How Zero Trust Helps Execute Missions with John Sahlin, Director of Cyber Solutions for the Defense Division at GDIT

(Intro Narrator at 00:00:00) Today, we're talking to John from GDIT about the intersection of zero trust, nerdy self-help, and networking with intention. You're listening to the Modern CTO podcast.

(John at 00:00:16) Hi, Joel. Hey, buddy. I gotta get some—

(Joel Beasley at 00:00:18) Of the San Diego tacos. Is that where it's at?

(John at 00:00:20) Right? Right? I am literally across the street from Tacos El Gordo.

(Joel Beasley at 00:00:24) That's awesome. So, typically, I like to just start with giving you a little bit of background about my experience. So 17 years as a software engineer. I built teams and then teams of teams, and I was writing and sharing what I had learned going from individual contributor to leader to leader of leaders. Turned that into blogs, then turned it into a book. And then before I published the book, I started sending copies of it to CTOs and technical leaders, having conversations.

(Joel Beasley at 00:00:50) Once the book was published, I just wanted to keep doing that. So I said, hey, let's make a podcast out of these interviews.

(John at 00:00:56) Oh, cool.

(Joel Beasley at 00:00:57) Yeah. Yeah. So now we're five years and 550 episodes into it. But yeah. So that's where I'm at.

(Joel Beasley at 00:01:03) That's my professional history. Can you tell me a little bit about yours?

(John at 00:01:08) Yeah. So my background is kind of weird, actually, especially for someone in the defense contracting, federal system integrator space. So I started out military. I, Naval Academy grad, ended up active duty Navy, but then I got out on a humanitarian discharge really early, and I ended up going into commercial industry. So I got super lucky.

(John at 00:01:38) I wanted to go back to where I'd gone to school. So I wanted to move back to the Annapolis, Maryland area and ended up getting hooked up with a couple of technology consultants that were based in that general area and ended up running a data center out of Silicon Valley from an Annapolis-based company, which was really cool. We ended up being the first application service provider on the market. In fact, I can't remember what—if it was ComputerWeek or Information World or something—but anyway, they coined the term talking about us. It was this really big deal startup company.

(John at 00:02:21) The CEO of DigX was one of our founders. So he was a huge fish in a very small pond and making a big splash. So that was cool. And I did the Silicon Valley thing for a few years: cybersecurity, systems engineering, and ecommerce solutions for commercial clients. And I always wanted to go back and support the Navy.

(John at 00:02:43) So I signed up as a reservist to go work for the Navy, and one of my reserve buddies said, hey, my company just won this huge contract down here in San Diego. If anyone from the Northern California area wants to come down here, they really are looking for people with that Silicon Valley experience. And I said, yeah, cool.

(John at 00:03:09) Sounds like an interesting challenge. Taking everything we learned about the ASP industry, pre-cloud computing—now it would just be called a cloud computing company—and kind of take that and apply that to tactical networks, to shipboard networks. And it was cool because to me, it was this perfect mix of continuous service to the public sector, but also allowing me to solve hard problems.

(John at 00:03:41) I like to approach things—I was always as a kid, I was always fascinated by puzzles. I was that kid that took everything apart just to see if I could put it back together, and I got in a lot of trouble for it because it didn't always work. But at least I learned a lot. Right? So for me, approaching things as a puzzle was interesting to me. So that was the ultimate puzzle. How do I get these commercial practices to work in these DOD environments that everyone told me—you know, I was completely off my nut for even going down there.

(John at 00:04:17) It's like, why would you do that? You make so much more money up here. We deal with newer technology. I was like, look, I kind of enjoy the challenge, and it was a huge challenge. And we did some really cool stuff. So I just fell in love again with my job because it was an opportunity for me to figure out how to make those square pegs kind of fit in those round holes of defense acquisition. And I haven't looked back. I've been doing that. See, I moved to San Diego in 2004, and I've been doing it ever since.

(John at 00:04:52) I mean, I've since moved to the East Coast, living in Northern Virginia doing the DC Beltway thing. But my heart really is into using technology, not for technology's sake, but to solve challenges, to solve problems, and that's the way I approach things. And that's why I love what I do and kind of where I'm approaching things is I'm not here to sell a product. I'm not here as a representative of a specific software component or a specific hardware component. I solve problems that the government isn't quite sure how to solve on their own, and I work with them.

