Skip to content
Sign in
Artwork for Professor Simon's IT and Cybersecurity Podcast
Technology

Professor Simon's IT and Cybersecurity Podcast

Professor Simon

Welcome to The Professor Simon IT & Cybersecurity Podcast, where we go beyond the textbook with real-world career advice, practical guidance, and lessons from the field. Whether you're breaking into IT or cybersecurity, building your skills, transitioning careers, or planning your next move, you'll gain practical insights to help you make better career decisions and understand what the work actually looks like. Topics include careers, certifications, IT fundamentals, SOC, GRC, leadership, AI, cloud security, and more. Cyber & IT Beyond the Textbook.

Play
Open in
  • 66 episodes
  • daily
  • Avg 10 min
  • English

Episodes 66

NewestOldestLongest
All20Unplayed20In progress0Played0
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
  • S1 · E74
    Friday · 7 min

    Vulnerability Scan Results: Where Do You Start?

    A vulnerability scan finishes overnight, the report is sorted by severity, and your manager asks, "Where should we start?" In this episode of Professor Simon's IT & Cybersecurity Podcast, I show a practical way to turn a long vulnerability scan report into a short, reasoned starting list. I use one made-up scan: 400 findings, 60 laptops missing the same update, and roughly 70 distinct issues once the duplicates are grouped. The scan, the systems and all of the numbers are invented for illustration. They are not real scan results. I cover how to check what a scan actually covered and which findings might not be real, how to group duplicate findings, why severity is only a starting point, how exposure, known exploitation, system importance and existing protections change the order, and a worked comparison of why a medium severity finding can come before a high severity one. I also cover how to hand system owners a short starting order with a reason for each item. Fixing the findings belongs to the people who own the systems, through whatever change process your organization uses. This episode is for IT professionals moving into security and early-career analysts who are handed scan results for systems they do not own. I don't recommend any product. ▶️ Companion YouTube Video: https://youtu.be/sPmU6OuTB2g 📝 Companion Blog Post: https://professorsimon.com/blog/vulnerability-scan-results-where-to-start 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline

  • S1 · E73
    Thursday · 8 min

    "But So What?" How to Turn a Finding Into a Risk Statement

    You found something real, wrote it up in one line, "No MFA on the VPN," and two weeks later someone asks, "Okay, but so what?" In this episode of Professor Simon's IT & Cybersecurity Podcast, I show how to turn a security finding into a risk statement, so the person reading it can make a decision. I use one made-up example, about 40 accounts in an older group that were never moved to a multi-factor authentication policy, and build the statement one part at a time, from the weak one-line version to a stronger one. The details and numbers are invented for illustration. I cover the difference between a finding and a risk statement, and the six parts of a useful one: the condition, the event it could allow, what is affected, what already reduces the risk, what you don't know, and the decision you are asking for. I also cover how to describe an existing control without overstating it and how to write for the system owner and for a busy manager. I also cover two mistakes to avoid, inflating everything and inventing numbers. If your team has a risk statement template, use it. I don't claim any framework requires this structure. This episode is for IT professionals moving into security or GRC and for early-career analysts who have been asked to write up an issue for someone else to decide on. I don't recommend any product. ▶️ Companion YouTube Video: https://youtu.be/lAHaqRikgmA 📝 Companion Blog Post: https://professorsimon.com/blog/how-to-write-a-risk-statement-from-a-finding 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline

  • S1 · E72
    Wednesday · 6 min

    Is This Data Sensitive? What to Ask Before You Share It

    Someone asks you to set up a shared folder, and one of the spreadsheets has employee home addresses and personal phone numbers in it. Before you click share, how do you decide whether the data is sensitive, and whose call is it? In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through how to recognize the issue, find the right person to decide, and find a safer way to help. I use one made-up example, a colleague who wants a shared folder and a link anyone can open, to cover what to look at in the data, whose information it is, who gets to decide, what your own organization's rules may say, and how to share less. I also cover how to ask without making it awkward, what to do if the owner isn't answering, and what to write down afterward. I don't cover what any law or regulation requires; that is a question for your privacy or legal team. This episode is for IT professionals and early-career security practitioners who get routine data requests, and I don't recommend any product. Your own organization's process and the data owner's approval come first. ▶️ Companion YouTube Video: https://youtu.be/6gcLIJeJfxU 📝 Companion Blog Post: https://professorsimon.com/blog/is-this-data-sensitive-checks-before-sharing 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline

