A Philosophical View on the Responsibilities of Leadership

Introduction to my Personal Belief

Careers are made and broken by supervisors and mentors. It is no secret. You can love your job, your coworkers, and the city you live in, but one bad supervisor can destroy all of that faster than it was ever built. In my career, I have had some terrible leaders and fantastic leaders.

While you can read books like Extreme Ownership, in which some of those lessons are lessons and by-products I will mention in this, my intent is not to regurgitate past principles or to discuss the difference between leaders and bosses, but to talk about problems sets that I have experienced as both a leader and follower.

Background

The Marine Corps will give you a list of leadership principles and leadership traits with some of those running through my head since I became an NCO right before deployment and Sgt. Wilson gave me a candid conversation about the expectations and responsibilities of being an NCO. There are a couple that have always stood out to me and have rattled my brain as I have had direct reports or Marines in my care.

• Know your Marines and look out for their welfare
• Keep your Marines informed
• Set the example
• Ensure that tasks are understood, supervised, and accomplished

While these are phrased in a way that is specific for Marines, you can easily see the applications to them in the civilian world and personal life. So let us rephrase the first two.

• Know your staff, both weaknesses, and strengths, and help to support their growth
• Keep your staff informed of changes, challenges, and successes

I spent the majority of my career so far in the military and/or serving as a government contractor which creates very distinct lines about the responsibilities of each person in the chain of command. As I left those organizations and moved to the private sector, my opportunities skyrocketed, but my expectations of leadership were constantly missing the mark, and very rarely have I felt that those who have been my supervisor have served my needs in my career as I feel are their responsibilities.

With that, I think that it is only fair for me to start to discuss what I believe is the requirement for leadership, in no specific order, and then we will talk about some of the challenges that I have seen over the years.

Beliefs

Belief 1 - Advocation

As you go through your career, you will want to get promoted, attempt different projects, and learn new skills, and at the same point, you will fail at all of those items or essential work tasks. It will happen. However, success and failure are where your supervisor has the major responsibilities.

Let us start with the advocation of your career growth; whether that is promotion or skillsets, we all want to move forward. I am going to assume you have informed your supervisor of your goals and desires for your career (See Inform Your Supervisor below). I believe that they should put you in place to work towards those goals either by providing you with opportunities to learn the items required such as shadowing and trial and error, or by giving you time to conduct your research and have an informed conversation about what you believe that will take to get there. For example, if you want to move from a technical role to a management role, it isn't just being a leader yourself. There are budgets, personnel conflicts, personnel management, planning, and a host of other things that go into it. So you both should take an assessment of your skills specifically talking about your weaknesses and your strengths to see where you need to start working. Once that is done, they should provide you the opportunities to build those skills.

An example of the above would be budgeting. You obviously cannot enter the official budget, but your supervisor can provide you with a copy of the request and give you a deadline to work through it, coming to your conclusions as to how it should be achieved. Then after you are ready, you present your budget to your supervisor just like they will to theirs.

There are a couple of LARGE caveats to this expectation that must be discussed. First, some of these skills that need to be worked on, cannot be worked on without direct exposure. The best example of this is dealing with personnel conflicts and personnel management. Conflicts between individuals will come up and no supervisor should be sharing those conflicts, who is involved, or how it was settled, with anyone outside of those within the conflict. I would make the argument that they are welcome to present either fictitious scenarios or scenarios from previous employment with redacted information as a means for you to tabletop the experience. The second caveat is going to be the primary one that you will hear from management and supervisors, "We don't have time to do this right now." That is not an acceptable answer. This is not an acceptable answer as the work and onus of time isn't on them it is on you. For you to learn you will have to do some work outside of normal working hours. Also, assuming what you are asking for is more technical and work-related, then an hour a week is worth the learning opportunity as well gives them a measurable performance item they can hold you to which allows them to have another way to evaluate you, which in turn gives them another way to advocate for you.

A supervisor should also advocate "you" to you and your peers. What I mean is that when you succeed, you should get your 5 minutes of fame publicly in a meeting. I am not talking about an overshowing of emotion, but a simple comment "I want to take a second and congratulate John/Sally on their work with their project. They were able to create this which will help us speed up our processes. Please reach out to them if you'd like to learn more." I know that there are going to be people who do not like public praise and that is fine. The real praise can be in private about the specifics of what was good, but they need to discuss your achievements in public so your team knows your strengths.

