First Person Meets… Ian Mountford: Late life career change

00:00

Matt Egan Hello, hello, hello. Welcome to First Person, the show where we meet the most interesting people in IT and learn from them what makes them tick by focusing only on their firsts. I'm your host, Matt Egan, asking you to enjoy, like and subscribe wherever you find us.

And if you are an interesting person in IT, do let us know because you might be the next First Person. The next voice you hear will be today's guest. He is Ian Mountford.

Originally from the UK and now based out of Sydney, Australia, Ian is a senior consultant in cyber governance, risk and compliance. Ian has a special interest in helping people transition into cybersecurity careers late in their careers.

He's also someone I will tell you I have known as a personal friend outside of IT for 25 years now. So I can tell you with 100 % assurance that he is definitely one of the most interesting people in IT.

And we're delighted to have him as a guest on First Person. So Ian, welcome. And first up, the question we always ask, what's the first thing people should know about you? Ian Mountford So.

Ian Mountford Well, you set me up and then you've knocked me off by telling everybody that we used to play football. That was the deal. We played. God, where were we? Where were we? Clapham Junction, we used to run around it when I used to shout at everybody.

Like, I'd still do it now. Like… Matt Egan Yeah. Matt Egan Yeah. Yeah. I think you and I are both two of the great shouters on a soccer field. Yeah. Ian Mountford we loved it. I got so much out of it.

It got all of my like, ya ya's out. You know, we used to just, you know, we to just run. Matt Egan Yeah, there's something to decide for that.

There's probably a management lesson to be learned from the benefits of team sports for certain, but also just, and I think it's principally a male thing, men expressing their rage against the world through the medium of sporting activity, which you and I certainly did.

Ian Mountford But there's part of that. And I think it still plays out in all aspects. If I hadn't have played sport, I wouldn't have any friends. I literally would have struggled in life. And I got so much from team sports that's translated out into all the environments.

So first of all, it needs to be said that you've smashed it. through your career, obviously. And it's a pleasure to talk to you. This hopefully will be a conversation that's entertaining as much as anything else.

Because like as Matt knows and people that know me, while my journey has been very bouncy from side to side and the journey to get into this career, this cyber career is just the same. yeah, it's a pleasure to be here and talk to you.

People like… The sport that I've done and the sport that me and Matt did was proper, soggy Sunday mornings and just like, you know, limping for three days. And I think we still wish we could do it now because it was such a fun thing to do.

But yeah, it's, they were happy days there and then look, they still are now and we can get, when we can get out there. But yeah, it's worth it.

Matt Egan Well, that's really interesting, Ian, and that takes us nicely into our first section, which we call First Things First. And this is where we like to get to know about our guests by understanding some of their first times.

One of the reasons I really wanted to get you on this show is you've got a really interesting story about your journey through your career and then into IT and cyber quite late on.

So please, if you could, would you tell us something about your first job in IT and how you got Ian Mountford Yeah, long story short, arrive in Australia 2016, get phished, telephone number ported. I think it was around $20,000 Australian taken out of the bank account.

Pop to see the police have to change hundreds of passwords.

It was a very simple scam where people broke into letter boxes in the Eastern suburbs in around Bondi and Randwick and some of these areas in Eastern suburbs of Sydney where they'll collect piles and piles of post, open the post.

If they can then get a Facebook profile with a telephone number against it and make that call, they can triangulate. And next thing you know, they're telling you they've got their… hospital results and I said I haven't been to hospital. what's your date of birth?

You give the date of birth next thing you know, they've got date of birth, telephone number, name and they can then set up a prepaid number and that was the end of that. Policeman comes round, shows me what they've done.

We had a conversation where he told me that the guys that did it would go to prison for three months and then come back out and start another three schemes. And I said, are you ever gonna stop this? Are you ever gonna get on top of it?

And he went, there's no way we can do it. We just haven't got the resources. So I'd done consulting and then marketing, know, like HR, all sorts of stuff in the past, recruitment.

And I thought, look, it's probably about time, mid to late 40s, where I did something where I had to get. some solidity in terms of knowledge. I've always been a learner. very keen on learning consistently. And I thought I've got to put myself to the test here.

So I thought IT is going to be a solid career for me until I retire. I'm like 40, I think I was 48, 49 when I made the decision to swap. You and me changed some messages and I said, about cyber? And you went, go for it.

Which, Ian Mountford reflection was probably one of the best things you've ever said to me.

did the… like at this point I've never done anything IT before so I did CompTier A-Qoops to see whether I could understand the difference between plugs and sockets and how a network worked and the basics basics of cyber.

