Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Tim Nordvedt on Going From Bikes to Bytes in Security
Guest:
Tim Nordvedt
Published:
Duration:
27 min
Episode summary
Tim Nordvedt, Senior Manager of Synack’s North American Solutions Architects, didn’t take a straight line into cybersecurity. His path ran through a college classroom, a bike shop, and a stack of certifications collected one at a time.
In this episode of WE’RE IN!, Tim traces that path, from a half-forgotten Commodore 64 to trying out for the Synack Red Team, and how he eventually built tools that automate attack surface discovery for Synack customers.
How do skills from an unrelated career and fixing bikes translate into cybersecurity value? What does it take to move from researcher to solutions architect? Why does Tim say the only way to survive an AI-driven security landscape is to fall in love with learning?
Don’t miss Tim’s advice for turning imposter syndrome into momentum.
Listen to the episode
S4 E13 · Tim Nordvedt on Going From Bikes to Bytes in SecurityWE'RE IN! Podcast · 27 min
Key takeaways
Someone on the inside helps sell you A recruiter told Tim he was not a fit for Booz Allen, but contacts made through his bike shop network and his uncle got him through the group interview and hired in 2017.
Previous careers are not wasted Ten years explaining gear ratios to bike customers taught Tim to translate technical detail into value, a skill he uses daily with security customers.
List all experience, paid or not Tim put community college classes, CTF competitions, and cyber boot camps on his LinkedIn and resume, and a recruiter later found him there for the Synack role.
Map new KEVs to customer attack surfaces After React2Shell, Tim built a tool that monitors new known exploited vulnerabilities from CISA and VulnCheck and produces a daily list of affected customers so account teams can reach out proactively.
Keep upskilling as threats change AI and LLM testing were not on the radar when Tim joined Synack four years earlier, so he now spends an hour or two a day on the Hack The Box Academy AI Red Teamer path.
Notable quotes
…you gotta reframe impostor syndrome. Because, yes, you may be professionally new to the cyber career, but all those previous careers you have, they're not a waste.
…anything that gives you experience, whether you're getting paid for or not, is valid to put on your LinkedIn on your resume.
…if I have to do the same repetitive task more than two times, I'm gonna find a way to automate it so none of us have to do it a third time…
…if you don't enjoy learning, you're not gonna succeed as a solutions architect.
Questions this episode answers
How can I break into cybersecurity from a non-IT career?
Tim validated his skills with a community college program and many certifications, then networked constantly through coffees, meetups, and conferences, because he knew a resume alone would not get him in the door. Read this section
How do you deal with impostor syndrome in cybersecurity?
Tim says to reframe it: skills from earlier careers are not wasted. His years as a bicycle mechanic taught him to translate technical concepts into terms customers understand, which applies directly to his security work. Read this section
Do solutions architects still write code and build tools?
Yes. Tim automates any task he has to repeat more than twice and has built internal tools, including attack surface discovery work and a vulnerability alerting tool, while still focusing on customer problems. Read this section
What is the best advice for becoming a solutions architect?
Fall in love with learning. Tim notes that AI and agentic AI testing became central to his conversations within four years, and he has had to upskill several times a year throughout his career. Read this section
About the guest
Tim Nordvedt is, at the time of recording, Synack's senior manager of North American solutions architects, after about three years as an individual contributor on the team. Before moving into cybersecurity around 2017, he worked as an accountant and ran a bike shop for REI in Maryland, then started at Booz Allen Hamilton in roles that included Splunk engineering, OSCP training, and deputy CISO support for a federal agency. He has also served as a SANS mentor helping people transition into the field.
Hello, and welcome to the latest episode of the WE'RE IN podcast here at Synack. I'm Josh Mason, solutions architect, and with me today is one of my... One of our leaders in solutions architects, Tim Nordvedt. Tim, thank you for joining me today.
You've been at this cyber game for a while, but you, like most people I know, have a complex path to or... To how you got here. Do you mind walking us through, like, how little Timmy... Or forgive me, if you don't like that, Nordvedt ended up where he is now?
No. Absolutely. And I kind of love telling my origin story because as you mentioned, there's no there's no clear path in how, you know, most of us got to where we are, and so it's always refreshing to hear that, you know, someone can hear the path and say, yeah. I can do it too. So I know you say, I've been at it a while, but realistically, I've actually professionally only been doing cyber, I think right around seven years now. So kind of how I got into it, I'll take you back like ten years ago, so around like 2015, 2016, I was working two full time jobs. During the day, I was an accountant for a car dealership, and nights and weekends, I was a bicycle mechanic. I ran a bike shop for REI here in the Maryland area, and I had been doing this career thing of two full time jobs for probably six, seven years at this point.
