Professor Simon's IT and Cybersecurity Podcast

Professor Simon

Welcome to The Professor Simon IT & Cybersecurity Podcast, where we go beyond the textbook with real-world career advice, practical guidance, and lessons from the field. Whether you're breaking into IT or cybersecurity, building your skills, transitioning careers, or planning your next move, you'll gain practical insights to help you make better career decisions and understand what the work actually looks like. Topics include careers, certifications, IT fundamentals, SOC, GRC, leadership, AI, cloud security, and more. Cyber & IT Beyond the Textbook.

Play

Open in

64 episodes
daily
Avg 10 min
English

Episodes 64

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

S1 · E72
Today · 6 min
Is This Data Sensitive? What to Ask Before You Share It
Someone asks you to set up a shared folder, and one of the spreadsheets has employee home addresses and personal phone numbers in it. Before you click share, how do you decide whether the data is sensitive, and whose call is it? In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through how to recognize the issue, find the right person to decide, and find a safer way to help. I use one made-up example, a colleague who wants a shared folder and a link anyone can open, to cover what to look at in the data, whose information it is, who gets to decide, what your own organization's rules may say, and how to share less. I also cover how to ask without making it awkward, what to do if the owner isn't answering, and what to write down afterward. I don't cover what any law or regulation requires; that is a question for your privacy or legal team. This episode is for IT professionals and early-career security practitioners who get routine data requests, and I don't recommend any product. Your own organization's process and the data owner's approval come first. ▶️ Companion YouTube Video: https://youtu.be/6gcLIJeJfxU 📝 Companion Blog Post: Companion blog post: https://professorsimon.com/blog/is-this-data-sensitive-checks-before-sharing 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline
S1 · E71
Yesterday · 9 min
Cybersecurity Interview Questions: How to Answer "Walk Me Through What You'd Do"
An interviewer says an account signed in from one city and, twenty minutes later, from a city on the other side of the country, then asks you to walk them through what you'd do. In this episode of Professor Simon's IT & Cybersecurity Podcast, I explain how to answer a scenario question like that out loud, even if you have never worked that exact alert. I use one made-up question and two made-up answers. First, an honest answer that lists tools and still doesn't land, because it tells the interviewer where you'd go and nothing about what you'd look for or why. Then a stronger answer built step by step: repeat the situation back and ask a clarifying question, say what you'd look at first and why, rule out the boring explanations such as a VPN, say what would change your mind, say plainly what you don't know and how you'd find out, and finish with who you'd tell and what you'd say. I also cover how to connect your answer to real help desk or IT experience without stretching it, how to handle follow-up questions, what to do when your mind goes blank, and how to practice out loud before the interview. This episode is for IT professionals going for a first security analyst role and early-career analysts interviewing for the next one. I can't tell you how any company scores interviews, and they don't all do it the same way. The question and both answers are made up for illustration, and I don't recommend any tool or product. ▶️ Companion YouTube Video: https://youtu.be/C2g8PMJjUvs 📝 Companion Blog Post: Companion blog post: https://professorsimon.com/blog/cybersecurity-interview-questions-scenario-answers 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline
S1 · E70
Monday · 8 min
Your Backups Succeeded. Could You Actually Recover?
Every morning the backup report says success. But if the file server died tonight, how long would it take before people had their files back? In this episode of Professor Simon's IT & Cybersecurity Podcast, I explain what a backup success message does and doesn't tell you, and how a small, approved restore test answers the question that security actually cares about: could we recover? I use one made-up example, a file server whose nightly job has reported success for months, to show what a restore test can reveal: a folder that was quietly excluded and a restore that takes far longer than anyone assumed (the numbers are invented). I cover why restoring files isn't the same as getting people working again, why attackers go after backups and why a separated copy matters, and how to propose a restore test and write down the result even when you don't own the backup system. This episode is for IT professionals moving into cybersecurity, especially people who already run or watch backup jobs. I don't recommend any product, and your own organization's process and the backup owner's approval come first. ▶️ Companion YouTube Video: https://youtu.be/32lIQ8V00ac 📝 Companion Blog Post: Companion blog post: https://professorsimon.com/blog/backup-restore-test-could-you-actually-recover 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline
S1 · E69
Friday · 8 min
A User Reported a Suspicious Email. What Do You Check First?