  • S1 · E71
    Tuesday · 9 min

    Cybersecurity Interview Questions: How to Answer "Walk Me Through What You'd Do"

    An interviewer says an account signed in from one city and, twenty minutes later, from a city on the other side of the country, then asks you to walk them through what you'd do. In this episode of Professor Simon's IT & Cybersecurity Podcast, I explain how to answer a scenario question like that out loud, even if you have never worked that exact alert. I use one made-up question and two made-up answers. First, an honest answer that lists tools and still doesn't land, because it tells the interviewer where you'd go and nothing about what you'd look for or why. Then a stronger answer built step by step: repeat the situation back and ask a clarifying question, say what you'd look at first and why, rule out the boring explanations such as a VPN, say what would change your mind, say plainly what you don't know and how you'd find out, and finish with who you'd tell and what you'd say. I also cover how to connect your answer to real help desk or IT experience without stretching it, how to handle follow-up questions, what to do when your mind goes blank, and how to practice out loud before the interview. This episode is for IT professionals going for a first security analyst role and early-career analysts interviewing for the next one. I can't tell you how any company scores interviews, and they don't all do it the same way. The question and both answers are made up for illustration, and I don't recommend any tool or product. ▶️ Companion YouTube Video: https://youtu.be/C2g8PMJjUvs 📝 Companion Blog Post: https://professorsimon.com/blog/cybersecurity-interview-questions-scenario-answers 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline

  • S1 · E70
    Monday · 8 min

    Your Backups Succeeded. Could You Actually Recover?

    Every morning the backup report says success. But if the file server died tonight, how long would it take before people had their files back? In this episode of Professor Simon's IT & Cybersecurity Podcast, I explain what a backup success message does and doesn't tell you, and how a small, approved restore test answers the question that security actually cares about: could we recover? I use one made-up example, a file server whose nightly job has reported success for months, to show what a restore test can reveal: a folder that was quietly excluded and a restore that takes far longer than anyone assumed (the numbers are invented). I cover why restoring files isn't the same as getting people working again, why attackers go after backups and why a separated copy matters, and how to propose a restore test and write down the result even when you don't own the backup system. This episode is for IT professionals moving into cybersecurity, especially people who already run or watch backup jobs. I don't recommend any product, and your own organization's process and the backup owner's approval come first. ▶️ Companion YouTube Video: https://youtu.be/32lIQ8V00ac 📝 Companion Blog Post: https://professorsimon.com/blog/backup-restore-test-could-you-actually-recover 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline

  • S1 · E69
    October 23 · 8 min

    A User Reported a Suspicious Email. What Do You Check First?

    Someone reports an email and says, "This looks weird." You have a queue, a few minutes, and a message you shouldn't click anything in. Where do you start? In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through a five-step first-look routine for a reported suspicious email: scope, read, check, compare, and decide. I use one made-up example, an access-expiry message that looks like it comes from a document-sharing service, to show how to read a message safely, weigh the sender, authentication results and links without treating any single clue as proof, ask the reporter what they did without blaming them, and choose between closing with a supported reason, asking for more information and escalating. I leave the example's final answer open on purpose. This episode is for IT professionals moving into security, and early-career practitioners, including junior SOC analysts and help desk staff, who receive suspicious email reports. If your team's process says something different, your team's process wins. ▶️ Companion YouTube Video: https://youtu.be/LLfsNu6cewc 📝 Companion Blog Post: https://professorsimon.com/blog/phishing-email-triage-first-look-routine 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline

  • S1 · E68
    October 22 · 9 min

    You're Asked to Prove a Security Control Works. What Do You Actually Show?

    Your lead asks you to show that a security control is working. You open the console, and everything is green. Is that proof? In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through four questions for answering an evidence request honestly: what are we trying to prove, what evidence would actually show that, can we trust what we're looking at, and what can't we prove yet. I use a made-up example, endpoint protection on company laptops with invented numbers, to show what a settings screenshot and a console report can and cannot establish, how to check that evidence can be trusted, and why two lists that do not match cannot yet be treated as a protection gap. I finish with a short fictional evidence note you can model. This episode is for IT professionals moving into security, and early-career practitioners, who are asked to gather, check and explain evidence within their own responsibilities. I am not telling you what any auditor wants. ▶️ Companion YouTube Video: https://youtu.be/TzOjSPYWNvc 📝 Companion blog post: https://professorsimon.com/blog/prove-security-control-works-what-to-show 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline

