Is My Job Even Real? Bullshit Jobs in Infosec

Is My Job Even Real? Bullshit Jobs in Infosec

Speakers: errbufferoverfl, Security Engineer

Conference: Kawaiicon

YouTube: https://www.youtube.com/watch?v=g3M71PyheQU

Overview

In her thought-provoking Kawaiicon talk, "Is My Job Even Real? Bullshit Jobs in Infosec," security engineer errbufferoverfl (also known as Beck or Buffy) delves into the pervasive feeling of meaninglessness and burnout experienced by many professionals in the cybersecurity industry. Drawing inspiration from David Graeber's seminal work, Bullshit Jobs, Beck explores why a field intrinsically critical to modern society can often leave its practitioners feeling disconnected, undervalued, and without tangible impact. Her research, based on a community-driven survey and interviews, provides a raw and honest snapshot of these frustrations.

This talk is not merely a complaint session; it is a profound sociological and psychological examination of the underlying systems that contribute to this disillusionment. By tracing the historical evolution of labor, time, and moral values, Beck constructs a compelling argument that the "bullshit" isn't inherent to InfoSec itself, but rather a byproduct of organizational, structural, and cultural forces. The presentation challenges attendees to reflect on their own experiences and consider how collective action, rather than individual resilience, is essential to reclaim agency and purpose in their professional lives.

The relevance of this talk cannot be overstated in an industry grappling with high rates of burnout, talent shortages, and mental health challenges. By articulating the often-unspoken frustrations of security professionals, Beck offers validation and a framework for understanding these issues beyond personal failings. Her call to action—emphasizing boundaries, community, and collective refusal—provides a roadmap for fostering a healthier, more impactful InfoSec environment, making this a crucial conversation for anyone working in or leading security teams today.

Background

▶ Watch: Introduction and talk overview (0:00)

The genesis of this project stemmed from errbufferoverfl’s personal encounter with David Graeber’s book, Bullshit Jobs. Graeber's description of "hell as a group of people hired to make cabinets who spend their day frying fish instead badly and resenting those who still get to make cabinets" struck a deep chord with Beck, articulating a familiar sense of pointlessness and professional envy. This concept, coupled with Graeber's "catastrophic disappearance" thought experiment—where the absence of essential workers like nurses or mechanics would be immediately catastrophic, unlike many corporate roles—led her to question the perceived impact of her own work. While her individual tasks (e.g., gap analysis for NLM authentication, flagging outdated JavaScript libraries, resolving Jira tickets) might not cause immediate global collapse if she vanished, she posited that the collective disappearance of all InfoSec professionals would undoubtedly lead to rapid systemic failure. This distinction formed the core hypothesis: InfoSec itself is not intrinsically a bullshit job, but it can feel or function that way due to the surrounding organizational, structural, and cultural systems.

To explore this hypothesis, Beck conducted exploratory, community-driven research, including an online survey that garnered 118 responses and several in-depth interviews. This qualitative approach aimed to capture personal reflections on work, providing a space for anonymous venting and follow-up stories. While acknowledging the sample size was small and self-selecting, particularly outside the Anglosphere, the goal was to offer a snapshot of how people genuinely feel about their work.

The talk then dove deep into the historical underpinnings of our modern relationship with labor and time, tracing a lineage from the Middle Ages to contemporary hustle culture. Beck highlighted that in earlier eras (14th-15th centuries), much of what we now call wage work was performed by unfree laborers, blurring the lines between livelihood and captivity. The radical idea of "freely selling your time for money" was not natural but imposed. This shift was largely driven by the enclosure movement, where common lands were privatized, forcing peasants to sell their labor to survive. Simultaneously, religion, particularly the Protestant work ethic, reinforced this transformation, recasting industriousness as a sign of grace and idleness as sin. This moral logic, which equates worth with output and efficiency, has been inherited by modern management systems like Fordism, Taylorism, and scientific management. Thus, the pervasive feelings of burnout and meaninglessness are not new phenomena, but "aftershocks of centuries of moral and technological conditioning" that have taught us our value lies in how we spend our hours.

Key Findings

▶ Watch: The shift from owning work to owning time (6:00)

The research conducted by errbufferoverfl, comprising 118 survey responses and personal interviews, revealed a nuanced picture of job satisfaction within InfoSec. Of the respondents, only 5 explicitly stated their job was bullshit, while 58 said "sometimes," and 54 reported "no." This distribution highlighted that for the majority, the experience of meaninglessness was episodic rather than constant, residing in the "sometimes" category.

A central finding, unifying all responses regardless of their "bullshit" rating, was the profound human need to "have effect"—to enact change on the world and witness its response. Beck introduced psychologist Carl Bruce's concept of the "pleasure of being the cause," observed in infants delighted by their ability to make things happen. Conversely, psychiatrist Francis Brk's "trauma of failed influence" describes the resulting rage, refusal, and retreat when agency is withdrawn and actions make no visible difference. This pattern resonated strongly with the survey data.