Someone reports an email and says, "This looks weird." You have a queue, a few minutes, and a message you shouldn't click anything in. Where do you start? In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through a five-step first-look routine for a reported suspicious email: scope, read, check, compare, and decide. I use one made-up example, an access-expiry message that looks like it comes from a document-sharing service, to show how to read a message safely, weigh the sender, authentication results and links without treating any single clue as proof, ask the reporter what they did without blaming them, and choose between closing with a supported reason, asking for more information and escalating. I leave the example's final answer open on purpose. This episode is for IT professionals moving into security, and early-career practitioners, including junior SOC analysts and help desk staff, who receive suspicious email reports. If your team's process says something different, your team's process wins. ▶️ Companion YouTube Video: https://youtu.be/LLfsNu6cewc 📝 Companion Blog Post: Companion blog post: https://professorsimon.com/blog/phishing-email-triage-first-look-routine 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline
S1 · E68
Thursday · 9 min
You're Asked to Prove a Security Control Works. What Do You Actually Show?
Your lead asks you to show that a security control is working. You open the console, and everything is green. Is that proof? In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through four questions for answering an evidence request honestly: what are we trying to prove, what evidence would actually show that, can we trust what we're looking at, and what can't we prove yet. I use a made-up example, endpoint protection on company laptops with invented numbers, to show what a settings screenshot and a console report can and cannot establish, how to check that evidence can be trusted, and why two lists that do not match cannot yet be treated as a protection gap. I finish with a short fictional evidence note you can model. This episode is for IT professionals moving into security, and early-career practitioners, who are asked to gather, check and explain evidence within their own responsibilities. I am not telling you what any auditor wants. ▶️ Companion YouTube Video: https://youtu.be/TzOjSPYWNvc 📝 Companion Blog Post: Companion blog post: https://professorsimon.com/blog/prove-security-control-works-what-to-show 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline
S1 · E67
October 21 · 8 min
Shadow AI in an Alert? What a Security Analyst Should Do Next
You are working an alert and something catches your eye: an AI tool you have never heard of. Is it a problem? You do not know yet, and what makes it uncomfortable is not knowing whether it needs you to do anything at all. In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through three steps for handling it without overstepping: notice, document and escalate. It is for early-career analysts and IT professionals moving into security. I am not asking you to go looking for AI tools. I am talking about what you do when one turns up during your normal, authorized work, in an alert, a log entry, a ticket or something a colleague mentioned. I use a made-up example: an alert showing activity consistent with an attempted file upload from a user's device to a site that appears to be an AI summarization tool. From the alert alone, you cannot tell whether the transfer completed, what information, if any, the site received, or whether the tool is approved. Notice: work out what you can establish from the evidence you are authorized to see. An unfamiliar AI tool is not automatically prohibited, and it is not automatically dangerous either. Separate what the evidence shows from what it does not, and write down what you cannot answer as unknown. Document: write notes someone else can use to decide. Keep what you observed apart from what you are assuming, and keep the notes lean. Escalate: follow your organization's procedure and hand the question to someone who can decide, using a five-point message, with a sample. I leave the ending of the example open on purpose. The example is made up. ▶️ Companion YouTube Video: https://youtu.be/Cy9C6lQlr2s 📝 Companion Blog Post: Companion blog post: https://professorsimon.com/blog/shadow-ai-in-an-alert-security-analyst ⁠ 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline
S1 · E66
October 20 · 8 min
Stuck Closing Alerts? What to Build as a SOC Analyst
You have been closing alerts for months, and it still feels like you are not getting anywhere. What should you build next? In this episode of Professor Simon's IT & Cybersecurity Podcast, I give you a practical way to think about what to build as a security or SOC analyst, in three parts: depth, ownership and direction. It is for analysts somewhere between their first few months and their third year. I am not assuming your organization has tiers or a standard promotion ladder. Depth: understand why an alert fired, pay attention to repeats, learn the systems involved and write investigation notes someone else can follow. Ownership: take responsibility for small improvements within your authority, share findings clearly and help newer teammates when it is appropriate. Direction: ask for specific feedback, find out what more responsibility looks like where you work, keep a record of your contributions and build a realistic growth plan. I also give you one thing to do this week. This is professional judgment and not a rule for every employer, and none of it promises a promotion. The example is made up. ▶️ Companion YouTube Video: https://youtu.be/TIIzUIV-G2M 📝 Companion Blog Post: Companion blog post: ⁠https://professorsimon.com/blog/soc-analyst-career-growth-beyond-closing-alerts 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline
