You Don’t Need Another Cybersecurity Certification…Do This Instead | Root To CISO Podcast

Certifications feel like progress… but this episode shows why they’re often not what actually moves your career forward.

In part 2 of our conversation with Adam Robertson, VP of Enterprise Technology & Information Security at Virgin Galactic, he unpacks what really creates momentum in a cybersecurity career and why relying on certifications alone can leave people feeling stuck.

 As he reflects on his own journey, from early roles through to leadership, it becomes obvious that the biggest opportunities didn’t come from what was on his CV, they came from being in the right environments, building relationships, and putting himself in positions where things could happen.

We get into:

•  Why certifications help you get started, but won’t move your career on their own 
•  How the “learn, certify, apply” model is becoming less effective 
•  The role networking and proximity play in unlocking real opportunities 
•  The value of broad experience across cybersecurity domains 
•  Why specializing too early can limit your long-term growth 
•  Why fundamentals matter more than chasing the next certification or trend 

If you’re trying to break into cybersecurity or figure out why your progress feels slower than expected, this episode offers a more honest perspective on what actually makes the difference.

Certifications aren’t the problem, but they’re not the solution either.

🎧 If you haven’t watched Part 1 yet, go back and start there, it sets the foundation for everything discussed in this episode.

#RootToCISO #CyberSecurity #CISO #CareerGrowth #CybersecurityCertifications  #Leadership #Hiring #CyberSecurityTips 

Transcript

Speaker 0:00

Hi, and welcome to the Root to CISO podcast. It's me, Kris Rides. I'm gonna be your host and I'm gonna be chatting to seasoned chief information security officers about their career journeys. We're gonna be unencrypting their real life stories and searching for the hidden keys to help you fast track your cybersecurity career

kris-rides_3_06-05-2026_142408 0:21

Hi everybody, and welcome to, part two of my conversation with Adam Robertson. We were talking about, at the time, talking about all different industries and working within different industries, and I was sort of thinking about it. Y- you were obviously at Protiviti a while, which is a consulting company. Going back on that conversation, like do you think the fact that you'd worked in consulting before also probably opened up the fact that some people may think that you're less sort of stuck in one particular industry?

adam-robertson_3_06-05-2026_142408 0:51

Yeah, I definitely. At, the time especially, it definitely shows you can be, adaptable, right? And I think that's something that, some companies would really admire and want in their, in their employees. So I would say definitely yes. I mean, now it's been, you know, 10 years since I've been doing that, so maybe not now, but

kris-rides_3_06-05-2026_142408 1:11

Yeah

adam-robertson_3_06-05-2026_142408 1:11

at the time when you're looking for that next position, it really does help play a big part in it. So yeah, 100%.

kris-rides_3_06-05-2026_142408 1:19

I think with all of that, like probably working for a consulting company, working in different industries, like building your network in different industries, like, that's absolutely key. I know how you've managed to get your roles previously and, and, and you know, a lot of that was sort of down to networking and building relationships and coming back and working with the same people in a new, you know, in a new position. Um, what would the advice be you would give right now for people that are either trying to move up into leadership or are out there sort of, you know, out of work currently trying to make the move into, uh, into a new role?

adam-robertson_3_06-05-2026_142408 1:59

I, I, I, to answer the second part of that, in terms of getting into a new role or at least, or breaking into cybersecurity in general, um, I'm probably just gonna repeat the same thing, you know, a million people have said in the past about the networking aspect of it, right? Um, it is very important. People need to know you, what you're like as a person, because you, you can't describe your character on a Word document. So when... I'll give you an example, actually. When, before I joined Protiviti, I wanted to get that visibility in, in the industry, right? In the community, local community of Cybersec. Um, and OWASP wa- is one of them, right? You can, there's probably an OWASP chapter everywhere you go,

