You Need Some Neurosparkle In Your SOC

You Need Some Neurosparkle In Your SOC

Speakers: Carson Zimmerman (Microsoft); Megan Roddie-Fonesca (Security Engineer, Datadog)

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=9Quke--qVPs

Overview

In their compelling FIRSTCON talk, "You Need Some Neurosparkle In Your SOC," Carson Zimmerman of Microsoft and Megan Roddie-Fonesca, a Security Engineer at Datadog, champion the invaluable role of neurodiversity within security operations. The speakers, both openly identifying as neurodiverse (Megan with autism spectrum disorder and ADHD, Carson with ADHD), argue that individuals with these cognitive differences possess unique strengths perfectly suited for the demanding and often chaotic world of Security Operations Centers (SOCs) and Computer Security Incident Response Teams (CSIRTs).

The core premise of the talk is that neurodiverse brains operate with "different operating systems," offering distinct advantages such as hyperfocus, exceptional pattern recognition, direct communication, creativity, and a high tolerance for chaos. However, traditional workplace environments and management styles are predominantly designed for neurotypical brains, leading to challenges like burnout, miscommunication, and the underutilization of these critical talents. Zimmerman and Roddie-Fonesca advocate for a fundamental shift in how security teams are built and managed, urging the industry to embrace and optimize for neurodiverse traits to enhance overall effectiveness and resilience against ever-evolving cyber threats.

This article delves into the specific "superpowers" of neurodiverse individuals, explores their technical applicability in security, and outlines actionable strategies for security leaders and teams to foster inclusive environments that harness these strengths. By understanding and accommodating neurodiverse ways of working, the security community can unlock a deeper pool of talent, drive innovation, and build more robust defenses.

Background

▶ Watch: Speakers introduce neurodiversity and themselves (0:00)

The concept of neurodiversity posits that variations in human brain function—such as those seen in autism spectrum disorder (ASD), attention-deficit/hyperactivity disorder (ADHD), dyslexia, and anxiety—are natural human differences rather than deficits. As Megan Roddie-Fonesca highlights, "our brains work differently. There are different people in this room who are operating systems work differently." This talk builds on the observation that security teams, particularly SOCs and CSIRTs, inherently rely on talents and traits commonly associated with neurodiversity. Yet, paradoxically, their established workflows, communication norms, and structures are often tailored for neurotypical brains, creating a significant mismatch that can lead to burnout and suboptimal team performance.

Carson Zimmerman delves into ADHD, explaining that it primarily affects executive functions—the cognitive processes that manage thoughts, actions, and emotions. While commonly associated with inattention, hyperactivity, and impulsivity, ADHD is not merely a "lack of willpower" or exclusively a childhood condition. For individuals with ADHD, time may not feel linear; 15 minutes can feel like three hours or vice versa, posing challenges for task execution on timelines. Memory can be fleeting when switching tasks, and emotions can be intense but transient. Task initiation often feels binary, shifting from "impossible" to "effortless" instantly. The Diagnostic and Statistical Manual of Mental Disorders, Fifth Edition (DSM5), now categorizes all related conditions under ADHD, moving away from the older term ADD.

Megan Roddie-Fonesca provides insight into autism spectrum disorder (ASD), which impacts how a person perceives the world and interacts with others. Characterized by differences in communication, sensory processing, and information processing, ASD is not a linear spectrum of "low" or "high functioning" but rather a complex "grid" of strengths and struggles. She notes that stereotypical traits often focus on boys, leading to misdiagnoses or underdiagnosis in women. For Megan, ASD manifests as a preference for direct communication—clarity over subtext—and a conscious, effortful processing of social cues like eye contact and body language. Conversely, it bestows benefits such as deep focus, precision in work, and a strong preference for predictability and routine, though adaptability is possible with increased effort.

The problem, therefore, is not a lack of capability among neurodiverse individuals, but rather a systemic failure to recognize and cultivate their unique strengths within an industry that desperately needs them. Security roles inherently demand traits like meticulous analysis, pattern recognition, and unconventional thinking, which are often hallmarks of neurodiversity. By understanding the distinct operating systems of neurodiverse brains, organizations can begin to bridge this gap, designing environments that not only accommodate but actively leverage these powerful cognitive differences.