S1 · E65
October 19 · 8 min
Your First 90 Days as a SOC Analyst: What to Focus On
You've landed your first SOC job. Now what? Your first 90 days as a SOC analyst aren't about knowing everything or being the fastest person on the team. They're about learning your environment, building consistent habits, and developing the judgment to know when to investigate further and when to ask for help. In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through a practical approach to your first three months: Days 1 to 30: Learn the environment, tools, workflows, and escalation procedures. Days 31 to 60: Build a repeatable investigation routine and improve your documentation. Days 61 to 90: Develop judgment, recognize unusual details, and understand your authority. I also discuss how to respond when you make a mistake, including communicating promptly, separating facts from assumptions, and documenting what you learned. This is a practical framework, not a guaranteed onboarding schedule. The mistake scenario is fictional. Resources: 📘 First SOC Shift: https://professorsimon.com/books/first-soc-shift ▶️ Companion YouTube Video: https://youtu.be/BohwoRWVDvY 📝 Companion Blog Post: Companion blog post: https://professorsimon.com/blog/first-90-days-as-a-soc-analyst 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline
S1 · E64
October 16 · 8 min
Access Denied? Fix It Without Making It Admin
Access denied tickets are easy to close if you grant admin, and that is exactly why it is tempting. Admin might not fix the problem, you may not learn what was wrong, and the extra access stays after the ticket is closed. In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through a five-step, provider-neutral method for troubleshooting an access denied ticket: identify the denied action, determine the identity and the resource, inspect the permissions and the restrictions, make the narrowest authorized fix, and retest and verify. I use a made-up example, with no real organization or person behind it, to show each step. Along the way I cover authentication versus authorization, other ways access can be blocked besides a missing permission, what to bring when you escalate, and how least privilege applies to the fix. More free resources: https://professorsimon.com/links ▶️ Companion YouTube Video: https://youtu.be/A_Z19Y6-jys 📝 Companion Blog Post: https://professorsimon.com/blog/access-denied-troubleshooting-without-admin 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline
S1 · E63
October 15 · 7 min
Security Metrics for Leadership: What Actually Matters?
You can pull a lot of numbers out of your security tools, and the safe move feels like putting all of them in the report for leadership. A full page of charts looks thorough, but a dashboard is not a decision. In this episode of Professor Simon's IT & Cybersecurity Podcast, I give you one question to ask about every number: what decision or action could this number change? I use a made-up vulnerability reporting example, with no real organization behind it, to show the difference between an activity metric and a number leadership can act on. Then I cover what a number needs around it (a reference point, a trend and a stated limitation), how to present your numbers to the person reading the report, and what to do with numbers that fail the test. I also share a simple exercise you can use on your last security report. More free resources: https://professorsimon.com/links ▶️ Companion YouTube Video: ⁠https://youtu.be/bFcRlIiOpQc 📝 Companion Blog Post: ⁠https://professorsimon.com/blog/security-metrics-for-leadership-reports 🎧 More Podcast Episodes: ⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: https://professorsimon.com/products/cybersecurity-interview-prep-pack 🔗 Resources, blog & more: ⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline
S1 · E63
October 13 · 8 min
Patch Management: How to Balance Security Risk and Production Stability
Every patch carries two risks. Leave a known vulnerability unpatched, and the exposure remains. Apply a patch without proper planning, and something the business depends on could stop working. In this episode of Professor Simon's IT & Cybersecurity Podcast, I explore how security managers balance those risks using PatchSecure Inc., a fictional teaching scenario from my book. We'll look at what it means for a patching program to fail safely, why realistic testing matters, and how patch management connects to change management, monitoring, access controls, incident response planning and training. I'll also share three practical questions you can use to evaluate your own patching program. This episode is independent educational content based on my own teaching. It is not official ISC2 material, and ISC2 is not affiliated with it. More free resources: https://professorsimon.com/links ▶️ Companion YouTube Video: https://youtu.be/L0BcUibSJ1U 📝 Companion Blog Post: https://professorsimon.com/blog/patch-management-program-security-risk-vs-stability 🎧 More Podcast Episodes: ⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠ 🔗 Resources, blog & more: ⁠⁠⁠https://professorsimon.com/links⁠⁠⁠ 🌐 Website: ⁠⁠⁠https://professorsimon.com⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.
S1 · E61
October 13 · 8 min
Cybersecurity Degree, Certifications, or Experience: Which Do You Actually Need?
