[Kaye] Hello everyone, my name is Kaye and thank you for joining our Industry Chats,
hosted by UTS Careers. I'd like to introduce Alistair Oxley. Alistair is a
UTS alum who graduated from UTS in 2008 an,d I'm having to read this here,
he completed the Diploma in Information Technology Professional Practice and
Bachelor of Science in Information Technology which, I believe,
affectionately you referred to as BScIT (biscuit)? [Alistair] Yep. BScIT and Dip. [Kaye] Fantastic.
Well, welcome Alistair and I think what we'll start with is just let's chat
cyber security. So, you're currently working as a manager in Application
Cyber Security at the Reserve Bank of Australia. Can you just tell us a bit
about your career journey to date and, you know, what led you to cyber security?
[Alistair] Yeah. So, when I went to uni, I guess, to start with, I thought I was going to be a BA,
I thought that's what I wanted to do and within the first semester I decided no
that's not what I want to do, I want to go into more the technical stream. And,
you know, I was tossing up between networking or programming but as
I did more subjects at uni, I realised I actually really liked
programming. So, I went down that path with University, I looked into
artificial intelligence, that was pretty fun, pretty new at the time, but yeah
really after I finished, I went and got a grad job at AMP, being a programmer
there. That was quite interesting because I went to...and did basically
mainframe work. I was working on AS/400s, IBM AS/400s.
They're not technically mainframe but I thought they were mainframes, and then
after that I went and did some Lotus Notes development for them but it really
wasn't what I wanted to work on and so then I found out, through a friend who
was at the Reserve Bank, that they had technology more aligned with what
to do. So, I applied for their grad program and came across there. I was
four years a grad which was, you know, quite interesting. When I came
to the bank, I started off basically working on one of their
banking systems, kind of like online banking but for government agencies, and
then after that first year I switched across into basically getting rid of
their mainframe applications, moving them to modern systems. I was in that
project...I rolled off the grad program and I continued on that for a full five
years. So, I spent a lot of my time doing full-time programming, had a really
great team, really good technology, so I was really happy what I was doing. But I
started to get an itch, after about five years in that project, I wanted to kind
of move on and expand and an opportunity came up in our Cyber Security team and
I'd always had an interest in cyber security, as well. When I was at uni,
we didn't have courses or subjects on cyber security. It was this kind of
mystical thing that you knew about but you also didn't really know about.
By the time I had the opportunity, I was always looking at delving deeper into
technology, always wanted to understand the next level down. Because the more you
understand, the better you're going to do and then work. I always saw the
hackers as that next level down. I was like, how do these people that, they don't
have access to your source code yet they're able to understand your system
so well that they can actually get around it and use it in a way that you
didn't intend. So to me that was the next level down. So yeah, I applied for a
12-month rotation into our IT security team and it's been years since I came in
for my one-year and I've been there ever since and not not going back. I love my
programming but I also love cyber security. So in my time there I've
I've been in a couple of teams. I started off in our Intel
team so it's all about looking at kind of external attacks that are happening
out there, what's the threat landscape, how is that changing, how's that going to
affect the bank? I got to do some pretty interesting stuff there.
I then jumped across to application security so, kind of going back more to
my roots as a developer but looking at things from a security perspective which
was also fun. And then I got the opportunity to not only manage that but
also manage our cyber delivery which is all about making sure we're
rolling out appropriate controls across the bank to keep us secure. [Kaye] Great. So, I
think that's a really good lesson for our students to hear. That's something,
you know, that the pathway isn't always linear and sometimes what we
think we want to do evolves. And it sounds like you've taken every opportunity that
came your way and, you know, embraced that lifelong learning and continue to
develop, so that's really great to hear. Just off the back of that, you
obviously you've got this passion for cyber security and obviously, within the
realms of what you can share with us, but what is the most exciting or challenging
cyber security project that you've worked on to date? [Alistair] Well, you're right,
there are obviously some things I can't talk about. So there's quite a few
interesting or exciting things I've done. Working in in security, I guess there's a
lot of smaller projects that we do. It wasn't like when I was back as a
developer working on the one thing for quite a while. So, some of the highlights
would include that...there's a lot of stuff I find interesting around
the dark web. S, you know, I got to go and listen to the FBI agents and so I went to
one of their conferences and heard them talking about when they did the first
takedown of the dark web, of the first talk web marketplace. Hearing how they
did that, like that was when the dark web was so new and, you know, you look at the
techniques they used, you'd probably think they're pretty basic today but
back then it was all new for them so it was quite interesting hearing all
that. I also did a deep dive into the actual Tor network, the code behind it,
and looking at various things there. I also, off the back of that, also built
a dark web crawler as well, so that was pretty fun. That was just more on my
own time but all that links into just, if you if you really enjoy
something you're not going to do it just because work tells you, you're going to do
it outside of that as well. I've done capture the
flag events, if you don't know what those are is probably a good thing to go and
look those up. I've run some capture the flag events or, you know,
participated in them as well so that's also been really fun and enjoyable. [Kaye] Great.
