Personal branding · Technology
Being findable is the job, and being too findable is the risk.
Personal branding for a security engineer or penetration tester runs into a limit no other trade has, because the detail that proves you are good also tells an attacker what you defend.
Scope, fee, reporting and term are agreed in writing after we have read your brief and spoken to you.
In one paragraph
Personal branding for a security engineer or penetration tester runs into a limit no other trade has, because the detail that proves you are good also tells an attacker what you defend. GullySales writes and runs your presence from a regular conversation, and will argue for publishing less.
Also written for
Cybersecurity specialist, Security engineer, Penetration tester.
Where this sits
For cybersecurity specialists
Where it usually goes wrong, and what we would do.
“Your own profile is reconnaissance”
A public list of the firewall, the cloud and the version numbers you run is page one of somebody's plan against your employer. Write about the class of problem and leave the inventory out of it.
“You cannot name who you tested”
Every engagement sits under a non-disclosure agreement, and an unfixed finding is not yours to publish at all. Disclosure timing belongs to the organisation you tested. How far the law stands behind that is a question for your own legal adviser, and the consequence of getting it wrong lands on your name, not on a marketing firm.
“The buyer wants a person and procurement wants a firm”
A chief information security officer picks the tester, then has to justify the spend to a committee asking about certifications and insurance. Both of them end up on the same profile.
“Fear sells badly here”
Posting about this week's breach with a warning attached is what every vendor does, and the people who buy testing stopped reading it years ago. What they have not seen is a clear account of how an assessment gets scoped.
What we do
What we deliver for cybersecurity specialists.
Every deliverable, what it covers for you, and the result it is there to produce. Nothing here is an extra.
A profile stating what you can actually defend
Your bio built around the assessments you run, the sectors you have worked in, and only the certifications you hold, checked against the issuing body's own register.
Result: A buyer can verify you without ringing three people first.
An hour after a disclosure deadline
An hour of your time on a test that went somewhere nobody expected, or on the control that almost every organisation implements the wrong way round. In an incident week that hour disappears, and the writing simply goes quiet rather than being filled with a news summary.
Result: Material that comes out of the work rather than off a news feed.
The publishing rules, agreed before a draft exists
What may be said about clients, findings and your own employer's systems, written down with your legal contact, with disclosure timing left exactly as the client set it.
Result: You publish without a week of internal escalation each time.
Writing for the person who signs the invoice
Pieces for a finance head or a compliance head on what a penetration test covers, why a scan is not a test, and what a report should contain before it is paid for.
Result: Fewer enquiries that wanted a cheap scan, and more that wanted you.
The research trail, handled safely
Advisories, conference talks and tooling published in the order and at the timing your disclosure policy requires, with nothing brought forward for effect.
Result: A public record of your work that no client can complain about.
How the result is measured
- Enquiries that name you or came through your profile
- Searches for your name, from Search Console
- Profile views and connection requests from your industry
- Speaking invitations, press enquiries and podcast requests
- Posts published against posts planned, and what held up the rest
Recorded as a baseline before work starts, so every later report has an honest comparison.
How it works
How the work runs for cybersecurity specialists
The work itself, in order. How an engagement starts, from your brief to a written scope, is set out on our method page.
- 1
Work out whether this is even your bottleneck
The first conversation covers how enquiries reach you today. If the company's own site is the weaker link, that comes first, and we say so.
- 2
Search your own name with you
We look at what a buyer sees today: every profile, old listing and photograph. Some of it you will want taken down, and some of it only you can take down.
- 3
Agree what you will and will not say
The subjects you know cold, the ones that belong to your clients, and the lines your regulator or association draws. Written down before anything is published.
- 4
Rebuild the profiles
The bio page, LinkedIn and the directories that matter in your field, done once and done properly.
- 5
The routine
Interview, drafts, your approval, publication. The interview is the only part that needs you, and it is the part that cannot be skipped.
- 6
Hand it over
The subject list, the drafting notes and the calendar are yours. If you would rather keep it running yourself, that is a fair outcome.
Before you hire anyone
The first thing to do yourself.
It costs nothing, and it shows what a buyer sees before they ever call you.
- Search your own name and your practice or business name in a private browser window, and list the first ten results.
- Open your profile on each major platform and check that the name, photo, description and contact details agree.
- Ask two people who recently chose you what they looked up first, and write down their answers.
Judge any provider
What to ask any agency or ghost-writer.
Useful whoever you choose, including us.
- Who writes my words, and do I approve everything before it goes out?
- Which of my own details and claims will you need to check with me before publishing?
- What will you not write because of the rules my profession follows?
- Whose account do the profiles and the content sit in, and what happens to them if we stop?
- What do you count as a result, and what will you not promise?
Where this fits
Three pieces of sales work, in this order.
GullySales builds every engagement from three pieces of sales work. This page is not one of them, but the same three steps apply to the business behind it.
Step 1
Sales audit
Find where deals are being lost and what to fix first.
Start here if you cannot say where orders are lost.
Step 2
Sales process design
One written way to sell, from first enquiry to repeat order.
Start here if every salesperson sells differently.
Step 3
Sales management
A target, a review routine and someone who owns the number.
Start here if the team has targets and no routine.
FAQ
Questions owners ask before they call.
Not here? More answers, or ask on WhatsApp.
Should I be visible at all?
Are the certifications worth putting up front?
Can you write about a vulnerability I found?
How much does it cost?
How long is the contract?
How soon will we see results?
Who will actually do the work?
What do you need from us?
What if we are not happy with the work?
Your next practical step
Tell us what you are trying to grow, and we will read it before we call.
Eight short steps, mostly taps. Skip anything you would rather answer on the call.