Only race cars should burnout.

This week, @taosecurity (Richard Bejtlich) wrote an important blog post on managing burnout (Managing Burnout). As he mentions in the first sentence, he is not talking only about information security, but burnout in any profession.

I’m certainly no expert in preventing burnout, other than regularly bringing myself to the burnout line, because that is the way I am. I enjoy working hard, solving problems, and moving on to the next challenge.  I tend to go all the way to that line because of high expectations of myself. I also tend to be highly vigilant of my limits.

I believe that most everyone in InfoSec (DF/IR) has the same type of personality. We see broken things and want to fix them. When we don’t see broken things, we break things and try to rebuild improved versions of what we just broke. That’s the nature of problem solvers. I have been that way in every job that I ever had.  You are probably the same way. This works out well most of the time, until it doesn’t.

Richard shared a great deal of his personal burnout careers, for which I am grateful of his sharing. My belief, based on what I have seen in my life so far, is that for us problem solvers, we have to monitor our burnout because few others will do it for us, or even if they notice, will ever show that they are worried about pushing ourselves too far.

For me, I have been lucky. My family has been the balance of burnout prevention. My wife certainly makes sure of it and I take vacations whether I feel I need it or not. Moral support is priceless too.

But here are some things that I learned about burning yourself out at a job.

• * The harder you work, the more work you get. Work smarter. Not harder.
• * Your job didn’t miss you before you got there. It won’t miss you when you leave. Do your bit and then go home.
• * Suck it up. Don’t be selfish. Until this turns into stupidity; then you stop.
• * There’s and time a place for everything. That includes recuperation.
• * You are just a warm body. You are there to do a job, not become the job.
• * See someone reaching burnout?  Offer support.
• * Are you a supervisor and see someone reaching burnout? You better have resources on hand, right now.
• * Be a positive in life overall.  Ask coworkers and friends how they are doing. You may just save their job.
• * If someone tells you that they are at their limit... BELIEVE THEM!.

This is what I came to conclude from my last jobs as an employee (before becoming business owner and part-time employer). At one point in my police career, I had many duties at the same time. Let me repeat myself: all at the same time. Most were on-call duties, but it added up. I was the Use-of-Force lead instructor (defensive tactics instructor, firearms instructor), SWAT, OIC (Officer in Charge), narcotics/vice detective, undercover officer, and computer forensics examiner. I carried a pager (for SWAT), a business cell (for detectives), and up to a dozen burner phones for all the undercover cases I was working in multiple countries and states. I answered calls 24/7. Was called out for bank robberies for SWAT, officer involved shootings as a detective, and undercover assignments for guns, drugs, human trafficking, and stolen car rings. I did some really cool cases in some really cool (and scary) places. I was at work a lot.  A whole lot.

None of that bothered me, except that when I would seize $100K cash in a drug bust, the expectation from my agency was that I would seize $200K the next time.  Or if I arrested 10 in a major case, that I’d arrest 20 the next time. And if the next case only had $10K in cash and one car seized instead of a fleet of luxury vehicles or a flush safety deposit box, the case was a failure. And running from city to city for either SWAT or undercover or imaging a computer, only to be worry about having lesson plans ready for either defensive tactics or firearms to teach the next week, led to me always reaching that burnout line as I didn't want a failure of a case because only $10K in drug money was seized, or the drug dealer's car was only a Camaro and not a Mercedez. Unnecessary stress. Half of it self-induced.

Couple that with expectations from multiple agencies that I worked with, that I was doing all of this at higher levels than anyone anywhere, that everyone believed that I could just keep going forever. Doesn’t work that way. This is where I repeat myself; know your limits because no one else will, or few (if any) will care anyway. Your warm body will be replaced by another warm body when you leave.

I have never been approached with advice or support or suggestions or offers to take some of the burden, so I quickly learned that it is up to me to recognize where my pain threshold is and to take proactive measures to not cross that burnout line. My suggestion is that you should never expect anyone to tell you that you need a vacation. You have to check yourself constantly. Consider yourself lucky if someone else tells you that you need a break. And take the advice because they may see something you don't.

Did I mention that family saves the day? Family and friends are my cure all to burnout. When any of them say, ‘Hey, you should take a vacation’, I take it to heart and take time off.

I have seen the Infosec community only in a sliver of time and space, much like peeking through a fence at a football game for one play, I only see a bit of the game. I haven’t worked everywhere or with everyone, but I certainly see some of us get burned out, frustrated, and even leave the profession for something else. With self-management, we can reduce this exodus, extend our joy of working in this field, and be productive by solving problems. More important, we can be better humans and be happy.

I don't want a point getting across that I am advocating being lazy, or not working hard. Quite the opposite. I have learned that when managed properly, you can be a star player and still take vacations,  and still not work yourself until you are delusional. Key point: Being a star player means taking care of yourself.

As far as being better humans, one of my primary goals in life is removing the worst humans from my life. If someone is not supportive, or always negative, then I don't want to be near that person, online or in real life. The Internet has made the few worst of us affect the whole lot of us, with negative tweets or shares, lies, allegations, and just plain meanness. They will never go away, so as the saying goes, don’t feed the trolls. A method I believe in:  mute them. block them. ignore them. don’t engage them. There is no other way to be less affected by the ugly on the Internet without excluding the Internet completely. 

Be vigilant

I look for burnout in others. And dude, if I see it, I am on it like no one’s business. If it comes down to me just giving a hug, a pat on the back, or having a serious sit-down, I do it on the spot. Consider that if you see burnout in someone, that is a problem. You are a problem solver. Go solve that problem. You might end up doing more than just saving someone’s job.

**May 15, 2019**

Relevant video, well worth the watch.