Key Findings

▶ Watch: Hyperfocus and repetition: powerful security traits (8:30)

The central message of "You Need Some Neurosparkle In Your SOC" is that neurodiverse individuals bring a suite of "superpowers" that are exceptionally valuable to security operations. These cognitive traits, often misunderstood or mislabeled as weaknesses, are reframed as significant assets:

1. Hyperfocus and Attention: Contrary to the stereotype of distraction, individuals with ADHD, when engaged, can enter a state of hyperfocus, achieving immense productivity in short periods. Similarly, autistic individuals often exhibit a remarkable tolerance for repetition and a drive for mastery. This combined ability is a "superpower" for deep-dive investigations, chasing complex rabbit holes, conducting thorough threat research, and continuous learning. As Megan stated, "We don't give up till we figured it out." This intense, sustained attention is not scarce but can be misallocated; when correctly channeled, it yields immense results.

1. Pattern Recognition and Systemization: Neurodiverse brains excel at recognizing patterns and detecting anomalies that neurotypical individuals might miss. They possess a natural ability to break down complex problems systematically, logically, and programmatically, often without the influence of emotions. This trait is a boon for tasks requiring the retention of vast amounts of knowledge and memory, such as threat hunting (sifting through mass data to find what matters), incident investigations (identifying critical forensic data), and quality assurance work. The "superpower" here is the ability to "get from A to Z at speed," provided the goal is clear.

1. Context Switching and Chaos Tolerance: For many with ADHD, there is a distinct strength in embracing chaos and managing multiple tasks simultaneously, coupled with decisiveness and a higher risk tolerance. This makes them ideal for dynamic, high-pressure roles like incident response and triage, where rapid changes and multiple threads of investigation are the norm. While there's a limit (what Carson calls a "buffer overflow" or "amygdala hijack"), the initial ability to thrive in multi-threaded environments is a significant asset.

1. Communication and Social Interaction: While often stereotyped for social challenges, neurodiverse individuals can bring unique strengths to communication. A preference for high honesty and directness ensures clarity over subtext, cutting through ambiguity that can hinder critical security decisions. This "radical clarity" and "radical empathy" (though empathy may be displayed differently) fosters effective team collaboration and leadership. Directness, from a neurodiverse perspective, is not disrespect but an efficient way to "say what needs to be said" to move forward, which is essential for "truthtellers" in SOCs and CSIRTs.

1. Creativity: Many neurodiverse individuals, particularly those with ADHD or other conditions, exhibit nonlinear thinking and intuition, leading to innovative ideas unconstrained by conventional assumptions. This deep curiosity and ability to explore new concepts are invaluable for developing new systems and tools, designing novel detection engineering strategies, and finding "sideways answers to straight-line problems." This "thinking outside of the box" is critical for staying ahead of sophisticated attackers.

In essence, the speakers conclude that "neurosparkly, neurospicy people" detect structure in chaos faster, offer creativity unbounded by convention, demonstrate unwavering persistence in problem-solving, and "debug reality" in ways that are crucial for SOC success.

Technical Deep Dive

▶ Watch: Pattern recognition: systematically finding anomalies in data (14:00)

The unique cognitive strengths of neurodiverse individuals translate directly into powerful capabilities within the technical domains of cybersecurity. These "superpowers" are not merely soft skills but are deeply applicable to the most challenging and intricate aspects of defensive and offensive security operations.

The hyperfocus characteristic, for instance, is an indispensable asset in malware analysis and reverse engineering. Dissecting complex binaries, tracing execution flows, and understanding obfuscated code requires sustained, intense concentration over long periods, often ignoring distractions. This same dedication is critical for protracted threat hunting campaigns, where analysts must meticulously sift through vast datasets, follow subtle leads, and connect disparate pieces of information to uncover hidden adversaries. Megan Roddie-Fonesca's experience in detection engineering and threat hunting directly leverages this, noting the ability to break down topics like "persistence in the cloud," understand "different techniques," and identify "where to look for those in my log" (14:00). This involves a deep dive into logs and telemetry, requiring an unwavering commitment to detail.

