Mind the Gap: Career Transitions in Security (Panel)

Mind the Gap: Career Transitions in Security (Panel)

Speakers: Josh Liburdi (moderator), Elle McKenna, Sarai Rosenberg, Andrew Kline

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: Watch the full talk

Reading time: ~8 minutes

TL;DR

Four security practitioners — a senior security engineer, a cloud security manager at Netflix, a security and IT leader at a 200-person startup, and a DoorDash security operations engineer — spent an hour covering career navigation, burnout, feedback, and the IC-to-staff-engineer transition with unusual candor. The thread connecting every topic: self-reflection and honest assessment of what you actually need, not what the industry's hierarchy suggests you should want.

Introduction

BSidesSF's "Mind the Gap" panel at 2025's conference was framed as a discussion of "the good, the bad, and the ugly" of managing a security career. What it became was one of the more honest conversations about the psychological and structural realities of working in a field where technical skills are prized, "level up" is the default cultural imperative, and burnout is endemic.

Moderator Josh Liburdi, who works in security operations at DoorDash, kept the conversation grounded with direct questions. The panelists — Elle McKenna (security and IT lead at a ~250-person company), Sarai Rosenberg (cloud security manager at Netflix), and Andrew Kline (senior security engineer at BS, formerly a security consultant) — brought perspectives spanning individual contributor, people manager, and recently-converted-manager roles.

The panel drew a full room of security engineers at various career stages, many of whom had submitted questions via Slido that probed genuinely difficult questions: Is career planning even necessary? What do you do when your company doesn't support growth? What does work-life balance actually look like in practice?

Knowing What You Want — and Why "Finding Your Passion" Is the Wrong Frame

▶ Watch: How do you know what you want? (3:45)

The opening question — how do you know what you want from your career — landed with Kline first. His answer reframed the premise entirely: "I don't know. I still don't know what I want to do." He described reading a career development book early in his career and taking away a counterintuitive lesson: there is not some pre-existing "thing" you were meant to do that you just need to find. The method is to try things, get good at them, and then you will love them.

Rosenberg added the advice of looking for opportunities that feel scary-exciting rather than just scary — and, critically, not letting failure or misfit drive premature exits. "It takes a really long time to pip someone out," she noted. "Even if you're really bad at it, go do that thing for a year and decide: am I getting better at this or is it time to find something else?"

McKenna layered in a question that rarely gets asked explicitly: how much effort will this role take, and do you have the bandwidth for that right now? Lifecycle awareness — recognizing whether you are currently capable of a 50-to-60-hour-week role or whether you are already trending toward burnout — is as important as evaluating the role itself.

The consensus on career planning was blunt: plans are usually wrong, but knowing what you do not want is valuable. Rosenberg described "anti-planning" as the durable skill — identifying deal-breakers and tolerances more than charting a five-year trajectory. McKenna, whose plan was explicitly to never become a manager, found herself managing a team within a year of making that plan.

Deciding Whether to Stay or Leave

▶ Watch: Factors in staying or leaving (17:20)

On the question of what factors should drive a decision to stay or leave, McKenna's framework was organized around people, financial trajectory, and scope: look for people you are excited to work with; assess whether the company's financial outlook makes sense (not collapsing in the next 18 months); evaluate whether the role offers sufficient "enrichment activities." The last factor — which she used to refer to whether there is enough interesting work to actually do — recurred throughout the panel as a proxy for sustainable engagement.

Rosenberg offered a simple heuristic: no company, team, or job is perfect. Every role has problems. The question is which problems are you willing to tolerate, which ones can you actually change, and which ones are fixed regardless of your effort. Self-reflection on what you have done, what you liked about it, and whether the new scenario enables more of the good parts is more reliable than any prescriptive framework.

Kline's contribution was practical: ask the right interview questions. The information about whether you will enjoy working with a team comes out in how people answer questions — but only if you ask questions designed to elicit it.

Burnout, Work-Life Balance, and the 50/50 Myth

▶ Watch: Work-life balance and managing burnout (25:00)

Is work-life balance a lie? Liburdi posed the question after noting that "work-life flexibility" is increasingly the term appearing on LinkedIn, implying that true balance is impossible. The panel's answer was nuanced: balance is real, but it is not 50/50, and it operates over longer time horizons than a single day or week.

Kline described a mentor at Palo Alto who advised him to commit to something outside of work with the same intensity he brought to his job. The specifics — the mentor suggested kickboxing — were less important than the structure: caring about something else enough that work was no longer the only outlet for that energy.

