Producer Pick: Finding Your Personal Brand and Cyber Tribe

Welcome to this special producer pick edition of Exit Buddy: Veteran Stories to Guide You.

If you missed it the first time around, be sure to listen as Army veteran John Stoner shares his resilient path from signals intelligence analyst to cybersecurity leader. He opens up about embracing authenticity through his iconic mohawk, navigating a volatile cybersecurity job market, and leveraging military-honed skills like briefing under pressure to bring calm to cyber chaos. John also offers candid advice on building support networks, prioritizing mental health, and discovering purpose outside the familiar anchor of a security clearance during the transition to civilian life.

You can find the original show notes and transcript here: https://www.buzzsprout.com/2535619/episodes/17880463-hawk-hack-finding-your-personal-brand-and-cyber-tribe

Follow us for more authentic veteran stories, and don’t forget to share this episode with a service member who’s navigating their exit.

Visit us at https://exitbuddy.buzzsprout.com to learn more about the show.

Have feedback or questions for us? Email us at ashleyjones.creative@gmail.com.

Transcript

SPEAKER_01 0:00

This is Ashley with Exit Buddy and welcome back. Today I'm pulling another one of my favorite episodes from the archives, and I'm digging a little bit deep here, going back to a favorite one from season one for this special producer pick episode. So grab your headphones, settle in. We're gonna roll back the tape on a memorable conversation with Army veteran John Stoner. And if you've ever been to a cybersecurity conference, you might have seen him with his iconic mohawk. Regardless, if you haven't met him before, you're gonna feel like you have. After this episode, he's going to talk you through his journey from signals intelligence to cybersecurity, along with a ton of great info on different themes like authenticity and mental health, and of course the importance of finding your people. So here's John Stoner on Exabuddy.

SPEAKER_03 0:49

This is Kathleen, and we're glad you're with us this morning, this afternoon, this evening, no matter when you're listening to it. I'm glad also to have my longtime friend and compatriot and supporter of the military community. Rachel, how are you doing today?

SPEAKER_02 1:04

Oh, with an introduction like that, I couldn't get much better. So excited to be here and so excited to get to meet a new friend and hear some new stories. So, Kathleen, what stories are we going to hear today?

SPEAKER_03 1:18

I am so excited. We're joined by John Stoner, a 10-year Army veteran who's carved out a path from singles intelligence to cybersecurity, complete with his standout mohawk, which I always love seeing. John, welcome to the show. Hi, Kathleen. Hi, Rachel. I'm really happy to be here. Awesome.

SPEAKER_02 1:36

Well, as Kathleen mentioned, you'd started your career in the Army, especially in the Signals Intelligence. So this is a podcast all about stories, and we would love to hear some stories from that time. Take us back in time. Tell us maybe some challenges, successes, or just something, uh, a real vivid memory from the time that you spent in the Army.

SPEAKER_00 1:58

Yeah, there's definitely a couple of great choices to choose from when I was still a SIGINT or Signals Intelligence analyst in the Army. I mean, one of the really interesting things about my career is I got to serve with the Canadian Armed Forces out of Ottawa as my last duty station. And that was actually a by name request from the director of NSA to go up there and fill this new slot. The army didn't have any folks up there, so there was a handful of U.S. naval folks that those positions had been established since the end of World War II. Um, so it was just a very unique experience to go up there and do a lot of really important work that was still supporting Operation Enduring Freedom, so the war in Afghanistan during that time. Ottawa was amazing. Um, not sure I love the 12 feet of snow the first winter we got. The pictures are pretty incredible from that time period. And apparently at negative 40 Celsius and Fahrenheit are the same again, which is a great fact. I'm not sure you want to live through that. So that was one of the really cool things that I got to do. I also served in Afghanistan in Bagram. I there's so many stories. One of the other really great ones is being able to navigate through NSA through the basement. And like once you have that figured out, you kind of like made it and you can avoid some of the crowds in the hallways.

SPEAKER_02 3:08

Amazingness.