(John at 00:05:34) I partner with them to say, alright, you say you want this thing or this solution. Why do you want that thing? What are you trying to do? What are you trying to accomplish? Well, let's figure out how to get there rather than say, you know what, I want this thing. And I think—gosh, this is almost a therapy session now—I think the reason I approach things this way is because when I worked for that service provider in Maryland, our CEO was a big proponent of the Nordstrom Way. Right?

(John at 00:06:11) He was a huge fan of that. In fact, we ended up a chapter in one of the reprints, one of the editions of the Nordstrom Way. So he was hell-bent on this idea that we don't have customers. We have clients. You don't go to McDonald's and roll up in the drive-through and say, well, you know, I'm feeling a little peckish. What's good today? Right? You go to McDonald's because you know you're hungry. You want a Big Mac or a Quarter Pounder or Filet-O-Fish, whatever. And you know about what you're willing to pay for it, and you're gonna get that thing, and that's it.

(John at 00:06:46) He likened it not to retail, but to more of a professional services thing. You know? Attorneys have clients. You go to an attorney with a problem. You say, look, I don't know how to solve it. You're smarter than I am in this realm. You tell me how to address this challenge, and we'll figure it out together. And that's based on trust. That's based on relationship.

(John at 00:07:10) That's not based on transactions. So that's how I've approached this industry as, you know, I want to be that trusted partner. I want to find out what's really keeping you up at night, what's really bugging you, and then let's figure out how do we apply technology and some process changes and some other changes collectively to address that core problem, not just you come to me asking for X, I provide you X at the lowest possible price that I'm willing to sell it for, and you decide whether you're willing to pay that or not. Does that make sense?

(Joel Beasley at 00:07:45) Yeah. No, I get exactly what you're saying because for all those years I did software development, I had a business partner who handled all the sales and the executive side of things, and I just was making sure the tech was good and came through on the promises that were sold and all of that. And then when I went out to do it on my own and here at this company where I'm the CEO, I had to learn the nasty S word, sales. Right?

(Joel Beasley at 00:08:08) And so I was—as an engineer, you know, I was very not into it. In my head, when someone said sales, I thought used car salesman, you know. And I was like, I don't want to do that. But then you quickly watch your savings go away, and you're like, alright, I have to make sales. And then I started realizing after getting into it that it is exactly—at least my business, it's exactly like how you described.

(Joel Beasley at 00:08:31) It's like we're constantly disqualifying people. And if they happen to meet all the indicators, it's like great, you know? It's like what audience do you want to reach? Okay. What message do you want to get? Do you have all of this stuff together? Okay. Well, then knowing all of that, we can help you do that, and here's what it looks like. I would say that I have a newfound respect for salespeople who can chain sales calls back to back all day.

(John at 00:08:55) Yeah. That's—

(Joel Beasley at 00:08:55) That's tough work.

(John at 00:08:56) It is not an easy thing to do for sure.

(Joel Beasley at 00:09:00) Dude, that's so cool. And so when you said San Diego, I'd been out there a couple times, and it is definitely a military-type town. There's a lot of industry out there. Yeah. But you—so you're splitting your time right now, you said, between Maryland and—

(John at 00:09:14) So I live in Northern Virginia. So I lived in San Diego for about 15 years, and then I moved out to the East Coast. So I now relocated. I'm in Northern Virginia. But they keep sending me back out here because they know that I have so many contacts out here.

(John at 00:09:33) And even though my role is DOD, so I cover cyber solutions for DOD for GDIT, they know that I've been embedded in the Navy programs for so long. They have me come out quite a bit to meet with the clients because I can talk to them about what specifically do they need. And, you know, what big Navy or big DOD need at the enterprise level is very different from what each of the services need at the tactical level, you know, on the ground when they're deployed or a ship at sea or a Marine Expeditionary Unit that gets sent out to the beach or a combatant commander that needs to set up temporary residences in theater to deal with things. That's a different problem and a different challenge than the typical enterprise solution.

(John at 00:10:33) And for so long, GDIT has been viewed as the enterprise data center folks for the General Dynamics family of companies. And we really are breaking that mold and looking at not only enterprise solutions, but how do we solve these challenges, particularly things like zero trust, down at the tactical edge? Because that's a very different challenge than trying to solve it at the enterprise level.

