Hawk & Hack: Finding Your Personal Brand and Cyber Tribe

Army veteran John Stoner shares his resilient path from signals intelligence analyst to cybersecurity leader in this episode of Exit Buddy: Veteran Stories to Guide You. With a decade of Army service—spanning time in Afghanistan, Bagram, Ottawa, and NSA headquarters—John was primed for a return to intelligence work after separating. Instead, repeated inconclusive results on the NSA Full Scope Polygraph exam challenged those plans and sparked a career pivot. He opens up about embracing authenticity through his iconic Mohawk, navigating a volatile cybersecurity job market, and leveraging military-honed skills like briefing under pressure to bring calm to cyber chaos. John also offers candid advice on building support networks, prioritizing mental health, and discovering purpose outside the familiar anchor of a security clearance during the transition to civilian life.

Chapters

• 01:16 Stories from John's Army SIGINT Career
• 02:48 The Polygraph Process and Career Pivot
• 04:56 Advice for Veterans Tied to Military Identity
• 07:04 Embracing the Mohawk and Authentic Self
• 09:54 The Evolution of John's Personal Brand
• 12:06 Discovering Passion in Community
• 15:11 Finding Your Tribe and Support Networks
• 19:15 Turning Military Skills into Cyber Strategy
• 23:25 Mentorship and Career Pathways

Key Takeaways

• Embrace Being Flexible: Tough job market? Channel "Semper Gumby"—stay open to small companies and commercial gigs. Your identity's bigger than your MOS or security clearance.
• Authenticity > Conformity: Rock your vibe (Mohawk or otherwise). Find a workplace or community that supports your authentic self.
• Prioritize Mental Health: Therapy isn't a last resort—and your spouse and family are not your therapist. Lean on pros to unpack the load.
• Find Your People: Swap Reddit rabbit holes for one-on-one mentors and community. Join cyber tribes like VetSec, BSides, or the Diana Initiative to build support mechanisms outside of your job.
• Fulfillment Hack: True passion can be found in the side quests—not just your 9-to-5.

Follow us for more veteran stories to guide your transition journey, and text this episode to a fellow service member who’s navigating their exit. Until next time, stay flexible and keep forging ahead!

Visit us at https://exitbuddy.buzzsprout.com to learn more about the show.

Have feedback or questions for us? Email us at ashleyjones.creative@gmail.com.

Transcript

Kathleen Smith 00:20 Hello, my wonderful listeners, and welcome back to another episode of Exit Buddy: Veteran Stories to Guide You. This is Kathleen, and we're glad you're with us this morning, this afternoon, this evening—no matter when you're listening to it. I'm glad also to have my longtime friend and compatriot and supporter of the military community, Rachel. How are you doing today?

Rachel Bozeman 00:45 With an introduction like that, I couldn't get much better.
So excited to be here and so excited to get to meet a new friend and hear some
new stories. So Kathleen, what stories are we going to hear today?

Kathleen Smith 00:57 I am so excited. We're joined by John Stoner, a 10-year
Army veteran who's carved out a path from signals intelligence to
cybersecurity, complete with his standout Mohawk, which I always love seeing.
John, welcome to the show.

John Stoner 01:13 Hi, Kathleen. Hi, Rachel. I'm really happy to be here.

Rachel Bozeman 01:16 Awesome. Well, as Kathleen mentioned, you started your
career in the Army, especially in signals intelligence. So this is a podcast
all about stories, and we would love to hear some stories from that time. Take
us back in time. Tell us maybe some challenges, successes, or just something—a
real, vivid memory—from the time that you spent in the Army.