Like I said, 2015, 'sixteen, I was in my mid-30s, I was married, I had two kids under five at home, and I just remember just this feeling of like, I can't do this forever. I've got to change something, I don't see my family, I'm barely making ends meet, I can't even think about paying for college, I need a different career path. So I started just surveying my network of people. I worked in a bike shop, so I dealt with people on a regular basis, so I started asking kind of, What do you do? Do you enjoy it? How'd you get into it? And I kept hearing, you know, this IT field kept reoccurring, and I finally made a connection, so to kinda take you back even further, I had an uncle who was a computer programmer for NSA his entire career, and he got me hooked on computers back in the early eighties, when he bought me a Commodore 64, and ever since I laid fingers on that, I was obsessed with computers.
In elementary school, I remember teaching myself basic program, then Pascal, then moved on to C, C. I'd always built my own computers, like I did tons of coding, just built stuff all the time, but never really made the connection that maybe I should make a career out of this skill I had. So as I heard all my friends talking about IT as just a great career to be in, I finally decided, you know what, why don't I give it a try? But my resume, as I mentioned, was accountant and bicycle mechanic and other odd jobs, nothing that screams IT professional. So, I wanted to kind of validate some of the skill sets that I had, so I actually went back to a community college, Howard Community College in Columbia, Maryland, and my initial plan was actually to go into programming, because I mentioned I'm very familiar with coding languages, even though professionally I'd never done it, I developed some pretty robust applications over the years.
So I started taking coding classes, but one of the required classes I had to take was network security Administration, part of their associate's program, and I went to that class, it was a night class, and it was taught by a gentleman who's still a good friend of mine today, Michael Resnick, he is a Red Teamer for Raytheon, and nights and weekends he taught classes, and he used to regale us of stories of what he did in his daytime job as a Red Team operator, and it was the first time I'd ever heard of security as a profession, and I was hooked. I just fell in love with the idea of cyber security, and actually pursuing that, more specifically, offensive security, and so as soon as I met him and was introduced to this concept of offensive security, I was all in, and I knew that was gonna be the career path for me. So, I, you know, outside of the associates, wrapping that up, I knew I needed additional stuff on my resume, so I went and got a whole lot of certifications, collected them like trading cards, just to kind of validate my skill set, but the last thing I did to kind of make the transition, is I knew the resume alone was not gonna get my foot in the door.
I needed to have someone on the inside to help sell me, so I started networking like crazy. I would have coffee with anyone who would give me 5 minutes, I would take phone calls, I would meet at happy hours, I went to local meetups, I went to every conference I could find, just constantly telling my story over and over and over again of what I was looking to do. And where I landed my initial job is I was talking to... I made a good friend at the bike shop I was working at, and he was gonna have a boys weekend where he had a place out in Deep Creek Lake, Maryland. He's gonna invite a bunch of guys to come out, hang out, just drink beers and ride bikes all weekend. So he invited me to come out and talk to his friends, see if any of them had any opportunities. So I went out there, and there's one of the gentlemen that was at that weekend was a guy named Levi. Still a friend of mine to this day. He actually owns a gym down in Washington DC.
He and I made a real connection, and he says, I'll I'll go to bat for you. Give me your resume. I'll start, you know, reaching out to my clientele. And he had one guy down there that was a consultant for Booz Allen, had been there for many, many years, and liked my story, and said, Look, I'll see what I can do to get your foot in the door. So he made some calls, got me lined up for a group interview to come in and talk to a bunch of the contracting teams, And so that was the first step. The last step, which is pretty wild when you think about it, but if I go back to my uncle who is the computer programmer for NSA, he's retired now. He just does some volunteer stuff. One of the places he volunteers is at a local thrift shop just to help out, kind of make sure stuff is working, help organize. And he was networking on my behalf, telling the other ladies that volunteered there too about my story.
And one lady told him, Hey, look, I have a son that works in cybersecurity, maybe he could talk to him, kinda help him out. So my uncle called me up, this was one week before I was going to my group interview at Booz Allen, and my uncle called me up, said, Hey, I have a contact, and he actually works at Booz Allen, maybe he can help out or something, so he passed the info off to me, when I looked it up, the gentleman was Brad Medairy, he was the senior vice president of cybersecurity for all of Booz Allen Hamilton. So not just a consultant, a pretty big dog. I emailed him, said, Hey, look, I'm coming in for an interview next week. I actually got your information from your mom, who knows my uncle, said I should reach out to you. I'd love to just shake your hand, catch you for five minutes while I'm down there. He accepted that, and so I went down for my group interview. And this is why I always tell people, when you're trying to break into cyber, it's important to have someone on the inside that can help sell you, because part of the precursor to that group interview process is you have to meet with the standard recruiter and kind of go through that process.