This last paragraph has a story attached to it. When I was first promoted to Corporal in the Marines I gave a task to one of my Marines, one of my best friends who I knew had a hot head. Something about the task really upset him, so he walked away as was his agreement with our section lead (I did not know that at the time). I followed him and began chewing him out for what I believed to be blatant disrespect, but this was in the middle of the hallway surrounded by his peers. I shouldn't done that and I know this because my Master Sergeant pulled me aside and said one thing: "Praise in public, punish in private."

All of this so far has been about how your supervisor should advocate for you in your direct interfacing. However, that is the bare MINIMUM of what they should be doing. The real advocation comes when their supervisor or one of their peers is discussing you or your team.

We all have either been in a situation where someone doesn't understand what you are supposed to be doing, or what you did, or is mad for whatever reason and asks for your supervisor. When that occurs that is where your supervisor should be providing top cover. This means they do not allow that person to unload on you, assign new additional tasks directly, or assign blame and make personnel decisions without your supervisor hearing, deflecting, and fighting to defend you. I am not saying they lie and say you are perfect, but mistakes are teaching lessons, assignments are theirs to assign based on the needs and job they are assigned to perform, and at no time should ANY be allowed to berate you. No matter what, a supervisor should discuss any correction independent of the original person upon the first instance.

For scenario sake, let's say that you made a mistake and caused an issue. Most companies will place you on a correction plan of some type. You and your supervisor should have continued communication about how to correct whatever went on there. Also, once the correction plan is over you should then continue on your original path.

This belief is the basic building block of any supervisor. Without this, they will be unable to fulfill the next beliefs. This baseline encompasses all of the rest, but if they don't advocate for you and with you, the education they provide will be what not to do.

Belief 2 - Education

I spoke about this in the previous section a little bit, but a supervisor should engage in spending time teaching you something that they know and you don't. I am not saying 40 hours a week or even an hour a week, but at least once a month or over a month, they should provide that lesson time.

A scenario that I am specifically thinking about is I am been working on my Python skills throughout the last couple of years. My supervisor a couple of years ago used to teach Python. So our education time was me walking through the program I was building and then him providing different techniques to speed up the program or a different methodology. During this planned time, I did come to him with specific questions I had about how to do certain things, issues I was having, or additional features I wanted to have to not waste his time. This same supervisor also provided time to show how our case-building procedures are done, how the review process worked on the backend, and other company-specific items that I needed to know to get promoted.

As we grow in our careers, we have to learn. Your skills, whether soft (I have been informed these are now called power skills) or hard skills, we will need someone to provide us with that education and mentorship. Your supervisor is the first line for this. I am not saying that supervisors have to know everything and as a direct report, you should know that. However, your supervisor does have something to teach you.

This is where you and your supervisor need to know each other. As I mentioned originally, they should know your strengths, weaknesses, and direction so they can better provide you with the education to get you to where you want/need to go. There is a book called What You're Really Meant to Do that talks about an employee who was the best salesman on his team without question. However, he was constantly overlooked for promotion and it came down to two things. One, his supervisor assumed that he would rather continue to be a salesman because of how well he was doing and the pay cut that would be required for the promotion (Less bonus). Two, when given the responsibility to do some of the more leadership-oriented things, the employee would always put them on the back burner to make a sale since that was his primary purpose and that would mean some of the tasks would not get done. These two things are a failure by both the employee and the supervisor. There was never that conversation of what the employee wanted to do or vice versa where the supervisor told him the expectations to get promoted, such as completing those tasks and/or the importance of those tasks.

Let's assume that the desire for promotion conversation did happen, the supervisor would have had the opportunity and responsibility to inform the employee that these tasks were in line with tasks typical of the next level as well as why they needed to get done. Then the supervisor lets the employee complete the task as they see fit and at the end comes back to show them where they did well and where they could improve making them a better candidate for promotion. That is where the education comes in.

This education mindset also has to come with letting our Ego go. Sometimes you are going to have a supervisor that you do not like, but that doesn't mean you can't learn from them on the technical side or ask them to show you how they do things. The latter could explain to you their experience in their career which in turn gives you the ability to see why you both think so differently.