John Stoner 01:37 Yeah, there's definitely a couple of great choices to
choose from. When I was still a SIGINT or signals intelligence analyst in the
Army, one of the really interesting things about my career is I got to serve
with the Canadian Armed Forces out of Ottawa as my last duty station. And that
was actually a by-name request from the director of NSA to go up there and fill
this new slot. The Army didn't have any folks up there, so there was a handful
of U.S. Naval folks. Those positions had been established since the end of
World War Two. So it was just a very unique experience to go up there and do a
lot of really important work that was still supporting Operation Enduring
Freedom, so the war in Afghanistan during that time. Ottawa was amazing. Not
sure. I love the 12 feet of snow the first winter we got. The pictures are
pretty incredible from that time period. And apparently at negative 40 Celsius
and Fahrenheit are the same, which is a great fact. I'm not sure you want to
live through that. So that was one of the really cool things that I got to do.
I also served in Afghanistan and Bagram. There are so many stories. One of the
other really great ones is being able to navigate through NSA, through the
basement. And once you have that figured out, you kind of like made it. Then
you can avoid some of the crowds in the hallways.

Kathleen Smith 02:48 Amazingness, John. You were so great in your pre-call, and
you mentioned that you thought you were going to go work at the NSA to continue
supporting the SIGINT mission after the military. But that best-laid plans
don't necessarily happen. So tell us how things took a turn and how you had to
pivot.

John Stoner 03:08 Yeah, I'm actually pretty happy to talk about the
situation, because I know that it does occur not infrequently. So when you are
active-duty military, you're only required to take the counterintelligence, the
CI polygraph, in order to work these positions within the national intelligence
structure. So when I got out, you have to go take the NSA full-scope polygraph.
So I assumed that I would go right back into SIGINT and continue supporting the
mission, having worked at NSA headquarters and NSA affiliates. But what I
learned was, apparently NSA full-scope polygraph and I, we just don't agree. We
just don't get along. So there was a period of about two or three years where I
attempted to take the full-scope polygraph six times total: two times as a
contractor, two times as a tentative civilian hire, and then two more times as
another contractor. And you're taking like the whole day off work. You're
tentatively accepting positions while maintaining another job. So it's very
stressful. And after the sixth time, they told me that it was still
inconclusive. And they said, "Well, what are you going to do next?"
And I said, "Well, I'm not coming back. This is the sixth time, guys.
Like, I love the mission. Good luck to you. But this obviously isn't going to
work out." And that was really a big transition point. So not only was I
transitioning from active duty to the civilian world at that same time, it was
pretty clear to me that my path forward for the rest of my career would
probably change pretty dramatically. So even though a lot of my career has been
supporting the intelligence community and the military since then, it has not
been directly at NSA, and I still hold a TS clearance. I've held a TS/SCI
clearance for a long time, but that inability to get around the NSA full-scope
really sort of changed the trajectory for the rest of my career.

Kathleen Smith 04:56 It's interesting, because not a lot of people can share
that story, and I really applaud you for showcasing that. So it sounds like you
had to explore things beyond your comfort zone during your transition. And
having your clearance as a big part of your identity is also part of your
comfort zone. So what advice would you give to veterans who feel that they're
really tied to their military identity, and they're really hesitant to go and
explore new pathways?

John Stoner 05:27 That's a really good question, and the answer is pretty
complicated. And I think it's further complicated by the cybersecurity job
market at the moment as well, which is not fantastic. So I have done a couple
of SkillBridge mentorships lately, and Hiring Our Heroes calls as well. And my
advice to veterans who are transitioning right now is you need to be open to
possibilities. The motto right now for your career transition is Semper Gumby.
Embrace being flexible. The job market is not fantastic overall, and it's not
fantastic in cybersecurity, so don't be afraid to take positions at smaller
companies than maybe you thought you would, or in strict commercial civilian
work. Your identity is not your clearance and the mission. And a lot of us
really feel that coming from the military. We really feel like, well, I'm a
cleared veteran. I supported national intelligence missions. And that doesn't
mean you couldn't go back into that line of work either. There's a lot of folks
I know who cross back and forth. I think the civilian world experience can be
really valuable to come back in. And I think sometimes having that mission
focus can be really important going into the commercial world as well. Your
definition of who you are is really more than just your clearance level and
which rank you got out at, and which branch you supported. And that'll probably
lead us into a lot of other questions around support during the transition as
well.

Kathleen Smith 06:51 Yeah, it's hard, because you have to sometimes break out of
your identity. And I think I'm gonna let Rachel talk a little bit more about
the identity that you created for yourself.