Cyber security, I presume, doesn't work in isolation so, really interested to know
that, as a cyber security professional, what other parts of the business do you
interact with? What other teams do you work with? [Alistair] Yeah
so, before I joined cyber security I was only...I was in my own little bubble, I
found, like when you're on a project you don't really get to interact with many
people. Coming to security, I'm dealing with everyone, you know. I I deal with
every IT team, you know particularly the... some roles not as much but, generally,
you're dealing with every IT team and they talk to you as if you're the expert
in their domain, whether that's networking or software design or, you
know, infrastructure system admin, they all assume that you know everything
that they know which is a bit of a challenge. You just learn a
lot of stuff along the way which has been good. And then, also on the business
side you talk with, again, everyone. You'll have different issues or
questions popping up from all over the place and you have to be able to talk
and engage with those people. So, you know, I've gone all the way to doing
presentations to the governor of the Reserve Bank on cyber security related
matters, so it's it's all over the place, it's really good. [Kaye] So, in terms of...just
throwing in there then. You were used to being in a bubble and suddenly
you're having to communicate with different professionals and stakeholders
at different levels. Did you have support within the
organisation to train you to have the skills or did you learn on the job?
How did that happen? [Alistair] I did a lot of learning on the job. I mean, the Reserve
Bank is really good, they will give you the training you need. I guess, I
already had the skills for doing a lot of public speaking so it was quite fine
for me. You know, a lot of people think developers are quite introverted and I
am an introvert but you know I'm also very happy to get in front of people and
talk, so yeah. But there's still, you know... doing it for your day job, just be..having
all that exposure definitely it builds you up just doing it and that's
probably the best way you can learn is just on the job. [Kaye] Okay. So, you're a manager
now at RBA and so, when you're hiring or you're working with cyber security or IT
interns, what makes students stand out for you?
[Alistair] It's not so much the the technical skills, like you know having the
technical skills is really good but, I think, attitude, for definitely the more
juniors in the team, is really important. Someone who has a positive attitude who
is going to be proactive in actually doing doing their work or seeking out new work,
that's really helped, I think, people stand out in in the past.
[Kaye] Anything in particular, in terms of their journey at university, that they
could think about? You know, student societies, things like that, that
you know has given students the edge when you've met them? [Alistair] I think, I
mean, for the cyber security specifically, it's great that universities are now
actually offering subjects and courses on it. So, you know, that's really good.