This belief is not for every supervisor. As with the cyber industry and the idea that "Entry Level" positions need 1-5 years of experience (This is complete crap), some believe that the direct report is required to learn themselves or that they don't know how to teach them. For the former, that is just absurdly wrong since they didn't learn everything themselves, someone taught them how to do what they do; For the latter, sometimes just allowing your direct report to shadow what you are doing or to sit in on meetings will allow them to ask the questions they don't understand.

Belief 3 - Mentorship

Mentorship is what we have already been talking about Career development, leadership development, education, etc., however, it is also the things outside of work that add to the mentoring requirement. "Mentorship is a protected relationship in which a more knowledgeable or experienced person guides and nurtures the professional development or growth of another, outside the normal manager/subordinate line management."

I originally was thinking of putting Education and Mentorship in the same section as they go hand in hand. However, in my current role, I have talked to my wife about this idea of mentorship and she made a great point: "While a supervisor should mentor their direct report, a mentor should be chosen by the mentee and typically you don't want it to be the supervisor as you might feel you cannot challenge them or know how to speak to them efficiently." Sometimes you might be mad at your supervisor and that is expected, but you might not be able to tell them that either because you don't have that relationship yet or they don't have that type of personality to take the criticism in the way that you mean. This is where you either need to ask your supervisor for whom to speak to to learn something you can't get/understand from them, or find one yourself. I spoke about the idea that mentors should be chosen by the mentee and this is where it comes into play.

It is hard for me to say that a supervisor shouldn't be a mentor because that is their primary role by definition. I can think of the man that I worked for the first 5-6 years of my Marine Corps career and to this day he is my friend and mentor. He was not my direct supervisor, but over time, there wasn't a time when I felt like I could not speak to him as he was full of information and was willing to listen and provide guidance. This is where the supervisor needs to at least land. When the direct report is having issues at work or home, at the very least the supervisor should listen. If the direct report asks for help, make a suggestion, but that suggestion doesn't have to be followed. There is a balance that will have to happen regarding suggestions and expectations of work products, but some simple direct language can fix that.

This belief is something we have already covered in different areas. I meanly wanted to separate it to specifically talk about the idea that supervisors have a responsibility to listen and to know their direct reports both at work and at home. I am not saying that the direct report has to tell them about their home life, but if it does help with their understanding of the direct report, they need to know.

Belief 4 - Honesty

We all fail and failing should not be grounds for firing. It is grounds for education and honesty. This isn't the Silicon Valley mindset of "Fail fast and fail often" as failing without learning is just stupid. You are not a robot and no supervisor or direct report should be expected to be. However, when failure, misaligned mindset, unrealistic expectations, or anything that isn't correct should be met with honesty and directness. You cannot beat around the bush or give vague pointers to mistakes.

Recently I sat on a podcast that was speaking about the idea of mentorship culture in the workplace. Sitting on that podcast was the inspiration for this continued examination of my beliefs in this idea. I spoke in the podcast about a time when the gentleman I mentioned previously instructed me to "Praise in public and punish in private" which is where the first belief came from. However, another lesson that he taught me a couple of years later that made me go and do some real thinking was the idea of how to help my direct reports. Specifically, we were given a mission to move a network to a specific location and then run 24-hour operations until subordinate units came online, then another group would take over. For the first 3 days, no one went home, some of the units didn't show up on time, others didn't bring the right gear, and of course, there were other technical issues. I also had an all-day training session that I had to attend with the promise that I would come back to work after that to help. While I was gone, nothing continued not because of the failure of my Marines, but because things were not working out and as one of the subject matter experts for this mission, I was not able to answer any questions. As a side note, I also was able to step away after a week of 12-16 hour days which allowed me to be rejuvenated when I returned that night. That night we ended up working an additional 8 hours and finally got the network settled and running correctly. My team went home to enjoy their weekend while the watch took over. On Monday, my mentor pulled me aside and told me that I messed up. I looked at him incredulously since I had no idea how since we accomplished the time requirement and even worked long hours to complete it. Where I messed up was going on the training, taking the time away and resetting, but not providing that same break for my Marines. While the training was important, I should have given the team throughout the week some additional time away if they didn't have a direct task. This goes back to one of those principles: "Know your Marines and look out for their welfare" or as we have decided to rephrase it "Know your staff, both weaknesses and strengths, and help to support their growth."