If you work in IT and want to move into cybersecurity, you have probably heard three confident answers: get the degree, get a certification, or just get experience. In this episode, Professor Simon explains why those answers contradict each other and gives you a better question to ask first: which gap are you actually trying to close? He walks through six common gaps between where you are and a specific security role, shows how a degree, a certification and experience may each help with different ones, and applies them to three made-up IT professionals. You will also get three questions to ask before you spend time or money, and a practical way to start by comparing real job postings. ▶️ Companion YouTube Video: https://youtu.be/s_w8r_Fd5Cs 📝 Companion Blog Post: https://professorsimon.com/blog/cybersecurity-degree-or-certification 🎧 More Podcast Episodes: ⁠⁠https://professorsimon.com/podcast⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: ⁠⁠https://professorsimon.com/links⁠⁠ 🌐 Website: ⁠⁠https://professorsimon.com⁠⁠ 💼 LinkedIn: ⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠ 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.
S1 · E60
October 12 · 8 min
Patch Management: What to Understand Before You Install a Patch
If you have been handed a list of systems to patch without seeing the decisions behind it, this episode is for you. Professor Simon explains what a patch management program has to understand before the first patch is deployed: the inventory, risk, business and regulatory requirements, policy, tools and testing, using a fictional teaching scenario, PatchSecure, Inc. He also shares two questions to ask about any patching program. More free resources: https://professorsimon.com/links ▶️ Companion YouTube Video: https://youtu.be/GFR2sHZXrH8 📝 Companion Blog Post: https://professorsimon.com/blog/patch-management-before-you-patch 🎧 More Podcast Episodes: ⁠https://professorsimon.com/podcast⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠https://professorsimon.com/guidance⁠ 🔗 Resources, blog & more: ⁠https://professorsimon.com/links⁠ 🌐 Website: ⁠https://professorsimon.com⁠ 💼 LinkedIn: ⁠https://www.linkedin.com/in/leonardsimon⁠ 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.
S1 · E59
October 9 · 8 min
What Actually Counts as Evidence of Cybersecurity Skill?
Sooner or later, someone who is thinking about hiring you is going to say, "Okay, I believe you know cybersecurity. Show me what you can do." A lot of capable people have a certification, a course certificate or a home lab, but nothing that lets the other person see how they work. In this episode, Professor Simon explains what actually counts as evidence of cybersecurity skill: a piece of work that shows your reasoning, so another person can evaluate it. He compares naming a tool with documenting your work in a hypothetical example, covers five things a piece of work should show, and explains how work you already do in IT can count, what to leave out before you share it and where to share it. He also covers how to write it up for technical and non-technical readers and how to practice explaining it out loud. It is for people trying to move into cybersecurity or already working in IT. He is also clear that evidence does not guarantee an interview or an offer. In this episode you'll learn: - Why certifications matter, but knowing something and being able to do it are different - The progression from knowledge to application to evidence to explanation - Five things a piece of work should show: the problem, what you looked at, what you found, your decision and why, and what you would do differently - How work you already do in IT can count, and what to remove before you share it - Other forms of evidence beyond a home lab, and where to share them so a stranger can open them - How to write for technical and non-technical readers and practice explaining your work ▶️ Companion YouTube Video: https://youtu.be/SJLnl_1tzhk 📝 Companion Blog Post: https://professorsimon.com/blog/evidence-of-cybersecurity-skill 🎧 More Podcast Episodes: https://professorsimon.com/podcast 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: https://professorsimon.com/links 🌐 Website: https://professorsimon.com 💼 LinkedIn: https://www.linkedin.com/in/leonardsimon 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.
S1 · E58
October 8 · 7 min
Cybersecurity Risk Management: What Makes a Decision Defensible?
A year from now, somebody is going to look at a risk your organization chose to live with and ask why it was decided that way. Most of the time, they want to know whether anyone can explain it. In this episode, Professor Simon explains what makes a cybersecurity risk decision defensible: a decision that can be explained and supported using what was known at the time, whether or not it turned out well. He walks through a hypothetical, not a real case, about a business team that wants to connect a new tool to customer data before the security review is finished. Along the way, he covers seven things a good risk decision record should show and five questions it should be able to answer. It is useful for security and GRC professionals who make or document risk decisions, and for anyone learning to write them. In this episode you'll learn: - Why a defensible decision is one that can be explained using what was known at the time, not one that turned out well - Why cybersecurity risk decisions should be written down when they are made, not rebuilt from memory later - How to state a risk in plain words that a business decision maker can weigh - How to be honest about evidence, assumptions and confidence in a risk rating - Why a record should show the options considered, and keep security's recommendation separate from the decision - How to record residual risk, assumptions and constraints, and the triggers for reviewing a decision - Five questions a risk decision record should be able to answer ▶️ Companion YouTube Video: https://youtu.be/SzwZ2SGvL-U 📝 Companion Blog Post: https://professorsimon.com/blog/defensible-cybersecurity-risk-decisions 🎧 More Podcast Episodes: https://professorsimon.com/podcast 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: https://professorsimon.com/links 🌐 Website: https://professorsimon.com 💼 LinkedIn: https://www.linkedin.com/in/leonardsimon 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.
