Cybersecurity Mentors Podcast
In this podcast we discuss mentoring in cybersecurity, information for those that are looking to get into cybersecurity, and tips for those that are looking to advance their careers.
Cybersecurity Mentors Podcast
Interview with Grant Adams: How Picking Locks Opened the Door to a Cybersecurity Career
In this episode of the Cybersecurity Mentors Podcast, Grant Adams returns to share his journey over the past year, focusing on his job search experience, the importance of networking, and insights from his interview process. One highlight of his story is how a conversation at a lock-picking table during an in-person conference led directly to his current role.
Grant also discusses the skills he developed, how AI is being integrated into cybersecurity practices, and personal updates such as his recent engagement. He emphasizes the value of work-life balance, soft skills, and building authentic connections in the cybersecurity field.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Grant Adams LinkedIn: https://www.linkedin.com/in/grantadams3/
Check out our Networking is King Course: How to Build a Career Through Real Connections
I started picking locks and I got lucky and popped two of them open and then I ended up popping this really hard master lock and the guy was like no way you got that in like 30 seconds. Another team was working on it for like two hours and I was like beginner's luck, I guess.
Steve:First learn stand, then learn fly. Nature ruled on your son, not the mind.
Grant:I know what you're trying to do. I'm trying to free your mind, neo, but I can only show you the door. You're the one that has to walk through it.
John:What is the most?
Steve:inspiring thing I ever said to you don't be an idiot changed my life. Welcome back to the cyber security mentors podcast. Today's guest is someone you might remember, grant adams. Last year he joined us for a live coaching session. It was actually the first coaching session we did where we kind of just talked about his background, kind of where he was in his journey. We gave a little bit of advice, reviewed his resume and just talked about strategy and just mindset overall. So that was a huge, huge episode for us. And now he's back after a year just catching up, trying to tell us how it is out there and kind of what he went through the good, the bad, the ugly. So welcome, grant.
Grant:Thank you, guys for having me back on the show. Yeah, did you have the beard and the long hair. Last time we spoke, I think I was working on it, but no, it's been a long time coming.
Steve:I like it I like it.
John:Yeah, that's good. No, it's good to see you, grant, and we've been keeping up with you and pinging you on Discord hey, how's it going? What's going on. So it's been cool to see that progression and finally get an, get an interview and then um, and then talk through that. So I think it was to start. There is, if you can remember you know it's been a year or so um, you know that interview process that you went through. Maybe you went through several uh to try to finally land this position. How did that? How did that go for you?
Grant:how did that? How did that go for you? Yeah, so the uh, the process of actually getting an interview took a while. The job industry seems kind of tough right now and I was applying for lots and lots of jobs. Um, and the way I actually found this job opportunity was kind of interesting, because I had been applying to jobs online through like Indeed and LinkedIn and just wasn't getting any replies at all. So I decided to go to like an in-person security conference. So I found B-Sides Portland and I knew you guys would love this.
Grant:I know this was advice, you used to give me a lot, that's right.
Steve:For the listeners. This was not planned.
John:This, literally, is we didn't even know he was going to say this.
Grant:No.
John:Yes.
Grant:Yeah. So I ended up going to B-Sides Portland with the intention of trying to connect with people, meet people, rub elbows, and ended up meeting a guy there who worked for NetSpy, the company I'm working for now, and he told me that they were hiring and showed me the application form and it was kind of a hidden application. You know, it wasn't on LinkedIn, it wasn't on Indeed or anything like that'd kind of just posted it on their own site and so if he I'd never met that guy, I never would have found it. But um, I know it's hilarious, let me pause you right here.
John:Okay, this is exactly what we were talking about with our. Networking is king, always be networking well, yeah. I think people are gonna think we paid you money to talk about this, but we, literally, this is what we just talked about, this course we made yeah advertising it now but you are advertising the exact stuff that we talked about, like hidden jobs.
Grant:So yeah, I didn't give you. I'm not paying you, but I might need to send you something I mean, you guys know your stuff and uh, um, yeah, it's true, I think, um, I knew you guys would love this story yes, so I was excited to tell you, guys, but um yeah, you had the hidden job, you didn't.
John:It was out there. Hey, check this out. Like, how did that conversation go?