Sometimes looking out for your direct reports means giving them some time off. There is an episode of Brooklyn 99 where Terry Crews' character hasn't slept in days and is making mistakes and they have a deadline to find evidence to keep someone in lockup without being sued. Captain Holt, with everything going on, continues to order Terry to go to bed, either at home or at the office. Like Captain Holt, I should have had the Marines cycle out for some extra time at home or just out of the path. We could afford to have them take a break while not in combat. We should afford that.

While this is relatively minor in the grand scheme of things, a supervisor needs to tell you when you messed up. Individual failure is a learning event, not a firing event. These learning events require honesty because, without honesty, it isn't hard for a single failure to become habitual. The honesty needs to be specific, direct, and provide a way forward. Just like when you don't agree with something, if you talk to someone about it WITHOUT providing a different solution it is just complaining. A supervisor telling you that you did something wrong without explaining why or how to fix it, is just stupid and poor leadership. The idea that they can say "Figure it out," is a copout. Plain and simple. If there is an SOP or document for it, they can be vague and say "Look at the document for this," but a good leader would assume you read it and missed/were confused by something. They should sit down and help you figure it out.

This belief comes from the 1000 times where I have been told to do something or told I was doing it wrong with no previous knowledge of how it should be done and the 1000 times I have messed up on something simple. We all make mistakes. Both you and your supervisor should own up to those and when you are giving/getting the correction, they should be honest about where you messed up and how to fix it. That is how you grow.

Belief 5 - Direction

Sometimes we have competing priorities, competing desires, and competing skills. For instance. A couple of years ago I was put up for promotion during a turbulent time in my personal life. I was denied the promotion and when I asked what I could do better, my supervisor gave me crickets. The worst part, it wasn't his fault. He wasn't told why I wasn't selected or why the others were. This event created an opportunity for us to reevaluate where to enhance my skills and where I wanted to go next. I talked about what things that I enjoy and things I thought I wanted to do. After a couple of weeks of talking about this, he provided me with a couple of people to talk to about how I could move to different teams, if those teams had space, and what skills they needed. All of this was based on the idea of what I decided to do.

So I called those people, talked to them about the teams, and then I returned to my supervisor and we discussed them. As we were talking, he cut me off to tell me that I was going to be unable to answer the question of what to do next because I had competing desires. He recommended that I read What You're Really Meant to Do and complete the exercises. I'll be honest it was a great book, but I still haven't finished the exercises on paper, I have thought through a lot of things and it did provide me with the direction I needed.

That conversation is something that I am continuing to work on, but it has provided me with a direction of skills I need to work on for either promotion or to another team. That is exactly what a supervisor should do. Help you get past yourself and see the things you can't see. What I mean by that is we all have a preconceived notion of what we look like, just like we think we sound differently than when we hear a recording of ourselves. With that in mind, we see our work product, our personality, and our mannerisms as something that could be completely different. We can see ourselves as being diligent and competent individuals and while that may be true for the most part, we are not nor will we ever be unable to learn and grow. Marcus Aurelius said in Meditations: “Be tolerant with others and strict with yourself.” In this, we should be critical of where we are weak and grow into those skills. Your supervisor will be able to see that in places you can't, so put your ego aside and listen, learn, and be humble.

This belief is probably the easiest for a supervisor to do, the most important to do, but the hardest to do right. There are going to be supervisors who will tell you that you need to do a task that doesn't align with your goals. When that occurs you will have to make a stand and be vocal about it. This thought is where they can truly provide the direction you need. The conversation about how to move forward is a give-and-take. The reason it is hard to do right is that sometimes they don't know you well enough, haven't worked with you enough, or the two of you don't agree on your strengths/weaknesses. There has to be constant conversation about your progress, see Beliefs 2-4, and you will have to be honest with them about how you are doing.

