CrankySec

The Modern Individual Contributor

As of this writing, it is the year 2025. Things have changed since I started doing cybersecurity. Or have they? Maybe I’m the one who’s changed. Maybe the real change was the enemies we made along the way. Be that as it may, some lessons were learned. Here are some tips and tricks on how to be an individual contributor in 2025!

Right off the bat, the very first thing you need to accept is that the term “individual contributor” itself carries a reminder of where one is in the hierarchy. It means you’re not in charge of anything that’s not assigned to you. That’s very important, so keep that in mind at all times. You take orders, and you execute those orders. That’s it.

Are those orders stupid? Do you know how to get the same results in a much more efficient way? Do you have opinions on how to address the root cause of the problem you’re being ordered to tackle? It. Does. Not. Matter. Keep it to yourself. At most, use that as conversation starters with your fellow individual contributors. You’re not paid to think about anything that’s not the work in front of you right now. And don’t overexert yourself with that, either.

When tasks are assigned to you, every critical decision that will affect the way you perform said tasks has already been made. You’re the last mile. Your thoughts on tooling, processes, procedures, standards and best practices are unwelcome. All of those things have been decided for you, and no one will change anything just because you don’t like Jira. Doing shit your way would save the company $3 million dollars a year? So what? Is that your money? Do you think that cash will go to your bank account instead? Do you think you’ll get a promotion? LMFAO.

“But what about goals, professional development, KPIs, OKRs, and process improvements?”

Great questions! The answer to those is “you do what you’re told.” Your goals are: Do the things you boss tells you to do and remain gainfully employed. Your professional development is your problem. KPIs and OKRs are just there so your boss can show their boss something green in a dashboard no one looks at. You have to do it anyway, right? Ask your boss what they think your goals should be, and run with that. Can’t do that? Write down some subjective nonsense that’s very hard to prove or disprove. Throw a random percentage where it doesn’t belong!

My goal for the FY is to support the enablement of cross-functional collaboration between departmental silos by 7.3%.

When performance review comes around, did you do it? Hell yeah, you did!

How do you handle your boss, though? That depends! Is your boss stuck in middle-management for decades the same way you’re stuck being an individual contributor? That’s great news: you can both pretend to give a shit together, and get that busywork out of the way quickly so you can both move on with your days. Eager, bushy-tailed manager? Go along, make grand plans to fundamentally change the way a corporation operates, see it never happen.

You do what you’re told, but you should also use the environment to your advantage: a couple of hours (on mute, camera off) watching a demo for a tool the vendor says would 500x productivity, and yet is never going to be purchased, is a couple of hours that you don’t have to do anything. Engage a little bit just to keep the appearances by asking something like “In the ever-changing landscape of cybersecurity, how does your tool leverage AI?” If you’re reading this in the future, replace AI with whatever bubble you have going on now.

Think the security posture of your company can be improved if only they did X? Mind your own business. Think running a Kubernetes cluster just to deploy a simple web app would be a financial, technical, mental, spiritual, and security nightmare? Not your call. Think everything this company needs is a terminal emulator, Neovim and the Rust toolchain? Enjoy C# and Visual Studio. And Copilot. And everything else that comes with that Microsoft 365 E5 license.

The modern individual contributor will leverage technical chaos and red tape: need to deliver some report that makes no sense? Tomorrow? Just toss some Word file onto Sharepoint and enjoy 3-4 weeks of peace while people try to figure out how to access it.

Shoot! I thought I uploaded it to Sharepoint, but it’s actually in OneDrive! Can’t open it? Maybe you need Power BI Pro!

That’s what business have been trying to tell you for years, buddy: you’re not paid to think about anything that’s not related to the task at hand. Like, at all. Your ideas to streamline and improve processes are not welcome. How many times do you need to be RIF’d until you understand that doing the bare minimum pays the same as going above and beyond, and that all pink slips are pink? How many times are you going to bring up some issue only to have it “risk accepted”? When will you just accept the fact that Confluence will be there until the CTO gets a better steak dinner and higher quality cocaine from some other vendor and that all your complaining is just annoying?

Know your place. This is infuriating, but only until you realize nothing about it is under your control. Once you realize that, it stops being infuriating and becomes freeing. Taking pride in your craft is great, but you need to remember that, as an individual contributor, this is not your craft. It’s someone else’s business. It exists for the benefit of someone else, not you. Enjoy the time wasted on 1:1 meetings with your manager. And town halls. And skip-level meetings. Embrace the reality that you’re never going to climb the ladder. Ponder if you even want to climb the ladder, because the next rung is just this, but with people like you to manage. And the same pay.

Redirect your energy, mental capacity, skills, and creativity towards something that’s yours. Get a hobby. Read a bunch of books. Go to the movies. Take care of your body. Homelab. Start a snarky blog. Shit, start your fucking business. Hang out with your friends. Call your mom. The ROI is much better this way.