Friday, February 10, 2006

Pursuing Advanced Degrees When Older

If you've seen my resume you'll know I do not have a degree in computer science. My last post mentioned what I studied in "college" -- history and political science, along with minors in French and German -- including a heavy engineering core. In grad school I studied national security in a public policy program. I graduated from the master's program ten years ago.

Looking to the future, I've considered what my resume needs to look like if I want to keep certain doors open. One of the doors involves teaching at the college/university level. Another door involves being considered for leadership positions in government. A common factor I've seen in both roles is possession of a PhD in the appropriate field.

Through speaking with people like Christian Kreibich (author of NetDude) or reading the work of people like Ross Anderson (author of the incomparable Security Engineering), I've come to respect the University of Cambridge Computer Laboratory. The university offers a Diploma in Computer Science, a one year conversion course for students who have a first degree in another discipline. That sounds perfect for me. If that program goes well, I would be interested in their research-centric PhD program.

My family has always wanted to live overseas. Our daughter won't enter school until 2009, and attending kindergarten and first grade in the UK should be fun. Assuming we follow the rules, we can even bring our dog with us without worrying about quarantine.

Are any of you pursuing advanced degrees, while in your thirties? My goal is to finish the PhD before I turn 40, which is attainable if I start next year, take 1 year for the Diploma, and three years for the PhD. If this comes to fruition, I'll be at Cambridge when it celebrates its 800th anniversary in 2009.

I know others are doing it. Forensics god Brian Carrier is at CERIAS. I just learned FreeBSD guru Robert Watson started studying at Cambridge last fall. What do you think?


jbmoore said...


I can't speak for CS PhDs, but I do have a PhD in Molecular Biology and I now work in IT. If you wish to pursue a doctorate, then you need to pursue it for the love of it. Pursuing it for job security may or may not work. Here is a book I can recommend:

A doctorate is kind of a badge of honor in an exclusive club but all it really means is that you were smart and focused enough to get a doctorate. The doctorate will also overqualify you for many positions that you would otherwise be qualified for. I would suggest that you get a Masters in CS first. They would give you one on the way to the doctorate in any event, but a Masters will give you a taste of CS graduate research and you can find out if you like graduate research before you can get in too deep. They say that doctorates take 4 years, but the average at my school was 6 years. Some did graduate in 4 years but they were the exception. I do not wish to dissaude you from your goal, but you need to know that grad school is very hard on families in more ways than one. Look at the faculty and count how many have families. There are a lot of childless couples who are scientists. Good luck with whatever you decide. I love East Anglia. You will like it there I am sure.

John Moore, PhD

Richard Bejtlich said...

Hi John,

I appreciate your comments. I am interested in the PhD for its own merits, which I believe you mention. At this point in my career (and for the foreseeable future) I am not looking for anyone to hire me (hence my negligence of my CISSP CPEs). I'm not worried about being overqualified, especially when I work for myself.

I am concerned by your point about grad school and families, since I am married with one child. I am not interested in pursuing a life in academia (as a scientist or researcher) beyond a PhD program. I intend to return to industry once I finish any program, assuming I am accepted.

I welcome any other insights you might share.

Colin Percival said...

Expecting to spend only 3 years doing a PhD is wildly optimistic. Oxford and Cambridge maintain the myth that the doctorate is a 3 year degree, but when I started at Oxford, I was told that under one percent of D.Phil students actually finished within that time. Generally speaking, students who finish within 4 years are doing well, and the average is around 5.5 years. (I don't have any precise statistics for CUCL, but I imagine they are similar to the statistics for OUCL.)

jbmoore said...


I enjoyed my years in grad school. They were extrememly rewarding. That said, they were also financially difficult, and I worked my ass off. There were times I wanted to throw in the towel, but it came down to ego. I didn't wish to fail, so I kept at it. Research in academia is cutting edge and risky. Because the problems are extremely difficult and the labor cheap, academia can produce new technology and knowledge that businesses couldn't afford to do with the exception of Bell Labs (which is a shell of its former self) and IBM. From the advisor's point of view, all he loses is some time and a little money (your stipend) if the project doesn't pan out. From your perspective, you lose time pursuing ideas that don't pan out, but you gain insight and experience in problem solving. From your family's perspective, you will be working on your doctorate the entire time and the stipend will barely cover expenses and you may even need a student loan to make ends meet. This is why I suggest that you get a Masters. You can teach with a Masters and if you like the academic environment and thrive within it, then you'll continue on to your Doctorate. If you find the academic environment a grind and the sacrifices too great with the Masters which would take a year or two to get, then you'll be wiser and better off then if you are 2-3 years into a doctorate and you are in too deep to quit, but aren't even close to finishing. You are already an expert in your field. You are a successful published author. You believe that the PhD would give you an additional air of legitimacy and cachet, but you've likely published more books than many tenured professors already. You don't really need a doctorate except to gain additional knowledge and skills and train your mind. The knowledge will be obsolete within 5-10 years, so the benefit of grad school is in skill acquisition and training of the mind. I can't tell you what to do. It's part value judgement and part cost benefit analysis. Only you and your family will know after you've gotten the doctorate whether it was worth it or not. You should probably talk to Mark Russinovich at Sysinternals and get his viewpoint as he's doing what you want to do. He's been through a CS graduate program and he's running his own business.

Good luck and best wishes,

George said...

What a funny topic Richard. . . So many of us are considering it, but usually only when the world of work is slow.

Like you, I graduated with a non-technical degree, although just a BA in Sociology with minors in French and Journalism. And like you, I'm in my 30's.

I got my SANS GSEC some years back just to get myself some paper 'credentials', although I have spent endless hours researching the possibility of a technology-related Master's program somewhere.

Does it matter?