S1 · E57
October 7 · 9 min
Who Decides During a Security Incident? | CISSP Blueprint
When a security incident starts, who is actually allowed to decide to take a system offline, bring in legal, or tell the executives? In this CISSP Blueprint episode, Professor Simon looks at incident management through a security manager’s lens, using a fictional healthcare provider, IncidentSecure Inc., as a teaching scenario. He organizes the management side of the work into three questions: who decides, what is at stake, and what the organization will be able to show afterward. Along the way, he covers the difference between a role and the authority to decide, why severity should follow business impact, how legal, compliance, and communication planning fit in, and what evidence can show about an organization’s preparation and response. This is original teaching, not official ISC2 material, and it contains no exam questions. In this episode you'll learn: - Why incident management starts with authority and evidence, not tools - Where incident management sits in the published CISSP exam outline (Domain 7, Security Operations) - The difference between a role and the authority to decide, and why it matters during an incident - Why severity should follow business impact - Why legal, compliance, and communication planning belong in incident management - How an organization can demonstrate preparation and follow-through, including why drills need a record - Three questions to ask about any incident scenario, and what changes when you move toward security management ▶️ Companion YouTube Video: https://youtu.be/glg8OT8ei8w 📝 Companion Blog Post: https://professorsimon.com/blog/who-decides-during-a-security-incident 🎧 More Podcast Episodes: https://professorsimon.com/podcast 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: https://professorsimon.com/links 🌐 Website: https://professorsimon.com 💼 LinkedIn: https://www.linkedin.com/in/leonardsimon 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.
S1 · E56
October 6 · 9 min
SOC vs GRC: Which Would You Actually Want to Do All Day?
Choosing between SOC and GRC usually starts with salary, difficulty, or which one sounds more technical, and those comparisons rarely settle anything. A better question is which kind of work you would actually want to spend your time doing. In this episode, Professor Simon explains what SOC (security operations) work and GRC (governance, risk, and compliance) work tend to feel like day to day. He explains why the idea that SOC is technical and GRC is not does not hold up, walks through one illustrated vendor security problem from both seats, and covers where the two paths overlap. He then gives two small exercises you can try for free, one for each path, along with the questions to ask yourself afterward. Because this is audio, the exercises and questions are described as he goes, so you can follow along while you walk, drive or work. In this episode you'll learn: - Why salary, difficulty and 'which is better' are weak ways to choose between SOC and GRC - What SOC and GRC mean, and what each kind of work tends to involve day to day - Why 'SOC is technical and GRC is not' does not hold up - How the same vendor security problem raises different questions in a SOC and in GRC - What the two paths share: how systems work, clear writing, and separating what you know from what you assume - Two small free exercises to try the work before you pick a path - Questions to ask yourself afterward, and why being able to do the work is different from wanting to do it all day ▶️ Companion YouTube Video: https://youtu.be/7_Ww6uTrMws 📝 Companion Blog Post: https://professorsimon.com/blog/soc-vs-grc-choose-based-on-the-work 🎧 More Podcast Episodes: https://professorsimon.com/podcast 🧭 Figure out which cybersecurity path fits you: https://careervectors.com 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: https://professorsimon.com/links 🌐 Website: https://professorsimon.com 💼 LinkedIn: https://www.linkedin.com/in/leonardsimon 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.
S1 · E55
October 4 · 9 min
Your Team Can Detect Incidents. Can It Manage Them?