SPEAKER_03 3:10

John, you were so great in your pre-call, and you mentioned that you thought you were going to go work at the NSA to continue supporting SIGAT mission after the military. But you know that best laid plans don't necessarily happen. So tell us how things took a turn and you had to pivot.

SPEAKER_00 3:28

Yeah, I'm actually pretty happy to talk about the situation because I know that it does occur not infrequently. So when you are active duty military, you're only required to take the counterintelligence, the CI polygraph, in order to work these positions within the national intelligence structure. So when I got out, you have to go take the NSA Full Scope Polygraph. So I assumed that I would go right back into SIGIN and continue supporting the mission, having worked at NSA headquarters and NSA affiliates. But what I learned was apparently the NSA Full Scope Polygraph and I, we just don't agree. We just don't get along. So there was a period of about two or three years where I attempted to take the Full Scope Polygraph six times total, two times as a contractor, two times as a tentative civilian offer, and then two more times as another contractor. And you're taking like the whole day off work. I mean, they're you're tentatively accepting positions while maintaining another job. So it's very stressful. And after the sixth time, they told me that it was still inconclusive. And they said, Well, what are you gonna do next? And I said, Well, I'm not I'm not coming back. This is the sixth time, guys. Like, I love the mission, good luck to you, but this obviously isn't gonna work out. And that was really a big transition point. So not only was I transitioning from active duty to the civilian world at that same time, it was pretty clear to me that my path forward for the rest of my career would probably change pretty dramatically. Um, so even though a lot of my career has been supporting the intelligence community and the military since then, um, it has not been directly at NSA. And I still hold a TS clearance and I've hold it, I've held a TS SCI clearance for a long time, but that inability to get around the NSA Fool scale really sort of changed the directory the trajectory for the rest of my career.

SPEAKER_03 5:16

It's interesting because not a lot of people can share that story, and I really applaud you for showcasing that. So it sounds like you had to explore things beyond your comfort zone during your transition. And you know, having your clearance is a big part of your identity is is also part of your comfort zone. So, what do you advise would you give to veterans who feel that they're really tied to their military identity and they're really hesitant to go and explore new pathways?

SPEAKER_00 5:47

That's a really good question. And the answer is pretty complicated, and I think it's further complicated by the cybersecurity job market at the moment as well, which is not fantastic. So I have done a couple of Skillbridge mentorships lately and hiring our heroes calls as well. And my advice to veterans who are transitioning right now is you need to be open to possibilities. And the motto right now for your career transition is Semper Gumby. I would embrace being flexible. The job market is not fantastic overall, and it's not fantastic in cybersecurity. So don't be afraid to take positions at smaller companies than maybe you thought you would, or in straight commercial civilian work. Your identity is not your clearance and the mission. And a lot of us really feel that coming from the military. We really feel like, well, I'm a I'm a cleared veteran, I've supported national intelligence missions. And that doesn't mean you couldn't go back into that line of work either. Um, there's a lot of folks I know who cross back and forth. Um, I think the civilian world experience can be really valuable to come back in. And I think sometimes having that mission focus can be really important going into the commercial world as well. Your definition of who you are is is really more than just like your clearance level and which you know rank you got out at and which branch you supported. And that'll probably lead us into a lot of other questions around uh around support uh during the transition as well.

SPEAKER_03 7:11

Yeah, it's it's it's hard because you have to sometimes break out of your identity. And I think I'm gonna let Rachel talk a little bit more about the identity that you created for yourself.

SPEAKER_02 7:25

So can we just talk about the Mohawk for a second? It is such a bold part of your identity. When did you start rocking it? And what was it like to embrace that side of yourself after years of having that, shall we say, more structured military haircut?