(Joel Beasley at 00:11:07) I want you to describe zero trust in the context. Like, what's different about zero trust, or what's harder about it in the military world versus the public world?

(John at 00:11:18) So it's interesting. The challenge is effectively the same, right, which is balancing the needs for protecting data from our adversaries, whether they're criminals or nation-state actors, and making them available to the people who need access to those digital assets in order to execute the organizational mission, you know, whether it's a business goal or some military mission. But I think what's fundamentally different between the two is in commercial industry, we're comfortable with the idea of—I'll call them attritable assets. It's a very military term. But, you know, basically, I'm comfortable with the idea that there's some information that if it leaks, it's not gonna be critical to our overall mission.

(John at 00:12:11) You know? It's not going to kill us. It's not gonna ruin our position in the marketplace. It's not gonna be great, but we kind of have this idea in commercial industry of tiering the priorities of our data in terms of what's really, really super critical. You know, our research and development intellectual property stuff is probably the most critical.

(John at 00:12:36) Then our sales information in our pipeline, then our marketing material and PII and stuff like that, and then the stuff that goes out into the public world. You know, in the military, we have a tendency to think of everything as critical, especially because we have this concept of—even though we have this concept of tiered security clearance levels, within that level, it becomes really difficult to say, if this piece of data gets compromised, it's not as bad as this other piece of data. So if we stay in the unclassified realm, it becomes very difficult for the military to say this kind of information, it's sensitive. But if it gets compromised, it's less important to our mission than this other piece of information that is equally unclassified but sensitive. So I think that's the challenge is that we have a tendency in the Defense Department and the military to apply blanket security policies across the board.

(John at 00:13:43) And where zero trust comes into play is it allows us the ability to be more dynamic about our security controls. And it does so not because we want to apply less security to a certain data element, but because we need to execute a mission. And when you are so blanket in your categorization of data, you have a binary decision. Security is on or it's off. And when chips are down and you need to make something happen, if the policies and the procedures and the rules don't allow you to do it, you go the extreme other case and say, fine.

(John at 00:14:22) I'm just gonna go with it and see what happens because we've gotta execute this mission. And zero trust allows us to live in that middle ground, which is pretty cool because we need to share information in order to meet our mission goals. And those mission goals don't have to be military. Right? I currently do work for the military, but we support all federal agencies and a lot of state and local agencies as well.

(John at 00:14:51) And this idea of providing dynamic security can apply across the board. You know, I was having this conversation with the director for identity and credentialing over at FEMA, you know, Federal Emergency Management Agency. And we're talking about zero trust at the edge, ICAM at the edge. And we came up with the use case, you know, what would you do this with. Right?

(John at 00:15:18) It's all about use cases of disaster recovery. So when I was a reservist, one of the things I deployed to is I deployed to Joint Base New Orleans to deal with the Hurricane Katrina relief efforts years ago. And right after, we were about ready to close up the shop in terms of the primary mission, the biggest emergency area of it and really rolling into more of the continuity operations type mission, another hurricane rolled in through and took a left turn in the Gulf of Mexico toward Texas. So we packed up. We were running a command and control unit in tents over in New Orleans, and we packed up all the tents, and we were ready to deploy all that stuff out to Texas.

(John at 00:16:07) And as we were doing that, I was thinking about, gosh, how hard it was for us to share data with the partners that we didn't plan on originally. Right? We knew we would have to plan on sharing data with all of our military partners, but at the time, we hadn't planned for American Red Cross, Doctors Without Borders, the local parish sheriff organizations, and first responders from the local hospital, things like that. That took us a long time to figure out how to share information with each other. And we thought, well, gosh.

(John at 00:16:43) We're about to pick up and move out to Texas to go deal with this other hurricane. We're gonna have to do this all over again. If I fast forward to current day, right, FEMA is now very well set up with the technologies that exist that didn't exist 10 years ago or more. You know, when I was dealing with this with Katrina, we had that one hurricane roll through Puerto Rico and did a lot of damage. Right?

(John at 00:17:13) And that one was terrible, did a lot of damage. FEMA rolled out. You know, they started dealing with their local first responders. And then Ian rolls up to the Florida coast, and those folks from FEMA now have to figure out how do I share information with a whole new set of first responders, a whole new set of hospital teams, local law enforcement, et cetera, et cetera. The ability to do this more dynamically has really helped us get agile in how the mission can flip like that, but we're not so tightly bound to a specific technology or a specific way of doing things that when that mission flips, we're caught flat-footed.

