97 Things Every Application Security Professional Should Know

Chapter 24. You’re More Than Your Job

Izar Tarandach

One day at the end of a particularly busy quarter, I woke up at the usual dark-o’clock and realized it was a national holiday. I did not need to start getting ready for a busy day ahead. I did not need to caffeinate and get myself in the right mindset to tackle the latest challenge.

Without the usual agenda, I didn’t know what I would do with myself that day, nor did I know what I wanted to do. Or what I could do. Or what was important to get done. Or that the option to not do the important thing also existed.

And so it dawned on me (pun not intended!) that my profession had finally turned into my identity. Without something to break, to protect, to analyze, or a crisis to respond to, I was lost in the woods without a compass. I had spent so much time training my head to think, “What could possibly go wrong and what do we do about it?” that now my fight-or-flight mechanism was deeply connected to conscious, constant threat modeling. I became my function, and I lacked a framework without doing it.

In psychology, the term for what I experienced is enmeshment, which describes a “situation where the boundaries between people become blurred, and individual identities lose importance.”¹ But, according to Janna Koretz’s article, enmeshment doesn’t need to be only between people—it also happens between people and their jobs.

AppSec ...