  • S1 · E67
    October 21 · 8 min

    Shadow AI in an Alert? What a Security Analyst Should Do Next

    You are working an alert and something catches your eye: an AI tool you have never heard of. Is it a problem? You do not know yet, and what makes it uncomfortable is not knowing whether it needs you to do anything at all. In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through three steps for handling it without overstepping: notice, document and escalate. It is for early-career analysts and IT professionals moving into security. I am not asking you to go looking for AI tools. I am talking about what you do when one turns up during your normal, authorized work, in an alert, a log entry, a ticket or something a colleague mentioned. I use a made-up example: an alert showing activity consistent with an attempted file upload from a user's device to a site that appears to be an AI summarization tool. From the alert alone, you cannot tell whether the transfer completed, what information, if any, the site received, or whether the tool is approved. Notice: work out what you can establish from the evidence you are authorized to see. An unfamiliar AI tool is not automatically prohibited, and it is not automatically dangerous either. Separate what the evidence shows from what it does not, and write down what you cannot answer as unknown. Document: write notes someone else can use to decide. Keep what you observed apart from what you are assuming, and keep the notes lean. Escalate: follow your organization's procedure and hand the question to someone who can decide, using a five-point message, with a sample. I leave the ending of the example open on purpose. The example is made up. ▶️ Companion YouTube Video: https://youtu.be/Cy9C6lQlr2s 📝 Companion blog post: https://professorsimon.com/blog/shadow-ai-in-an-alert-security-analyst ⁠ 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline

  • S1 · E66
    October 20 · 8 min

    Stuck Closing Alerts? What to Build as a SOC Analyst

    You have been closing alerts for months, and it still feels like you are not getting anywhere. What should you build next? In this episode of Professor Simon's IT & Cybersecurity Podcast, I give you a practical way to think about what to build as a security or SOC analyst, in three parts: depth, ownership and direction. It is for analysts somewhere between their first few months and their third year. I am not assuming your organization has tiers or a standard promotion ladder. Depth: understand why an alert fired, pay attention to repeats, learn the systems involved and write investigation notes someone else can follow. Ownership: take responsibility for small improvements within your authority, share findings clearly and help newer teammates when it is appropriate. Direction: ask for specific feedback, find out what more responsibility looks like where you work, keep a record of your contributions and build a realistic growth plan. I also give you one thing to do this week. This is professional judgment and not a rule for every employer, and none of it promises a promotion. The example is made up. ▶️ Companion YouTube Video: https://youtu.be/TIIzUIV-G2M 📝 Companion blog post: ⁠https://professorsimon.com/blog/soc-analyst-career-growth-beyond-closing-alerts 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline

  • S1 · E65
    October 19 · 8 min

    Your First 90 Days as a SOC Analyst: What to Focus On

    You've landed your first SOC job. Now what? Your first 90 days as a SOC analyst aren't about knowing everything or being the fastest person on the team. They're about learning your environment, building consistent habits, and developing the judgment to know when to investigate further and when to ask for help. In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through a practical approach to your first three months: Days 1 to 30: Learn the environment, tools, workflows, and escalation procedures. Days 31 to 60: Build a repeatable investigation routine and improve your documentation. Days 61 to 90: Develop judgment, recognize unusual details, and understand your authority. I also discuss how to respond when you make a mistake, including communicating promptly, separating facts from assumptions, and documenting what you learned. This is a practical framework, not a guaranteed onboarding schedule. The mistake scenario is fictional. Resources: 📘 First SOC Shift: https://professorsimon.com/books/first-soc-shift ▶️ Companion YouTube Video: https://youtu.be/BohwoRWVDvY 📝 Companion blog post: https://professorsimon.com/blog/first-90-days-as-a-soc-analyst 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline

  • S1 · E64
    October 16 · 8 min

    Access Denied? Fix It Without Making It Admin

    Access denied tickets are easy to close if you grant admin, and that is exactly why it is tempting. Admin might not fix the problem, you may not learn what was wrong, and the extra access stays after the ticket is closed. In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through a five-step, provider-neutral method for troubleshooting an access denied ticket: identify the denied action, determine the identity and the resource, inspect the permissions and the restrictions, make the narrowest authorized fix, and retest and verify. I use a made-up example, with no real organization or person behind it, to show each step. Along the way I cover authentication versus authorization, other ways access can be blocked besides a missing permission, what to bring when you escalate, and how least privilege applies to the fix. More free resources: https://professorsimon.com/links ▶️ Companion YouTube Video: https://youtu.be/A_Z19Y6-jys 📝 Companion Blog Post: https://professorsimon.com/blog/access-denied-troubleshooting-without-admin 🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠ 🔗 Resources, blog & more: ⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline

  • S1 · E63
    October 15 · 7 min

    Security Metrics for Leadership: What Actually Matters?