(John at 00:18:05) And I think that's what's really cool about doing this at the edge as opposed to at the enterprise. Things are a lot more dynamic. The problems, the challenges are a lot more complex, and it's more of a puzzle to solve. So to me, I gravitate toward that kind of use case.

(Joel Beasley at 00:18:23) Yeah. And at least in the past year or so, the military has definitely become more part of our news cycle, at least, right, with the conflict in Ukraine. I actually got to have this guy from Ukraine, Alexander, and he has a business where they do—you hire developers through them. But, you know, those types of businesses, so they connect the developers and all of that.

(Joel Beasley at 00:18:48) And then he did a special episode developing from a bomb shelter. So his company—a lot of people fled Ukraine.

(John at 00:18:55) Interesting. Yeah.

(Joel Beasley at 00:18:56) A lot of people stayed and they work. They wake up every day, go to work, and they would be working out of a bomb shelter writing code and all of this stuff. And I was like, wow, that is a crazy reality that they were experiencing. Have you ever — we've never experienced that in America where we're getting shot with stuff and we're in bomb shelters doing podcasts. You know?

(John at 00:19:17) Yeah. Fortunately, I haven't had to get to that extreme. But, you know, this last two years dealing with COVID has taught us a lot about how things change and how change throws away a lot of our assumptions on how we look at things. And it's funny, you know, I talk to a lot of people about, oh, let's use AI and ML to monitor user behavior and manage our computer networks and automate the response and that sort of things because they can act more quickly than a human. I was like, yeah, they can. That's true. But when life throws you some kind of crazy curveball, whether it's having to work out of a bomb shelter because your city is literally under siege, or there's this global pandemic that's forced a dramatic change in how we do things — the thing about AI and ML-based solutions, especially security solutions, is they make decisions based on rules. Right? And those rules are defined either as an input in the case of heuristic-based solutions, or in the case of truly dynamic solutions, they're based on what they've established over time as, quote unquote, normal. Well, the minute normal changes, those systems have to go back into learning mode. So the minute I'm no longer spending three and a half hours or three hours of my day commuting to the office and then spend a solid number of hours working pretty heavily and then another, you know, hour and a half or whatever to get home in peak traffic.

(Joel Beasley at 00:21:08) Stressing me out hearing you talk about it.

(John at 00:21:10) I know. Right? But that's what the life was. You know, an hour, hour and a half commute was not unusual in 2019, especially for people in Northern Virginia. And then suddenly, we're no longer doing that. Everybody's working from home, at least office workers are, and I realized that that's still a small portion of it. But we were working from home. And that meant we were working at weird hours. It was unusual. First of all, it wasn't from a trusted network, so that part of it went away. We were coming in at really weird hours because either we had no sense of work-life balance, and we needed those boundaries. I needed to be able to put on a shirt and a bow tie to put myself in my game mode, right, to put myself in work mode, and that was my uniform. And that meant now it's time for professional John instead of, you know, home John.

(Joel Beasley at 00:22:09) John Plus.

(John at 00:22:15) That's right. John Plus. Molar covalence, if you will.

(Joel Beasley at 00:22:15) There you go.

(John at 00:22:15) So that puts me in that mode. A lot of people didn't have that because they weren't used to working from home. So they got really unhealthy in terms of when they were working. They suddenly found themselves working fifteen, twenty-hour days because there was no separation. They didn't know how to break their day up. Or because they had childcare issues or had to help with kids at home in terms of homeschooling that suddenly wasn't their norm, their workday became their work night because they were helping their kids for whatever reason. So all of the rules that made sense to our security engines got flipped. And just about that time, when we got comfortable in a real mode of what's, again, new normal for us, we started flipping again. A lot of companies started pushing to come back into the office place or do a hybrid thing. So we're back in flux again.