kris-rides_3_06-05-2026_142408 2:43

Yeah

adam-robertson_3_06-05-2026_142408 2:43

There's plenty of others as well, you know, CSA and everything else. but I started going to those OWASP meetups, um, as an attendee. there practically every time it was on, which was once a month at the time, I think. went there for networking. It was, you know, free beers and free pizza, so it was like a win-win all round. Can't complain at that. Um, and it got to the point where, you know, the more you go, you know the people, the more you talk to the people that organize it, the other attendees, right? And it kind of got to this point where, the guy running it at the time wanted to step down, essentially. And I said, "Well, look, I will help,", "but I don't want to be the, primary guy. I'll, I'll be secondary guy. I just wanna help." Um, well, it, it kind of got lost in translation along the way, and I didn't show up for beers one night, and I was volunteered to be, you know, to run it. So show up for beers with your friends, otherwise they'll stitch you up. That's my lesson for everyone. Um, so when, when I was doing it, when I was running OWASP OC, I had help, right? There were people helping me., But one of the responsibilities is, right, you need to try and find speakers that will come in, uh, present. it sounds quite easy, right? Like, well, we do one a month. If I can find 12 people, we're solid for a year. Y- y- yeah, it, it's not that easy, right? So, it kind of forced me, in a way, to network differently. So there's networking where you go to the meetup and meet people, right? And you have a beer with them, and you, you, you build a bond and a friendship and all that. But when you're kind of running the show and you have to get the speakers in, there's an element of pressure there, right? Um, and so I would spend my Saturday mornings, like before the wife woke up, because I'm working on a Saturday and the wife's awake, it's a, it's not a good day for me. Exactly.

kris-rides_3_06-05-2026_142408 4:47

Big trouble.

adam-robertson_3_06-05-2026_142408 4:47

I'd-

kris-rides_3_06-05-2026_142408 4:48

Big

adam-robertson_3_06-05-2026_142408 4:49

Yeah, exactly.

kris-rides_3_06-05-2026_142408 4:49

OC.

adam-robertson_3_06-05-2026_142408 4:50

So I would, I'd wake up a bit early on a Saturday. wake up quite early anyway. But anyway, I, I would reach out to random people and, um, the, there's something... I remember one example, right? There's something called Web2py. Uh, it's an open source, full stack, secure web dev everything, right? Fantastic. and I knew about that from years and years ago when it was a little bit after it was founded, but a buddy introduced it to me t- time before this, I thought, "Well, that would be, that'd be a good topic, right?" 'Cause Web2py is not broadly known. Well, at least it wasn't back then, which I'm talking 10, 12 years ago. and so I just contacted them, right? Contacted the guy, uh, Massimo Di Pierro, and I said, "Hey, I'm running OWASP OC. I'm looking for presenters. Um, any chance you or someone might be interested in coming in just, you know, hour chat, just talking about how Web2py is secure, already protects you from SQL injections, CSRFs, all that kind of stuff," right? he got back to me and he said, "Oh, yeah. You know, h- how did you hear about us?" I was like, "Oh, long story, but through a buddy." And he said, "Let me, let me reach out to some of the contributors to the project and see if there's someone local that would be up for it." I said, "Great." So he then gets back to me a few days later and he says, "Hey, I tell you what, if I can do this, you know, in, in June instead of May, and you can do it on a Saturday instead of a Thursday, I'm gonna be in OC. Do you want me to do it?" I was like, "That'd be fantastic." So sure enough, right, the, the... One of the founders of the, the Web2py framework, he, was, you know, he was coming over for family business or

kris-rides_3_06-05-2026_142408 6:42

Yeah

adam-robertson_3_06-05-2026_142408 6:43

Um, he came in, we did a Saturday OWASP OC instead of a Thursday, and he presented the whole Web2py, you know, why it's secure the OWASP top 10, right? So It forced me a little bit out of my comfort zone 'cause I'm not, uh, you know, I don't normally just randomly hit people up on LinkedIn and be like, "Hey,

kris-rides_3_06-05-2026_142408 7:04

Yeah.

adam-robertson_3_06-05-2026_142408 7:04

how you doing?" Um, and so that, that's one part of the story, right? And then through that, I, I knew a couple of other people that would go, um, and we ended up... There was four of us actually. We went, we ended up entering a, I think F- Facebook put it on. It was down in San Diego years ago, right? And I think some of the Facebook engineers, security engineers and all that, they put on a little hackathon in like a public place that they rented out, it was all free, right? Um, you just basically showed up and they supplied, you know, beers, ice cream, pizza. So four of us cruised down to San Diego, um, and we, we did this hackathon. It was only like a, a one-day thing, right? We didn't pl- we, we didn't prepare for any of it. We just thought, "Oh, we'll go down. We'll have a laugh." Luckily, my team was really good, so like

kris-rides_3_06-05-2026_142408 7:59

Yeah

adam-robertson_3_06-05-2026_142408 8:00

you know, I was the, token guy that didn't really know what he was doing. But- Yeah,

kris-rides_3_06-05-2026_142408 8:06

Riding on their ta- on their coattails.

