The company was subsequently fined by the Attorney General and forced to reinstate a security program that was even more comprehensive in nature than before the incident. I won't even comment on the massive Klez virus outbreak they suffered. Lesson: Security is not something you can put off, sweep under the rug or buy in a box. Take what we do very seriously.

Lesson 3: You are just as expendable as anyone elseAfter learning from lesson one, I was appointed CSO of a moderately sized startup company. I was the first (and only) CSO the company had ever had. There were press releases and interviews touting my appointment, and the company and I managed to turn what we were doing with security into a significant competitive advantage. I was assured by the founders that the company was not looking to be bought or otherwise change course in any way. There is another lesson here: Believe none of what you hear and half of what you see. After about a year on the job, I was taken aside into a conference room by one of the founders. "Today we are going to announce that we are being acquired," I was told. "You don't need to worry about anything. Nothing will change, and we still need you as CSO," he said. "Fine," I thought to myself. "We'll just switch gears from operational to integration mode. They'll need due diligence and documented assurances in order to complete the acquisition and leverage a better purchase price." After almost a year and many hours working to integrate our company into our newfound parent, I was called yet again into a conference room. "There's no easy way to tell you this, so I'm just going to come right out and say it. We're letting you go. We've decided we don't need a thought leader anymore." Lesson: No matter who tells you or how loudly they say you've got nothing to worry about, worry anyway. Don't ever fall into the mind-set of, "They can't get rid of us. They need security." Don't lose hair or sleep over it, but be proactive instead of reactive.

Lesson 4: Smaller fish can sometimes swallow larger fishWorking for a biometric authentication company seemed like the wave of the future. This was post 9-11, and security theater was just winding the corner. This just had to be a long-term job. I was wearing many different hats and really enjoying my work there. The company was a public company, financially viable and a leader in the market. But I had assumed after a merger with another biometric company was announced that because we were the majority and the larger partner, we would be holding all of the right cards. Evidently the board didn't think of it in this same light. Shortly after the merger was announced I, was speaking at a conference in Florida. I spoke with our CEO and he told me, "Just between you and me: If you have another job lined up, take it. There are going to be some major changes very soon." The smaller partner of this merger had a large presence in the area where I lived. And since the new president and CEO of the resulting merged company was from the other company, I was out of luck. Relocation was never even offered as an option. Lesson: Similar to lesson three. Politics will often override sensibility and financial factors. Always consider the political side of things when evaluating a potentially career-changing event.

Lesson 5: Keep bags packedMy current employment situation is very tricky. While I enjoy working here immensely, I can clearly see the writing on the wall. The winds are changing. We are being forced by the E.U. to make drastic changes, and much of this has been well-publicized. We've eliminated many jobs in the past year and with more cuts on the way. We've gotten very lean, very quickly. We've gone from burning fat to burning muscle. In my humble opinion, there are very few ways this will end. 1) Merger with another institution, or 2) Breakup and sale of our institution. While we position ourselves for option one, I'm not content to sit back and wait for the political winds to shift a given way. Having learned and applied lessons one through four, I've come to the conclusion that the right thing to do at this point is to position information security as a vital service, and not merely an offshoot or task of IT. By providing core services for security that are vital to the operation of any resulting merged organization, we can accommodate nearly any governance framework or management structure. And if we do perform services better than anyone else at a lower operating cost, we'll be successful.

I'd like to leave you with some additional job-seeker advice. To the recently unemployed, don't fret. Things will turn around; they always do. The job market really does stink at the moment, but there are things that even a caveman can do to make himself more marketable. Take the opportunity to consult, speak at industry events and write about your experiences. I know one recruiter who relies mainly on the nomination list of one of the best security awards that money can buy where you pay your $150 fee, nominate yourself and make their list of security luminaries.