Respondents who felt their job was consistently pointless, such as a senior penetration tester who lamented that "nobody cared about security, only about ticking compliance boxes," exemplified the trauma of failed influence. Conversely, those in senior roles, like a CISO who "see[s] risks being mitigated by the collaboration I foster," or a threat detection engineer who valued "being able to see the direct impact we're having," clearly experienced the pleasure of being the cause. These individuals often enjoyed greater autonomy and visibility, making outcomes tangible.

The "sometimes" group, representing the largest segment, articulated the paradox of knowing their work could matter but often struggling to see its impact. A CISO from New Zealand noted their job made a difference, but their managers might not see it, while a head of security in Australia found reward in "improving detection" but described "endless compliance debates" as the most frustrating part. This disconnect between effort and outcome was identified as a primary driver of erosion of well-being, leading to fatigue, cynicism, and detachment. The extreme case of Lawrence Vanvassen Hoveve, who sued her employer after 20 years of being paid without work, underscored how the slow disappearance of purpose can be deeply damaging, even when financial compensation is present.

Burnout emerged as a recurring theme, not merely as a consequence of excessive workload, but as another manifestation of the trauma of failed influence. A red teamer reported "70-hour weeks and saw no meaningful change," while an engineering manager noted becoming more burnt out as their environment improved, highlighting that the issue was the return on effort, not just the effort itself. This environment fosters "right scolding"—a moral policing where dissatisfaction is met with admonishments like "you just need to find your path" or "it's what you make of it," echoing the Protestant work ethic that equates endurance with virtue. This insidious mechanism externalizes systemic problems as individual failures, making it difficult for people to resist systems that deny agency, rest, and care.

Technical Deep Dive

▶ Watch: The pleasure of being the cause and trauma of failed influence (10:00)

While "Is My Job Even Real? Bullshit Jobs in Infosec" is not a technical talk in the conventional sense, it offers a profound sociological and historical deep dive into the systemic factors that influence the psychological well-being of security professionals. Instead of focusing on code, protocols, or architectures, Beck meticulously deconstructs the conceptual frameworks and historical forces that contribute to the perception of meaninglessness and burnout within the industry.

The technical core of this talk lies in its analytical framework, which synthesizes ideas from labor history, psychology, and sociology to explain a contemporary problem in InfoSec. The primary theoretical anchor is David Graeber's concept of "bullshit jobs"—roles that are so utterly meaningless, unnecessary, or pernicious that even the person performing them cannot justify their existence. Beck adapts this by arguing that InfoSec roles are not inherently bullshit, but the systems around them can render them so.

A critical component of this framework is the psychological concept of agency, articulated through Carl Bruce's "pleasure of being the cause" and Francis Brk's "trauma of failed influence." The talk technically dissects how human beings are fundamentally driven by the need to act on the world and observe its impact. In an InfoSec context, this translates to the satisfaction derived from seeing vulnerabilities mitigated, threats detected, or users genuinely secured. The "technical" problem, then, is the systemic obfuscation or denial of this impact. For instance, a security engineer might spend weeks developing a robust security control or conducting a thorough penetration test only for the findings to be ignored, relegated to an endless backlog of Jira tickets, or dismissed as mere compliance box-ticking. The effort is expended, but the tangible effect—the "cause"—is decoupled from the "effect," leading to the "trauma of failed influence."

Beck's historical analysis serves as a root cause analysis for this systemic issue. She traces the evolution of labor from feudal systems, where unfree workers were bound by servitude, to the modern capitalist wage economy. The crucial shift, she argues, was from owning work (e.g., buying a potter's pots) to owning time (e.g., renting an individual's hours). This was not a natural evolution but an imposition, notably through the enclosure movement of the 14th-15th centuries, which dispossessed peasants and forced them into wage labor for survival. This historical "protocol" for labor was further encoded by the Protestant work ethic, which moralized work, equating industriousness with virtue and idleness with sin. This "moral architecture" underpins modern management philosophies like Fordism and Taylorism, which prioritize efficiency, measurable output, and disciplined work as signs of worth.

In InfoSec, this manifests as a culture where "performance productivity" is often valued over genuine impact. Security professionals might be lauded for the number of vulnerabilities identified, reports generated, or hours logged, even if these actions don't translate into a demonstrably more secure environment. The pressure to "do more with less" and the glorification of "hustle culture" are direct descendants of these historical and moral lineages. The "technical deep dive" here is into the systems that govern our work lives, revealing them to be centuries-old constructs designed for extraction and control, which inadvertently strip InfoSec professionals of their agency and sense of purpose, despite the critical nature of their craft.

Demo / Proof of Concept

▶ Watch: Collective change begins with individual refusal (20:00)

This talk, being a deep dive into the sociological and psychological aspects of work within InfoSec, did not feature a traditional technical demonstration or proof of concept involving software, exploits, or security tools. Instead, the "proof" was presented through the qualitative data gathered from the community survey and interviews, illustrating the lived experiences of security professionals. The speaker effectively demonstrated the impact of these abstract concepts through anonymized quotes and aggregated statistics from her research, which served as the empirical evidence for her arguments.