Rachel Bozeman 07:04 So can we just talk about the Mohawk for a second? It is
such a bold part of your identity. When did you start rocking it? And what was
it like to embrace that side of yourself after years of having that, shall we
say, more structured military haircut?

John Stoner 07:22 Sure, yeah, I'm happy to talk about this. So obviously, in
the military, everybody's conforming to the grooming standards. And then I got
out in 2010 and kind of conformed to East Coast consulting standards. I had
worked at Booz Allen a couple of times. I was a federal employee, and then
COVID happened. And I was a federal employee during COVID at the DoD Cyber
Crime Center. And it was really at that time where I said, "Well, I'm not
even going to the office right now." We went fully remote, or mostly fully
remote. Some of us would go in to access classified systems. I said, "I'm
going to try to grow this Mohawk." And I also got my ears pierced. And I
decided eventually that trying to be more comfortable with who I wanted to be in
the workplace all the time and not sort of have like a work persona and another
persona, and I just wanted to be myself, was more important than conforming. So
eventually it really became part of my brand. I mean, it's really the style,
it's the vibe, it's the brand. People recognize me at conferences because I
have the Mohawk and this particular look. But there's obviously some downsides
to this as well. I mean, we still encounter clients and other people who do not
like an alternative look. This has affected not only me directly. It's affected
people I know who want to have different colored hair or just have sort of like
an alternate, non-conforming, non-standard East Coast consulting vibe. But I
think part of transitioning out from being the veteran and trying to navigate
your career in your life is you need to be comfortable with who you are. I
think it's much easier to be fully authentic and bring my authentic self to
work, and try to find a workplace and communities that support me in who I am.
And that's why the Diana Initiative has been really important to me, and try to
support them and other veterans communities. And at Google now, I'm very well
supported with my leadership and my friends and colleagues at Google as well.
And to some extent, the Mohawk and the look has really become sort of a
signature, sort of like a calling card as well. But there's going to be some
limitations, because some people don't appreciate that look. So you do have to
think about that. I think early transitioning veterans probably don't think
about this a ton, but at some point in time, like you will want to make some
decisions about how you are perceived at work, what you're putting on the
socials, on LinkedIn, and also what you're comfortable with and how you want to
go through life with whatever you decide to be.

Kathleen Smith 09:54 You mentioned sort of when it happened, but was there some
catharsis? Was there some, "Hey, I really want to do this"? Was it
dramatic? Was it something that was gradual? Or was this something, because
we're going to talk a little bit more about your involvement with DEF CON and
Black Hat and Diana Initiative and BSides and all of that, was this just
something that you felt that you wanted to be part of that community and really
adopt that persona?

John Stoner 10:22 Yeah, that's a great question, and I think it's a
multi-layered answer. I remember the first time I was voluntold to submit to
BSides Northern Virginia, and I got accepted to present the first time in a
conference. And I was like, "Oh my God, there's all these people doing
threat intel outside of a secure facility. This is amazing." And that was
my first realization of how big the cybersecurity community was beyond the DoD
or the intelligence community as well. So I started to meet a lot of people
within that community. I remember seeing someone going into the…at Fort Meade
who had a huge Mohawk at one point. And I thought that was pretty interesting
to see on the Fort Meade campus. And then the more I got involved with other
groups, it was pretty clear to me that there was room to be your authentic
person and bring your full authentic personality into the workforce, obviously,
in a professional manner. But I don't know if there was like one singular
thing. What I do remember is, at one point, I guess this is pretty important,
at one point, I shaved the Mohawk off. I wasn't sure I was going to be able to
keep it, and I went to soccer practice, and one of the kids had been wanting to
come see my Mohawk, and I had shaved it off, and this little kid was so
disappointed that I didn't have the Mohawk, and I pretty much had known the day
after I shaved it off that it was going to come back. And so like it was a
pretty big realization that that was the wrong decision to go back. And I do
want the Mohawk, and I've kind of embraced it. But yeah, I guess at this point
it's a little bit like my calling card. And you still don't see a lot of people
in sort of like federal or SLED or the intel that really have sort of a
non-conforming image. It's still pretty rare. So I am also quite comfortable in
my career at this point to just move ahead with who I am.