    You can pull a lot of numbers out of your security tools, and the safe move feels like putting all of them in the report for leadership. A full page of charts looks thorough, but a dashboard is not a decision. In this episode of Professor Simon's IT & Cybersecurity Podcast, I give you one question to ask about every number: what decision or action could this number change? I use a made-up vulnerability reporting example, with no real organization behind it, to show the difference between an activity metric and a number leadership can act on. Then I cover what a number needs around it (a reference point, a trend and a stated limitation), how to present your numbers to the person reading the report, and what to do with numbers that fail the test. I also share a simple exercise you can use on your last security report. More free resources: https://professorsimon.com/links ▶️ Companion YouTube Video: ⁠https://youtu.be/bFcRlIiOpQc 📝 Companion Blog Post: ⁠https://professorsimon.com/blog/security-metrics-for-leadership-reports 🎧 More Podcast Episodes: ⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: https://professorsimon.com/products/cybersecurity-interview-prep-pack 🔗 Resources, blog & more: ⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠ 🌐 Website: ⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline

  • S1 · E63
    October 13 · 8 min

    Patch Management: How to Balance Security Risk and Production Stability

    Every patch carries two risks. Leave a known vulnerability unpatched, and the exposure remains. Apply a patch without proper planning, and something the business depends on could stop working. In this episode of Professor Simon's IT & Cybersecurity Podcast, I explore how security managers balance those risks using PatchSecure Inc., a fictional teaching scenario from my book. We'll look at what it means for a patching program to fail safely, why realistic testing matters, and how patch management connects to change management, monitoring, access controls, incident response planning and training. I'll also share three practical questions you can use to evaluate your own patching program. This episode is independent educational content based on my own teaching. It is not official ISC2 material, and ISC2 is not affiliated with it. More free resources: https://professorsimon.com/links ▶️ Companion YouTube Video: https://youtu.be/L0BcUibSJ1U 📝 Companion Blog Post: https://professorsimon.com/blog/patch-management-program-security-risk-vs-stability 🎧 More Podcast Episodes: ⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠ 🔗 Resources, blog & more: ⁠⁠⁠https://professorsimon.com/links⁠⁠⁠ 🌐 Website: ⁠⁠⁠https://professorsimon.com⁠⁠⁠ 💼 LinkedIn: ⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠ 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.

  • S1 · E61
    October 13 · 8 min

    Cybersecurity Degree, Certifications, or Experience: Which Do You Actually Need?

    If you work in IT and want to move into cybersecurity, you have probably heard three confident answers: get the degree, get a certification, or just get experience. In this episode, Professor Simon explains why those answers contradict each other and gives you a better question to ask first: which gap are you actually trying to close? He walks through six common gaps between where you are and a specific security role, shows how a degree, a certification and experience may each help with different ones, and applies them to three made-up IT professionals. You will also get three questions to ask before you spend time or money, and a practical way to start by comparing real job postings. ▶️ Companion YouTube Video: https://youtu.be/s_w8r_Fd5Cs 📝 Companion Blog Post: https://professorsimon.com/blog/cybersecurity-degree-or-certification 🎧 More Podcast Episodes: ⁠⁠https://professorsimon.com/podcast⁠⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: ⁠⁠https://professorsimon.com/links⁠⁠ 🌐 Website: ⁠⁠https://professorsimon.com⁠⁠ 💼 LinkedIn: ⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠ 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.

  • S1 · E60
    October 12 · 8 min

    Patch Management: What to Understand Before You Install a Patch

    If you have been handed a list of systems to patch without seeing the decisions behind it, this episode is for you. Professor Simon explains what a patch management program has to understand before the first patch is deployed: the inventory, risk, business and regulatory requirements, policy, tools and testing, using a fictional teaching scenario, PatchSecure, Inc. He also shares two questions to ask about any patching program. More free resources: https://professorsimon.com/links ▶️ Companion YouTube Video: https://youtu.be/GFR2sHZXrH8 📝 Companion Blog Post: https://professorsimon.com/blog/patch-management-before-you-patch 🎧 More Podcast Episodes: ⁠https://professorsimon.com/podcast⁠ 👉 Need help with your IT or cybersecurity career? Work with me: ⁠https://professorsimon.com/guidance⁠ 🔗 Resources, blog & more: ⁠https://professorsimon.com/links⁠ 🌐 Website: ⁠https://professorsimon.com⁠ 💼 LinkedIn: ⁠https://www.linkedin.com/in/leonardsimon⁠ 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.