Grant:yeah, it was interesting because um b-size was a two-day event and the first day I was meeting people but it wasn't really going as planned. I you know, I was having interactions but not really finding any opportunities that I was hoping for. And then on the second day I was participating in the CTF event. That was going on too, and I just happened to go by the physical security table lock picking and started picking some locks. You might remember me, carson and Zach got into that a little bit in college.
Grant:So, yeah, I started picking locks and I got lucky and popped two of them open and then I ended up popping this really hard master lock and the guy was like no way you got that in like 30 seconds. Another team was working on it for like two hours and I was like beginner's luck, I guess.
Grant:So yeah, then we just started chatting after that and he told me he worked at NetSpy and yeah, and then it just came up naturally from there. So you know, it was partly being open to chatting to people and trying to make connections, but then there's always just luck and chance. I think that plays into it?
John:Yeah, no, for sure, absolutely.
Steve:You give off that vibe, man, If you go into some. This is just in life. You go into a situation and you're open, and you're just open for opportunity, just open for whatever comes your way. Like that's just some sort of vibe you're giving out.
John:People read that Absolutely think, um, man, there's, there's a lot of good things here just picking locks like who?
Grant:knew picking locks would get you an opportunity to meet somebody right? I love that. Yeah, I love it yeah, that is great.
John:Um, and just being open to to have those conversations, uh, you know how long did it take you to tell him that you were famous, that you were on a famous podcast, and then that, then that's really what came up, and you're like let me show you my episode.
Grant:Does he even know?
John:you've been on this podcast.
Grant:I didn't have to bring out the clout.
John:Dang. Okay, I thought maybe that was like you had it set and then we just liked it over the wire.
Grant:No, your advice got me in the right position okay okay, it was just luck from there all right.
John:No, no, not luck. I mean, you know you you went in there with intention, you know, and you you had a plan. So it was luck that you happened to be there at the right time, right place. But you know, you worked it out too. So, yeah, great, great job.
Steve:That's awesome. So did you make any other connections while you were there or did you? What were some of the maybe some, maybe additional connections or things you took away from, you know, going to a conference, to network and, just you know, grow in your professional career?
Grant:Yeah, that's the interesting part for me is I kind of felt like I was striking out a little bit up until that point and that was like the very last, like 10 minutes of the last day. You know, I had met people and we were chatting and it was nice, but most of them were people, younger people, looking for jobs as well or just interested in cybersecurity and attending the conference out of curiosity. So good people to you know, nice people, good people to chat with, but they're not going to offer me a job, kind of thing.
Steve:Yeah absolutely.
Grant:Yeah.
John:No, that's. That's good, though you know, you never know. You never know who could be a good connection or a link in the chain and you may be able to help them right yeah yeah, so it's all good. It's like fishing, you know. Sometimes you catch one, sometimes it's just hey, we'll put that one back, no big deal. But no, that's really cool.
Grant:Uh, thank you for sharing that story yeah, and so that was just, you know, leading up to getting the interview. You actually asked about the interview process itself, but I wanted to tell you that part.
Grant:Yeah, yeah. And then the interviews were. It was probably the most intense interview process I'd been through. They had an initial call just to chat about things and I guess, kind of check me out, just am I, you know, am I weird, whatever, and that kind of thing, and they asked me some really basic technical questions and asked about experience and that kind of stuff. And then after that we scheduled another interview call, and that call and that one was with actual technical employees and they drilled me on more technical questions, trying to see how far they could go and how deep my knowledge was on.
Grant:I think they had seven categories so, and the questions would get progressively harder. And, yeah, they just wanted to see where I was at. And then, after passing that, they sent me a exam through some third party site and it was a timed one hour exam that had logic questions as well as like here is some HTTP request response traffic, what stands out to you in that? And some other more technical questions too. So, yeah, and then after that process, yeah, I think that was the last step and then they offered me the job. Awesome.
John:Yeah, let me ask you about those questions. So how did you feel? I don't know if they graded you, if you knew what your score was, um, if you did, but how did you feel about, you know, with your confidence level in answering this, those questions?