Passed the two exams, got lucky… at that point still didn't know what to do and then started applying for help desk jobs. So I thought I've got to show people that I'm willing.

I've got to eat a bit of poo and just go through the process and dig in and say, okay, I can do this. I'm old, but I'm happy to do this. This work didn't get anything. It must have applied for 30, 40 jobs was getting a bit disillusioned.

So I I'll start the degree course. Matt Egan Mm-hmm. Ian Mountford I started the cyber security degree course. Lucky me. Left school at 16 with no real qualifications apart from a few GCSEs. Got C in maths. Second week, second project, discrete maths, graph theory.

40 hours we were given a week for study and they said, look, it'll probably take you between five to eight hours a week to do each of the maths parts.

The first week I spent 40 hours doing graph theory and I got through it, loved it, found actually some value in maths that I'd never seen before.

It's still in my stupid head, couldn't work out how I was going to be doing that on a daily basis but stuck with it and the tutor at that point was excellent, helped me to actually get a credit out of it rather than just a pass which is what I was hoping for.

Matt Egan Wow. Ian Mountford but it showed me that the diligence that you need to sort of dig into something and pull it apart was gonna get me forward.

So I had a conversation with the tutor on the course who said, look, you're never gonna be a technical person. Don't try and go for technical GRC job for cyber jobs. It's not gonna work for you. Have you heard of governance, risk and compliance?

You don't need to be a coder. Matt Egan Mm-hmm. Ian Mountford You can get stuck in, start to know the concepts, start to use your consulting skills and see how that goes with clients. It's a steep learning curve, but you can do it if you get a chance.

I applied to CyberCX, which is the big brand down here, or was at the time, and managed to get on their kind of first associate program that they ran. And by hook or by crook, I… Matt Egan Mm-hmm.

Ian Mountford found myself then in exactly the right position for me at exactly the right time. I bundled through project management certificates. I bundled through as many things as I could stack up to help me on day one be ready. You know, got my Excel skills polished.

You know, was going in really fresh, but it worked out. And we're still here. Matt Egan Yeah, there's a lot of amazing things in there, right?

First of all, and I've known you a long time, like you've had many careers and you've been very senior in a lot of those careers, despite leaving school at 16, to your point, without what would be conventionally seen as great qualifications, albeit I think your professional sporting career probably helped you with some of the kind of skills and experiences that you pick up along the way.

Amazing that you have the thought and the courage to say, right, I'm going for this now. This is the thing to do. Very obvious that there isn't a clear path, right? There isn't a way of doing this. So did some certification, then you went.

So did you complete the degree or did you from the degree modules go into the job? Ian Mountford What? Well, what they told me at that point was, you you're better off now pointing yourself in the direction of certifications.

And I said, well, look, I've invested a year of my life going deep on this course. Do I want to do another three years of it? Probably not. Is it going to hurt my career if I put it to one side? They said, look, you've proved the point.

You're through the door. Now start to look at more specific bespoke. Matt Egan Yeah. Yeah. Ian Mountford qualifications and that was perfect for me. It really helped. Matt Egan Well, that's one of the things that really comes through here in this story, right?

Is that the tutor had your best interests at heart and knew enough from an academic background to understand what you needed from a professional background, which isn't always the case, right? There's a whole debate, particularly in the US, about the degree versus certification. think, yeah. Ian Mountford Corrupt.

Ian Mountford think it's one of the big problems. Sorry, cut you off. It's one of the massive problems is that me being me having worked in careers and HR, recruitment and being kind of in a help people type mindset.

It's quite interesting for me to approach people in the industry. And even when I was in the industry at the early days, I work out what my pathway was gonna be.

very keen to do more learning, very sort of focused on doing the right things and not wasting time based on being old.

And I can recall having a few conversations with people and I was shocked at how little information there was out there, which I've changed a bit now, there's a lot of YouTube channels, a lot of people talking to a lot of sense about what the job entails and what it's about.

But at the same time, I think there's a lack of professional structure. and everybody's trying to pimp their own courses at you. Like come and do this room, come and do ISACA, come and do this, come and do that.

And it confuses the hell out of most people because they think that's the gateway to getting the job and it's not the gateway at all in some cases.

And there can be some people that get into these careers in GRC that are overqualified in some ways, but kind of have never tested and demonstrated it. So they're getting everything. Matt Egan Yeah. Well.

Ian Mountford They think they've got to get it and they don't necessarily need all of it, but they need to be to apply some of it and then they'll be a bit more successful.

Matt Egan Well, and to a couple of the points you've made there, right, in your previous life, you've had roles as a consultant, you've had roles in the customer facing role you've had in terms. So that side of things was never going to be a challenge for you.