Challenges

Challenge 1 -Burn Out

This is the number one thing that will cause any employee to quit, become complacent, slack off, or just be downright rude. Having experienced this myself on multiple occasions, you will see this a lot with asking an employee to take on more responsibilities without relieving them of lesser priority tasks, in SOCs/NOCs and ticket jockeying/alert fatigue, or if leadership feels that everything is a priority. For instance, during a time of frequent and particularly large change in my company, we took on cases every week that would necessitate leadership to send an email to all the teams asking for support or all hands on deck each weekend. Talking to my peers and hearing from my direct reports during these few months when this occurred, the pace was insane and it made it hard to return to the normal caseload during the week after putting full days in during the weekend. It wasn't long after this that one of my favorite peers left the company because the level she was at had the least amount of people, the heaviest lift, and their on-call schedule was being expanded since we were in a hiring freeze. These small things pile up pretty quickly for the boots on the ground. It can wear on your body and your mind.

The easiest way to watch out for this and to recover from this is to watch your team, talk to your team, and replace time given with time off. If they give their time on off hours, they should be able to take that time off during the week. It might have to be that your team leaves a couple of hours early for a couple of days, just give them the ability to do so without the pressure of "Why aren't you at work?"

I know someone is going to say, "What about work requirements? What if there is a business need for someone to be there?" See all of the above principals also, you don't have to send the whole team at the same time. Just give them the chance to recover.

Challenge 2 - Focus

This is the weirdest one of the challenges because it isn't something that typically comes up often, but I believe that it is something that sits in the back of our minds and can interfere with our work.

In the cyber security world, we talk about something called job rotation as a means to check for suspicious activity, but I see it as a way to expose your team to new techniques, lessons, and interests. While most companies don't do job rotations, I have learned in my work experience that these job rotations while I was on active duty and the new information I received made me a more effective cyber security professional later in my career. Let me provide some specifics.

In my Marine Corps career, I was stationed all over the world serving in different aspects of the field. From engineering, policy work, policy enforcement, incident response, malware analysis, and pen-testing. The learning that I was forced to have in each of these positions allowed me to be more comprehensive in my investigations, reports, and communications with clients and leaders. Specifically, I can think of a time when my team was told that our higher headquarters was being informed of a threat actor with admin-level access to their network. Based on their understanding of the threat actor's TTPs, the threat actor would be able to conduct the same infestation of our network. However, the threat actor was relying on specific ports and protocols to make communication to their command and control network. These specific ports and protocols were not authorized on our network as we did not have the bandwidth to allow them in general practice so our network was relatively locked down to only allow communication with .gov and .mil sites and activity related to those activities. During our briefing about this, I made a comment to my CO about this lockdown and asked for 5 - 10 minutes to verify my understanding and expectations based on our policies and SOPs that we are operating under. I was able to conduct a search in our SIEM for the traffic, and then I connected to the firewalls and reviewed the rules to verify that those ports and protocols were explicitly blocked. These ports were not explicitly blocked, however, we operated in a white list provision on our firewalls which I was able to show that only certain ports and protocols were allowed to specific networks, which the threat actors command and control network were not on this list. Taking this information (screenshots, a copy of the search results, and a snippet of the firewall config) to my CO, I was able to provide evidence that we were not susceptible to the threat actor activity and that we could put rules in place to look for attempts.

As a supervisor, we can hope that there is a genius on our team to help us out of the narrow field of view we can stuck in. We can get some of this by allowing our team to shadow different functions without the division. IR folks shadowing the red team and vice versa. This will allow the team to have insights into the thought processes of the "enemy" and give them ideas to innovate making them more focused on the task at hand with a revitalized mindset.

Challenge 3 - Knowledge

The story from before also relied on the addition of knowledge that I had gained over the years. This is also imperative for supervisors to encourage in and out of work. We all have a litany of tasks that we are expected to do for our jobs. I need to understand my client's network, how to conduct SQL searches, review and edit Python code, and then there is also the investigation that I need to be able to conduct without support. My teammates are in different stages of their careers so they might be good at one part and terrible/ok at another.

As a supervisor, you should work with your direct reports and teams to ensure that information is being spread across the team. You don't want bottlenecks or single-threaded knowledge bases because then the team can/will fail whenever a hiccup occurs in staffing or maybe the team is just spread then.

Supervisors do not have to know everything. They never will and no one should think they should. What they should be able to do is point someone in the right direction to gather said knowledge or be able to direct their team to provide it if it is specific to the mission at hand.

Your Responsibilities as a Direct Report

As a direct report, outside of your job, you have a responsibility to yourself. No one is going to take care of you and your career goals more than you. While this is a leadership post, you have to take leadership of yourself and work on your skills and knowledge.