And, you know, every time there's flux, it's not the pre-change and the post-change that's important. It's that window of flux in between, that transition phase. That's where things get weird, and that's where there are frankly opportunities for our adversaries to sneak in under the radar and not get noticed because we don't know what's normal and what's not. So it could just be some blip, some anomaly that we can't attribute to anything. And that's where windows of opportunity show themselves even with the best AI and ML-enabled detection remediation tools. Every time we change what we define as normal from a process, every time something weird happens, there's an opportunity. Chaos brings opportunity. And that's a real opportunity for our adversaries, and that's what scares me the most, I think, about the future is as we get more dynamic and as the changes keep rolling, if we don't prepare ourselves to be flexible and agile, we're gonna have a lot of situations where we're caught flat-footed, and we are going to open up opportunities for those who want to do us harm to sneak in without us knowing. You know? I kind of liken it to being a boxer. I used to box in college. There's that famous Mike Tyson quote. Right? Everyone's got a plan till they get punched in the mouth. And it's a thing, man. It's a thing. You would know exactly how you're gonna go up against the person that you're up against in the ring right up until you get popped in the mouth. And then it all comes back to your training and how resilient you are, how well you can take that first hit and not just crumble from it, either physically crumble or you get so vapor-locked in your head that you just don't know what to do.

(Joel Beasley at 00:25:09) I'm the person that just gets back up.

(John at 00:25:12) Yeah. Exactly. You keep going.

(Joel Beasley at 00:25:14) I got lucky. When I was twelve years old, I got hit by a car, and I was in a wheelchair for a year and had to go through the process of learning how to walk again and all of that. And, you know, through that, it taught me a lot of humility having people help me shower and go to the bathroom. And it also taught me persistence because, you know, you'd sit there in the rehab and flex your calf muscle a hundred times a day, and it took two months for it to start coming back and getting a feeling in it. And so I just learned, like, I guess that's the moment when it just happened. My brain got wired, and then that's helped me out, you know, as I went through things in high school and in my twenties and in my thirties. It's just, like, there's really no other option. You can either sit around and cry and go nowhere, and that path sucks, because, you know, it's so far from my reality to not get back up and keep going. And when you do, you learn a whole lot, and then you can become proud of yourself.

(John at 00:26:13) Mental health care is health care. Right? If we're not honest with ourselves about how we're feeling, just as if we're not honest with ourselves about physically how we're doing, we're just gonna cause ourselves more damage. And I think that anything we can do to open up that conversation is a wonderful thing. And, you know, bringing it back to our particular company, you know, one of the things I love about GDIT is that we are at the leadership level, at the highest levels, big proponents of mental health care as health care. One of the things our president sponsored as a large-scale project within the company was this program called How Are You Really? And it was, you know, kind of focused on — it was part of this change in COVID operations. But it really was focused on this idea that when someone asks you, especially your boss, hey, how are you doing, what's the first thing you're saying? Oh, I'm fine. I'm good.

(Joel Beasley at 00:27:09) Great. Yeah. Fine. Good. Great.

(John at 00:27:11) Yeah. You know? And then that's it. We drop it. And she really challenged all the leaders in the organization to say, no. No, don't let it stop there. Follow up with, well, how are you really? You know, what's going on in your life?

(Joel Beasley at 00:27:27) And then are you — for me, I did not have that. I didn't necessarily have those people around me. You have that in your culture, and it's happening at your company. When I was going through, I didn't have it around me, which has allowed me to grow in the sense — specifically, for me, it's getting involved with church and my community, being around these people that care about you, and they'll ask you that, and you can confide in them. And having that network and building that for yourself is human 101. Build a network of people who care, who have your best interest in mind, and who are there. I'm glad that you guys have that at GDIT.

(John at 00:28:03) Yeah. It's pretty cool, and that's one of the things that I'm very proud of as far as the culture thing of our organization is that we really try to instill that kind of engagement from the top down throughout the entire leadership organization because you're right. Building that network of people who care about you as a human, that's foundational, man.

(Joel Beasley at 00:28:26) And you guys are a huge company. Right? I mean, you have tens of thousands of employees. Right?

(John at 00:28:31) Yeah. Yeah.

(Joel Beasley at 00:28:31) So that's amazing to have that culture at that scale. It's pretty rare.

(John at 00:28:36) Yeah. Absolutely.

(Joel Beasley at 00:28:38) From a technology standpoint, what's the most exciting or interesting thing that you're working on at your company right now that you can talk about?

(John at 00:28:47) Yeah. Yeah. So right now, the coolest thing that we're working on right now is a number of technology investments within the company. So companies usually hire GDIT to outsource functions of their organization. So they'll — we might provide data center operations, either doing everything from our data center or sitting in their data center facilities and just, you know, staffing their desks, for instance, would be one thing or doing dealing with the logistics or the engineering elements of it. We might write some custom code for them. So we have software developers and data scientists and systems and software engineers and things like that who go out and solve problems for the government. But it's always, you know, hey, do this thing for us rather than, you know, build a thing and then we sell the thing. Right? So we have services contracts primarily.