  • S1 · E59
    October 9 · 8 min

    What Actually Counts as Evidence of Cybersecurity Skill?

    Sooner or later, someone who is thinking about hiring you is going to say, "Okay, I believe you know cybersecurity. Show me what you can do." A lot of capable people have a certification, a course certificate or a home lab, but nothing that lets the other person see how they work. In this episode, Professor Simon explains what actually counts as evidence of cybersecurity skill: a piece of work that shows your reasoning, so another person can evaluate it. He compares naming a tool with documenting your work in a hypothetical example, covers five things a piece of work should show, and explains how work you already do in IT can count, what to leave out before you share it and where to share it. He also covers how to write it up for technical and non-technical readers and how to practice explaining it out loud. It is for people trying to move into cybersecurity or already working in IT. He is also clear that evidence does not guarantee an interview or an offer. In this episode you'll learn: - Why certifications matter, but knowing something and being able to do it are different - The progression from knowledge to application to evidence to explanation - Five things a piece of work should show: the problem, what you looked at, what you found, your decision and why, and what you would do differently - How work you already do in IT can count, and what to remove before you share it - Other forms of evidence beyond a home lab, and where to share them so a stranger can open them - How to write for technical and non-technical readers and practice explaining your work ▶️ Companion YouTube Video: https://youtu.be/SJLnl_1tzhk 📝 Companion Blog Post: https://professorsimon.com/blog/evidence-of-cybersecurity-skill 🎧 More Podcast Episodes: https://professorsimon.com/podcast 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: https://professorsimon.com/links 🌐 Website: https://professorsimon.com 💼 LinkedIn: https://www.linkedin.com/in/leonardsimon 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.

  • S1 · E58
    October 8 · 7 min

    Cybersecurity Risk Management: What Makes a Decision Defensible?

    A year from now, somebody is going to look at a risk your organization chose to live with and ask why it was decided that way. Most of the time, they want to know whether anyone can explain it. In this episode, Professor Simon explains what makes a cybersecurity risk decision defensible: a decision that can be explained and supported using what was known at the time, whether or not it turned out well. He walks through a hypothetical, not a real case, about a business team that wants to connect a new tool to customer data before the security review is finished. Along the way, he covers seven things a good risk decision record should show and five questions it should be able to answer. It is useful for security and GRC professionals who make or document risk decisions, and for anyone learning to write them. In this episode you'll learn: - Why a defensible decision is one that can be explained using what was known at the time, not one that turned out well - Why cybersecurity risk decisions should be written down when they are made, not rebuilt from memory later - How to state a risk in plain words that a business decision maker can weigh - How to be honest about evidence, assumptions and confidence in a risk rating - Why a record should show the options considered, and keep security's recommendation separate from the decision - How to record residual risk, assumptions and constraints, and the triggers for reviewing a decision - Five questions a risk decision record should be able to answer ▶️ Companion YouTube Video: https://youtu.be/SzwZ2SGvL-U 📝 Companion Blog Post: https://professorsimon.com/blog/defensible-cybersecurity-risk-decisions 🎧 More Podcast Episodes: https://professorsimon.com/podcast 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: https://professorsimon.com/links 🌐 Website: https://professorsimon.com 💼 LinkedIn: https://www.linkedin.com/in/leonardsimon 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.

  • S1 · E57
    October 7 · 9 min

    Who Decides During a Security Incident? | CISSP Blueprint

    When a security incident starts, who is actually allowed to decide to take a system offline, bring in legal, or tell the executives? In this CISSP Blueprint episode, Professor Simon looks at incident management through a security manager’s lens, using a fictional healthcare provider, IncidentSecure Inc., as a teaching scenario. He organizes the management side of the work into three questions: who decides, what is at stake, and what the organization will be able to show afterward. Along the way, he covers the difference between a role and the authority to decide, why severity should follow business impact, how legal, compliance, and communication planning fit in, and what evidence can show about an organization’s preparation and response. This is original teaching, not official ISC2 material, and it contains no exam questions. In this episode you'll learn: - Why incident management starts with authority and evidence, not tools - Where incident management sits in the published CISSP exam outline (Domain 7, Security Operations) - The difference between a role and the authority to decide, and why it matters during an incident - Why severity should follow business impact - Why legal, compliance, and communication planning belong in incident management - How an organization can demonstrate preparation and follow-through, including why drills need a record - Three questions to ask about any incident scenario, and what changes when you move toward security management ▶️ Companion YouTube Video: https://youtu.be/glg8OT8ei8w 📝 Companion Blog Post: https://professorsimon.com/blog/who-decides-during-a-security-incident 🎧 More Podcast Episodes: https://professorsimon.com/podcast 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: https://professorsimon.com/links 🌐 Website: https://professorsimon.com 💼 LinkedIn: https://www.linkedin.com/in/leonardsimon 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.

