What does a typical workday in the life of a CISO look like? Most CISOs would agree that there are myriad things that are constantly begging for attention in their work, and yet have 20 extra things that land up in their inbox that need to be sorted out immediately - High impact data leakages, discussion with a prospective customer, a minor escalation, and Oh Yes (or No !!, not again), another review with CEO/COO/CIO/Board of directors and what not!! This is in addition to the millions of discussions or calls they are pulled in on TEAMS/ZOOM etc. etc. and the zillions of emails asking for guidance on every aspect. Did I miss the travel itinerary that needs to be taken care of?
Hold on, I know these expressions !! You are either smirking that I missed so many things or just smiling that you don’t deal with any of this stuff, but so much other stuff that I have not even touched upon. Whatever the case, you would agree that cybersecurity professionals have a tough job that involves intense focus, creativity, technical prowess and responsibility, and more often availability ( all the time).
We all love ( and believe) statistics. So let’s look at some of those:
- 51% of cybersecurity professionals have trouble sleeping due to work-related stress.
- 47% of cybersecurity professionals are working between 41 and 90 hours per week.
- 48% of CISOs reported that the level of stress they are under has affected their mental health
- 97% of the C-Suite said that the security team could improve on delivering value for the amount of budget they receive
Well again, these statistics can be biased or have a low sample level, etc. But I would like to share a personal account of how I suffered a bout of burnout during the pandemic.
It becomes difficult to talk when you are writing your own story. But, I feel, that it’s important for me to voice out my thoughts. It was during the pandemic that I started feeling that I was suffering a burnout. To be honest, I love my job and the work I do, and the difference I make to my organization’s security posture. I had never felt this feeling in my 8 years on the job, but this one was a bit different.
The cybersecurity team was working round the clock, along with other teams to ensure a smooth and secure transition towards the work from home. However, staying and working from home continuously over the next 3 months took a toll on me. I was becoming irritated, started hating that TEAMS ringtone (it’s a nightmare, trust me!), and overall disliked my job. The work pressure was all-time high and the mundane routine along with pandemic stress ( it was a scary time), all contributed to my burnout.
Did I realize that something was wrong? Yes, the signals were there. Did I accept that I was suffering from burnout? Yes and No. The affirmative side was mainly because my family clearly started pointing out the signs they noticed and deep down I was noticing it too. But do you really accept such things so easily? You know the answer to that question.
At some time, during the pandemic, I was sure that I want to leave everything and just not care about anything -- job, performance review, or salary for that matter. But before I talk about it further, it’s time to actually understand burnout.
Burnout is that feeling when you think you are done. You just don’t care even if you are passionate about cybersecurity ( or the field you are in). Performance reviews, promotions, new initiatives nothing excites you further. You just want to leave everything and probably decide to live on a remote island.
Did I feel this? Yes, by the fag end of the lockdown I was literally suffering from all this and just wanted to go to Switzerland, live in a hut, and do nothing almost nothing. ( I know you are smiling, but this is the first thought that came to my mind).
But, here I’m writing this article, continuing in the same organization and place ( yes, this sucks, would have been great if I was in Switzerland !!), so what changed? Did my burnout go away? Did I do something about it? More on this later.
Before we move further into my story, let’s look at some of the reasons that contribute to burnout.
Work from Home does NOT mean 24*7 availability.
Ever since the pandemic started and organizations asked people to work from home, there has been a growing mentality that you are always available. In fact, people make statements such as “ You are at home only, why can’t you attend a call at 10.30 PM or 7.30 AM?” or “ What is the need for a leave, anyways you are at home” or “ Having lunch, you can always attend calls side by side.”
There is a reason why people log off after office hours. They need time to spend time with family, wind down after a long day’s work, and rest.
Such a culture of 24*7 availability often leads to frustration which over time builds up the symptoms of burnout.
The never-ending load of cybersecurity breaches, ransomware attacks, and zillions of vulnerabilities need to be patched.
