Be comfortable not knowing things and delegating, don’t report to the CIO (bcuz usual conflict of interest stuff), invest in people (training, career progression stuff), don’t follow the industry herd (i.e. salivate over AI just because every other E-level type is). I’m an IC, always have been, so there’s a lot im sure I don’t know in terms of effective management among managers but from my perspective this is what I would perceive as efficacy and proficiency at that level. That and Ill throw in that traditional ways of measuring “success” or output rarely applies to infosec teams. It’s hard to measure “how secure are we” or “how many things did we block this month”.

Not really actively doin’ any certs or training. But have been learning a bit more about threat modeling recently 🤷‍♂️

Working on all manner of stuff for my site, trying to figure out how to SAFELY eradicate poison ivy in my back yard, and working on some work-stuff related to AI, Recall, and other general assessment/testing stuff.