adam-robertson_3_06-05-2026_142408 8:07

I, I just drank their beer so they didn't feel left out. and we did this hackathon, right? I remember actually, we were doing terrible. It was obviously a time thing, right? And it's like, oh, you know, get to the end and most points wins. We were doing awful. Uh, and there's other teams that were coming round, and they had like their, you know, their girlfriends and whatnot there. You would hear them like point in the room 'cause everyone had a room each. Were like last place by like a gillion miles. Like we were-- it wasn't even close. And there was only maybe like 10 teams, but we were like zero points, you know, something like that, 'cause we're all drinking, having pizza and whatnot. Um, and then it got to a point where we just tried a little bit harder and I was playing around with this like encryption thing and I started figuring it out and I was like, oh, hang on a minute, no one else has done this. And there's a big like, you know, 50 points, whatever, I don't know. And so then I, I suddenly got that and one of my other buddies did this hack and, you know, someone else, and, and suddenly all our points just shot up the, the, the table, right? We ended up coming third. I still have the little, uh, coin that says, you know, third place Facebook hackathon or something. It's in my drawer somewhere. but one of the guys that was on my team, uh, he was actually working for Protiviti at the time. name was Adam Brand. Um, great guy. Learned a lot from him. Um, and he was the one that, you know, within weeks after that... You know, he, he'd known me a bit because of OWASP OC, but then we did the hackathon for fun, whatever. Um, he was then like, "Hey, you know, we're always looking to expand our, our, our consulting practice." Um, interviewed there, and that's kind of how I got into it. But, you know, from when I went to OWASP OC originally, I was looking at it as, right, let me build my network. Let me find people that are like-minded. Maybe I can learn from them. Maybe something comes of it, maybe something doesn't, right? But it was more interest, and then it turns into fun because, you know, like I say, there's a couple of beers floating around and a bit of pizza and whatnot.

kris-rides_3_06-05-2026_142408 10:11

Yeah, you meet some good people, like-minded people. Yeah

adam-robertson_3_06-05-2026_142408 10:15

exactly. And so then, you know, it went from that to like this fun hackathon to, uh, a new job, And, and then you're in that consulting world and, you know, as we already discussed, that kind of opens different doors because of your flexibility and adaptability. So yeah, I would say, I know it's a long-winded answer, but I would again echo what other people have said to people trying to make that change is, is the networking, right? And but not just going to the networking events, volunteering. And I, I'm not suggesting jumping in the deep end and saying like, "Hey, I wanna run the show." That's a bit scary. But definitely say to the person running it, if... Is there anything I can do to help?" You know, whether it's find a speaker or set up the tables or, you know, order the food, just something that kind of... Ultimately, you're sacrificing your personal time and, and that shows that you're interested, i-in my opinion. If

kris-rides_3_06-05-2026_142408 11:11

Yeah

adam-robertson_3_06-05-2026_142408 11:12

to say, "I'll sacrifice my Thursday night and my Saturday morning," it just goes a long way. Mm-hmm.

kris-rides_3_06-05-2026_142408 11:19

I to-, I mean, you, well, you know a bit about my background, so you know, i- you know that I am, me and you are on exactly the same page with that. And I know through, you know, through, through us working together that, like, finding people that volunteer and get involved, they're always very high up in some of the things that you look for when you're hiring. I think that's a great story, and I think there's, um There's a lot to be said, right? All of these organizations are run by volunteers and, and you can't do it without volunteers, and you can't get enough volunteers. You know, you very rarely are people turning down people that are willing to help. And, and quite honestly, you don't have to have an official thing to be just like, "Oh, I'll just help you tidy up at the end of the meeting," right? It's amazing, people just assume it just magically gets done, but there's multiple people there that are still picking up plates and taking the trash out from, you know, from the offices or what, whoever's been kind enough to give you the space. You know, you leave it in a mess, you don't get that space again. So,