Grant:yeah, I um. They told us ahead of time that it was going to be hard for both of the technical parts. They said they wanted to push us and see the limits of our knowledge and especially for the timed one, they told us we wouldn't have enough time. They wanted to put us under a time crunch and, even knowing that, it still felt bad and stressful, it was definitely hard and, yeah, I felt like I did a good job, but I wasn't sure I did good enough. Going out of it, did they give?
John:you any feedback after the interview? Or from the questions like hey, here's what we saw from how you answer these questions. Here's what we think you did good, here's what they think you did you know could do better at. Was there any of that? Or is it like, okay, we're moving to the next step?
Grant:Not really any feedback. During the technical interview they did say a couple times throughout the process you know, know, you're doing great, um, you did great on that section, that kind of stuff.
Steve:But no in-depth review of how I did okay, awesome so question, uh kind of when going back a little bit, um, the resume, right, so you found the application you applied To your knowledge. Did that guy that you met at the lock picking section give the hiring manager a heads up or say, hey, I met this guy. He can pick a lock in 30 seconds, like to your knowledge? Do you know if he gave you any sort of Wizard, yeah any sort of nudge in the company, or no?
Grant:I think he said he could try. When we were first chatting he was like yeah, maybe I could put a word in for you. Um, I don't think he ended up like being able to do that. I'm not okay, sure I kind of told him, you know I've applied you know.
Grant:But um, he's. I think he was kind of just there for moral support, which was nice too. He was giving me tips about the process and what was coming and things like that, but he didn't really I don't think he put in a big word, or anything.
Steve:My next question was so the resume. So you were. You said at the beginning you were applying to all of these different companies and just not hearing much back. Did you do anything different with your resume when you applied to this one, or did you kind of use the same format logic that you were using previously?
Grant:I think it was about the same.
Steve:The same.
Grant:Okay, I think partway through the application process I was applying for a while and then I think I sent it to you guys actually, and you guys helped me revise it. And then I kept applying to places, hoping that would help. I got one response from a place, but it was kind of for a general it low level, entry level job, uh, and I felt, felt like I can do better than that with my experience. So, um, I didn't end up going for that, but, yeah, it was. It was tough, even with the good resume. I felt like yeah, it's.
Steve:I mean, and this was, uh, this was last year. Was it kind of middle of the year? Summer was a fall spring.
Grant:It was. It was like August of last year through yeah November.
Steve:Okay, Okay. Yeah, I mean, at times, like you said, at times are tough, things are getting difficult. We're seeing now with just helping people. We're seeing people that are very qualified, they have very, very solid resumes and it's just just, it's crazy out there. It's very, very tough right now. But anyway, yeah, I was just curious if how the whole resume thing and how everything worked out. But that's awesome, man.
Grant:I'm really happy for you.
Steve:So, are you able to tell us a little bit about kind of what you do, kind of what your job is and kind of what you do?
Grant:Yeah, I think not super specific, but I can tell you just the generals of what I do. Yeah, so right now I'm an associate security consultant. For the first six months they have us go through a training process where we learn about the basics of web vulnerabilities, and then we have some internal applications that we spend weeks testing against. So each week we get a new application, we test it for a couple days, then we write up a report on our findings and we present that report to our coach, kind of like a mock client presentation, and so we go through that week after week and then the third part of the program is the one I'm in now where we're actually testing client applications but there's a primary tester as well and we're kind of not competing. But they're comparing us with the primary tester just to see how we're doing, if there's anything that we're missing consistently or if we're doing well. That kind of thing.
Steve:So this is more offensive security focus.
Grant:Yeah, so a security consultant is my official title, but we're pen testers for web applications specifically.
John:Got it. Yeah, awesome, yeah. So one question I had kind of sorry to back up a little bit on this maybe what skills you think helped you through the interview, through the questions that you know you went through? What do you think were beneficial from your previous experience or any training or learning that you did that you that may have helped you edge out the competition or, you know, get in to officially land the job? Is there anything that stands out like skill set that you man? This probably was more. You know one or two things that may have helped.
Grant:Yeah, I think it was pretty wide ranging the questions they asked, and so I felt like I was able to pull from experience everywhere. Like I was able to pull from experience everywhere my experience with you guys, as well as what I had learned studying for the Security Plus and the Network Plus and then what I've been doing on my own, like the TryHackMe courses and Hack the Box, because they asked about vulnerabilities. They asked about Linux commands. They asked about Linux commands, they asked about Windows commands, network traffic, all kinds of things.
