Burnout and Cybersecurity…What No One Talks About
There I was, 33 years old about to embark on the next greatest chapter of my career. I had already surpassed my goals to be promoted to higher grade at my government job. I was on track to become a GS-15 (which is the equivalent to a colonel in the military) by 37, and wanted to become a senior executive before I hit 40. I had big dreams, lofty goals- maybe a bit too big for my own good. For years I had been burning the candle on both ends, and put my physical and mental health on the backburner. I saw them as major hurdles, unnecessary obligations on my path to rise up the government ladder. How wrong I was about neglecting my precious health, and eventually my body received the message loud and clear.
Part of why I’m sharing my story is to provide a disclaimer to those who are currently thinking about joining the ranks of the frontlines of cybersecurity, “securing the nation”, and any other catchy cyber phrase you can think of. Everyone knows about the “great resignation” where millennials choose to quit their high paying jobs, especially people in tech. When I walked away from my secure government job, people thought I was legitimately crazy. I mean why would I give up such security, to leap into the unknown of the private sector? It was because I found that the price that I had to pay was too much, the cost of admission suddenly became too high.
What people don’t understand about working in cybersecurity is that you live an extremely sedentary lifestyle with little to no work-life balance. You spend more hours staring at data on your screen then with actual people, which can’t be healthy in the long run. You spend more time trying to keep up with the latest threats and technology, and it’s a constant battle to get newer certifications. Literally as soon as you finish one course, you’re onto the next one. It’s a field where you’re constantly having to keep your mind engaged to learn about the next technology, threat or vulnerability. It’s a never-ending hamster wheel of development. This can lead to fatigue and cause a mental denial-of-service because you’re just taking in too much data. Everyone in this field is busy keeping their systems up to date, but their bodies are severely degraded and at risk of being decommissioned.
People who glamorize cybersecurity only think about the high paying salaries without accounting for what people in this field have to do to keep it together. It’s not easy field to work in. Often times I went without any breaks, neglected to get annual checkups, and was chronically sick. My body started breaking down and I was suddenly diagnosed with fibromyalgia and would have these crazy flare-ups where I was chained to my bed for days on end. Only to find out later this was actually caused by chronic stress that I took upon myself like some cyber martyr. My wakeup call and rock bottom was when I ended up in the hospital for several days due to severe exhaustion and depression. I had neglected my mental health for so long and finally I started to take notice. Poor mental health is typically very common for those in cybersecurity because we often go without true human connection, and a fair amount of us are introverts.
We don’t necessarily enjoy socializing, we prefer information over people. We may even put off speaking with a therapist or counselor, for fear of someone exploiting our vulnerabilities. For those of us who work remotely and don’t physically go into an office- it’s can be extremely isolating. It’s literally against our biological makeup to live in this manner. For as long as humankind has been on earth; only in the past few decades have been completely devoid of connectivity at this scale. Instead of developing relationships, we indulge on Twitter feeds, Reddit posts, and compare our lives to others on social media. We “opt-in” for short fixes of dopamine and “opt-out” for deep social connection. We go from screen to screen without ever taking a break in between, except to sleep and recharge our physical batteries.
When you find more comfort at staring at a binary file than going out to eat with your friends or visiting a sick family member, then something in your bios has been corrupted. At a fundamental genetic level, we’re not really meant to go for months staring a screens and not connecting with a single soul. What people don’t realize is that if you neglect your health and exchange it for your career, eventually your body will give up and start breaking down. While we’re patching systems, someone needs to speak out about patching our relationships and mental health.
I am speaking up about this because I want to provide some life lessons learned along the way, and hope that you will start prioritizing other things such as your health. There is more to life than your illustrious career in tech. This is why I wrote this article; to somehow speak to my younger self, and tell her that this career is not something you should sacrifice your health over. I would tell my younger self to slow down and enjoy the moments with your kids and stop stressing over failing the next cert. I would tell myself that if you don’t take care of your health, eventually your body will deteriorate to the point where you will end up in the hospital and in the worst case scenario, cause permanent damage. Thankfully, I was able to reverse a lot of damage I caused, but I’m still working on making up for lost time. You only get one body in this life you have, and if you don’t take care of it, it won’t take care of you.
When you have that big presentation at BlackHat, your body may just wake up one day and say I don’t give a shit about your goals, I’m going to pass out and end up in an emergency room. Even Steve Jobs who is considered one of the most creative and brilliant minds in tech, died before his time. I can’t exactly say why, but all I know is that chronic stress and anxiety takes a toll on anyone. Your health doesn’t care if you’re a tech billionaire, you could put so much pressure on your body that it disintegrates next to nothing.
Obviously, not everyone is as extreme as I was, but I found that more often people in this field are actually like me. We all want to achieve cy-lebrity status and get more certifications and letters after our names. However, it will come at a cost and often it will be your physical and mental health. I decided to share my story because burnout is so common for those who work in cybersecurity and it doesn’t have to be that way.
Fast forward today, I have learned from my mistakes of constantly prioritizing the next ticket in exchange for my mental and physical wellbeing. Luckily, I have found a great company to work which does allow me to be a go-getter but with guardrails. This took an act of courage and tremendous amount of risk on my part, but I have zero regrets about finding more balance and shedding the cloak of so-called “security” which held me down for so long. I can say that I’ve grown and learned from my poor habits and not prioritizing my life correctly.
You see, burnout doesn’t discriminate on your race, gender, or financial status. Your body could literally care less that you are a CISSP. It cares that you’re not feeding it the right foods and taking your vitamins and meds like you’re supposed to. By any means, I am not a marathon runner, health junkie, or supermodel. But I am making small and intentional changes in my daily habits and trying set some boundaries. I often remind myself to look at the big picture, and I’m more conscious about the projects I take on and mindful of what it will cost me. Remember, no matter how amazing your mind is, you still have to reside in a body. You still have to feed it with fuel. A car without gas will breakdown on the side of the road whether it’s a Ferrari or a Toyota.
Another thing that people don’t share about burnout is that you will spend more time recovering from it than you spent on those years of productivity- therefore it is basically a zero-sum game. A more balanced approach is to still achieve your goals, but do so with an understanding that you need to schedule breaks in between. I once read this quote that said: “When you get tired, learn to rest, not to quit.” All those months and years you spent getting ahead will be followed by periods of recovering from exhaustion; physically and mentally recovering from the damage you’ve done.
This is my message to those in cybersecurity, please take the time for yourself to do something you enjoy every single week, if not every day. Take time away from the screens and go outdoors, slow down and enjoy the simple moments. Spend your money on vacations, not on a fancy Tesla and gadgets. Do what makes you feel alive and happy, invest in restoring yourself the best way you know how. Get out of your home office, take off your sweatpants and go meet a friend at that cool spot that you always wanted to try out. If you don’t feel like you have time, force yourself to reevaluate how you’re spending that time.
Forget about keeping up with the Kardashians, live your personal best and don’t take yourself so seriously. At the end of our lives, we will not be remembered by our certifications and the bullets on our resume, we will be remembered by the connections and contributions to others. Our legacy should not be one of being a burnt out, unaware, half-functioning individual, but it should be remembered by our ability to adapt and overcome and most of all, have fun.
Live foolishly, stay curious, and don’t forget to take care of yourself along the way.
-J.K.