adam-robertson_3_06-05-2026_142408 12:16

Yeah

kris-rides_3_06-05-2026_142408 12:16

you know, and I think even, you, you do, you meet people you connect with and, then you have these awkward conversations like I have with my wife, where I'm like, "Oh, I'm going out and, uh, I've got to this conference. I'm super excited and I'm seeing so and so, and so and so." And they're like, "Oh," and she's like, they're your friends?" And I'm like, "Yeah, yeah, my friends." "This doesn't sound like work." And I'm like, "Well, you're allowed to have work friends, right?" You know. All of a sudden I'm like, you're like, "Well, you know," and they do turn into, like, I've been, like, I've gone on a few sort of things with CISOs and friends and, and clients and other people and, you know, end up, a couple of days before RSA going on wine tasting events and stuff like that. Um, which, my wife's very, very jealous, uh, uh, very jealous of and, and definitely says, "Well, are you, are you supposed to be at a conference two days early?" And I'm like, "It is work, I promise you." But the great thing about it is you end up, you end up, like say, working with people you generally like, genuinely like. You don't sit there and, you know, you didn't ask for a job. You weren't saying to the person, "Can you hook me up? Can, you get me in there?" In the same way that I'm not going out there saying, "Oh, I'd love to help you fill your positions. Come, you know, like, will you be my client?" Right? I wanna, I wanna get to meet people and, and if that stuff comes of it, which it will do, if you're good at your job, whether that's being a recruiter or, or being a security engineer, if you're good at it, people recognize that and then they wanna work with you, right? So I don't, um, I don't think that's, I don't think you need to go knocking on doors and forcing the subjects. If anything, when you do, that stuff doesn't tend to work out so well. So no, not at all. I think that's a absolutely great example of that. Now, what I'm interested in is how you feel, like with AI coming in over the last couple of years and changing an awful lot of stuff, has that had any change on the networking? Is, has that made it more important, less important? You know, has that changed anything that people should be doing?

adam-robertson_3_06-05-2026_142408 14:17

I'd say it's probably more important. I think the human element of, of life is way more important now, right? It's, um, from everything from, you know, people applying to jobs, right, to the work being done I see a lot of resumes come through from candidates, and especially over the last, I'd say over the last six months or they're almost identical.

kris-rides_3_06-05-2026_142408 14:47

Hmm.

adam-robertson_3_06-05-2026_142408 14:47

Mm. they're, they're a little bit different. But if you, if you kind of like, you know, if you weren't reading the words and you kind of held them back a little bit, they're like 99% the same. They're just same layout. You know, you can just see it. And I think that makes it hard as a, a hiring manager, right? Because now I'm looking at 50 excellent resumes. One, two, three, four, 10 of them might be legitimate rockstar people that, you know, I, I would give my right arm for to get on the team. But the fact that there's gonna be the fluff of the 40 to 45 AI-generated resumes, I can't read through them all. And even if I do, they look exactly the same. am I gonna talk to? I haven't got time to talk to 50 people. Like, it doesn't work like that. So, um, I, I think the referrals is... I, I

kris-rides_3_06-05-2026_142408 15:45

Mm-hmm.

adam-robertson_3_06-05-2026_142408 15:45

Mean, not that referrals weren't useful before, but I think they're even more useful now. and, and I think, we talked about, going to the local meetups, whatever they are. You're gonna meet people who are like-minded, hopefully, uh, that you eventually build that bond with over time. But I'd also say look at your network, right? You know, the mates you went to school with, like, they probably work at some company. They might be in something completely different, but there's a chance that company needs an infosec guy or an infosec guy or, or an IT right? Um, ask them. Like, there's nothing wrong with utilizing people that are not professional to try and get a cybersecurity job. So, there's obviously a lot of benefits to AI. There really is. it does make very challenging, right? The... You, you got the AI generating the resume, and then you got the AI ATS system looking at it.

kris-rides_3_06-05-2026_142408 16:46

Right.

adam-robertson_3_06-05-2026_142408 16:46

say, "Hey, you look great, you look great, you look great." So there needs to be something, something different, and I think that's the human element, right? It's the what's this person like? Are they good? Are they gonna show up? Are they keen? Are they eager? Do they wanna learn? Like that type of stuff. And like you say, it's not gonna happen overnight, so start it today if, if you can. Get out there. Just do it.