John:Okay, yeah, that's good to know and I was thinking about was there because this was for web app security, pen test type role, how much content in that was around web app security how much content in that was around web app security.
Grant:Yeah, I'd say maybe about 50-50 or maybe slightly higher, maybe 60-40, 60% being web application focused. I think they weren't super concerned with how deep our web application knowledge went because they knew they'd be training us up on that once we got hired. But they kind of just wanted to get a sense for our general technical knowledge and so, yeah, it was good to know. It's interesting that they asked about Linux commands and Windows commands and networking things when we really haven't dealt with that at all Now that I'm hired with them.
John:So, yeah, and did you know you were interviewing for a web app pen test position? Or was it like a hey, whatever you know, they'll, they'll put me where they need me. Did you know what? How specific it was?
Grant:Yeah, I knew it was going to be web application pen testing.
John:Okay, great, awesome.
John:And this last comment I'll say on just the whole, back to the interview piece. I think just you know. Number one you found out about an application that you wouldn't have known about. We talked about that. So, even if even the fact that it was hidden quote, unquote that lowers, potentially lowered the pool of applicants, so it helps you stand out better versus a hundred different people, right? So that's that's awesome too, even if he didn't put in a good word necessarily, but the fact that you met him and then, hey, guess what? There's a position. Then you probably were in a much smaller pool than you would typically would have been if it was on LinkedIn, right?
John:Um, I just read this whole wall street journal article about this, like people applying for jobs, and how many of those are through bots, that people are using AI to apply for jobs, and so as a hiring manager, you get a hundred people and then you're trying to weed through all that too. So that's awesome too. And then the last thing is just having that. You mentioned that trusted insider, right? So even though he's not interviewing you, he wasn't the hiring manager. How much better does it help knowing what the process is? Okay, this is how it's going to go. What's the next step? What's the next step? Right, Summing that inside information because of the connection you made right, quote always be networking, end quote. Um, but yeah, I mean that, those kind of things I mean that's, that's awesome.
Grant:Right, you still had to perform, you still had to do the technical pieces of it, but just some of those things I was thinking about, um, some of those things I was thinking about in my head about this topic, yeah, and a strategy I kind of landed on after applying for a lot of remote jobs. I just realized the pool was too big on those. I could see on LinkedIn how many applicants and it's thousands.
Grant:So I just quit wasting my time on that. I thought total waste of time. I just quit wasting my time on that. I thought total waste of time. And I was only looking for local jobs. And I think that was another advantage with this one is that they wanted people that could come into the office and eventually we can go remote, but they definitely want us in the office for the first six months. So that gave me an advantage over, because there's less people that can apply.
John:Sure, yeah, absolutely From your cohort, your group. I don't know how many was in that group or the group you're in now. Well, how many was that? A dozen? Okay, from the dozen? How were your experience and skill sets Just curious, like comparison about the same, where people that were higher or lower or more lower, I mean, I don't know, I think my skill set was actually near the high end.
Grant:A lot of the people here were transitioning from other careers or didn't have security experience. So, yeah, I think it was rare that I had experience in security.
John:Gotcha, did they weed anybody out? I'm curious.
Steve:it's like hungry games so you started with a dozen. There's still a dozen, yeah it's a good question.
Grant:Actually, our class everyone has survived up until this point, but the cohort ahead of us, um, one person did get cut and people have been cut from previous cohorts for sure, um, for various reasons, some sometimes people try and cheat and that obviously gets them cut. But the guy in the cohort again above us, um, he got cut because he couldn't do well in the client readouts. He just really struggled under the pressure of presenting and talking to people so you're saying communication is important I knew you, yeah, yeah definitely how how has that been for you just?
John:as you, because you're like you said you're presenting to. You know, not the quote-unquote real client, but you still have to present. Does everybody in that cohort present in front of each other or, like you, just to the the the lead?
Grant:Just yeah, just to the coach and our mentor.
John:Gotcha.
Grant:Yeah, yeah.
John:Then do they give you feedback.
Grant:They do.
John:Yeah.