Your monitoring tools flag something, and now somebody has to decide how serious it is, who needs to know, and who is in charge of the response. If nobody settled that ahead of time, those decisions get made at the worst possible moment. In this episode, Professor Simon explains why detecting an incident and managing one are two different jobs, and why much of the work of managing an incident happens before the incident ever occurs. He uses a fictional health care provider, IncidentSecure Inc., from his book as a teaching scenario and walks through its four stages: assessing what it needs, designing a strategy, putting controls in place, and training and improving. Along the way he covers defined roles, classification levels, response procedures, a communication plan, where detection fits among the controls, where a response tends to break, and why practice matters. He closes with four questions you can ask about one type of incident your own organization could realistically face. Because this is audio, the four stages and the four questions are described as he goes, so you can follow along while you walk, drive or work. In this episode you'll learn: - Why detecting an incident is not the same as managing one - The four stages of the fictional program: assess needs, design a strategy, put controls in place, train and improve - Why defined roles, severity levels, response procedures and a communication plan matter - How a detection becomes a coordinated response, from classification to who hears about it - Where a response tends to break: a role nobody owns, a severity nobody agreed on, a message that goes out late or wrong - Four questions to ask about one type of incident your team could realistically face - How to explain the work around a detection tool in an interview ▶️ Companion YouTube Video: https://youtu.be/IzMXywJ_GBc 📝 Companion Blog Post: https://professorsimon.com/blog/incident-management-process-before-an-incident 🎧 More Podcast Episodes: https://professorsimon.com/podcast 🧭 Figure out which cybersecurity path fits you: https://careervectors.com 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: https://professorsimon.com/links 🌐 Website: https://professorsimon.com 💼 LinkedIn: https://www.linkedin.com/in/leonardsimon 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.
S1 · E54
October 2 · 13 min
I'm 44. I've Been in IT Since 2000. I'm Building Something New.
A more personal Professor Simon episode. There are no lessons this time, just an honest conversation about why I'm building Professor Simon. I'm 44 and have been working in IT since 2000. I talk about getting my first computer, an Apple IIgs, at about eight years old, how that turned into a career in cybersecurity and teaching, and the gap I kept noticing between learning IT and cybersecurity and actually building a career in it. I also talk about learning video and content creation as I go, how slow growth feels, what I'm still figuring out about where Professor Simon goes next, and learning when to stop working and be present as a husband and father. IT & Cybersecurity Beyond the Textbook. ▶️ Companion YouTube Video: https://youtu.be/0FtMu2uejsw 📝 Companion Blog Post: https://professorsimon.com/blog/starting-something-new-at-44 🎧 More Podcast Episodes: https://professorsimon.com/podcast 🧭 Figure out which cybersecurity path fits you: https://careervectors.com 🔗 Resources, blog & more: https://professorsimon.com/links 🌐 Website: https://professorsimon.com 💼 LinkedIn: https://www.linkedin.com/in/leonardsimon 📸 Instagram • X • TikTok: @profsimononline If you enjoyed this episode, please follow the podcast and share it with someone who might need to hear it.
S1 · E53
October 1 · 10 min
Failed Logins, Then a Successful One: How to Investigate a SIEM Alert
Your SIEM flags an account: about a dozen failed logins in a few minutes, then a successful one. It looks like someone guessed a password, but it looks exactly the same when a phone keeps retrying an old one. In this episode, Professor Simon walks through one hypothetical alert from start to finish, with the focus on the reasoning that transfers from one SIEM to the next, not on any product or query syntax. He treats the alert as a question rather than a verdict and works through six steps: getting the context, building the timeline, checking the source and destination, seeing what happened after the login, arguing both the benign and suspicious stories, and writing a conclusion someone else could follow and check. Because this is audio, the examples are described, not shown, so you can follow along while you walk, drive or work. In this episode you'll learn: - Why an alert is a question, not a verdict - What to check first: what the rule detects, which account is involved, and what it was signing into - How to build a timeline and read the pattern and reasons behind failed logins - How to check the source and destination, and how to recognize password spraying - What to look for after a successful login: new MFA devices, inbox forwarding rules, and unfamiliar systems - How to argue both the benign and suspicious stories, and how to write a conclusion someone else can check ▶️ Companion YouTube Video: https://youtu.be/gnl2qc-DREM 📝 Companion Blog Post: https://professorsimon.com/blog/siem-alert-investigation-failed-logins 🎧 More Podcast Episodes: https://professorsimon.com/podcast 🧭 Figure out which cybersecurity path fits you: https://careervectors.com 🔗 Resources, blog & more: https://professorsimon.com/links 🌐 Website: https://professorsimon.com 💼 LinkedIn: https://www.linkedin.com/in/leonardsimon 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.

Showing 1–20 of 64 episodes