Rachel Bozeman 12:06 I love it, and I love any conversation that revolves around
hair. So this has been fantastic all the way around. So just to take it a layer
deeper, so we talked a little bit about just that authentic self. And after
leaving the Army, I'm sure you took many different paths, things to try to find
joy—different roles, different color Mohawks, if you will. But do you recall a
moment when you realized, kind of that light bulb went off, that said,
"This is my true passion, and this is what I was meant to do"?

John Stoner 12:36 Yeah, that's a pretty interesting question as well, because
I think the world has changed quite a lot from the '80s or '90s, where a lot of
people really identified with where they worked. They were going to work at
that company for a really long time. There was a retirement plan, and if
somebody worked at one of the big defense industrial base companies, they were
probably going to stay there for a long time. I think that's really
dramatically changed. I have changed jobs every two and a half to three and a
half years since I've got out. I have been at Booz Allen three times. I'm a
two-time comeback kid at that organization, but I've been a government civilian
as well. And now I'm at one of the big FAN companies. And what I tell people is
like, your connecting who you are is not necessarily where you work, and it's
sort of more like your job, your career stability, your brand, your presence.
If you're managing all of that and doing really good work, you're going to
build the reputation as well. So in this age of contracts ending and people
getting lack-of-work letters and RTOs and layoffs and restructuring, the
reality is, it's unlikely people nowadays are going to work 10 years at the
same company for a really long time. I think we're really starting to see the
end of that. So a lot of this is all tied up in amongst all of the realities we
face right now in cybersecurity and with being a veteran that has transitioned
out, whether you served a short period of time or whether you retired. So I
think like the supporting communities, whether it's an online community, an
in-person community, the Legion—I'm the vice chairman of VetSec—there are
cybersecurity-focused communities that aren't focused on veterans, that a lot
of people could join. There's women-focused cybersecurity communities for our
women veterans. I think finding your people and your support networks, and it's
kind of hard to find like that definitive "I know who I am," and
really for me, what's interesting is I think I get the most value back of all
the things I do that really aren't work. It's the supporting the local BSides
conferences, or giving a Sky Talks talk, or spending a half an hour to mentor
someone, or taking time to look at a veteran's resume. That's the stuff, I
think, where I really am impactful in supporting other people in the community,
and obviously I try to do a good job at work as well. But sometimes that's just
what—work that's paying the bills and making sure I have healthcare insurance,
and sometimes the real fulfillment is the other things I do around the
community that is actually really important.

Kathleen Smith 15:11 And I think that those are really great things to say,
because I know that when I was still part of BSides Las Vegas, I sort of made
sure we had a transitioning veterans program. And Black Hat has a really great
transitioning veterans program. Many programs do because, I think, and this
isn't a question we talked about before, but I'm going to go in a little bit
deeper, is finding your tribe. You have a tribe in the military, and you sort
of know where you fit in rank, and you know where you fit in at the mess hall,
and you know—going through a process where you have to find it on your own,
rather than it structured and just put on top of you that this is what you
have. So kudos to you for finding that. You know that there are other communities
out there. And I would really urge all of our listeners to follow John on
LinkedIn and see that there are so many local, national, and international
organizations that you can find that same group that will watch your back. So
as you understand, many veterans sort of struggle with not having the same unit
structure that they had in the military. Were there differences in the civilian
workplace that surprised you? And other than the hacker community support
network, what other support networks did you establish?