(Joel Beasley at 00:29:52) So you're like a giant consulting company for technology?

(John at 00:29:57) Yeah. Kind of.

(Joel Beasley at 00:29:58) Yeah. Because they've got the big — like the Accenture and the Deloitte and all those. But I don't see them like — if I were to think of them and put them all up in my head, I see them as business strategy first, and maybe they dabble in technology. But the way you're describing GDIT is you're the big technology one.

(John at 00:30:20) We are primarily a technology outsourcer. Right? So we don't — you know, we have some elements and some organizations within our company that do focus on the big strategy stuff, and we have some people who are really good at dealing with, particularly, technology strategy, CIO, CTO types. In fact, that's what I used to do for a few of my clients was act as their strategist and help them figure out what's the horizon plan for the next two, five, and ten years for our program. So we have people like that. But by and large, we are doing the day-to-day operations and services from a technology perspective of certain elements of our client base. So with that kind of model, doesn't really lend itself to a whole lot of internal research and development programs. But over the past couple of years, we realized that we need to invest in technology solutions as a force multiplier to our people. Because if your only story is people, then it becomes more difficult to win because everybody's got good people.

(Joel Beasley at 00:31:39) Well, especially when the technology is out there, it exists. Other competitors can come along and build that technology, make their people better people for lack of a better term.

(John at 00:31:49) Right. So then you're either into a beauty contest where my people are, you know, better than your people, and then the government decides, or it's a price shootout.

(Joel Beasley at 00:31:59) Yeah. I don't like that one.

(John at 00:32:01) And I don't like that one. I don't like living in that one. So in either of those cases, though, what ultimately happens, if that's your sole value statement, the minute one of your key beauty queens leaves and gets attracted to another company, suddenly that argument starts to go away, and then your only thing left is price. And if your only thing left is price, that means pressure on salaries and benefits and other things to the rest of the employees that you've got. So it starts to degrade over time. So what we did was we made a concerted decision to focus on investing in technology-enhanced solutions. Leveraging technology, not, you know, creating the next new thing, but truly from an engineering perspective, using technology to solve complex problems and help enhance our services so that the technology components turn into a value accelerator for our client base. So we can show value for the investment early on rather than, oh, well, you know, just hire a bunch of bodies and eventually, you know, after a number of years, you'll start to see some value into it. No. We can turn that into rapid value recognition very early in the engagement.

So what we did was we started investing into technology-enhanced services or technology solutions around six key areas of technology. And the one that I'm responsible for is cybersecurity and zero trust because that's my background. So I'm in charge of an IRAD program that actually spans across the whole company, not just defense, but I focus on solving the challenges or trying to solve the challenges that speak not only to our defense clients, but our intelligence and homeland security community clients and our federal civilian and state local clients. And to me, that's exciting because, again, it opens up a whole new world of challenges for me to try to address, and it gets super intriguing for me because I don't know what my week is gonna look like, not from a bad chaos perspective, but from a turn the corner and, wow, that's a really cool thing to look at. And it's like this magical world has opened up for me again, and it's no longer John 2.0. Now it's John 3.0. And it's awesome.

(Joel Beasley at 00:34:42) And I know exactly what you mean. Monday mornings, I get the list of everyone I'm gonna be speaking to that week, and it's variety within the structure, and it's exciting to look forward to. Right?

(John at 00:34:53) Sure. Yes. Yes. It's not so chaotic that it's, you know, that it's an absolute mess, and you just wanna curl up in the corner in fetal position with, you know, a cookie and your blanket and call it good. No. No. It's variety within a structure. I like that.

(Joel Beasley at 00:35:07) Yeah. That does sound nice, though, the cookie and the blanket.

(John at 00:35:10) You know, it's not bad. I just got off — I just got off a week's vacation that my wife and I haven't taken more than a long weekend in over five years. So it was nice, you know, to have that break. I went to Costa Rica.

(Joel Beasley at 00:35:23) Dude, that's so cool. And then the last one I wanna make sure, you must be hiring. Right? So how do people learn more about potentially working with you or on your team? Do they have to have security clearances? Where do they go to learn more?