kris-rides_3_06-05-2026_142408 17:10

Yeah. It's looking for those differences, right? And getting the people that say, "This person's good." The other thing that a, like a lot of people are encouraged to, like, find somebody in the business that can internally recommend you, but everybody's trying to find somebody. So if you don't really know the person and you're asking them to do you a favor or recommend you, those recommendations do go along with, with the person's, name, right? So if I'm saying, "I, I recommend..." Even as a recruiter, you know, we've had this conversation where like, "Look, here's the resume. Let me tell you a bit more about them. Uh, it's definitely worth having a phone call with the person and having a conversation. Don't think the resume tells the whole story." Right? I would go out on my limb to do that because we've spoken to the person, qualified them, we understand them. If you then start asking people internally to go out on a limb for you and you've never met them before and you're just hoping that they can do that, um, it's not gonna work. And, many people are asking the same question of all the people that are on LinkedIn. And so get to the point where you really do need to network and get out and meet people and have somebody that can recommend somebody to somebody else, right? It's your degrees of separation. Um, yeah, standing out from the crowd is more difficult than, than ever. Um, and then how-- And, and I know you're a big... Bigger companies tend to silo a lot of people, and I know we talk, me and you have spoken a lot of times about siloing, and it's not something that you're a big fan of. Um, how do you manage to sort of build your teams out without siloing them or, or still giving them the opportunity to have other, other areas of interest or skills to, to develop?

adam-robertson_3_06-05-2026_142408 18:53

Yeah. And I, I know the, this is gonna change depending on the size of the company, right? If you have 150,000 employees, it's a very different story to, 5,000 employees. The reason I like trying not to silo is because, a few reasons. One is I don't want the person to get bored,

kris-rides_3_06-05-2026_142408 19:13

Mm-hmm.

adam-robertson_3_06-05-2026_142408 19:14

if you get put in a role and it... that's it, it's great for the honeymoon period, right? The three months to six months, and then you get to that 9 months to 12 months and they're bored, maybe they get a bit longer, but maybe at the two-year mark they're, they're thinking, "Well, what am I gonna do next? Just be a senior of what I'm doing? But I don't enjoy what I'm doing." So in bigger companies, like I say, you know, 100,000 employees, you might need that dedicated person and there's a lot, you know, the honeymoon period might last three years or four years or five years. But in smaller companies it might not What I also like about people getting exposed to as many areas as possible is then they have a much better perspective. Their input becomes way more valuable. And I always give this example, and I don't know why I pick on it, but I do. But vulnerability management, right? It's, it's one of those things where... And I, I have actually spoken to candidates in the past where someone says, "Hey, I 10 years plus in vulnerability management" with whichever tool, you know, they've got experience with. And it's great. We need it. They're an expert. They're gonna come in, they're probably gonna be up to speed in about three weeks because it's just, you know, nature to them. But they don't always understand other pieces, right? Especially on the business side. They... know I've got a patch and I know I've got to tell someone," but they have no idea what the impact could be. They just know that they should be telling someone through a change control ticket. But it's similar with other elements of cybersecurity, right? So they're gonna be this expert in whichever domain, but that's one part of a puzzle, right? If I give you a piece of a puzzle and I say. What's the picture?" You're kind of guessing a little bit, right? You're looking at it saying, "Well, it, it could be a dog, or it could be a cloud. I don't really know, actually." Well, if I give you every piece of the puzzle, you know what the picture is. Now, there's a learning curve to that. Um, I think there are some people that don't want to do that because it can be overwhelming, and I understand that. and there are other people that really love it. And I'd say through the teams I've built, it has been people have loved it off the bat. That they just love that kind of like freedom and, uh, exposure and, you know, they constantly, they get a little bit bored of this domain, so they move over to that domain, right? That type of thing. Um, and then there's people I've hired that weren't used to that mentality and that, that way of working, and it took them a bit of time, right? It can take three months, six months, whatever, and then they love it. They love like the fact that they can log into that system and log into that system. Um, but it, it's not for everyone. it-- I like it because I, like I say, I'm one of those people that doesn't want to get bored. I can be in 10 systems instead of one, I, I choose that over anything. But again, different people prefer different things.

