Pep Talk: Building the Confidence To Start Writing

Starting Comfortably Dumb, and taking writing about cybersecurity seriously was one of the most professionally fulfilling decisions I've made in my career to date. It allows me an outsize presence in the industry, as well as allowing me to express myself in a way that I feel is more accessible to people looking to break in, or just to understand what we do a little more.

Though, as many people on LinkedIn will attest, the Internet is a graveyard of half-finished and abandoned blogs, and many more never get started in the first place from lack of confidence.

Here are some tips I've picked up from years of semi-professional writing to help get you the confidence in your abilities to start writing yourself.

---

Cybersecurity and tech in general, have an odd quirk in that they are fields that one can generate their own “work experience”, so to speak. This self-generated work experience (usually in the form of Capture the Flag participation or establishing a home lab) along with some savvy networking can allow someone to generate an outsized presence in the industry relative to their experience level. Demonstrable experience and proficiency is one of the factors that almost every hiring manager out there will have near the top of their list when looking at candidates, and is a key factor when other professionals look to give a referral to someone else for a job. How do you show someone how good you are (or could be, given the chance) when you haven’t had a chance to do the job for real?

One of the best things any young professional or any professional, for that matter, can do to boost their chances of being spotted by recruiters or tipping the scales in their favour at the interview stage is start a blog.

Blogging about what you spend your free time tinkering with, your side project that you’re working on after work, or even just engaging with the cybersecurity/tech news of the week demonstrates several positive traits to any prospective employer, namely:

· A willingness to consistently put in work that has not been specifically asked of you – you’re taking your own time to write up your thoughts and exploits when not being paid to do so, after all.

· You are actively contributing to the wider information security/tech community by contributing your thoughts and documenting your deeds. You might think that what you are doing is pretty small-scale, but it could inspire someone else to do something much bigger down the line. You never know!

· You are demonstrating a capacity for consistent effort applied over time – shown both by the subjects of your posts and the fact that you are consistently posting in the first place. Consistent hard work over time almost always beats raw talent, and a solid chain of posts over time shows that you are able to consistently chip away at a larger goal, in this context establishing a body of work associated with your name.

Blogging is about the lowest-risk, lowest barrier-to-entry method of developing an industry presence and demonstrating one’s technical proficiency outside of work that exists.

---

The First and Highest Hurdle: Mustering the Confidence To Write In The First Place

This is consistently the hurdle that 9/10 prospective bloggers fall down on. Ignoring that voice in the back of your head that says “Why would anyone want to read what I write?” or “What if someone doesn’t like what I write?” and then putting fingers to keyboard for the first time is easily one of the hardest parts of setting up a blog or writing a book etc.

Plenty of people never get over this hurdle, and just…never get started. And that’s a massive shame. It was certainly a persistent thought in the back of my mind before starting Comfortably Dumb – was I qualified enough to start writing about the industry I worked in? Would I get ridiculed for even trying?

I honestly understand why people get so nervous about the idea of putting themselves out there like that – it’s genuinely scary, and I’d be lying if I said I wasn’t a little terrified before hitting “Publish” on my first article. So how did I get over that hurdle and start the ball rolling on my blog?

It was one of those insufferable “motivation” accounts on Instagram that tipped me over into acting for the first time. You know the type, some quotes from a source that’s in the public domain so they don’t have to pay any royalties or ask permission, overlaid on a stock picture of a mountain or a forest.

The quote went something like this:

“We wouldn’t worry so much about what people thought of us if we realised how rarely they actually do think of us.”

When I first looked at it, I had the first reaction of “Ugh, another bulls**t quote”, but then I stopped to think about it properly. They had a good point, despite the trite delivery system!

I was so worried about people thinking that I wasn’t qualified enough to write about the industry, or write in general – but never stopped to think that the people I expected to think that way are too busy being terrified of the same thing themselves.

It really took the pressure off. And it might sound a bit odd but deciding to do a bit of market research and look at other cybersecurity professionals’ blogs before starting up was a good confidence booster too. They were good, interesting, and at times very engaging – but not to the point where I got discouraged. I ended up realizing “these people are good, but not so good that I couldn’t do this too…” – so I did.

I wrote an article (I believe, off the top of my head) about Amazon Web Services and insecure buckets, which was something I had discovered on a penetration test and thought was interesting. I thought that sounded as good a topic as any to start with and planned out my first article. I worked out what information I wanted to put across in the article and what kind of tone I wanted to strike with Comfortably Dumb.

I ended up deciding to concentrate on my strength of writing engaging and interesting content, rather than going for being the most out-and-out technically deep and thorough blog out there.

I might not know the most about a given topic - trust me, there is ALWAYS a bigger fish in that particular pond. However, I’ve always been good at explaining technical topics to people who aren’t technical in a way where they actually enjoyed the process. So, that’s the way I decided to write, breaking down complex topics in a way that someone who didn’t work in security could understand what I was on about.

I cannot recommend this enough as a strategy for someone trying to gain the confidence to start off writing. You don’t have to be the only one doing something, just work out what you do well and lean into it to start off. This stops you from starting off on the back foot and in an eternal game of catch-up with people that have unassailable leads on you. So, I’d decided on the way I wanted to write, and I’d decided what I wanted to write about and I’d even produced an article.

---

Impostor Syndrome Incoming in 5.....4.......3.....2....

Eventually you’re going to be where I was, with a finished article in hand and about to hit “Publish”. This is where that last attack on your confidence is about to hit, so be prepared. Your brain will instinctually want to protect you from negative experiences, and a lot of the time this manifests in negative self-talk. If you bring yourself down first, you don’t have to worry about other people doing it, right?. And once you’ve hit the “Publish” button, it’s out there.

What if people don’t like it?

What if people ridicule me for even trying?

These thoughts will hit almost like clockwork before doing something difficult or irreversible and it is imperative that you give these thoughts the proper respect they deserve – which is precisely zero. Just because your inner voice says it, doesn’t make it true. Case in point, I got super drunk once and genuinely forgot Belgium existed. Trust me, it is still there – at least last time I checked!

This is where I suggest you remember the quote I brought up earlier. People aren’t out there judging you, they’re too busy being worried about getting judged themselves. And the people that spend their lives sat at keyboards trashing people, you were never going to win over in the first place.

People like that are not worth listening to anyway. Trolls and angry critics mostly do what they do to assuage their own feelings about their lack of contribution, and it’s usually not about you as a writer or as a person. You’re contributing to the discourse, and they’re not able to do it for whatever reason. I highly recommend that you pull the trigger and share your thoughts and insights with the world!

Some final tips on confidence building:

· I don’t know who said it, but this has stuck with me: Don’t take criticism on board from someone you wouldn’t take advice from. Just like I said before about not everything your inner voice says being true – the same goes for outside criticism, too.

· Everyone’s perspective might not be completely unique and never-seen-before, but it doesn’t need to be. Your experiences are just as valid as anyone else’s.

· Make peace with the fact that your first effort at literally anything you pick up – including writing – will SUCK. Your first draft of a book, your first article - they will all be utter garbage, and that’s the point. Everyone starts out somewhere and everyone must do their time as a “white belt” before they get good at anything. Sooner you start, sooner you’re good.

· Consistent practice and hard work will thrash raw talent on its own every time, and your work ethic and focus are entirely under your control. The gap between you now and where you want to be is yours to close – consistency is king.

---

The above article is a test excerpt from the upcoming sequel to the Cyber Field Manual, the Career Field Manual - all about sharpening your interpersonal "soft skills" to give you a massive edge in your tech career. Let me know what you think and add your own experiences!