Grant:It's it's been a lot of feedback over the past couple of months. It's um yeah, it's been a lot and it's great. I think I've learned a lot about how to present and, for example, I went into my first readout and the guy said you're using too many likes and ums, you're talking too fast, all these things. So, yeah, it's been good. I've learned a lot.
John:Good, no, really cool.
Steve:Does it remind you of like taking speech, like public speaking class in college?
Grant:Definitely yeah, but with like an added edge where you're talking to a client and they warn us ahead of time that clients will try to like get findings downgraded or removed, and so they're almost hostile to us during the practice readouts. Just to see how we stand up to that pressure and to be able to stand our ground and like justify findings and to manage and navigate those difficult situations.
John:Oh yeah, really good.
Steve:Yeah, I mean that's true, that's real life. I mean I know John's got some stories of doing some work for other companies and them trying to downplay a finding. I mean even for us, like in an organization, right, like if we're getting audited or whatever, um, we want to make sure that, hey, if you're going to dock us on something, make sure it's legit and not just you, because you're on, you're not knowledgeable enough to fully understand the problem. You're just going to assume, oh yeah, it's, it's bigger than it really is. But no, I think that's good, it's good training.
Grant:Yeah, for sure, cool. So how long do you have left in this phase? Yeah, it just depends if I pass or not. So this might be my last week of the training program. I'm doing my final evaluation and if I do a good job then I'll graduate, essentially, nice yeah, we have full confidence, you're gonna kill it.
John:Yeah, you got it, thank you. Thank you, um, and is that final, if you can say, is it like a final presentation based off a bigger scope or scale, or something like that?
Grant:It's just another client application and we've been doing client applications for a couple weeks, but they're slowly weaning away the support they give us and they expect us to do better each week and ask less questions, basically. So, yeah, just another application.
John:Pen test nice, interesting, very cool. On the technical skill side, have you taken like classes or they taught classes on? You know, but doing web app pen testing, has it just been on the job? Like hey, we're going to start you at the small footprint of an application and then now we're going to gradually move you up and give you feedback, like how have you gotten better at your skills?
Grant:Yeah, so, like I said, the first part was solely just learning concepts Learning what SQL injection is and cross-site scripting, and they took us pretty deep. We were learning a lot of HTTP headers and cookie directives and all these kinds of things, and that took about two months. And then after that we were assessed on vulnerable applications you know the ones out there like juice shop and those kinds of things. So, yeah, we started with smaller, more vulnerable apps and then, I think, traditionally when you get into the client applications, they're a lot bigger and more secure. So, yeah, it's kind of been a transition from slow and more vulnerable to bigger and less vulnerable.
John:Yeah, makes sense. I'm just curious, like you know hey, you talked about cheating, but I mean, it's like Google, right, you can use Google to figure out things. Are they cool with you guys using AI to help figure out web vulnerability problems and or troubleshooting those problems and looking for ways to you know ways to exploit those vulnerabilities? Or they're like hey, you got to learn the manual way first.
Grant:There was definitely an emphasis on learning things manually at first. But, yeah, ai is a tool just like anything else, just like a search engine, and they want us to use it. If we have questions about things, definitely ask chat, gpt or some AI. They don't want us, obviously, copying and pasting client information into the AI, so sometimes we have to be creative about how we ask questions. But, yeah, ai use is definitely a part of what we're doing and I think the company is trying to find more ways to integrate ai into our workflows and, um, mostly it's not being used to find vulnerabilities, but it's being used to help us write up our vulnerabilities, or that's kind of what they wanted to be at first okay, gotcha cool.
John:No, thank you, I was curious about that. That's good to hear. I think that's a good approach yeah yeah yeah, absolutely.
Steve:Um. So, yeah, how's? How's life? Like taking a step back from just the professionalism, like how's life going for you, man, just catching up yeah, well, like I mentioned before we started recording, I got engaged a month ago which is awesome congratulations yeah, thank you thank you.
Grant:Um, and things are going good. It feels good to have a job and income because before this job I was working at a nursery and a bakery and you just don't make enough money on minimum wage to live really so yeah having the money has been really a relief and, uh, it's allowed me to buy some things like woodworking tools. I've started doing some little woodworking things obviously the beard, the hair and woodworking tools. I've started doing some little woodworking things, obviously the beard, the hair and woodworking.