(John at 00:35:38) Yeah. You know, obviously, gdit.com/careers is a great place to start. Right? But the key to getting hired at a super large organization like GDIT, I think, is making those personal connections. Right? Because you can send your resume through the recruiter mill and, you know, hope that you hit enough of the keywords that you get past the first screen. But, really, the goal should be to learn about an organization and meet people. Go out to the events that we're at, or if we are participating in social media, reach out to those who are particularly active on social media. You know, I do a lot of stuff on LinkedIn. Some stuff is, you know, GDIT specific.

(John at 00:36:33) Other stuff is, hey, this is a really good blog that I've read, or this is an interesting post that I want to echo. And get engaged with those individuals and then say in some side channel, hey, you know, I'm interested in joining your company, and I saw some—could you introduce me to or could you give me some more advice on how to do it? Because if you can get in front of the hiring manager, if you can get your name in front of that person, they can go back to the recruiter and say, you know, Joel applied for this gig, and I didn't see them.

(John at 00:37:10) I kind of expected to see them in the resume folders for the queue to interview. Why didn't he make the cut? And I can either give you some feedback and say, well, you know, here's why. Or say, you know, I really think even though they may not meet all of the keywords, we should give them a chance because for X, Y, Z reason. You had asked about security clearances.

(John at 00:37:36) Not all of our positions require security clearances. Some do. Many do, but not all. Even within the Defense Department, we have some positions where as long as you're able to get a clearance, it's not required early on. And that's particularly true for some of the emerging technologies capabilities because we recognize that it's difficult to find people who are already in the space using these inherently commercial technologies.

(John at 00:38:09) So I think the combination of don't sell yourself short because you don't have a degree or a security clearance or what have you, but you have the experience, try to figure out a way to get past the recruiters and speak to people who can at least introduce you to people by going to these kinds of events, reaching out to people via social media if you find that you share common interests, somebody who goes on a podcast and talks about some stuff and you want to talk—you say, hey, you know, that was pretty cool. Anything you can do to strike up a conversation is helpful for you because the recruiting mill works, but there's a lot of luck involved in that too.

(Joel Beasley at 00:38:55) Yeah. After the podcast and learning how all these things happen, what I realized is that—and you can disagree—but the application process and your resume and type deal, that's for people that have a job or want a job. If you want a career, you have to find something that you're interested in. Step one, find something you're interested in, maybe a problem or an area that you want to work.

(Joel Beasley at 00:39:21) And then step two, start looking for companies that are operating in that area, and then actually look at them, read their culture, understand who they are. And if they align with you, write an email about your story or how you could potentially bring them value or ask them a question that's a good question, not a basic question. Ask them a question that shows that you've been working at this. I tell people when they have a favorite book or something, you know, you can email the author and they'll likely respond if you have a good question. If you have a question that's answered in the book explicitly, and it's a title of a whole chapter, and it's very clear, they're just going to ignore it because they're like, that person didn't read the book.

(Joel Beasley at 00:40:06) They just maybe read the first chapter or something. But I will never have an issue helping people and telling them how they can get jobs because it's really easy. Just super care and go talk to each person, and it takes time. But I'll tell you what, it's way more satisfying, you know, sitting down and maybe writing two detailed, well thought out messages a day versus just clicking the button and scrolling down a list and just clicking that button to LinkedIn apply or whatever.

(John at 00:40:36) Yeah. No. Agree 100%. It's easy for us to say that's how to do it if you've got a career that satisfies you already. And there are times when you literally just need a job, and I get that.

(John at 00:40:50) I've been there too. Right? And it happens to the best of us where you get laid off or something happens or whatever. Right? So there's no shame in that at all.

(John at 00:41:00) Sometimes you just need a job to pay the bills. Cool. But keep your head on the swivel if you're in that situation. Don't let yourself get in a funk. Keep your head on a swivel and have those conversations and think about what the career move is for you and reach out when that makes sense in that way.

(John at 00:41:20) And I think that's the right mix to have. And I think that's the problem is a lot of people who ask how do you get a job and you give them that kind of advice. They're thinking, well, yeah, but I need a job right now. That doesn't help me. Okay.

(John at 00:41:33) Go get that job right now. Take care of the base level—

(Joel Beasley at 00:41:38) Of your needs. And then build a network because that's how come you're in this position right now. You're in this position right now because you don't have a network.