But understanding the level of technical detail that you need to have in order to advise people kind of was.

So I also think it really stands out that the diligence of doing the work in that year, one of your calls probably really helped you right in terms of like picking up. Ian Mountford Yeah, true. Ian Mountford Yeah. Matt Egan some core principles.

But also one of the challenges I think is, and you kind of referenced this, is there's competing needs and desires on behalf of the people offering training. So certifications are often tied to specific vendors and platforms, and the universities obviously want people to do their courses.

And then the other thing is this is such a fast moving space. One of the reasons why I think you're a good example of why senior people who've had experience going into cyber is a really valuable thing because things change so quickly.

If you start a four or three year degree, the chances are what you learned at the beginning might not be that relevant by the end anyway. Ian Mountford That's a huge point. think we're a bit lost in this education system.

And I think what it's doing, it's putting up barriers that are stopping people that have strong skills, strong, they can communicate really well.

They understand the concepts at a high level, but they can apply their approach and understand the way that we do the work that we do to assess and audit clients and get to the nub of what the problems are.

But they look at these massive walls that there are to get over in terms of trying to be the man when it comes to doing the job and being a cyber person. It seems to be pushing people out because I've had a few conversations with people.

Like I did a talk last year at one of the conferences, the big cyber con down here for the Australian Information Security Association. And it was just a little kind of like, I thought there'd be three people and a dog.

was literally careers in cyber for mature changes, job changes. And I thought, look, there'll be a couple of randoms like me might turn up. Matt Egan Yeah. Ian Mountford I got like 30 people just suddenly swarmed on me at this desk.

I ended up just doing a Q and A with everybody. And there were so many people I felt very, some of them, some of them I think were going to struggle, but there are a lot of them.

And I would say probably 70 to 80 % who were stood there just frantic and helpless because they just couldn't see the roots. They couldn't see how they were going to be able to make it work. Matt Egan Hmm. Ian Mountford They were bringing bags of experience.

Some of them, I was thinking to myself that if there was a much more kind of unified, it may be a country by country approach, but some even at those early stages back to like when we were at school, we had one route that we took that got us off the start line and you got it or you didn't.

And then you carried on. And I think with we're struggling, there's a skills shortage in our industry. There's not an, there's not a.

lack of people that want to do the work that there's so many people that thinking you could just transition into this out of networking or that like I came across a guy what one role it just couldn't apply what he knew but he'd been working on the plugs and sockets for 20 years and it was like it's it's it's getting people to that start line with an engine that's fully revved up ready to go and they're and they're Matt Egan Yeah.

Yeah. Ian Mountford got the power to last the whole race if you know what I mean. I don't know that's a pretty correct word but it's how you start getting people getting them ready to go. It's like a big deal. Matt Egan Totally. I like it.

We're big fans of the… Matt Egan Yeah, no, it definitely is. And I think your point about the skill shortage is really, really valuable. I think that actually goes across all of IT.

People who have good life experiences, but maybe don't have the technical chops can be taught the technical things.

And I think that, you know, that's something I think about it often in the context of, the way we lose women from the industry, because because of parenting, like it's such, it's such a loss of talent kind of thing. Ian Mountford So.

It's a disaster and I don't think it's difficult to fix.

This is the thing I think all these competing pressures and the lobby and the money and that, you it's all these things that are adding these barriers that are making what should be just a hurdle you step over into this kind of crazy assault course.

It's just, it's not right, but hey, who am I to say? Matt Egan Hmm. Matt Egan Yeah, well, let's find out who you are to say it because we are here to focus on you and we left you to go into that very interesting conversation.

We left you having found your place as a consultant. And was that one of the questions we ask at this point is, the first time you thought this is the industry for me or I could be good at this, was that that point?

you find your feet in the… you can do the consulting, right? You're a communicator, you're someone who likes to help people. Like immediately, was that something that worked out for you or like… Ian Mountford Yes.

Ian Mountford Now, God, you sit through a couple of calls quite quickly and you're getting in our position, we get to meet CISOs, we get to meet heads of information security, we get to meet CIOs, we get to meet board members and talk to them about what they do in their organization.

And we're asking them very specific questions, heads of IT, technology leads, all sorts of different people. Matt Egan How'd that go? Ian Mountford And those first few conversations when people start talking terminology, they're just like straight over the top.

And that fear factor that we all have, doesn't matter how confident you are, when you hear a term that you've never heard before, people are looking at you like they're nodding as if to say, you know what I'm talking about, don't you?

And you're like, like, Matt Egan Yeah. Matt Egan But how do you handle that Ian? Because like, you know, experience tells me now, ask.