  • S1 · E56
    October 6 · 9 min

    SOC vs GRC: Which Would You Actually Want to Do All Day?

    Choosing between SOC and GRC usually starts with salary, difficulty, or which one sounds more technical, and those comparisons rarely settle anything. A better question is which kind of work you would actually want to spend your time doing. In this episode, Professor Simon explains what SOC (security operations) work and GRC (governance, risk, and compliance) work tend to feel like day to day. He explains why the idea that SOC is technical and GRC is not does not hold up, walks through one illustrated vendor security problem from both seats, and covers where the two paths overlap. He then gives two small exercises you can try for free, one for each path, along with the questions to ask yourself afterward. Because this is audio, the exercises and questions are described as he goes, so you can follow along while you walk, drive or work. In this episode you'll learn: - Why salary, difficulty and 'which is better' are weak ways to choose between SOC and GRC - What SOC and GRC mean, and what each kind of work tends to involve day to day - Why 'SOC is technical and GRC is not' does not hold up - How the same vendor security problem raises different questions in a SOC and in GRC - What the two paths share: how systems work, clear writing, and separating what you know from what you assume - Two small free exercises to try the work before you pick a path - Questions to ask yourself afterward, and why being able to do the work is different from wanting to do it all day ▶️ Companion YouTube Video: https://youtu.be/7_Ww6uTrMws 📝 Companion Blog Post: https://professorsimon.com/blog/soc-vs-grc-choose-based-on-the-work 🎧 More Podcast Episodes: https://professorsimon.com/podcast 🧭 Figure out which cybersecurity path fits you: https://careervectors.com 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: https://professorsimon.com/links 🌐 Website: https://professorsimon.com 💼 LinkedIn: https://www.linkedin.com/in/leonardsimon 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.

  • S1 · E55
    October 4 · 9 min

    Your Team Can Detect Incidents. Can It Manage Them?

    Your monitoring tools flag something, and now somebody has to decide how serious it is, who needs to know, and who is in charge of the response. If nobody settled that ahead of time, those decisions get made at the worst possible moment. In this episode, Professor Simon explains why detecting an incident and managing one are two different jobs, and why much of the work of managing an incident happens before the incident ever occurs. He uses a fictional health care provider, IncidentSecure Inc., from his book as a teaching scenario and walks through its four stages: assessing what it needs, designing a strategy, putting controls in place, and training and improving. Along the way he covers defined roles, classification levels, response procedures, a communication plan, where detection fits among the controls, where a response tends to break, and why practice matters. He closes with four questions you can ask about one type of incident your own organization could realistically face. Because this is audio, the four stages and the four questions are described as he goes, so you can follow along while you walk, drive or work. In this episode you'll learn: - Why detecting an incident is not the same as managing one - The four stages of the fictional program: assess needs, design a strategy, put controls in place, train and improve - Why defined roles, severity levels, response procedures and a communication plan matter - How a detection becomes a coordinated response, from classification to who hears about it - Where a response tends to break: a role nobody owns, a severity nobody agreed on, a message that goes out late or wrong - Four questions to ask about one type of incident your team could realistically face - How to explain the work around a detection tool in an interview ▶️ Companion YouTube Video: https://youtu.be/IzMXywJ_GBc 📝 Companion Blog Post: https://professorsimon.com/blog/incident-management-process-before-an-incident 🎧 More Podcast Episodes: https://professorsimon.com/podcast 🧭 Figure out which cybersecurity path fits you: https://careervectors.com 👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠ 🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠ 🔗 Resources, blog & more: https://professorsimon.com/links 🌐 Website: https://professorsimon.com 💼 LinkedIn: https://www.linkedin.com/in/leonardsimon 📸 Instagram • X • TikTok: @profsimononline If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.

Showing 1–20 of 66 episodes