So you want the freedom, flexibility and ownership of your career? Maybe you have professional experience as a cybersecurity consultant, and want to go independent, or you could be transitioning from a related field after taking a course in cybersecurity. Getting started is hard, I know because three years ago I started a cybersecurity consulting firm. It's a scary leap to make, so I wanted to share with you a few things I wish I had known three years ago.
Trust
Trust is the bedrock of every cybersecurity relationship. Most of the time, your client will not have the technical abilities or time to evaluate whether you can properly do your job or if the work you performed is acceptable. Think of your relationship with your doctor. How do you choose a physician? Why do you trust one doctor, but not another one? What would make you suspicious?
The way we choose a doctor is similar to the way clients choose a cybersecurity consultant. A recommendation is usually the strongest indicator, so make sure to lavish your clients with attention and followup regularly. Sometimes we check the doctor's credentials. Getting certifications or having worked for a particularly reputable cybersecurity brand can help here. Most important though, are our interpersonal interactions.
The biggest tell that a professional isn't worth your trust are the questions they ask (or don't ask!). Active listening is a skill that requires practice and empathy, but I'll share with you here a technique you can try out. There are no shortcuts, but with practice and authenticity, this method can go a long way.
Replace probing questions with paraphrasing. I picked this up from former FBI hostage negotiator, Chris Voss. As cybersecurity people, we want to get to the bottom of things as fast as possible. Tell me your problem! Open up your systems! Let me identify the root cause! This approach will make clients clam up like a scallop in a fishnet. By paraphrasing, you are showing that you are paying attention, while demonstrating that the client is in control of the conversation.
Loyalty
Once you have established trust with a potential client, it is time to build on the superficial first interactions. The two most powerful things you can do to develop a long-term relationship are be honest and honor your commitments. Honesty establishes your character and honoring commitments lets clients know that you are conscientious.
Character is one of those things that is hard to describe, but everybody knows it when they see it. It is often a big reason we got into cybersecurity in the first place. To demonstrate character it is important to tell them the truth. We are often in the business of delivering news a client does not want to hear, but needs to know. Being honest also extends to yourself. We often feel that we should hide what we don't know for fear of being found out, but the exact opposite behavior actually builds trust. Don't go out of your way, but if something comes up that you don't know, simply say, "I'm not sure about that, but I'd love to find out, and will get back to you in X amount of time."
Follow-through is one of the most sought after traits these days. One big fear clients have when hiring a consultant is that they have no recourse if you simply stop showing up, either physically or metaphorically. To keep your commitments, build in extra time for error, communicate frequently, and hold yourself accountable. Nothing is worse for trust an loyalty than surprising somebody by missing a goal or deadline. If things went off the rails, reset expectations as quickly as possible and make sure any activities that depend on your work don't get held up.
Understanding
Once you are adept at establishing trust and developing loyalty, it is much easier to understand your clients. What are they looking for in a cybersecurity consultant? Sometimes it's a feeling of being in good hands. Other times it's a specific technical capability with a particular piece of software. Whatever it is, you are unlikely to find out without building trust and nurturing loyalty.
One way to get to know your clients better is to ask them to share their story with you. This takes the typical advice about storytelling and turns it on its head. Instead of looking as every interaction as an opportunity to pitch, let your clients share their experience with you. This goes back to active listening. When you give the client an opportunity to get excited about their journey, it opens up the possibility for you to become part of that journey by gaining deeper insight into what they want to achieve and what the biggest risks facing their business are.
Brand
Why did they come to you? What are they looking for, and what differentiates your offering? In my case, I was able to speak to my experience in cybersecurity while playing off my relative youth to demonstrate that I was facile with newer programming languages, tools, and concepts. While this may sound obvious in retrospect, it took years for me to realize what resonated with clients and what didn't.
Once you have laid the groundwork of trust, loyalty, and customer understanding you can start asking questions about what clients liked and didn't like about working with you. While this would always be a good thing to attempt, you may not get the brutally honest answers you need until you have a working relationship built on a solid foundation.