Read a book

There are some fantastic books out there that can help you figure out what you need in your career or how to enhance it. None of them are cyber-related so anyone can read them. The two that I will mention are What You're Really Meant to Do (For a review from me, click here) and Atomic Habits.

Atomic Habits is probably one of the most well-known books in recent years. It is still on Audible's and Amazon's most popular list and has been for a long time. This book provides some easy ways to build good habits, both personal and professional. Taking these lessons and applying them to your life will provide some guidance to your life.

"What You're Really Meant to Do" is a book that provides you with some challenges to help you know what part of your life you want to expand. For instance, from the book that I am going to paraphrase when this lady was not feeling fulfilled by her life, she was talking to the author and they were discussing what she would want to do if she could do any job. After the conversation, the author asks her if she could do her job, but apply it toward her preferred career and the simple answer is yes. I know that you are thinking "What are you talking about?", "This is obvious," but when you have something like a corporate lawyer for the last 20 years and you need to maintain the income you've gotten with that, but you find it tedious, changing to something that deals with animals would be a hard change. However, becoming an animal rights lawyer might be an option. Taking your skills and applying to them what you are called to do is the goal.

There are other books out there, but those two are by far some of the best lessons you can learn that will have long-term impacts on both personal and professional life.

Inform your Supervisor

Your supervisor can't do anything with the information about what you want to do, where you want to go, and whatever else you are attempting to achieve. This means that you will have to be open with them even if you don't like them or they are not the best supervisor. Continue to talk to them.

Extreme Ownership (For a review from me, click here) talks about "Leading Up and Down the Chain of Command." You have to accept your responsibility for guiding those around you and that is up and down your leadership chain. Some thoughts to help spur the information you provide your supervisor is this. If they are not performing the way you think they should talk to them. It also might help to not ask them for "Next Steps," but to tell them what you plan on doing to achieve the items you want to achieve. Have them guide those steps rather than them coming up with off-the-wall tasks to meet your goals.

Conclusion

I will be honest, this post is significantly longer than I expected it to be or wanted it to be. It is so long that I think it will be a detriment to you as a reader because it is just too full and possibly repetitive. However, this is important to me and is something I think about constantly as I continue my career and think about what my work life should be in the next 15 years. So let me summarize the ramblings above.

• Advocation is the penultimate building block of any supervisor. Without this, their ability to help you is so severely limited that they become ineffective as leaders. However, you have to give them something to advocate for and with.
• Education is and always will be a continuing process. You and your supervisors should never stop learning and they should support that goal. You have to decide what to grow into though.
• Mentorship is the direct report's choice. While our supervisors are provided to us, sometimes we need a second set of information or perceptions from someone who isn't directly involved. This mentorship should also allow for direct reports to learn about differences in style and capabilities from senior individuals. A form of education.
• Honesty is a requirement in life and a supervisor should never pull a punch. Directness and honesty will allow for accelerated growth in learning and innovation if applied in the right way with lessons learned.
• Direction is for us all. No matter who you are, at some point in your career, you will feel directionless. You will feel adrift. Supervisors should take the honesty they have with you and help you see the next direction you should go that work with your gifts. However, this direction should also be in line with your objectives. I.e. Do not tell anyone who wants to be an Air Force pilot that they can't do it. Tell them it will be difficult and help them with the steps to achieve that goal whilst also providing them with direction for them to see where their strengths are.
• Challenges are a constant for supervisors. As direct reports, we have to remember they are balancing you and their other direct reports as well as the business needs. However, that also means they need to work harder to ensure they protect (Go up and read advocation) their direct reports from the crap. That is their job.
• Responsibilities of direct reports are often either overlooked or pushed as the fault in the relationship between two butting heads. There are only two things that you will always need to do. Continue reading and keep your leadership informed. Just as they owe you information, you owe them information.

I have said a lot and will continue to think about this as I grow in my career. We never stop learning.

Contact

Want to get a hold of me?
Email | [email protected]
Discord | Mimir Cyber

The Official Mimir Cyber Discord Channel. It is the duty of those with knowledge to spread to those who ask for it. This is a place for individuals new or old to the cyber industry to get or provide support for other learning their way forward. No question is too small