Ian Mountford Honesty Matt, you know Honesty, it's you can't just pretend and I think it was a very early learning for me to be put in that position and feel and I talked to one of the managers at Leona I was like, this is this is a stretch.

We don't know this information Could you have pride me a little bit better to help me and get and it was for me it was taking myself right back to 16 first weeks of work in the bank when I first started working in the UK and how did I get over those hurdles?

No, I didn't go straight to the pub, is what we did in those days. like now, very much more about communication. I had to adapt myself to a brand new environment. There was an expectation because I was older that I would know all this stuff.

And I was like, hands up, you know, I need to just go a little bit slower. Matt Egan Thank Matt Egan Yeah, but you got to ask. Yeah, you have to ask. And I think that is another example where maybe at 16 you wouldn't.

Maybe at 16, you'd kind of feel like you needed to pretend, whereas, you know, with experience of life and work, you're confident enough to say, sorry, can I stop you there? I don't know. I shouldn't understand what that what that term means.

Can you explain it to me kind of thing? Ian Mountford I think it's an interesting point to make as well. think that over time… The people that you work with can help you to give confidence or they can take it away.

And so consulting environments are much better structured than others in terms of helping to kind of facilitate you as a consultant, let's say, and grow those skills. It's the same in any job environment. Some are great, good leads, good managers, they give you a little bit of runway.

Others don't. Matt Egan Mm-hmm. Ian Mountford And I think in some consulting environments across the world, it must be the same that you single swim and you kind of adapt and you evolve and you do all those key things to do so.

But I think the responsibility and one thing that I've taken from the jobs that I've had and the mistakes that I've made has been very much around doing the things that I know myself that I can do better.

and working on the things that I can improve, whether it's being more organized in terms of time, whether it's taking better notes, whether it's being clearer in my own knowledge before I get on a call when I'm working on something that I've not worked on before.

And especially when you, I think the fear of technology and the terminology that goes with it, I think fills a lot of people full of dread. And I think it probably needs a few people to flip out where… Matt Egan Yep. Yep.

Ian Mountford You've got to back yourself. It's like most things in life that might, know, this, you've worked in environments where you've been in circumstances and situations. You're in a boardroom that you've not been in before.

You're, you know, you're dealing with a client on a topic that you've not covered. You've got to back yourself to be confident in that environment.

And I think they're skills that we don't get a lot of soft skills training, if any, in terms of the work that we do. And I think the whole technology environment. until you probably get to the levels of seniority where these things are an expectation.

I think some of the consulting staff could probably, know, the more junior levels will benefit from soft skill stuff as well. Cause it's just, it's crucial. It's crucial across the board.

Matt Egan Well, it's also another argument for more experienced people coming into the industry, right, is you're able to do that. And a couple of things to pick out, right?

Well, one last thing in the success bit before we get to the failures, which you trailed there, and I'm very excited to go there. But like you mentioned, like leadership and management.

And I'm interested in this from actually the whole of your career going back to 16, like… You know, if you could, one of the questions we ask is the first great boss kind of thing.

It didn't have to be the first, but I'd love to hear from you about a great boss and the things you've learned from them over your career. Ian Mountford Yeah. Ian Mountford Great boss.

Ian Mountford They listened and I think this is one of those things that back in, I started working 88 and the first four to six years were a bit of a blur.

I walked around a bank with a piece of paper and everybody thought I was busy and that was kind of what I thought that I did was just carry a piece of paper around all the time. But the first boss sat me down and talked straight to me.

Matt Egan Yeah.

Ian Mountford Explain the things I needed to do in language that I understood Made me listen by telling me that I wasn't listening and was direct with me in terms of explaining what I was not doing right but what he did was he built a relationship with me and It's somebody that I'm still in contact with now.

He's now in his early eighties I didn't see him this time when I went back, but I know he's back to UK, but I know he's kind of a bit old and getting a bit ill now.

But I have the ultimate respect for him because a lot of leaders at that point just talked to us in words that suited them but we didn't really understand.

And he actually got to know us as people that were working for him and we built relationships where we did end up socializing, we did a few things outside of work together. But when we weren't, we knew if we were on his time we needed to deliver.

Matt Egan Yeah. Ian Mountford and we did some very specific things. I was getting into a sales role at that time in the bank. It was sort of later on in my career.

And I was doing some very basic sales, rudimentary sales things for insurance products, but it involved building relationships with the customers. And this was just like news to me completely.

didn't think that, you it was just transactional, but when you actually had a conversation with the customer, they told you the things that you wanted to hear and you… we were taught that that was how we translated that into sales for products.