SPEAKER_00 7:43

Sure. Yeah, I'm happy to talk about this. So obviously in the military, you're very everybody conforms to the grooming standards. Um, and then I got out in 2010 and kind of conformed to East Coast consulting standards. I had worked at Booz Island a couple of times. I was a federal employee, and then COVID happened, and I was a federal employee during COVID at the DoD Cybercrime Center. And it was really at that time where I said, Well, I'm not even going to the office right now, right? We went fully remote, or mostly fully remote. Some of us would go into access classified systems. I said, I'm gonna try to grow this mohawk, and I also got my my ears pierced. And and I decided eventually that trying to be more comfortable with who I wanted to be in the workplace all the time, and not sort of have like a work persona and another persona, and I just wanted to be myself was more important than conforming. So eventually it really became part of my brand. I mean, it's really the style, it's the vibe, it's the brand. People recognize me at conferences because I have the mohawk and this particular look. But there's obviously some downsides to this as well. I mean, we still encounter clients and other people who do not like an alternative look. This has affected not only me directly, it's affected people I know who want to have different colored hair, or just have sort of like an alternate, non-conforming, non-standard East Coast consulting vibe. But I think part of also like transitioning out from being the veteran and trying to navigate your career in your life is you need to be comfortable with who you are. Right? I think it's much easier to be fully authentic and bring my authentic self to work and try to find a workplace and communities that support me in who I am. Um and that's why like the Diane initiative has been really important to me and try to support them and other veterans' communities. And at Google now, I'm very well supported with my leadership and my friends and colleagues at Google as well. And to some extent, the mohawk and the look has really become sort of a signature of sort of like a calling card as well. But but there's gonna be some limitations because some people don't appreciate that uh that look. So you do have to think about that. I think early transitioning veterans probably don't think about this a ton, but at some point in time, like you will want to make some decisions about how you are perceived at work, you know, what you're putting on the socials, on LinkedIn, and also what you're comfortable with and how you want to go through life with whatever you decide to be like.

SPEAKER_03 10:16

You mentioned sort of when it happened, but was there some catharsis? Was there some, hey, I really want to do this? Was it dramatic? Was it, you know, something that was gradual, or was this something, because you're we're gonna talk a little bit more about your involvement with DEF CON and Black Hat and Diana Initiative and B-Sides and all of that. Was this just something that you felt that you wanted to be part of that community and really adopt that persona?

SPEAKER_00 10:42

Yeah, that's a great question. And I think it's it's a multi-layered answer. I remember the first time I was voluntold to submit to B-Sides Northern Virginia, and I got accepted to present the first time in a conference, and I was like, oh my god, there's all these people doing Threat Intel outside of a secure facility. This is amazing. And that was my first realization of how big the cybersecurity community was beyond the DoD or the intelligence community as well. So I started to meet a lot of people within that community. I remember seeing someone going into the disability at Fort Mead who had a huge mohawk at one point, and I thought that was pretty interesting to see on the Fort Mead campus. And then the more I got involved with other groups, it was pretty clear to me that there was room to be your authentic person and bring your full authentic personality into workforce, obviously in a professional manner. But I don't know if there was like one singular thing. What I do remember is at one point, I guess this is pretty important, at one point I shaved the mohawk off. I wasn't sure I was gonna be able to keep it. And I went to soccer practice, and one of the kids had been wanting to come see my mohawk, and I had shaved it off, and this little kid was like so disappointed that I didn't have the mohawk. And I pretty much had known the day after I shaved it off that it was gonna come back. And so, like, it was a pretty big realization that like that was the wrong decision to go back, and I do want the mohawk. And I've kind of embraced it, but yeah, I guess at this point it's a little bit like my calling card, and and you still don't see a lot of people in sort of like Federal or SLED or the Intel that really have sort of a non-conforming image. Um, it's still pretty rare, so I am also quite comfortable in my career at this point to just move ahead with who I am.

SPEAKER_02 12:26

I love it, and I love any conversation that revolves around hair. So this has been fantastic all the way around. So just to take it a layer deeper, so we talked a little bit about just that authentic self. And after leaving the army, I'm sure you took many different paths, things to try to find joy, every, you know, different roles, different color mohawks, if you will. But do you recall a moment when you realized kind of that light bulb went off that said, This is my true passion and this is what I was meant to do?