Cybersecurity teams have a never-ending job of dealing with vulnerabilities reported in applications, servers, software, and whatnot. Almost every day, vendors release patches and updates which have to be pushed to every system out there to mitigate the threats. This becomes a thankless job that never finishes. How would you feel to work on a project that has no ending in sight?
Such jobs often result in monotony which results in burnout.
Expectations / Job responsibilities are not clear
“I feel that should be looked at by the security team”, or “Could you look into this too ?”. Most often the expectations from the security team are not clear. Whenever business teams look at something that mentions “Security”, they just send it to the cybersecurity team asking them for their so-called guidance.
The expectations and job responsibilities are not clear. When you look at the jobs that are advertised by an organization, the responsibilities are endless even for an entry-level professional. Most of the time, all roles - application, network, and whatnot, are baked into the role. Even the president of a country has fewer roles and responsibilities to take care of !!!
Glorifying Overwork
Another trend that is quite prevalent is the practice of glorifying overwork. People are rewarded for neglecting their health, family, and most importantly themselves. You don’t and should not have any time for yourself. If you are overworked, and always available for every initiative out there, you are great, else you do not have the “it factor” to make it big.
While this may feel great in the short run, you are hurting yourself and most importantly creating that potent mixture of burnout.
These factors may differ from individual to individual. But this often leads to people leaving their jobs. According to research by VMware, 47% of cybersecurity incident responders say they've experienced burnout or extreme stress over the past 12 months.
So what do we have to do to avoid burnout or at least handle it? While I had a few things that really worked out in my favor, you will have to find techniques that work for you.
Learn to say NO
We are taught this wrong practice of saying Yes to everything - extra work, customers, and of course bosses. We have to learn to start saying NO when we think we will not be able to handle the work. Rather than stressing yourself out later or missing your son’s birthday, it is better to be the bad guy.
Start declining meetings where you know that you just have to say “Thanks” at the end and nothing more. Start saying “NO” to “Can we get into a quick call?” where people just want you to be there.
Don’t worry, if your boss has decided NOT to give you a promotion, he isn’t going to give you one even if you say “Yes to Everything.”
Prioritize and Learn to Delegate things !!
Often CISOs feel that they must always be in charge. They should get their own hands dirty and get the job done. While a hands-on approach is always good, you really need to start focusing and prioritizing the work only you can perform.
I have seen this fear in people that if they delegate, their value in the organization will decrease and they will no longer be valuable. That is a cause of concern only when you are not learning new things. Focus on improving yourself always and learning new aspects. You will automatically remain relevant in your field.
Take a vacation and spend time with your family/friends
We often neglect our loved ones in the wake of work. But often, these are the people that come to our rescue in times of need. You are indispensable to them, but not to your organization. It will take a minute for the company to replace you when you are dead !!
Talk to your friends, and spend time with loved ones. Studies have shown that these are powerful boosters that help you cope with the stress of your jobs.
Finally, it’s ok to take a break for sometime
We hesitate to take breaks in our careers. What would I do without the paycheck? How would I justify it on my resume? It may not be possible under every circumstance, but taking on a less stressful job or with a lower paycheck is far better than struggling with a high-pressure job. Your life is worth it.
In my case, I have a very supportive family I could turn to. I would speak to my mum for some time every day and that really helped me in the process. At the same time, I have a boss who is extremely supportive and understanding. I never spoke to him directly on this matter, but often took guidance on things that were bothering me at work. I learned to say NO and avoid unnecessary meetings that seriously did not require any of my input.
Conclusion
Burnout in a job is very real. It affects a lot of professionals out there. Do not feel that this is a problem unique to you. It’s ok to take outside help if you feel distressed and burnt out. It’s ok to take a break sometimes and just spend some “me time”. Begin the journey towards a stress-free life-Yoga, meditation, playing music, dancing to your favorite song, reading a book, a walk in the park, or cuddling your dog -- whatever works for you.
What do you think about burnout? Have you experienced it? Share your journey in the comment(s) section below.
Comments ()