Rosenberg argued that burnout is fundamentally an environmental problem, not a personal failing. Individuals can build resilience, find external support, and develop coping mechanisms, but those tools have limits. "If your environment isn't supporting you, you need to change that," she said. As a manager, she has the leverage to address team-level contributors to burnout, particularly single points of failure — situations where one person feels they cannot take PTO because too much depends on them personally. Her response is mandatory consecutive week-off PTO every quarter and deliberate business continuity planning to eliminate those single points of success.

McKenna's leadership contribution to burnout prevention was concrete: "You can't personal-choice your way out of systemic issues like burnout." She tracks that her teams take regular PTO not as a perk, but as a structural intervention.

Growth, Promotion, and the Peter Principle

▶ Watch: Career growth and when to stop climbing (35:10)

On growth opportunities, Rosenberg described her approach to talent management as "a giant multi-dimensional Tetris game" — mapping capabilities, interests, and opportunities over time to find moments where they align. For individuals without a manager doing this on their behalf, the advice was persistent self-advocacy: make room for growth in your current role where possible, find mentors inside and outside the company, and, if over a sustained period growth opportunities simply are not appearing, leave.

McKenna drew a distinction between growth for skill expansion and growth for promotion, arguing these often look different in practice. She also pushed back on upward mobility as the only definition of growth: "Sometimes growth is just doing less of the [stuff] you hate."

The panel's most memorable exchange came around when to stop climbing. McKenna invoked the Peter Principle — the idea that people get promoted until they reach a role they are bad at. She described checking each promotion against a checklist: Is the compensation meeting my needs? Do I have work-life balance? Are there sufficient enrichment activities in this role? "If the answer to all of those things is yes, then maybe you don't want a promotion." Rosenberg reframed levels entirely as a social construct: "There doesn't need to be an up versus a down. It can look like hills and valleys. Levels are just a social construct."

On the question of the senior-to-staff transition specifically, the panel flagged it as a jump that many underestimate. Senior and no-prefix engineer are essentially the same job class with different seniority markers; staff is a meaningfully different role with different responsibilities. Anyone considering it should understand what the job actually looks like before assuming the title is the goal.

Feedback: Organic, Actionable, and Not Always Accurate

▶ Watch: On the nature of useful feedback (47:30)

The conversation on feedback was one of the panel's richest segments. Kline's view was that organic, direct, peer feedback is the highest-quality kind — more valuable than the quarterly peer review process, which tends toward the generic. He described proactively asking colleagues "how did I do with that?" as the practice that generates actionable signal. His standard for useful feedback: specific, candid, and directional — "you did this well, you did this other thing not as well, I would have liked to see X differently."

Rosenberg offered a structural framework: feedback has levels of directness that should match the strength of the relationship and the psychological safety of the context. Start lower, see where the conversation goes, and escalate directness as the relationship and trust develop. She also noted that feedback is often not verbal — whether someone consistently raises their hand to work with you is itself feedback, as is whether the systems you have put in place are functioning as designed.

McKenna added that some feedback is simply wrong. She recounted being marked late to class in student evaluations for a course where she taught back-to-back in the same room and had never started a session late — feedback shaped by bias or misperception. The skill she emphasized: "Thank you so much for that feedback. I'll take it into consideration" — and then assessing separately whether it has merit.

The Q&A closed on whether intentional career planning was even necessary — or whether moving from opportunity to opportunity without a master plan was valid. The consensus: anti-planning (knowing what you won't tolerate) is more durable than any 10-year roadmap, and passing up a scary-exciting opportunity because it doesn't fit a pre-set trajectory is more costly than most people recognize.

Notable Quotes

"There wasn't some thing out there for me to do that I was just searching for. The thing I needed to do was anything — try it, get good at it, and then I'll love it."

— Andrew Kline, ▶ 4:20

"You can't personal-choice your way out of systemic issues like burnout."

— Elle McKenna, ▶ 31:00

"Levels are just a social construct. There doesn't need to be an up versus a down. It can look like hills and valleys — or a hyperbolic plane."

— Sarai Rosenberg, ▶ 42:15

Key Takeaways

• The "find your passion" frame is less useful than trying things, getting competent, and building interest from that competence — and tolerating the discomfort of not knowing your direction early in your career.
• Burnout is environmental, not a personal failing; structural interventions at the team level (mandatory PTO, eliminating single points of success through business continuity planning) are more effective than individual resilience strategies alone.
• The senior-to-staff transition is a job-class change, not just a seniority increment; the responsibilities differ substantially and deserve explicit evaluation before pursuit.
• High-quality feedback is specific, candid, and directional — and some feedback is wrong; developing the ability to receive feedback gracefully while filtering for merit is a distinct and valuable skill.
• Anti-planning — knowing what you will not tolerate and what you need to thrive — is more durable than a 10-year career roadmap, which tends to become inaccurate quickly as actual experience accumulates.