SPEAKER_00 12:56

Yeah, that's a pretty interesting question as well, because I think the world has changed quite a lot from the 80s or 90s, where a lot of people really identified with where they worked. They were gonna work at that company for a really long time. There, there was a retirement plan, and if somebody worked at one of the big defense industrial-based companies, they were probably gonna stay there for a long time. I think that's really dramatically changed. I have changed jobs every two and a half to three and a half years since I've got out. Uh, I have been at Booz Allen three times. I'm a two-time comeback kid at that organization, but I've been a government civilian as well. And you know, now I'm at one of the big fang companies. And what I tell people is like your connecting who you are is not necessarily where you work. And it's sort of more like your job, your career stability, your brand, your presence. If you're managing all of that and doing really good work, you're gonna build the reputation as well. Right? So, in this age of contracts ending and people getting uh lack of work letters and RTOs and layoffs and restructuring, then the reality is it's unlikely people nowadays are gonna work 10 years at the same company for a really long time. I think we're really starting to see the end of that. So a lot of this is all tied up in amongst all of the realities we face right now in cybersecurity and with being a veteran that has transitioned out whether you served a short period of time or whether you retired. So I think like the supporting communities, whether it's an online community, an in-person community, the Legion, I'm the vice chairman of VETSEC. There's cybersecurity-focused communities that aren't focused on veterans that a lot of people could join. There's women-focused cybersecurity communities for our women veterans. I think finding your people and your support networks, and it's kind of hard to find like that definitive, like I know who I am. And really for me, what's interesting is I think I get the most value back of all the things I do that really aren't work. It's the supporting the local B-sides conferences, or giving a Sky Talks talk, or spending a half an hour to mentor someone, or taking time to look at a veteran's resume. That's the stuff I think where I really am impactful in supporting other people in the community. And obviously, I try to do a good job at work as well, but sometimes that's work. That's paying the bills and making sure I have healthcare insurance. And sometimes the real fulfillment is the other things I do around the community that is actually really important.

SPEAKER_03 15:31

And I think that those are really great things to say because I know that when I was still part of Besides Las Vegas, I sort of made sure we had a transitioning veterans program, and and Black Hat has a really great transitioning veterans program. Many programs do, because I think, and this isn't a question we talked about before, but I'm going to go into a little bit deeper is finding your tribe. You have a tribe in the military, and you sort of know where you fit in rank, and you know where you fit in at the mess hall, and you know that. You know, going through a process where you have to find it on your own rather than it structured and just put on top of you that this is what you have. So kudos to you to finding that, you know, that there are other communities out there. And I would really urge all of our listeners to follow John on LinkedIn and see that there are so many local, national, and international organizations that you can find that same group that will watch your back. So, as you understand, many veterans sort of struggle with not having the same unit structure that they had in the military. Were there differences in the civilian workplace that surprised you? And other than, you know, the hacker community support network, what other support networks did you establish?