And I remember the phone call with the recruiter, he was looking at my resume, and the gentleman that kind of initially got my foot in the door, his name was Ernie Crossland, and the recruiter said, I know Ernie vouches for you, but I'm looking at your resume, and if you come down here, think it's a waste of your time. I don't think you're a fit for us, I don't think you're what Booz Allen is looking for. I mean, if you wanna do it, you can, but I honestly don't see this working out for you. But I believed Ernie when he said he could help me, and I had this other connection with Brad Medairy. So I went down for the group interview, went up to Brad Medairy's office afterwards, we talked for a little bit, and they decided to take a flyer on me. That was 2017 when I got my first official position with Booz Allen Hamilton, kind of in the whole cyber field. So I know that's a lot, but that's kinda my origin story, kind of how I got into this field initially.
I love that. I love that. I mean, I got my Security plus in 2017 as well. Yeah. There's a a whole life before that that people like hearing stories about, but don't don't necessarily... They don't seem like they have direct tie ins. I think you and I, now that we've been in for a little bit, can probably make the tie ins. I... You've been... You've worked at a lot of really different places, and I bet what you learned there helped you obviously get those, jobs by networking, connecting with people, and selling yourself. So at one point, you ended up coming over to Synack and are now part of the sales team. How did that transition occur?
Yeah. Just kinda piggyback off of one thing you said there, and I'll kinda answer the question. But, you know, yeah, I I do a lot of talks at conferences, I've worked with SANS as a SANS mentor, trying to help people transition into the cyber field, and one of the things that's a common theme people always deal with is this whole imposter syndrome concept, And I remember the first day... My first day at Booz Allen Hamilton, walking into this office, this floor with hundreds of people, and it really hit me that this is my... I was, what was I, 38 years old at the time. My first day ever in anything professionally, IT, cyber, I'm surrounded by people that have been doing this for decades. And so it was a real thing, do I really belong here? Like, do I fit in? But as you mentioned, it's kind of, I always ask, tell people, you gotta reframe impostor syndrome. Because, yes, you may be professionally new to the cyber career, but all those previous careers you have, they're not a waste.
You're not throwing them away. That gives you a whole different set of skills that you wouldn't have had if you didn't didn't pursue that path. Like for me, for example, I spent over ten years as a bicycle mechanic. Was a bicycle mechanic, bicycles are very complex machines. And most people that ride bicycles have no idea about gear ratios and brake fluids and oil weights and everything. Like, you can't talk to them about the technical specifics, you have to learn how to take technical concepts and translate it to speak and value that that bicycle customer is gonna understand. So I have ten years of that, and that's actually directly relevant to what I do in cybersecurity. Most of my customers, I can't speak to them with a specific technical detail level. You have to learn how to take the technical details and translate it to value and higher levels.
Yeah. So, you know, impostor syndrome, you know, looking at your skills previously, there's a lot of tie in connections that allow us... There's things I do today that I learned outside of cyber IT that make me successful. It's kind of how I got into Synack and sales, so I started with Booz Allen, I did a whole bunch of different things while I was there, like initially, the first contract they put me on was a Splunk contract, spent a year as a Splunk admin engineer, then they moved me to, because I had the offensive security background certifications, I was put on a contract to help train, people train for the OSCP, because that was a requirement for one of the contracts we supported with the federal agency. Then I moved to another contract, where I was working, as a deputy CISO to a federal agency, and helping him build and mature his security program, with the concept we were calling to as the Security Fusion Center, where we were looking for ways, like we had, in security, everything's very siloed.
You have your SOC, and you have your vulnerability management team, then you have your Red Team, and you have your governance clients, and you have physical security, you have all these very siloed orgs, but there's really a lot of tie ins, so how can we kind of pull all these disparate functions together and kind of get a central view just to kind of create a more holistic picture? So I worked with him to kind of help build out and evolve that program. But all the while, there's two things. One, think if back to how I initially fell in love with this industry, it was from listening to Michael Resnick's story about being a Red Team operator. Offensive security was my passion. Love security as a whole, but really offensive security is where... What drives me. And so all these things I was doing, they were adjacent to offensive security, but not in the actual offensive security swim lane.