Pattern recognition and systemization are foundational to many core security functions. This systematic and logical approach is vital for developing robust SIEM rules and anomaly detection algorithms, where the ability to discern subtle deviations from baselines is paramount. In forensic artifact analysis, neurodiverse individuals can excel at identifying critical data points within overwhelming amounts of information, constructing coherent timelines, and systematically attributing actions. Their "robot-like" ability to break things down programmatically (14:00) is invaluable for protocol analysis, understanding complex network traffic, or meticulously reviewing system architectures for vulnerabilities. This trait also lends itself well to vulnerability assessment and red teaming, where identifying unusual pathways or overlooked flaws in systems requires a highly structured yet unconventional thought process. The emphasis on "show me your query" (16:00) highlights the need for a traceable, logical approach to data exploration, a natural fit for this systematic thinking.

For individuals with ADHD, their capacity to embrace chaos and multitask can be a significant advantage in incident triage. In the initial moments of a breach, where multiple alerts fire, conflicting information emerges, and rapid decisions are necessary, the ability to pivot quickly between different data sources (e.g., threat intelligence feeds, endpoint telemetry, network logs) and make decisive judgments is crucial. This agility is also beneficial in managing the dynamic, often unpredictable nature of cloud security incidents, where ephemeral resources and distributed environments demand constant re-evaluation and adaptation.

Direct communication, while sometimes challenging in social contexts, is a critical technical strength in security. Unambiguous language is essential for writing precise detection logic (e.g., YARA rules, Sigma rules), crafting clear and actionable incident reports, and developing effective playbooks. During high-stress incident response calls, where every second counts, the ability to communicate findings and actions without subtext or ambiguity can prevent critical misunderstandings and accelerate resolution. Megan's personal experience of being valued for "say[ing] out loud what every person is thinking" (22:00) underscores the importance of this radical clarity in technical problem-solving.

Finally, creativity and nonlinear thinking are vital for innovation in cybersecurity. This translates into developing novel detection engineering strategies that go beyond signature-based approaches, designing resilient security architectures that anticipate unforeseen attack vectors, and envisioning advanced threat intelligence frameworks. The ability to find "sideways answers to straight-line problems" (30:00) is particularly relevant in vulnerability research and developing proactive defenses against zero-day threats, where conventional approaches fall short. By fostering environments that encourage this unique cognitive exploration, security teams can unlock truly groundbreaking solutions.

Demo / Proof of Concept

▶ Watch: Actionable advice: enabling neurodiverse talent in SOC (30:30)

This talk was primarily conceptual and advocacy-oriented, focusing on the psychological and operational benefits of neurodiversity rather than demonstrating a specific technical tool or proof-of-concept. The speakers aimed to raise awareness and provide actionable strategies for fostering inclusive and effective security environments, drawing heavily on personal experiences and observations within the industry.

Defensive Implications

▶ Watch: Q&A: Supporting employees without official diagnosis (39:30)

The insights shared by Carson Zimmerman and Megan Roddie-Fonesca offer profound and actionable implications for strengthening cybersecurity defenses by optimizing for neurodiverse talent. The core message is to design for strengths, not conformity, transforming SOCs and CSIRTs into environments where neurosparkly individuals can thrive.

1. Rethink Recruitment and Onboarding: Security organizations should actively seek out neurodiverse talent, understanding that traditional interview processes might not capture their full potential. During onboarding and ongoing work, provide clarity, not guesswork. Define clear goals, direct instructions, and explicit expectations. This reduces the ambiguity that can be highly stressful for neurodiverse individuals, particularly those on the autism spectrum (18:00).

1. Optimize the Work Environment:

• Reduce unnecessary noise: Acknowledge and mitigate sensory overload. Carson noted his difficulty in open-plan offices (12:00). Provide options for quiet workspaces, noise-canceling headphones, or flexible work arrangements (remote work) to limit distractions and prevent "buffer overflows" where cognitive capacity is overwhelmed.
• Flexible Workflows: Allow individuals to work in ways that align with their brain's operating system. This might mean asynchronous communication, dedicated deep focus time, preference for written over verbal communication (or vice versa), and flexible hours. The goal is to maximize throughput by respecting individual cognitive styles (32:00).
• Pacing and Recovery: Encourage and normalize breaks, walks, and recovery time, especially after intense social interactions or periods of hyperfocus. Megan highlighted her need for significant recovery time after social events to avoid burnout (26:00-28:00). Managers should understand that this isn't laziness but a necessary component of long-term productivity.