kris-rides_3_06-05-2026_142408 22:19

Yeah. But I mean, 'cause you're treating people the way that you wanna be treated, and I think there's a lot to be said for that. And I know you personally, and obviously I know a lot of the people that have worked for you and with you before. And, um, y- you know, the, the headache always for me is like wherever you go, I wanna keep working with you, but all of the people we've placed previously wanna keep working with you. So got You're filling your own positions with them. So you're backfilling them, so But that's a great sign, right? It's a sign of a good leader, right? When, when, people move on, then the fact that the, the people that are still there wanna continue working with them is a great sign. So I think that's, I think that's amazing. Now, if you look back, and, and this is a question I've asked a few of my guests, but if you look back at your whole career and you go back to, the younger Adam, um, and you could give yourself one piece of advice, what would be that one piece of advice you'd give yourself?

adam-robertson_3_06-05-2026_142408 23:21

I would say to Put more effort in while you're younger and have the energy. I feel that... A-and I think I did, right? I think I kind of did a lot of self-studying and sacrificed a bit of time, but, do more, learn more, be a sponge while you're younger, Because life kicks in later, right? You get married, you have the kids, you have a house. That time to learn evaporates, So if you're, if you have the opportunity now, just study, study, study, study. I don't necessarily mean go to college, go to university or, or do a course. You can set up a home lab, right? If you really wanna show, uh, maybe that's a differentiator as well, right? Is resume's hard to show cybersecurity experience when you don't have it. But if you have a home lab or a, you know, cloud lab, I guess, these days, you say, "Yeah, I've, I've spun up all these open source tools." Yeah, an enterprise probably isn't running those open source tools, or at least all of them. But those tools fall within a domain, right? You can get, uh, you can get an open source SIEM tool. You can get an open source vulnerability scanner tool. You can translate that, right? And so I think if I was younger, I wish I did that more. I wish I actually we didn't have the cloud back then, right? It wasn't really a thing back in the dinosaur era. But home lab, right? I could have done that. I could have said, "Right, I wanna learn more on info sec. Let me find some open source tools." And I know there probably wasn't as many around back then. But doing that, I, I think that's something that would've probably excelled me or accelerated me a little bit quicker. so take the time, right? Like I know everyone's out there wants to have a party and all that, and do it, but, uh, I, I could have probably spent more time on that, it would've got me where I wanted to be quicker. And that, I think that's another problem actually, is, uh, and I'm guilty of this, is when you're younger, you kinda chase the title or chase the money, right? Depending on it is. Um, just, just don't. I mean, I know everyone wants more money and they need it, especially in this day and age. But on just being extremely strong at the fundamentals, and that'll carry you through for decades. Everyone's very... I don't wanna say everyone. I, I find some people a very shiny toy,

kris-rides_3_06-05-2026_142408 25:46

Mm-hmm.

adam-robertson_3_06-05-2026_142408 25:46

the shiny toy? Just 'cause one company uses a shiny toy, the next one doesn't necessarily. So understand what the tool is doing, understand how it works, and you'll maintain that knowledge forever, and you can translate it or transfer it, sorry, from every single tool there is on the market. So don't rush it, but focus on the fundamentals.

kris-rides_3_06-05-2026_142408 26:06

Yeah, I like that. I think understanding how's, how the actual tools work is more important than learning the tool itself when, you know, 'cause if you pick one specific tool and you become the guru of that tool, and it turns out that some competitor ends up taking all the market share, and that isn't the tool anymore, if you haven't learned how those types of tools work and you can't apply it to a, to their competitors, then you find yourself sort of isolated and, and perhaps struggling to get your next role, right? Unless you really are lucky and the, the, the thing you choose becomes the thing. So yeah, I, I like that. I also think when I think about your career, you know, when you talked about it in part one, you talked about certifications and, you know, you saw this certification, it sounded really interesting. And I think, like, I wanna ask you a little bit about that because I think the way you discussed it is the way that I would love more people to be thinking about, 'cause that's one of the most common questions we get, right? What certification should I be doing? And like the truth is, I can't answer that for people because it should be driven by your interest, and if it drives your interest, you might end up using it more often or it getting you into a role. Um, you know, back when you were looking at those things, like what was driving you? How did you pick them? Um, because that sounded like that gave you the major opportunity to get into security.

adam-robertson_3_06-05-2026_142408 27:31

Yeah, I think. So yeah, so I think the, one that interested me originally was that certified ethical hacker. Yeah.