So I was trying to find a way to get back to there. And also, I wanted to be a little closer operationally. Like, I enjoyed what I was doing as a consultant, but it was very much... I would come in, I would observe, I would kind of provide some recommendations and guidance, but then they would move me onto another contract before I could actually deploy any of that. So I never actually got to see the securing of the mission, or I never actually got to be there when we were having those wins and such, and I was kind of missing out on that. So, all this while, I was still attending conferences, and I would go to ShmooCon and all the BSides and everything, I remember I was at BSides Charm, I think it was 2018 or so, actually it was BSides Nova, 2018, and Synack, the Red Team, actually had a booth there, because they tried to have BSides and recruit members for the Synack Red Team, and that was my first introduction to Synack, and hearing about the Synack Red Team.
And so I applied for the Synack Red Team, and while I'm a decent hacker, I was never quite good enough to actually make it onto the Red Team. I think I attempted three different times, got past the initial phases, but I was never quite up to par of the full Synack Red Team members. But then, you know, kind of going back to Booz Allen Hamilton, here I was kind of in this quandary. I enjoyed what I was doing, but I wanted to get offensive security, and then I actually got a message on LinkedIn from a recruiter that they were looking for a solutions architect for Synack, and it piqued my interest immediately, because I knew who Synack was, I respected them as a company, thought, well, if I can't be on the Synack Red Team, then maybe be on the employee side just as good. So I kinda looked into the role, and as a solutions architect, it's kinda very similar to what I was doing as a consultant, but I got to see projects from beginning, middle, and end in fruition.
And one of the things I fell in love with being a solutions architect is you're still very technical, because you have to, you know, kind of understand the ones and the zeros and build out security programs, and you're side by side with the security practitioners, but there's still a very aspect of soft skills in sales and under helping people connect, you know, value to pain point and solving problems and enjoy that mixture of technical and kind of dealing with customers at that level that really intrigued me about this role. So I took it. That was four years ago, so I've been at Synack just four years now, and as you mentioned, the first three or so years I was an individual contributor, And then more recently, I have been promoted that now I run the North American Solutions Architect team.
It's it's awesome seeing parallels too. I know other folks on the team, myself, had had a a similar feeling and relationship to Synack and how I got my role, a recruiter on LinkedIn. And I think it's valuable that people who are trying to get jobs in cybersecurity hear these stories and hear how it works. Because clearly, your LinkedIn, if they found you, said something about you that was valuable and pointed out what you'd been working on, what your skills were, what your projects were. And you had to have been keeping that up to date and connecting with folks. I know you do now. So Absolutely.
I mean, LinkedIn, I didn't even have the looking for opportunity switched. But as you mentioned, another thing when I talk to people trying to transition, when it comes to experience, experience is much more than just what you do professionally and what your paycheck is. And yeah, are correct with experience, I put all of the classes I was taking with Howard Community College on there, I put all the CTFs I was participating in because I was part of a CTF team and did a lot of competitions and won some prizes over the years. I had done several cyber boot camps, so I put that all in there. So I put, when it comes to experience, anything that gives you experience, whether you're getting paid for or not, is valid to put on your LinkedIn on your resume.
Yep. 100%. Some of those projects happen in the company, even here. I know sometimes when I talk to people about what it's like being a solutions architect, it ends up being, at the core, a lot of that communicating and translating and, helping a potential customer or existing client, build out their program and utilize what we've got. But we've got some amazing folks on the team. You are one of the standouts. One of the tools that we have and that we provide to folks isn't connected to the platform. It was something that, I know we had a piece of, but you've really helped build out our attack surface discovery.
And, I know I've even watched it in the year I've been here, grow and become more and more of a tool. And I know some of the other solutions architects are jumping on that, and I've started adding, some pieces to it so that we have, tools that aren't available in the platform for our customers, to analyze certain things. And they might not get them from other tools either, and you've been able to put that together. I think it's interesting for folks to, know that being in sales, a sales engineer or being a solutions architect doesn't mean you're done messing with code or building out, tools. It can be a lot of those things.
No. Absolutely. I mean, it's kind of in the name of solutions architect, like, do you do? I architect solutions. And so many times that, like you said, kind of the priority of building those solutions is for our customers. It's understand what are their pain points, what are their issues, and kind of helping them build out solutions that we align to and that we can deliver value. At the same time, I architect solutions for any problem I see. I mentioned how before professionally, I was doing, I initially wanted to code in, because I had done lots of projects on my own, and most of that was out of laziness. I found myself that if I have to type the same thing more than two times, I'm gonna find a way to automate it so don't have to type it a third time. And so most of my projects stemmed from how can I do this more efficiently, like for my accounting job, I say I was doing that full time, but I had automated so much of that with macros and scripts and just things that I was doing that I could do the job what most people are taking forty hours, ten to fifteen hours a week, because I had built so much automation around that, and I do the same thing here?
