Building in the Open When Everything Is Classified.

The paradox of working in security: the work matters, but you cannot talk about most of it. The dashboards stay internal. The architecture stays internal. The names stay internal. You can’t link to a launch announcement because the launch was on an internal mailing list six months ago.

This is true for a lot of senior work, not just security. Anyone who has built something hard inside a big company knows the version: the most important thing you have ever shipped is something you cannot put on your resume in any specific way.

It puts you in a strange position. You’re supposed to have a public voice — a presence, a point of view, a body of work — and the actual work is sealed.

Here’s what I’ve learned about that.

The thing you can share is never the what. It’s the how.

The principles. The patterns. The philosophies. The system you used to think about the problem. The questions you asked before the work even started. The way you led the team through it. None of that requires breaking confidence. All of it is more universal than the specifics anyway.

Specifics expire. Principles compound.

You can write about how you decide which incidents to triage first without naming a single incident. You can write about how you build a team that owns its own quality without naming the team. You can write about the lesson you learned about leadership from a hard week without telling anyone what made the week hard.

The discipline of stripping the specifics out turns out to be the real work. Anybody can write about the meeting they had yesterday. Almost nobody writes about the category of meeting and what makes it hard, because that requires more thinking. That is where the writing earns its keep.

So: classified work is not a wall. It’s a filter. It forces you to write at the level of pattern, not anecdote. That is where the readers were going to be anyway.

— mk