Probably. But again, it really seems only to be something that has any pull for me personally when things are slower, as they were a few years back.

One close buddy of mine in technology is taking some online classes at Drexel with the aim of giving himself an extra push, but then again, since I'm slowly building my own business, I really can't find the time or drive to do something that requires such a time committment. I would also be concerned, as someone running a small business, that I'd lose what I've worked so hard to build over the past few years.

Richard Bejtlich said...

Colin, re: 3 years for a PhD -- you mean I can't believe everything I read on the Internet? :) I guess that's why I asked for comments. I took the Cambridge "3 year program" at face value.

John, thanks again.

George, it is funny that we are in the same boat. We'll have to chat at NYCBSDCon.

Joao Barros said...

I'm turning 30 this year and don't have a CS degree aswell.
Here in Portugal that pretty much prevents you from taking a management job, unless of course you're pretty well connected, etc.
I suppose in other countrys that should also apply, and that has been a concern as I've ideas of moving abroad.
But having a heavy and tiring schedule at work how do you cope with the added burden of classes, exams, etc?
And how do you kickstart "back to school" after so many years?
Does anyone identify themselves with this? Share you experiences :)

Mike said...

I'm just turned 31, and I work as a sysadmin at a school of computer science. (I'll leave it deliberately vague to protect the guilty.) I have a BA in History, no technical qualifications beyond "I've done a lot of different things with different OSes and gotten paid for it". My manager has a BSc in Psych, his manager has a Masters in Applied Math, and the various people I work with have degrees in Physics, Engineering, and yes, even a couple have degrees in CS. (I think I'm the only BA though.) I've considered taking advantage of cheaper tuition for staff members in order to get an MA in another discipline, but I've never felt that I would be lacking because of no MCS or PhD.

I echo the comments of others: I work very closely with grad students and faculty members, and most of them take a couple of years for their Masters degree, sometimes three; most take at least 5 years for their PhD, and it's not totallly unheard of for it to be 6-7. A good friend of mine took 10 for his. The ones with families seem to have to work twice as hard.

Taking undergrad courses while working 40-50 hours a week with a family was tricky enough; part of the reason I'm dragging my feet a bit is I don't know that I can handle doing a Masters part-time while balancing everything else - and I have a regular paycheque coming in and cheap tuition.

That being said, you have a great opportunity, and it's your life. It doesn't sound like you've ever taken the easy way simply because it was easier, and you obviously have a great work ethic and discipline. If you decide that a Masters is for you, you ought to do well.

Ever consider studying in Canada? :)

Anonymous said...

Have you considered the National Defense University? They offer programs such as CIO & CISO in their Information Resources Management College, and many of their classes transfer for credit to public institutions for credit towards Masters and PhDs. They also have teaching vacancies from time to time. Since NDU is where a large portion of DoD employees (both military and civilian) receive their training, working there as a professor would sort of qualify as a leadership position.

Anonymous said...

IMHO, FWIW, AFAICT... I review resumes and hire candidates for high-end (Fortune 10) computer security positions. I look at advanced degrees as a sign of extended childhood. In my experience, I'd rather take someone who's done everything from pulling cable to writing SOX policies over an ivory tower thinker who has little real-world experience. An ability to implement is 80% of the game.

I'm 38 and *think* my resume speaks for itself, but I've never hired myself so what do I know?!

Anonymous said...

Just do the PhD! Without it you will be hard pressed to achieve the goals you aim (gov. position et. la)

bschonhorst said...

I decided to take the plunge into graduate school this fall at Polytechnic University, which happens to be a CAEIAE. Although I have only taken some of the more general courses towards my masters, I am looking forward to getting to spend some time in Poly's ISIS security lab.

Right now, I am still working full time and taking classes at night. Getting back into school has definitely provided a shock to the system but so far my experience has been a positive one. I am not quite thirty yet but it has been several years since I was in school. Sometimes I wonder if I would have been better off just getting more on the job experience but I'd like to have a computer related degree on my resume too (Psychology major in undergrad.) I will say, I underestimated the amount of time grad school would take - just ask the other NYCBUG members how often I make it to meetings these days!

Good luck with what ever you choose to do.

Roch said...

I started an MSC in Infosec last October with Royal Holloway in the UK. It's all distance based. I'm covering the material in 2 years, plus a huge project. I feel it's quite do-able and the work load is quite good. I'm doing this part-time of course as I have a day job as well to look after. I have no family commitments though which gives me plenty more time to study and work.

Best of luck, I would go down the masters route, also Royal Holloway provide part-time PhDs aswell for the successful student.

Roman said...


I'm 32, and still working on my BS in Computer and Information Sciences. I hope to achieve a MS, as well as a Ph.D at some point, if nothing else just so I can prove it to myself and gain the research experience.

The other comments here are quite interesting, particularly the ones citing experience above education. One reason I'm looking to higher education is to fill self-percieved gaps in my knowledge. Often, I have found I have a better working knowledge of how to implement something than someone with their degree (BS, MS, Ph.D, etc), but researching something I don't know I feel a bit deficient in my methods. The area I really feel behind in is programming.

Oddly enough, the school I'm currently attending hasn't exactly challenged my programming skills (self taught mostly, couple classes in high school 15 years ago). I'm going there to learn things, like modular coding, design, and other topics which I know I don't know.. but don't know the name of it. :) At the same time, even the teachers don't seem to be teaching anything beyond syntax. I want to know why something works or how something should be implemented, but the formal education I'm getting feels lacking.
At the same time, I'm not sure where I can go to 'self-teach' this without picking up some seriously bad habits.

Thus my frustration with higher education. I hope once I have my BS I will be able to find a job near an excellent graduate program. But I also worry that once I get there, I'll be out of my depth.