Defensive Implications

▶ Watch: Practical steps: take breaks, join community, learn rights, unionize (21:00)

The "defensive implications" of errbufferoverfl's talk extend beyond traditional technical cybersecurity measures, focusing instead on organizational resilience and individual well-being within the InfoSec workforce. These are strategies for defending against the erosion of purpose, burnout, and the systemic forces that make InfoSec feel like a bullshit job.

For Individuals (Defending Personal Agency and Well-being):

• Reclaim Time and Boundaries: The most fundamental "defensive" action is to assert control over one's time. This includes consistently taking lunch breaks, stepping away from the desk, and starting and finishing work on time. These are presented as small but potent acts of refusal against the expectation of constant availability and unpaid overtime.
• Seek Non-Output-Driven Community: To counteract isolation and the pressure for constant productivity, individuals should join communities outside of work where output isn't graded. Examples include local clubs, meetups, creative groups (e.g., pottery, community theater, life drawing), or political collectives. The goal is to rediscover curiosity and play, fostering a sense of worth beyond professional performance.
• Enhance Legal Literacy: Understanding one's employment rights is a crucial "defensive" tool. Knowing the basics of labor laws—such as protections against unfair dismissal (e.g., the Australian high-income threshold example)—empowers individuals to recognize when their rights are being eroded and to advocate for themselves and others.
• Join a Union: Unions are highlighted as a powerful collective defense mechanism in a system designed for isolation. They provide language, leverage, and community for addressing issues like unreasonable workloads, excessive hours, bullying, pay gaps, and even ethical dilemmas. A union ensures collective support and representation, preventing individuals from being "taken for a ride."
• Challenge Internalized Guilt: Individuals must defend against "inner cop" narratives that equate rest with laziness or self-worth with endless work. This involves consciously resetting expectations, drawing firm boundaries, and understanding that one is a person, not merely a resource.

For Organizations and Leadership (Building a More Resilient InfoSec Environment):

• Foster Visible Impact and Agency: Leaders must actively create environments where security professionals can clearly see the impact of their work (the "pleasure of being the cause"). This means moving beyond mere compliance box-ticking to genuinely mitigating risks and celebrating tangible improvements.
• Combat "Right Scolding": Organizations should actively dismantle the culture of "right scolding" that blames individuals for systemic issues. Instead of telling burnt-out employees to "find their passion" or "try harder," leadership should acknowledge structural problems and support genuine solutions.
• Prioritize Well-being as a Strategic Asset: Recognize that burnout is a systemic issue, not an individual failing. Invest in policies and cultural shifts that support work-life balance, rest, and mental health, understanding that a healthy workforce is a more effective and resilient one.
• Rethink Productivity Metrics: Challenge the ingrained moral logic that equates worth solely with measurable output and efficient use of time. Explore alternative metrics that reflect genuine security improvements and team collaboration, rather than just activity.
• Support Collective Action: While the speaker's call for revolution is lighthearted, organizations can support internal collective initiatives, employee resource groups, and fair labor practices to empower their workforce.

Ultimately, the defensive implications of this talk are about shifting from an individualistic, blame-oriented approach to a collective, systemic one. By understanding the historical and psychological forces at play, InfoSec professionals and their leaders can collaboratively build a more meaningful, sustainable, and truly secure industry.

Key Takeaways

• InfoSec isn't inherently a "bullshit job," but systemic issues can make it feel that way. The problem isn't the work itself, but the organizational, structural, and cultural systems that surround it, leading to widespread feelings of meaninglessness and burnout.
• The human need for agency and impact is critical for job satisfaction. Individuals are driven by the "pleasure of being the cause"—the ability to enact change and see its effects. The absence of this, or the "trauma of failed influence," is a primary driver of frustration and disillusionment.
• Our modern perception of work is shaped by centuries of historical conditioning. From the enclosure movement and the Protestant work ethic to scientific management and hustle culture, our understanding of time, labor, and worth is deeply rooted in systems designed for extraction and control.
• Burnout is a symptom of failed influence, not just workload. Many security professionals experience burnout not solely due to long hours, but because their significant effort yields little visible or meaningful return, exacerbated by "right scolding" that blames the individual for systemic issues.
• Individual refusal and collective action are essential for change. While self-care is insufficient to solve structural exploitation, small acts of personal refusal (setting boundaries, taking breaks) coupled with collective efforts (joining communities, learning rights, unionizing) can create cracks in the system.
• We must challenge the glorification of overwork and support each other in valuing worth beyond productivity. Fostering a culture that prioritizes rest, boundaries, and genuine impact over endless output is crucial for creating a healthier, more meaningful InfoSec industry.

About the Speaker(s)

errbufferoverfl, who also goes by Beck or Buffy, is a Security Engineer with nearly a decade of experience "fist fighting computers." She explicitly states that she is not a sociologist or a policy analyst, but rather approaches her research from the perspective of a practitioner embedded within the industry. Her work on "Bullshit Jobs in Infosec" is characterized as exploratory and community-driven, reflecting a deep personal interest in understanding the human experience of work within her field. Beck's willingness to delve into unconventional topics and her candid approach to discussing mental health, capitalism, and burnout highlight her commitment to fostering a more honest and supportive environment within the cybersecurity community.