Anything that does help you to be able to socialise more with people. I think we
live in a very technological world and people can be quite insular coming up
now. You know, everyone's addicted to their phones. I think students
really need to make sure that they can work
without those things in place, not being glued to your phone and not
interacting with people in face-to-face ways like, if you can do...if you can
actually talk to people and be happy in doing that, then that's
definitely going to help you. [Kaye] So, maybe practicing a bit of public
speaking, doing something like Toastmasters or something might be
something for our students to to think about. So, in terms of that,
you've had quite diverse roles and IT functions and throughout your career so,
any advice for students who, they're not quite sure what career path to take? Can
you give some advice around that, with your experience to date? [Alistair] Yeah,
like, as I said, I went into uni thinking one thing, I came out the other end doing
something else and I've obviously switched around. You don't
have to know what you want to do, going into university. You know, it's great if
you do. Some people definitely have a very clear goal of what they want to
do. I guess my advice would be to take the opportunities that are presented to
you. Don't, you know...even if it's something you think you don't like, you should still
work a hundred percent on that opportunity you've been given, you might
find that you like it or, even if you don't like it, you will still learn a lot
more if you actually apply yourself to it. So, I think that would be my key
takeaway, particularly, when you're younger. You can move around,
I've moved around being, you know, technically a bit older but you
do get more opportunities to try more things out when you're young and so,
particularly if you get onto grad programs. The Reserve Bank,
for instance, has a two-year grad program and they rotate people through four
different sections. I didn't get that when I came on as a grad program but I
think it would have definitely been something that would have helped. It gives you
I guess that greater exposure across the business and IT
and make you a more well-rounded individual. You can always...you can
start to specialise later on but, again, taking opportunity to broaden your
experience is good. [Kaye] So basically just embrace everything that comes your way.
[Alistair] That's right and yeah, you know, opportunities will pop up for you, if you
do that. If you don't do it then you might find that not all doors get opened.
[Kaye] So based on your observations from, you know, your current organisation and other
companies, what areas do you see growing in that IT space at the moment?
[Alistair] Yep so, not to be biased but I think IT Security is obviously one of those
things that is growing. There's a there's a lot of demand. Look
at stats coming out of the US, they're talking about millions of jobs being
vacant. I don't see that necessarily dying away, there is always
going to be a need for cyber security. It's one of those things that...you
know, when I was in uni, I saw it as the dark arts, there wasn't much
information on it. Now it's very much in the limelight and it's not going
away. So there's... definitely that's
an area that's growing. And I think one of the other areas that's
growing as well is the whole big data concept. Data analytics, you know, whatever
you want to call it. The ability to...we have so much information and data now,
it's about how can you drive insights from it and so that's another
area that a lot of companies are interested in and trying to move towards,
understanding the data that they have. [Kaye] Yeah. So, specifically with cyber security,
obviously, you've seen probably exponential growth in your time in that industry.
What's bubbling up under the surface right now? Where do you see the
industry heading in the next year, two years? [Alistair] Yeah, it's surprising that
there's so many organisations out there that still don't have the basics right. I
would still say that cyber security is in its infancy for a lot of places. The
bigger organisations, yeah they've got their security teams
and they're putting things in place, not that they're immune, they're you know...
everyone has their issues but there are a lot of organisations out there that,
you know, they just don't have the capability of the security aspect of
things. Just getting the basics of cyber security hygiene right is still
something that's growing. So, I think you know the trend is really to actually
bring people up to a certain baseline before we even start talking about
what's the future trend for it. So if you understand those basics and
understand how to kind of protect against the basics, the basic cyber
hygiene, you should be able to get jobs out there, for whether it's
working for a company for them or working for consultancies to you know
help people put those in place. That's really where we're sitting
at the moment, just getting the basics right. [Kaye] But it sounds...as an industry it's
in a state of...continues to grow and there'll be opportunities for students
who are interested in that space for a significant time to come. And it sounds
like it's probably just as exciting today as it was for you when you first
joined? [Alistair] Oh yeah, totally. You know, the landscape is always
changing in security which I think yeah, it does mean that it's not always the
same thing all the time. You'll see different attack vectors coming along
and with that a whole new way of defending against them. The attacks
themselves are quite interesting and looking at how, again it's that, how do
you take a process that was designed to do one thing and people are turning
it on the head and doing other things? And it's you know, not that I would want
to glorify that type of way of doing stuff, but it is always interesting to
see what they're doing. [Kaye] Yeah, and probably interesting for our students to
hear about that to because I think that, as you mentioned, if you're
interested in that industry, all facets good and bad, make interesting
reading. Alistair, thank you very much for sharing
with us your insights, your knowledge, and clearly your
passion for your industry. And I would say to anyone who's just viewed this,
please have a look at the show notes. Alistair has shared with us a list of
resources that he's built up over the years for anyone who is either studying
cyber security, or even who has an interest in cyber security. So again, thank
you very much Alistair for joining us today and participating in our Industry
Chats. [Alistair] Great, thank you very much.