1. Refine Management and Communication Styles:

• Individualized Management: As Megan emphasized, "a good manager will understand that everybody has a different way of succeeding in the workplace" (40:00). Managers should avoid a one-size-fits-all approach and instead learn individual needs—whether it's more routine, direct instructions, or a preferred communication channel (Slack, email, Zoom). Datadog's "how I work" sheet is an excellent example of proactively gathering this information (40:00).
• Promote Direct and Honest Communication: Encourage a culture of "radical clarity" where subtext is minimized. This means "saying the thing that needs to be said out loud" (32:00), even if it's uncomfortable. For neurodiverse individuals, directness is not disrespect; it's efficiency. Managers can model this by stating their intent upfront and explicitly labeling emotions during discussions to avoid misunderstandings (26:00).
• "Show Your Work": For individuals who arrive at solutions non-linearly, encourage them to deconstruct their thinking and "show their work" (16:00). This helps neurotypical colleagues understand the logical path taken and ensures alignment, rather than simply accepting the "A to Z at speed" outcome without context.

1. Strategic Task Assignment and Project Management:

• Leverage Strengths: Channel hyperfocus and precision towards critical tasks like malware analysis, threat hunting, or detection engineering. Utilize pattern recognition for anomaly detection and forensic analysis.
• Thoughtful Chaos Assignment: Carefully assign "chaos-heavy" roles like incident response and triage, recognizing that while some neurodiverse individuals thrive in chaos, others (like Megan) may find it draining (20:00).
• Structured Project Management: Pair individuals who excel at generating ideas with those skilled in execution, potentially leveraging program managers to break down projects into clear, manageable milestones (30:00, 36:00). Establish what is "good enough" to counteract perfectionism and prevent getting stuck in analysis paralysis (16:00).
• "Parking Lot" for Ideas: For creative individuals prone to breadth-first searches, provide a "parking lot" for ideas to capture their innovative thoughts without derailing current tasks (30:00).

By implementing these defensive implications, security teams can cultivate an environment where neurodiverse individuals are not just accommodated, but truly empowered. This leads to reduced burnout, higher job satisfaction, and ultimately, a more diverse, innovative, and resilient cybersecurity workforce capable of tackling the most complex threats.

Key Takeaways

• Neurodiversity as a Strategic Asset: Neurodiverse individuals, particularly those with ADHD and autism spectrum disorder, possess unique cognitive strengths ("superpowers") that are inherently valuable and often critical for success in demanding cybersecurity roles like threat hunting, incident response, and detection engineering.
• Targeted Strengths for Security Operations: Key neurodiverse traits such as hyperfocus, exceptional pattern recognition, systematic problem-solving, direct communication, and a tolerance for chaos directly translate into enhanced capabilities for deep investigations, anomaly detection, precise technical communication, and innovative threat mitigation.
• The Mismatch Problem: Traditional, neurotypical-centric workplace environments, communication norms, and management styles often fail to leverage these neurodiverse strengths, leading to burnout, underperformance, and a loss of valuable talent within the security industry.
• Designing for Success, Not Conformity: Security organizations must proactively adapt their environments, management practices, and communication frameworks to accommodate and explicitly optimize for neurodiverse ways of working. This includes providing clear goals, reducing sensory noise, offering flexible workflows, and promoting direct communication.
• Individualized Support and Burnout Prevention: Effective management requires understanding and adapting to individual working styles, providing necessary breaks and recovery time, and recognizing the signs of sensory overload or cognitive "buffer overflow" to prevent burnout and ensure long-term productivity.
• Unlocking Innovation and Resilience: By embracing neurodiversity and designing inclusive practices, security teams can tap into a deeper pool of talent, foster creative problem-solving, and build more robust, innovative, and resilient defenses against evolving cyber threats.

About the Speaker(s)

Carson Zimmerman is a distinguished professional working at Microsoft, with an extensive career in security operations that he humorously notes has given him "gray hairs." He openly identifies with ADHD. Outside of his professional life, Carson is a passionate amateur photographer, a detail he shares to encourage informal conversation. His experience managing teams and individuals, including those with neurodivergent traits, provides him with a unique perspective on optimizing team performance.

Megan Roddie-Fonesca is a Security Engineer at Datadog, where her work focuses on detection engineering and threat hunting. Megan identifies as being on the autism spectrum and also has ADHD. She brings a wealth of practical experience, having started her career as a SOC analyst and progressed through roles in threat intelligence, incident response, and her current threat hunting specialization. Megan is also a martial artist and a hobby farmer, proudly sharing a picture of her goat, Venus, as a fun fact for small talk.