kris-rides_3_06-05-2026_142408 27:40

Mm-hmm.

adam-robertson_3_06-05-2026_142408 27:42

then, you probably didn't meet many certified ethical hackers, right? It was a, a, a lot smaller

kris-rides_3_06-05-2026_142408 27:49

Changed a lot, yeah.

adam-robertson_3_06-05-2026_142408 27:50

Yeah. Yeah. It's definitely changed a lot. Um, I think certification... Sorry if I'm drifting here, but I think certifications in general, um, they help,

kris-rides_3_06-05-2026_142408 28:00

Yeah

adam-robertson_3_06-05-2026_142408 28:02

The problem is you don't know if someone's gone and done boot camp and got a certificate, or someone's been studying the domain for three years, and they just got the certificate to show they can do it. And that's a huge difference. And so it's hard to know that from looking at a resume sometimes. And there's a very different value in someone that's been doing it for X number of years and just got the cert because their company said, "Hey, we gotta spend this training money, or it's gone next year." Versus the person that did that boot camp and they passed, and they don't really remember anything from it. So

kris-rides_3_06-05-2026_142408 28:38

Right

adam-robertson_3_06-05-2026_142408 28:38

there can be value, and I, I, I think I'm on your page as well, as I don't always like telling people what to do or at least offering advice. Because they go do it and it doesn't work out, then I, I would feel guilty, right? So I always... I, I would say, you know, pick the domain you're interested in, right? So when someone says, "Hey, I wanna get into cybersecurity," they obviously don't understand it, which is fine. They, they're trying to get into it. Yeah. But, but what interests you? Do you wanna do, like, governance? You wanna write policies? You wanna do blue team, red team? But what do you wanna do? would even, again, I would say maybe shy away from the certifications at and focus on, again, that home lab, right? Because wanna put money and time and effort into a certificate and then say, "Oh, actually, uh, yeah, I don't like that, to be honest. I made a mistake." up a home lab with open source software and you don't like it, who cares? Spin down the VM, spin up a new one, right?

kris-rides_3_06-05-2026_142408 29:39

Yeah

adam-robertson_3_06-05-2026_142408 29:39

Yeah. Um, and you can keep doing that 100 times a day until you find the thing you like, and then maybe you go look at certificate, right? I mean, that's gonna come down to what are requirements of jobs at that time. And if someone says you have to have this certificate, then yeah, that kinda forces your hand a bit. But if not, then it... And I wanna v- I don't wanna provide a recommendation. Surely, you know, do,

kris-rides_3_06-05-2026_142408 30:05

Not--

adam-robertson_3_06-05-2026_142408 30:05

you.

kris-rides_3_06-05-2026_142408 30:07

I, I totally agree, and I think, um, you know, people are looking for somebody else to answer it. And, you know, you can go on LinkedIn, you can go on Indeed, you can search job, jobs, and you can see which ones are most popular to be asked. But you're absolutely right. If you turn up and you've got, got that, maybe, depending on how the, you know, the, talent acquisition person's filtering, maybe that gets you through a filter. Maybe it's not important at all. I know for us, when we get them on job descriptions and we then talk to the hiring managers, it's almost always like a desirable and not even like a high desirable. "Yeah, it'd be nice if they've got that just because, you know, we know they've shown some interest." But then when you get into an interview and you have to sit down and talk about that domain and what you learn and how you've utilized it, if all you can say is, "I went down a four-day boot camp and I can't remember much about it," right? Or all you can do is quote what you read in the book, it's not gonna be that useful. Um, I agree actually, like pulling together a, a lab or even just like a lot of the training material's free out there. It's completely free. So you can pick a certification that you're in an area you're interested in and just go and do the training and, and look up what's online and learn about it. Make sure it's the one you're genuinely interested in before you go and pay for, for an actual, you know, a te- a test and, and to get that. And then that way you're also more likely to be able to talk about it in an interview. So yeah, I, I completely agree about that. We are almost at time. Um, yeah. It's gone quick, right? It's funny. It's funny when I tell this to people and I'm like, like, "We're gonna need this amount of time to record." And like almost always they're like, "Well, that's quite a long time." But then when you get talking, you know... See, I probably would be even, like say, with a couple of Fosters with us being Aussies, it would've been easier for that. But, um, yeah, it goes quickly. So I wanna ask one last question of you, and it's just really, like if you give one piece of advice, you know, you've hired a lot of people, you know, over the years. You've looked at a lot of resumes. You've interviewed a lot of people. If there's like one single piece of advice that you could give to somebody that's out there that's looking currently, maybe they have experience, maybe they don't, but a single piece that would work for everyone, what's the one thing you would say to them?

