I wanted to work for GCHQ: a hacking demo, and a need to know how things work

The thing I wanted to be#

When I was younger I wanted to work for GCHQ.

Not in a vague, "that sounds cool" way. I properly wanted it. The idea of working somewhere that sat at the centre of keeping a country safe, doing work most people would never see, was exactly the sort of thing that grabbed me as a kid. It felt like the biggest puzzle in the world, with the highest stakes.

The gaming festival#

The moment it became real was at a gaming festival.

I was there for the games, like everyone else. But there was a hacking demo running, and I stopped to watch. I was hooked within minutes.

I will not pretend I understood every step. What I understood was the shape of it. There was a system that was supposed to behave in one way, and someone who looked at it differently and made it behave in another. Nothing magic. Just a person who understood the thing better than the people who built it expected anyone to.

I walked away from that demo excited about cyber security, and that excitement never fully went away.

It was never really about hacking#

Looking back, the demo was the spark, but it was not the fuel.

I did not want to break into things for the sake of it. What pulled me in was the why. Why does this work? What is it actually doing underneath? What assumption did the person who built it make, and what happens when that assumption is wrong?

Cyber security is one of the few fields where that question is the entire job. You cannot defend something you do not understand. To protect a system you have to know how it works, how it fails, and how someone with a different mindset would look at it. Attackers and defenders are reading the same manual. The difference is what they do with it.

I need to know how things work#

This is the real answer to why that demo landed the way it did.

I love knowing how things work. I am a deeply curious person, and it is not a hobby I switch on and off. It is how my brain is wired. If something works and I do not know why, it bothers me. If I can open it up, trace it through, and finally see how the pieces fit, that is one of the most satisfying feelings I know.

It shows up everywhere:

• Games. I do not just want to play, I want to understand the systems underneath. How the numbers work, why a mechanic feels the way it does, what the designers were trying to achieve.
• Technology. A setting, a log line, or a strange error is never just an annoyance. It is a thread to pull.
• People. I want to understand why people behave the way they do, and I have spent a lot of time trying to understand myself too.
• Security. The best bit of any incident, any alert, or any odd bit of behaviour is the moment it clicks and you can say, "Right, that is what happened."

A hacking demo was simply the first time all of that pointed at one thing, and I recognised it.

Curiosity is the skill#

Here is what I believe now that I did not understand at the time.

The tools change constantly. The products, the platforms, the threats, and the acronyms are all different from year to year. What does not change is the habit of asking how something works and refusing to be satisfied with "it just does".

That habit is worth more than any single certification or tool. It is what lets you work out a system you have never seen before. It is what makes you notice when something is slightly off. It is what keeps you reading, testing, and learning long after the job description says you are done.

If you are curious, you can learn the rest.

What it still means to me#

I wanted to work for GCHQ because I wanted to be near the hardest, most interesting puzzles there are. I still want that. The setting looks different from what I pictured as a kid, but the pull is identical.

Whatever route someone takes into security, I think the starting point is often the same. Someone sees something they are not supposed to be able to do, and instead of shrugging, they ask how.

I am grateful that a gaming festival and a hacking demo put that question in my head. I have been trying to answer it ever since.

If you are young, curious, and feel the same pull, follow it. Take things apart, ask why, and do not apologise for needing to understand how everything works. That is not a quirk. It is the whole job.

References#

• GCHQ
• National Cyber Security Centre (NCSC)