SPEAKER_00 16:51

Yeah, that's a that's a great question as you try to find the support networks. And again, I think a little bit has has potentially changed because many of us won't be at one particular job or at one company for like a decade or two decades anymore. So you're gonna want to have some support mechanisms where you do work, right? I think that's gonna be important, whether it's your official boss or your skip line manager, um, other colleagues there, but you're gonna want support mechanisms outside of that as well, right? So that's where we talk about all these communities. There's specific veterans-focused communities, there's veterans-focused communities for cybersecurity, and then there's cybersecurity-focused communities, not specific for veterans. And there's many. There's many to choose from. And when I talk to people, it's like you're gonna want to find the the people that you just vibe with, right? So whatever that might be, the Diet Initiative, your local B-Sides organization, a different B-Sides, uh, Black Girls Hack, Blacks in Cyber, VetsEc, Vets Tech. There's so many different organizations to choose from. I also am a strong believer in like getting the therapy that you need. Um, I have a therapist. You know, you're gonna want somebody to talk to. I think that's really important. I think we're trying to do a good message to break through to veterans that like mental health, your mental health is important, you should take care of it. There's no issues with having a therapist. It's actually something we all strongly encourage, right? Because your family and your spouse aren't your therapists. Like, if you need a therapist, you should get a therapist. They're there to support you, but you don't want to, you don't want to like unload all of your problems on the people you care about in your family unit all the time. And that's where sometimes these online communities can be really helpful. Like you might just have a question, right? And the other thing is that there's no dumb questions when you're getting out, like, hey, it's casual Friday. I work at this consulting firm. What is it what do I really wear? What do I wear, right? Uh to casual Friday. Like, and that seems like maybe that seems like a dumb question to somebody, but you're like, oh, maybe I shouldn't wear jeans. Maybe they really mean like pants and a polo, and that's as casual as it gets at this office setting. And there's other things people have like, you know, if I have a remote job, a lot of veterans are terrified of a remote job. It was like, you do not have to sit at your computer from 8 a.m. to 5 p.m. and like never leave the computer. That's not how remote works, right? The whole point of remote work is it's remote and there's more flexibility. You just need to get your work done and generally be available. Like if you're running out to like Walgreens or CVS, like send someone a note, hey, I'll be back in 30 minutes, I gotta run to the pharmacy. Um, but these are things that if you don't have some community to ask the questions on, you're probably just like in some weird Reddit thread and not getting super great help.

SPEAKER_03 19:30

I know about that. Reddit, Reddit ain't doing it.

SPEAKER_02 19:35

Uh, wanted to ask a little bit. So you mentioned about the cybersecurity, and so I want to dig in a little bit more into that particular realm of you and all things about youth donor. Let's talk about your cybersecurity career and experience. How have you been able to turn cyber chaos into clear, actionable strategy? Have you leveraged maybe some things that you learned in the military and transition those over into the corporate cybersecurity world?

SPEAKER_00 20:04

Um, certainly I used skills from the military as I transitioned into uh the cybersecurity realm. The first thing I ended up doing was being a technical instructor. That was sorting the sort of during the time where I wasn't sure if I was gonna eventually be able to pass the full scope polygraph and go back into a SIGINT role. So I ended up being a technical instructor. Um, but a lot of that paired up with instructing I had done formally and informally in the military as well, right? We do a lot of training of the new soldiers that are coming in, a lot of SOPs to get them up to speed and on how we wanted to do things, how reports were going to be written. So I had been an instructor before to some degree, and I had done quite a lot of training in the military. So that helped. And then from there, I sort of discovered threat intel, cyber threat intel, which really married up so many of the concepts we take from the intelligence community already. And then that gets married up with cybersecurity concepts for threat intel support. Um and my first real threat intel support job was actually in a counterintelligent cyber threat support position. So it really was still very much mission-focused, counterintelligence plus cyber, plus cyber threat intel. And that was also during the time that I discovered cyber threat intel was like this big commercial thing that happens outside of secure facilities, which I was pretty excited to learn. And and how you're bringing order to all of this probably to a large extent depends on like your modus operandi, how you operate. I'm an INTJ, I'm very organized, and I like to make lists and I like to have plans, but you have to be flexible with some of this. When I got to the DOD Cybercrime Center as a civilian, I was pretty quickly chief of analytics and then eventually a deputy director. And one of the things is try to bring calm to the an organization. There's always chaos in cybersecurity. There's always going to be a bad day, there's always going to be a new zero day, some sort of new exploit that the you know the adversaries are taking advantage of. A lot. It is also trying to explain things up to much more senior, much less technical people. That is a skill that many of us do have from the military if we were briefing senior officials or senior officers. I once sort of had to disagree with the Supreme Allied Commander of Europe, which is a memory that's forged in my brain. So that has served me well to try to explain things like computer forensics take a long time. So we don't have all the answers yet, right? To people in the Pentagon who want answers immediately about a situation. So there's there's more than one way and more than one strategy. I also think one of the things that a lot of military folks bring to the table that I've talked about pretty extensively is I served during wartime. Right? Every day I was supporting troops. For seven years, I was supporting troops on the battlefield in Afghanistan, and people were dying. And that is just rarely the case in most cybersecurity situations. I won't say ever. There have been some catastrophic ransomware attacks in the healthcare sector. Um, but most of the time, people get very excited about this cyber situation that is unfolding, like a Microsoft Office Zero Day, and it is not life and death in most of the time. And I think sometimes the veterans that are in these organizations can help sort of like bring that to a more calm level because we have been, we have been in life and death situations, and that is not what is happening right now. Whereas many people in those situations, that is the most sort of significant event that they have ever been a part of. So that's another really good aspect, I think, where veterans can come into technical leadership roles and help calm things down when there's a situation.