I think the thing that, and it filters through into everything I've done through my career, but even now, especially the more we listen to the client, God, we find out things that the client's not even trying to tell us.

We can work things out and we can probe a bit and use the right kinds of questions. it all stems to this guy who basically said, look, you need to know these things. You don't know them now because you've you know, fallen off the hook. yeah.

And I think that in the, in the industry that I'm in now, and I think when I see people that I work with, who I admire of which there are a lot, they have listening skills that are way beyond the basics.

I'm serious skills that Matt Egan How could you? Yeah. Yeah. Matt Egan Yeah, and also… Ian Mountford take training and they take patience and they take diligence and an approach, a really specific approach, but God, they listen really well.

They use sign properly, the end of the day, things like that. Matt Egan Yeah.

Matt Ega Yeah, and it's kind of the empathetic nature of that boss who is quite a senior person to go to the 16 year old and invest the time knowing they're going to get something back. Again, these are transferable things, right?

Whatever industry you're in, that is, whatever role you're in, that's extremely useful. So Ian, thank you so much. Like, this is amazing. Like we've seen you through this challenging journey and like now it is very cool and on a personal level.

I love the fact that you found this career that is your, your metier, but Ian Mountford Okay. Ian Mountford Yeah. Cool. Matt Egan It's too positive, frankly. We're not only here for the good things, I want to some bad things, right?

And we do learn more from our mistake, which I know is something that you definitely sort of hold dear and live by. So I wonder if you could tell me anything about the first big mistake.

And that can be in cyber or maybe it's outside of that, but definitely professionally. Where does your brain go when I ask you about your food? Ian Mountford Well, well. I'm going to cyber because I think it's an important one for people when they're making decisions around careers.

I joined with small company. And I joined this company off the back of a conversation and it was a bit of a nudge and a wink. I didn't do too much due diligence.

And I found myself in a scenario with a they'll probably listen to this fair play if they do. But I think it was recognized where things had gone wrong.

time and I found myself in a situation where it was an a former IT person who had become a security guru without any training without any real experience bar writing policies for people over a number of years.

Ask this guy networking questions he could answer them all day long but ask anything related to security and regulations and compliance and privacy and things like this it was very big gaps. So.

He gave some advice to a client during a call where I was the junior person on the call, but I immediately challenged it after the call with the guy and I was like, is right. You know, can you just tell me where, where that came from?

immediately the answer I got was a very negative one. was a confront, you know, I'd, I'd poke the bear in that case.

And Ian Mountford You know, I had to, I had to leave that role fairly sharpish, but what it, what it did, heightened my awareness and it made me realize that you've got to do like, because so many people want to get into security now and so I, but because there's so much money in it and there's a lot of clients that need the solution.

Matt Egan Yeah. Ian Mountford And I thought that it would be good to test myself in a smaller environment and actually see how that felt after some big brands and big firms the first few years.

And yeah, it was a shock to the system and it made me reflect on that amount of due diligence that you need to do.

Just because people have been in the industry for 20 years or purport to be in the industry for 20 years, that doesn't necessarily mean that they're going to do a great job for clients. And I think… That was a huge learning point for me.

Matt Egan ( .974) Yeah.

30:08

Well, think the diligence thing is particularly apparent at the minute, right? Because we are in this world where there's a skill shortage, but there's also lots of people losing their jobs, Economy, contracting.

And I do think it's very, very difficult to hold yourself to that diligence, but it's very important that you do. That job that you had there was not right for you at that time. It probably was fine for somebody else, right? Maybe. Ian Mountford ( .881) yeah.

30:37

Matt Egan (

30:38

.766) And equally, something we often hear on this show is like the value of at the right point in your career, working for the big org, because you will get the training and the support. Ian Mountford (

30:48

.35) Yes, and again, can be frustrating. And, you know, I've been self employed for many years.

I've, I've, I've sat in sales meetings and sold things to people and, and, you know, done some decent sized deals that have fed me and my wife and family for a long time. Right.

But at the same time, that doesn't mean that you've got all the, you know, all the, radars are working all the time and sometimes you get into a conversation where something feels good and you feel like it's worth flipping the coin on it and it doesn't play out and I think I think it's it's the the big company could sometimes feel restrictive the big corporates always can because you know there's there's a limitation to the to the amount of scope you've got to work in And sometimes the law of the smaller firm and a little bit more flexibility in some ways can be very attractive.

This was cool because I could ride my bike there every day and I like, like I'm like, but like, you know, you have to, you have to be serious.

I think the kid, the career that we're in here and the reputation that you have has to go for get you, if you're going to give advice to people, you're going to work in it in consulting as an advisor when it comes to cyber.

Matt Egan ( .187) Good.