan to apply for and get into business school will likely take a year or more to execute,  and I don’t currently plan on going to school full time, as I would like to work while doing it if possible.   I also really like my current job, and the company I work for.  This isn’t an immediate change, to be sure, but a more long-term plan that I want to execute carefully and make sure I can maximize it’s benefits over the long haul.

It honestly feels good, though, to have something long term that I’m working for… I have a goal, something to work for, and perhaps most importantly, something to be passionate about (other than my marriage, that is ).

Now – to prepare for the GMAT….

I’ve been fairly silent over the past week. That’s something that in and of itself isn’t too much of a shock… there are times when I go for weeks without posting anything, so why should a handful of days be special? Well – in this case – they were special.

For quite a while I’ve been considering a job change. There are a variety of reasons for this consideration – none of which I will go into in such a public forum. Back in December, just before Christmas, I interviewed with a company in downtown Indianapolis, for a position on their Information Security team. I felt myself to be a strong candidate – after all, for the past 10 months I’ve been building and managing a security program for a federal contractor. This position offered me things I couldn’t get in my existing position, and these were things I found to be highly desirable.

The hiring manager mentioned that he hoped to have an offer out before the end of ’08, but if not, then shortly into ’08. Christmas came and went with no word one way or another. A week or so into ’09 and I sent a second followup e-mail (I sent the first when I got home from the interview). Again, no word. I’ll be honest – at this point I wrote it off as a “not gonna happen”.

Imagine my surprise, then, when on Tuesday, when I got back from lunch, I noticed an email from Twitter that the hiring manager had started following me. I can remember thinking “What the hell?! He ignored me, didn’t hire me, now starts following me on twitter?!” It was about that time he called to offer me the position.

And so, two days later – once I got the official offer letter – I resigned. I offered the company two weeks to transition my duties from me to my senior security analyst. They (and by they I mean a certain few – not the entire company – a long story that I won’t mention here) didn’t take it well, and have banished me to work those two weeks from the comfort of my own home. I am – to the best of my knowledge – still on payroll, and still earning my salary. That’s something.

So, for the next two weeks I get to work from the comfort of my new home office – with the notable exception of this coming Monday morning, during which I will be conducting an exit interview with the senior executive team of the company (CEO, COO, CTO and HR Director – Possibly the CFO as well). While my physical access to the office I was based out of has been revoked, my laptop and blackberry taken, my VPN access also revoked , I still have access to e-mail and that – apparently – is enough for me to work. Supposedly.

I am looking forward to the new job. It seems to be a good company, performing strong even in this dismal economy. They also offer a variety of employee benefits that go well above and beyond my previous employer. The work will be much more in line with what I want to be doing as well, so the whole deal is just much better.

If only I didn’t have to wait two more weeks to start….

My boss, Mr IT Director,  pulled me aside and let me know that our CEO had emailed him, regarding me.  He relayed that the CEO was asking questions about me and what I do,  who I report to, and what my team does.  She also apparently stated that she doesn’t think I do anything.    

And…. that did it, I was floored.  This was coming after last week I sent a report to the corporate leadership team (CEO, COO, CFO, Etc) regarding a serious security flaw we found in our network, and our recommended course of action to rectify it.  I believe her exact words at the time were “good work!”.    This also comes a few hours after a meeting in which one of the department heads mentioned having worked with me to resolve security issues,   and another one begging people to stop acting like “junior security analyst” and ask the security staff for answers instead.  

As I’m sure you’ve noticed, I haven’t really talked much about my job and what I do.    There are a few reasons for that,  the biggest one being that I don’t want an issue to come up because of something I blogged about.  

Mr IT Director made me promise I wouldn’t get mad, and showed me the email he received.    I kept my promise – I didn’t get mad.    I did get profoundly sad, though.   I work hard, and so it saddens me to know that the work I do is overlooked and under-appreciated.