You mentioned the ASD, as a company internally, I'm constantly looking for ways, like what are things that we are doing that aren't very efficient? How can we make this more efficient? Again, out of laziness, if I have to do the same repetitive task more than two times, I'm gonna find a way to automate it so none of us have to do it a third time and we can focus our efforts elsewhere. So yeah, it's still, even though on the sales side it's not as technical, we still have the ability flex those technical muscles and kinda dig into the weeds as much as we want to.
Oh, yeah. I've had my head down in a project working on translating, RFP, request for proposal requirements into an actual document that fits what we do and pricing and all of that. And it's a lot of Python scripts. Yeah. And I don't think people realize, you know, that that can be part of the job. You also have plugged into, like, the CISA and KEV databases and created some newsletters and updates for yourself that you've also been able to share with others. Is that along the same lines of wanting to have heads up in order to provide value to customers and, I don't know, tinkering with the tool to figure out how to do that best?
No. Absolutely. Like, a lot of this was stemmed from the project you were talking about recently, React2Shell, where we as a security company, you Synack, know, we're offensive security, pentesting as a service, kinda got lots of labels there, but companies look for us to help them protect their external attack surface, and in today's, you know, adversarial world, threats are near real time, and we need to be able to respond real time and help them real time. And I saw that when React2Shell recently was released, like we were in a defensive position. We had all this data available, so it was first we had to sift through and figure out who actually has the fingerprints of React2Shell that we should react to, and so when that came about, we had all the tools to help our customers, but I found we were a little bit behind the eight ball and be able to deploy those tools.
So I wanted to find a way that how can we stay more on top of this? You know, as a solutions architect, you know, one of our goals is to be a trusted adviser to our customers. I'm not looking to just be transactional, you know, just call me when you you need to buy something. Like, I wanna be a trusted advisor, whether it's a solution I sell or not. I want I want you to trust me just as a general security practitioner that can give you advice on variety of things, not just how to buy more Synack, if you know what that means. It's just more general, and so one of the ways we can do that is not wait for customers to come to us, that we proactively reach out to them. So, yeah, I developed a tool that in near real time monitors the release of KEVs, both from CISA and VulnCheck. VulnCheck sometimes doesn't have as much red tape to go through a CISA, so they release things a little earlier, So I monitor both, and then I map that to our customer's attack surface.
So I get a daily kind of spreadsheet showing all the new KEVs and then all the customers that it maps to, so it puts us in position that we can then reach out to those customers and say, Hey, just wanna make you aware of this new KEV. We saw it over here. It might be something to look into. Kinda empower our solutions architects and our account teams to be in that trusted advisor position.
It's amazing, and it's... Thank you for providing this leadership and example to the team. As one of the newest SAs on the team, I know... I appreciate it, and it's one of the reasons I am glad to be here. I wanted to, wrap up real quick. If there was one bit of advice that you'd wanna share with people about getting into cyber, maybe looking at solutions architect or sales as a role, what's, like, your one piece of advice that you'd wanna share with folks?
Oh, one piece of advice. That's a hard one. If I had to boil it down to one, and kinda put it aside, I've already mentioned a couple things, the one I'd probably leave with is to fall in love with learning. Because in this, if you don't enjoy learning, you're not gonna succeed as a solutions architect. The one example I say all the time is, I've been at Synack four years ago. When I started four years ago, testing AI and LLM's wasn't even on the radar. Agentic AI, using that as a solution, was not even on anyone's radar, but here I am today, that's the forefront of every conversation I've had. And so, I had to go out and become an AI SME. Right now, I'm going through Hack the Box Academy, they have a learning path for AI Red Teamer, that I'm actively doing this at least an hour or two every day, try to upscale myself on an AI SME, to become an AI SME and kind of be the trusted advisor and the expert in this area, and I've had to do this multiple times.
Several times a year on my career, I have to upscale myself on a, not always a new technology, but a new adversarial technique, a new attack path. Just constant learning, and that's how you succeed at being an SA is always kinda being at that cutting edge. And that if you don't fall in love with learning, it's gonna be a long, trudgers career path and and something you're not going to enjoy.
It's huge. Thanks, Tim. This was awesome. Really appreciate you joining me today. For those who are new to the podcast, I hope you enjoyed it. Please tune in again, and we'll see you on the next one.