John Stoner 16:31 Yeah, that's a great question as you try to find the
support networks. And again, I think a little bit as has potentially changed,
because many of us won't be at one particular job or at one company for like a
decade or two decades anymore, so you're going to want to have some support
mechanisms where you do work. I think that's going to be important, whether
it's your official boss or your skip-line manager, other colleagues there. But
you're going to want support mechanisms outside of that as well. So that's
where we talk about all these communities. There's specific veterans-focused
communities. There's veterans-focused communities for cybersecurity, and then
there's cybersecurity-focused communities, not specific for veterans. And there's
many to choose from. And when I talk to people, it's like, you're going to want
to find the people that you just vibe with. So whatever that might be, the Diana
Initiative, your local BSides organization, a different BSides, Black Girls
Hack, Blacks in Cyber, VetSec, Vets in Tech. There's so many different
organizations to choose from. I also am a strong believer in like getting the
therapy that you need. I have a therapist. You're going to want somebody to
talk to. I think that's really important. I think we're trying to do a good job
messaging to break through to veterans that mental health is important. You
should take care of it. There's no issues with having a therapist. It's
actually something we all strongly encourage. Because your family and your
spouse aren't your therapists. Like, if you need a therapist, you should get a
therapist. They're there to support you, but you don't want to unload all of
your problems on the people you care about in your family unit all the time.
And that's where sometimes these online communities can be really helpful, like
you might just have a question. And the other thing is that there's no dumb
questions when you're getting out, like, "Hey, it's casual Friday. I work
at this consulting firm. What do I really wear?" What do I wear to casual
Friday? And that seems like maybe that seems like a dumb question to somebody,
but you're like, "Oh, maybe I shouldn't wear jeans. Maybe they really mean
like pants and a polo. And that's as casual as it gets at this office
setting." And there's other things people have, like, you know, if I have
a remote job, a lot of veterans are terrified of a remote job. It was like,
"You do not have to sit at your computer from 8 a.m. to 5 p.m. and never
leave the computer. That's not how remote works." The whole point of
remote work is it's remote, and there's more flexibility. You just need to get
your work done and generally be available. Like, if you're running out to like
Walgreens or CVS, send someone a note: "Hey, I'll be back in 30 minutes. I
gotta run to the pharmacy." But these are things that if you don't have
some community to ask the questions on, you're probably just like in some weird
Reddit thread and not getting super great help.

Kathleen Smith 19:09 I know about that Reddit. Reddit ain't doing it.

Rachel Bozeman 19:15 Wanted to ask a little bit, so you mentioned about the
cybersecurity. And so I want to dig in a little bit more into that particular
realm of you and all things about you, donor. Let's talk about your
cybersecurity career and experience. How have you been able to turn cyber chaos
into clear, actionable strategy? Have you leveraged maybe some things that you
learned in the military and transitioned those over into the corporate
cybersecurity world?

John Stoner 19:43 Certainly, I used skills from the military as I
transitioned into the cybersecurity realm. The first thing I ended up doing was
being a technical instructor that was sort of during the time where I wasn't
sure if I was going to eventually be able to pass the full-scope polygraph and
go back into a SIGINT role. So I ended up being a technical instructor. But a
lot of that paired up with instructing I had done formally and informally in
the military as well. We do a lot of training of the new soldiers that are
coming in, a lot of SOPs to get them up to speed on how we wanted to do things,
how reports were going to be written. So I had been an instructor before to
some degree, and I had done quite a lot of training in the military, so that helped.
And then from there, I sort of discovered threat intel, cyber threat intel,
which really married up so many of the concepts we take from the intelligence
community already, and then that gets married up with cybersecurity concepts
for threat intel support. And my first real threat intel support job was
actually in a counterintelligence cyber threat support position. So it really
was still very much mission-focused: counterintelligence plus cyber plus cyber
threat intel. And that was also during the time that I discovered cyber threat
intel is like this big commercial thing that happens outside of secure
facilities, which I was pretty excited to learn. And how you're bringing order
to all of this probably, to a large extent, depends on your modus operandi, how
you operate. I'm an INTJ. I'm very organized, and I like to make lists, and I
like to have plans, but you have to be flexible with some of this. When I got
to the DoD Cyber Crime Center as a civilian, I was pretty quickly chief of
analytics, and then eventually a deputy director. And one of the things is try
to bring calm to an organization. There's always chaos in cybersecurity.
There's always going to be a bad day, there's always going to be a new
zero-day, some sort of new exploit that the adversaries are taking advantage
of. A lot of it is also trying to explain things up to much more senior, much
less technical people. That is a skill that many of us do have from the
military. If we were briefing senior officials or senior officers, I once sort
of had to disagree with the Supreme Allied Commander of Europe, which is a
memory that's forged in my brain, so that has served me well to try to explain
things like computer forensics take a long time, so we don't have all the
answers yet—to people in the Pentagon who want answers immediately about a
situation. So there's more than one way, more than one strategy. I also think
one of the things that a lot of military folks bring to the table that I've
talked about pretty extensively is I served during wartime. Every day, I was
supporting troops. For seven years, I was supporting troops on the battlefield
in Afghanistan, and people were dying, and that is just rarely the case in most
cybersecurity situations. I won't say ever—there have been some catastrophic
ransomware attacks in the healthcare sector—but most of the time, people get
very excited about the cyber situation is unfolding like a Microsoft Office
zero-day, and it is not life and death. And most of the time, I think sometimes
the veterans that are in these organizations can help sort of bring that to a
more calm level, because we have been in life-and-death situations, and that is
not what is happening right now, whereas many people in those situations, that
is the most significant event that they have ever been a part of. So that's
another really good aspect, I think, where veterans can come into technical
leadership roles and help calm things down when there's a situation.

