What does it mean to be "blue collar" for the blue team? Amy sat down with security researcher Ryan Fetterman to discuss his journey from federal agency work to his new role at Talos. He shares the realities of detection engineering — including the creative, often frustrating ways attackers evolve their tactics to stay one step ahead of traditional defenses.

Beyond the technical grind, Ryan shares his philosophy on building a career in security without burning out. From the value of project-based learning to the importance of finding time to step away from the keyboard, here's Ryan's take on what it really means to navigate today's cybersecurity industry.

Amy Ciminnisi: Tell me a little bit about the journey that has taken you to Talos, from early on in your career through to now. How did you get here? I actually don't know that much about it.

Ryan Fetterman: I've been doing security about 15 years now, and my career was largely shaped by where I started in the DC area. I spent about a decade there. I started out in consulting and then pivoted over to research, but that was a great place to get started.

I got a lot of great experience in federal agencies and government consulting, continued my education down there, got trained up, got certifications and things like that. And that was where I got my first exposure to doing actual security operations, which is what I really stuck with. It was my first exposure to Splunk.

Querying lots of log data and building visualizations and analytics in Splunk was the first time in my career that I felt it was kind of my natural inclination. It seems like it should have been more obvious to me looking back on it, but it's something that I try to explain to people a lot. When you first get into security, there's a desire to kind of find your specialization and start working towards it. But in my experience, it's just not something that you can rush.

I met the people connected with that space, which eventually led to me going to work for Splunk. I worked on the Splunk research team, SURGe. And then after the Cisco acquisition of Splunk, I ultimately became reorganized into Talos.

AC: I'm sure there have been so many challenges, so many obstacles in your way as you're trying to do this research. Can you share one that you've faced and how it shaped your perspective on cybersecurity?

RF: Something that stuck with me was actually my first advanced persistent threat (APT) incident. Now, you can look this up. It's called Pandora Song if you search for the C2. I was in the DC area working in a federal SOC, and I was doing some of the first host-based analytics at the time, which have now become kind of the concentration of a lot of detection. Engineering and analytics are host-based, so this was kind of pioneering at the time.

I was looking at a lot of host-based sensors and writing analytics in Splunk, actually, and we had been tipped off to this incident by a third party. I was looking through the details of the incident and how the attacker was carrying out the progression of their attack...

Want to see more? Watch the full interview, and don’t forget to subscribe to our YouTube channel for future episodes of Humans of Talos.

Cybersecurity is rarely a straight line. In this special Black Hat edition of Humans of Talos, Amy looks back at the incredible journeys that brought past guests to the world of threat intelligence. From forensic labs and newsrooms to the kitchen line, we’re revisiting the stories and lessons that define the people behind the threat intelligence.

Heading to Black Hat? We have a presence within the Cisco and Splunk booth (2633) during Black Hat where you can chat to us about our latest threat research and incident response, and grab the newest Snorty. Check out our schedule here.

Want more episodes? Watch the full episode, and don’t forget to subscribe to our YouTube channel for the next Humans of Talos.

Ever wonder how someone goes from studying human viruses to leading cybersecurity teams? In this Humans of Talos, we’re joined by Martin Lee, EMEA Lead, to talk about his journey into the industry. Martin takes us back to the early days of the internet, explaining how he made the leap from academia to the front lines of threat research. He also gives us a fascinating look at his current work, where he’s applying a sociological lens to cybersecurity to better understand what makes certain organizations more resilient than others.

Whether you’re just starting your career in security or looking for a fresh perspective, you won't want to miss Martin’s advice on staying visible, being curious, and "flavoring your life with many spices."

Amy Ciminnisi: Martin, welcome! Can you describe what you do here at Talos for people who might not know you?

Martin Lee: My job is really ambassadorial. I still research the threat landscape, although I spend less time doing that now. Certainly understanding what are the changes that are happening in the threat landscape. But mostly my job is to externalize that — both to write about the threat landscape, but also discuss what we're seeing, what's important, and what's different with our customers and partners.

AC: I had no idea that you started your career in researching the genetics of human viruses. That’s one hell of a career change. Can you tell us about how you ended up where you are today?

ML: Yeah, "I discovered the internet," is basically the short answer. I discovered the internet very, very early on and just thought this is going to be the biggest invention in my life. I thought if I didn't jump there and then because I could see it was going to explode and go everywhere, and if I didn't jump then, I wouldn't be able to keep up with it. So, I left behind a career in academia to jump on board in the early internet and start building it and building websites.

AC: I actually wrote about this in my most recent newsletter — I'm one of the younger members of Talos, so I was born well after all of this started. It is so fascinating to me to hear about people who were out of college when the internet really started booming.

ML: Yeah, it was growing massively through the mid to late 90s, which was awesome. And then there was the .com crash, which was pretty rubbish. So, I found myself with a young family and less work than I wanted. This job came up, writing spam filters. This was before spam filters and certainly before spam was a big problem. So I thought, "Okay, that sounds fun, let's do that." And then we started detecting all of these weird and wonderful attacks. What we didn't know is we were detecting the first APT attacks. In trying to work out what was happening and what we were seeing, that kind of launched the career. So here we are over 23 years later, and cybersecurity has just grown massively. But it was entirely by accident that I ended up here.

Want to see more? Watch the full interview, and don’t forget to subscribe to our YouTube channel for future episodes of Humans of Talos.