adam-robertson_3_06-05-2026_142408 32:28

Oh, that's a, that's a million-dollar question right there. Um,

kris-rides_3_06-05-2026_142408 32:32

And then we'll build an AI thing to answer it, and me and you will turn it into a huge global multi-billion dollar business.

adam-robertson_3_06-05-2026_142408 32:40

I like that. Um, so, uh, yeah, sorry, was the question, uh, to get into the industry? Is

kris-rides_3_06-05-2026_142408 32:46

No, just like across anybody that's kind of looking. So whether they're trying to get in or whether they're already in the industry and, and, and trying to move jobs into, to something that might be a, you know, something better than what they're currently doing

adam-robertson_3_06-05-2026_142408 33:00

Yeah. I, I'd say think about how you differentiate yourself, right? A resume can, but not necessarily, right? So what is different about you compared to the other 300 applicants that applied in the last 10 minutes, Demonstrate your value. Um, whether you're coming from an IT admin role or a sales role or a first-time job out of college, whatever it is, you need to be able to articulate the value you bring as well. So obviously, if you're lacking the experience, then you can't put that on your resume, but about how you can translate it. Your experience can always translate somehow. Um, and if you can get that across in the resume, in the cover letter, or in a networking introduction... Uh, again, I know all, all CISOs are different, but me, I, I wanna look for the person that's a little bit different from the other 100 people that have the same AI-generated resume. And so if you can somehow get that message across, you're gonna stand out immediately.

kris-rides_3_06-05-2026_142408 34:10

Yeah. I, uh, I think that's an amazing answer. I think knowing, know thyself, right? Kn- knowing exactly what your background, what your skills are, understanding that, and then being able to translate it into what that company or the business needs, which means doing a bit of homework, finding out, you know, what's out there. Combining the two is a quick way to, to make yourself, like, distinguishable from everyone else, as long as you can then put that message across. But no, that's a, it's a great piece of advice. Thank you, mate. I appreciate this. Been really good. Learned a few things.

adam-robertson_3_06-05-2026_142408 34:44

Yes

kris-rides_3_06-05-2026_142408 34:45

Both of our dads, BT people.

adam-robertson_3_06-05-2026_142408 34:47

There we go. Thank you for having me. And, uh, yeah, ho-hopefully, uh, Spurs have a better season this year

kris-rides_3_06-05-2026_142408 34:54

Yeah, indeed. Yeah, let's hope so. I'm interested. The World Cup will throw, um, a few curveballs, but it'll be interesting to see if we spend some money and where we spend it.

adam-robertson_3_06-05-2026_142408 35:03

Yeah. Yeah, exactly

kris-rides_3_06-05-2026_142408 35:05

We'll see. Yeah. Anyway, that said, if anything brings, uh, breeds resilience, it's being a Tottenham Hotspur fan. So maybe that's the other thing. I don't know whether either of us would recommend that to the audience. Um, uh, but it definitely is a way to build up thick skin and a lot of resilience. So there you go. You have to start young though, I'd say.

adam-robertson_3_06-05-2026_142408 35:25

Yeah, exactly.

kris-rides_3_06-05-2026_142408 35:26

Otherwise, people just think you're insane. If you choose that as a team, if you choose Tottenham as a team now, they'll just think you're crazy. So there you go. Good stuff. So thank you again, everybody. Thank you, Adam, for joining me. Thank you everybody else for joining me on this episode and, uh, yeah, look out for our third guest coming soon. Thank you for joining us

Speaker 35:46

thank you for listening to the Root to CISO podcast. If there's something you really want me to ask on the next episode, or if you're a CISO who wants to inspire the next generation, please reach out. I'll leave a URL to my LinkedIn profile and make sure you connect and message me there. We're always looking for feedback, so please don't forget to like, comment, and subscribe wherever you get your podcasts.