(John at 00:41:46) That's right. That's right. So do something, anything to get a couple of your bills paid and start building up that network, and then from there, roll in. And I think that's good advice for the people who are just trying to get in. And it's funny, I get this question a lot because I teach cybersecurity at George Washington University. I teach on the side. And I get a lot of students who ask me. They're like, hey, I'm mid-career, but I'm changing careers.

(John at 00:42:13) I don't have a cyber background, but I'm using this as a springboard. How do I get that first cyber job? And I that's kind of what I tell them is, hey, do whatever you can, and it's going to suck for the first year because you might be getting paid less than you thought you were going to when you started down this program. But let somebody take a chance on you.

(John at 00:42:35) Keep your head on a swivel, build out your network, and really start pushing. And if you're willing to do that, chances are it's going to turn out really well for you.

(Joel Beasley at 00:42:42) Oh, I haven't met anybody who's willing to do it and has done it that it hasn't worked out super well. Right. It's the rule. It's not the exception. You put the effort in, you'll get it.

(Joel Beasley at 00:42:51) A lot of people get stuck at that stage of debating whether or not they should put the effort in. And it's like, you've got to get over that, homie.

(John at 00:42:58) Agree. Agree.

(Joel Beasley at 00:42:59) Yeah. I think it's also worth noting too, you've got me thinking about my past self and how I would have heard and interpreted some of this advice. And whenever I would hear something about networking, I was like, oh, that's nonsense too. Right? Just like the sales thing.

(Joel Beasley at 00:43:16) And so the easiest way that I've found to explain it is the way you can network is just by being useful to other people that are in the space that you want to be in. So just find a way to be useful, and you don't always have to build your network up. If you know how to do programming, you can teach people Hello World that don't know any programming at all. And you can build your network that way and then through peers and then, you know, so on. So building your network is simply just bringing value to other people that you want to know.

(Joel Beasley at 00:43:45) It's not gimmicky or exchanging business cards at scale to as many as you can get. It's just about being useful to other people because then, you know, you get one piece of trust. You get into that network or that node to trust you, then they'll refer you and talk about you to their whole network. So it's a compounding effect.

(John at 00:44:05) Yeah. I agree, and I just want to circle this back all the way back to zero trust for just a second because there's one thing that I think is worth bringing up is that, you know, being useful to someone and having that work, that's what executing the mission is all about. Making those decisions, whom I'm going to trust at what level for now because we are useful to each other in the now. And maybe that turns into a long-term thing. Maybe it's a very short-term thing, and that's okay.

(John at 00:44:38) If we take that same human interaction concept and apply it to technology, that's what we're trying to accomplish with zero trust solutions is establishing an enterprise where we can make decisions in the now about how much I'm going to trust this transaction or this person or this thing that's requesting this bit of information. And maybe the answer isn't just yes, no. Maybe the answer is yes with conditions or yes for a period of time or yes with additional monitoring for now until we continue to build up that trust relationship just as building up your network sometimes takes time. And I think that's one key element. And then the other key element that we talked about, you know, with the John 1.0, okay, that life has ended because I reached the end of that story, but that isn't the end of my story.

(John at 00:45:36) Rolling into John 2.0, that requires resilience. And I think if we apply that same resilience model to cybersecurity, not every breach has to result in the end of the story. It's just the end of that particular story. And, okay, how do we move on so that it doesn't become the end of our story? It doesn't become a species event for our organization or for our national security or whatever.

(John at 00:46:03) And I think if we apply it in that manner rather than thinking of it as a zero sum game, as an all or nothing thing, we're really going to end up serving ourselves better and end up with a more secure environment and a much healthier environment both from a digital perspective and as we've been talking about, a personal perspective. I really—I didn't expect this conversation to go this direction, but I like that it did.

(Joel Beasley at 00:46:27) Yeah. No. Thank you. Man, we made a podcast. How do you feel?

(John at 00:46:31) I love it.

(Joel Beasley at 00:46:31) Thank you so much for listening. And if you found this episode useful, please share it with a friend or colleague who you think would get value from it. And if you have topics that you would like to hear discussed on the podcast, either add me on LinkedIn, or send me an email [email protected]. Every time I get an email or LinkedIn message, it absolutely makes my day and inspires me to keep going.