John:They come together. They all go together and you got a bread in the oven, it's like, look, I got both. Yeah, that's awesome, man, it's great to hear too.
Grant:Thank you. Thank you, yeah, I've just been trying to find a good life balance so far and I think some people can work all day on a computer and then go home and keep working on the computer. They just love it. You know they can't get enough, but it definitely wears me out after a day of pen testing. So I've been making sure I come home, I disconnect, go outside, get some nature, that kind of stuff Can't come home and sit around anymore.
John:Yep, that's great, Great way to do it, for sure. Yeah, it's amazing how draining it can be. You're just sitting there and you're doing stuff. You know just like all day and you're just like man. I've been sitting in a chair most of the day, but I'm exhausted. Yes, yeah.
Grant:I've been sitting in a chair most of the day but I'm exhausted.
Steve:Yes, yeah, yeah, absolutely, that's good. I mean, work-life balance is very important. I think people and the reason why I was asking is because when you are in that mindset of I got to get a job, I need to apply, I need to level up my skills, you're just thinking about the end game, and then you finally get it. Then you're like, okay, now what? So it's good to just kind of like take a step back and just like reevaluate, soak it all in, just make sure your life is where you want it to be, and then you can go after the next goal or after the next adventure, whatever you have. So it's, it's good. Good to hear that from you, man.
Grant:Thank you, yeah, yeah, I was excited to tell you guys how my life has been going and about the engagement for sure.
John:Yeah, and I knew you guys would get a kick out of my long hair.
Steve:And the beard. Yeah, when we jumped on, I was like are we talking cybersecurity? Is he going to tell us he's driving a train?
Grant:Let me tell you what I'm ushering for. I've got some tips for you guys that's funny well, great man um, yeah, any any other.
John:I think we talked about if you had any recommendations or anything like that you want to share any advice?
Grant:yeah, yeah, really, I've already said it all, but, in summary, I think you guys are preaching a lot of good stuff and the in-person connections are really important. I think they're more and more important. At least from my experience, it seems are really important. If you want to be a pen tester, you have to present your findings to clients, so you have to be able to talk to people, hold your ground, navigate those difficult situations, all those kinds of things yeah, awesome, I couldn't, I couldn't have said it better good job, yeah, seriously it's.
Steve:It's so cool to so, for if y'all listening, this is the first time listening we I met grant in 2017 2017 yeah I was applying for a job with john. John was putting me through his mini gauntlet at the time and I was assigned one helper and that one helper was grant as a student. He was a student intern and he sat next to me while I was going through this, like challenge, that, like through splunk, that john put me through and, uh, I remember that grant.
John:I remember that. Yeah, grant, you had your chance. You could.
Grant:You could be like this dude is I know my one time I had power over steve. If I could go back, you don't know what I would do, yeah, I'm sure I was like, well, grant what, what did you?
John:what did you think? What'd you think? Yeah, I'm sure you were like, oh, he was good you, he worked with me and he talked to me and you know all that good stuff yeah.
Steve:No, but it's crazy to think back then and now, man, it is crazy. I'm glad we're still stay in touch and connect and glad to hear things are going well for you. And congratulations again on the engagement, man, that's exciting, and I'll be waiting for a wedding invite. That's all I'm saying.
John:Okay, if we do a wedding, call it, you know yeah, you could be like somebody else we discuss and, just like you know, go to the the office and just make it happen. Yeah, um, no, thank you. Thanks so much for coming back on. We'll definitely, you know. We know we're going to stay in touch. Yeah, if you ever need anything, you know, feel free to reach out and let us know.
Grant:Definitely Well. Thank you, guys for having me again. It was awesome to talk with you.
John:Yeah thanks, grant, all right, see you guys later.
Steve:We'll see you. Thank you for tuning in to today's episode of the Cybersecurity Mentors Podcast.
John:Remember to subscribe to our podcast on your favorite platform so you get all the episodes. Join us next time as we continue to unlock the secrets of cybersecurity mentorship.
Steve:Do you have questions or topics you'd like us to cover, or do you want to share your journey? Join us on Discord at Cybersecurity Mentors Podcast, and follow us on LinkedIn. We'd love to hear from you. Until next time. I'm John Hoyt and I'm Steve Higuretta.
John:Thank you for listening.