Kathleen Smith 23:25 Yes, that's a very good point. So you've done a lot of
mentoring, and with all of the experience that you have, if you were to talk to
a young John Stoner, what would you tell them?

John Stoner 23:40 I think one of the things that I wish I would have had a
little bit more is a better support network when I was transitioning, which is
one of the reasons I try to give back as much as I do now, because I didn't
really have that as much as I maybe thought I did when I was transitioning out
around both the job situation and sort of like getting your VA disability
claims in and getting some support with all of that. So finding your support
mechanisms is really critical at work and outside of the workplace. I don't
know, it's kind of hard to go back and be like, "Oh, I wish I would have
done X, Y, or Z." I have managed to, I think, forge a pretty decent career
so far, and career paths aren't linear. So that's one of the things. I think
even I thought back in the day when I was getting out like we're all used to
checklists and SOPs and step one, step two, step three. That's very much how
the military works, and that is not how really cybersecurity careers work at
all for the most part. This is still a really new field. It's not like medicine
or law or philosophy. I know CISOs that have MBAs, and I know CISOs that don't
have a degree, and you can forge your own path, and there's not going to be
like, "I have to get this certification and this degree and this training
and then this type of job." And we get a lot—I hear a lot of people being
mentored of like, "You should go work help desk," or "You need
to get a SOC tier-one job, and that's the only way." And I don't know
anybody that has like a similar playbook to my career path, and everybody I
know has a unique career path. So in this field, career paths are very unique.
So I guess one of the things I would tell myself is perhaps having a better
one-on-one mentor earlier in my career would have let me see that, as opposed
to sort of like some general advice that gets thrown around on the socials and
on LinkedIn, which isn't really tailored. And that's the most important thing
is when you're getting out is, are you in some kind of a program where you have
a one-on-one mentor to ask some of these questions, who's walked through some
of these steps before? And, you know, I used to, like many of us, used to ask
my parents for support, ask my dad for support, but his experience is so
different in the workforce than mine is. I mean, I remember I had the
realization at some point that like I can ask my dad information, and keep them
updated as to what's going on. But I can't explain hacker summer camp to Dad. I
can't explain to Mom and Dad like what's happening at Black Hat and the Diana
Initiative and BSides and Sky Talks and DEF CON. There's just no frame of
reference for like how important it is to be part of that community. Because
Mom will always be like, "Was it for work?" She's like, "Is it
for work, John?" I was like, "Yes, but no, but yes—like, it is work,
but it's not, but it's networking, but there'll be some parties." So
having that one-on-one mentorship with someone in the industry, preferably a
veteran, will help you during your transition quite a lot.

Kathleen Smith 26:37 John, this has been wonderful. Thank you so much for
sharing your story, sharing your advice, and I look forward to seeing all the
things that you do on LinkedIn.

John Stoner 26:47 Well, thanks for having me on the podcast. I really
appreciate being here and talking to you and Rachel today.

Rachel Bozeman 26:51 Thank you, John, and thank you, listeners, for tuning in
today. Sharing really is caring. So be sure to share this episode with your
fellow exit buddies. Make sure you also follow the show so you don't miss out
on one single episode. Toodles, see you soon.