Do you have a big presentation or meeting coming up? Figuring out what to wear in infosec can actually be quite the challenge. For some of us, the stress on what to wear may even outweigh our concerns over our research or presentation (which we know is rock solid!). We want to be taken seriously, and unfortunately we still exist in a world where how we dress can undermine the content of what we say and how others perceive us. Most guidance I’ve received tends to focus on what not to wear: never wear a skirt; always wear my hair back; don’t wear high heels; only wear neutral nail polish. It has taken me years to push aside the range of guidance that would have me dress like a man, while also recognizing the different nuances that do matter.
In many cases, the distinctions come down to differences in academic, government, or security industry settings, each of which have extremely different workplace cultures that influence the proper attire. It’s impossible to cover them all, but if suddenly you find yourself entering unknown territory for a conference, job talk, or interview, here are some quick tips for maintaining your own personality and style while respecting the unique characteristics of these settings.
Academia
During the day-to-day of the school year, almost anything goes for academics. Where academia becomes tricky is if you’re making a first impression. For a job interview, you should be one of the best dressed in the room. That may feel awkward, but in reality it gives you power. It signals your expertise, and that you are serious about the position. This doesn’t mean you need to go full-out boring, or dark and formal, but more so your favorite suit would be a better choice than your favorite jeans. The jeans are fine once you have the position, but generally aren’t appropriate for a job interview.
Unlike the job talk, academic conferences don’t necessarily require the suit, but for the presentation itself, it again is better to err on the side of dressing up. Choose a dress, or pants or skirt and fitted jacket, which is what I chose (pic below) at a recent conference The outfit should not be overly formal or stuffy, as that can be perceived as infringing on the academic pursuit of knowledge, but you still need to emit a professional vibe. When you’re not giving the presentation, it’s generally fine to network and attend talks in more casual leggings or jeans, dressed up with a blouse or jacket.
Finally, if you are visiting a school to talk to students, and are representing your company or the infosec community, it can get a little tricky. The classrooms are casual, but at the same time, you still want to look put together and not get confused with the student who just rolled out of bed. Company shirts or sweatshirts are acceptable in these situations, but try to pair them with nicer jeans and flats.
Government
Almost a year ago, The Atlantic wrote a great style guide on what to wear when working for the federal government – but it was all from a male’s perspective. I could easily have used something similar years ago. The government is not monolithic, and the environments vary depending on federal, state, or local levels as well as departments. Since I know the national security apparatus best, I’ll focus on that. The Pentagon floors can be a challenge for heels (especially the ramps!), but it doesn’t mean it’s impossible. You’ll be in meetings with everyone from four star generals to contractors to civilians, each of which brings a range of styles. Generally, a suit is most appropriate in these situations, and you can then personalize it with various accessories and colors (Olivia Pope’s style is a good case in point, or check out these ‘cyber warriors’ for a range of ideas). As in all situations, don’t shy away from your individual style, but remember that most of these organizations likely have a dress code, and you should respect that.
However, context and purpose matter and should guide your fashion decisions for government outings. If you’ll be in day-long meetings, or running an all-nighter training exercise, comfort may be the most important factor, but do still keep it professional. Interestingly enough, the farther you get from DC, the more these quick rules of thumb change, especially OCONUS. I had meetings in Hawaii, where most of my colleagues wore their favorite Hawaiian shirt and khakis. Conversely, a trip to the Ministry of Defence in London required more formal attire. Basically, geography has a strong influence on what to wear in the government sector. To see how govvies dress at cons, check out the picture below for this year’s Meet the Fed panel at DEFCON, where women comprised 75% of panel! In general, when speaking at government conferences – whether in Tampa or Dayton or Newport – business casual is often a safe bet. And if you’re making an appearance on the Hill, step it up a notch further for business conservative, but be sure to maintain individuality among the sea of dark suits.
The Security Cons & Tech Meetings
As in the other situations, geography and attendees guide what to wear at these conferences. For the security cons, each has its own unique characteristics. For instance, the BSides conferences (such as the picture below, my colleague Amanda Rousseau) tend to attract practitioners, so this is the place for anything edgy that you love or you can never go wrong with your nerdiest infosec shirt and jeans. On the other end of the spectrum, if you’re representing your company at a talk at RSA, this is a much more corporate environment. Business casual is a good rule of thumb, but if you have a suit that you love and nowhere to wear it, RSA could be the place for it. For any of these, I personally would add shorts into the section of what not to wear if you are giving a talk. I’ve seen this before, and it quite frankly seemed like the speaker was prepping for a barbecue, not a tech talk. Similarly, other than RSA, unless you want to throw off the ‘spot the Fed’ game, you can keep your suits at home.
This is generally relevant advice for meetings in the tech industry as well. I had a friend with an academic/military background who had a security meeting in Silicon Valley. She was surprised when I recommended she wear jeans, which could still be dressed up with a blazer and heels. When she returned, she was thankful for that advice. In some situations, wearing a formal suit is actually a distraction.
In general, there is one consistency across all of these environments – they tend to be overly generous in the use of air conditioning. If you’ll be sitting all day, bring a hoodie, jacket, pashmina, or whatever extra layers you need so you don’t have to constantly run outside to warm up.
I refuse to accept the assumptions that unless I abandon my own identity, my research, presentations and publications will not be taken seriously. At the same time, it is essential to take into account geographies and settings and their nuances. The key is to absolutely remain true to your own style, while respecting the unique characteristics in each of these environments. Most importantly, prep your favorite circuit board nails and get ready to rock the outfit that empowers you.
VanitySec 