SPEAKER_03 23:46

Yes, that's that's a very good point. So you've done a lot of mentoring. And with all of the experience that you have, if you were to talk to a young John Stoner, what would you tell them?

SPEAKER_00 24:01

I think one of the things that I wish I would have had a little bit more is a better support network when I was transitioning, um, which is one of the reasons I, you know, try to give back as much as I do now, because I didn't really have that as much as I maybe thought I did when I was transitioning out around both the job situation and sort of like getting your VA disability claims in and getting some support with all of that. So finding your support mechanisms is really critical at work and outside of the workplace. I don't know, it's kind of hard to go back and be like, oh, I wish I would have done X, Y, or Z. I have managed to, I think, forge a pretty decent career so far, and career paths aren't linear. So that's one of the things I think even I thought back in the day when I was getting out. Like we're all used to checklists and SOPs and step one, step two, step three, right? That's very much how the military works. And that is not how really cybersecurity careers work at all for the most part. Uh, this is still a really new field, right? It's not like medicine or law or philosophy. I know SISOs that have MBAs, and I know SISOs that don't have a degree. And you can forge your own path, and there's not going to be like I have to get this certification and this degree and this training and then this type of job. And we get a lot, I hear a lot of people being mentored of like, you should go work help desk or you need to get a sock tier one job, and that's the only way. And I don't know anybody that has like a similar playbook to my career path, and everybody I know has a unique career path. So in this field, career paths are very unique. So I guess one of the things I would tell myself is perhaps having a better one-on-one mentor earlier in my career would have help let me see that, as opposed to sort of like some general advice that gets thrown around on the socials and on LinkedIn, which isn't really tailored. And that's the most important thing is when you're getting out, is are you in some kind of a program where you have a one-on-one mentor to ask some of these questions who's walked through some of these steps before? Right. And, you know, I used to like like many of us used to ask my parents for support, ask my dad for support, but his experience is so different in the workforce than mine is. I mean, I remember I had the realization at some point that like I can ask my dad information and you know, keep them updated as to what's going on, but I can't explain hacker summer camp to dad. I can't explain to mom and dad like what's happening at Black Hat and the Diane Initiative and B-Sides and Sky Talks and DEF CON. There's just no frame of reference for like how important it is to be part of that community. Because mom will always be like, Was it for work? She's like, Is it for work, John? It's like, yes, but no, but yes, like it is work, but it's not, but it's networking, but there'll be some parties. So having that one-on-one mentorship with someone in the industry, preferably a veteran, will help you during your transition quite a lot.

SPEAKER_03 26:57

John, you know, this has been wonderful. Thank you so much for sharing your story, sharing your advice, and I look forward to seeing all the things that you do on LinkedIn.

SPEAKER_00 27:08

Well, thanks for having me on the podcast. I really appreciate being here and talking to you and Rachel today.

SPEAKER_02 27:12

Thank you, John. And thank you, listeners, for tuning in today. Sharing really is caring. So be sure to share this episode with your fellow Exit buddies. Make sure you also follow the show so you don't miss out on one single episode. Toodles.

SPEAKER_03 27:31

See you soon.