This past April, I got to be part of something really special: a 4-person panel, alongside Reanna Schultz, Chris Honda, and ZeroSignal, celebrating the 2-Year Anniversary of Simply Cyber's all-volunteer Public Speaking Group. In two years, that group has helped double digits worth of new and seasoned cybersecurity professionals land their first conference talk, with a handful going on to land multiple, major cybercon speaking slots.
I put together a lot of notes for that panel and figured, why let them live and die in a Discord voice channel? Here's everything I know about actually getting booked to speak at a cybersecurity conference, from finding the right CFP to remembering to pack a belt.
Finding (and Choosing) Your Opportunities
BSides is the move. Find one near you and apply. It's a wonderful, low-stakes way to get your first talk under your belt.
If you're in a specific niche, look for specialty cons built around it. DETHCon is fantastic if you're into detection engineering and threat hunting, and Intellic0n is a great one too. And don't be afraid to ask an AI assistant to help you scout niche cons in your area, it's genuinely useful for that kind of research.
Don't sleep on general, location-based cons either. GrrCon (Grand Rapids, if the name didn't give it away) and CypherCon in Milwaukee are both fantastic ways to get to know your local security community.
How People Actually Find You
Funny story here. I once applied to two CFPs in a short window, one of which I'd actually been approached to apply to. I basically threw that one away as a defense mechanism, figuring I wouldn't get it anyway, so why bother really selling myself. The other CFP, where I was just another applicant with no inside track, I went all in and wrote what I still think is a genuinely good submission.
I actually apologized to the organizer of the first CFP, telling him it wasn't my best work. He told me the reason he'd approached me in the first place was my social media, specifically the educational content I'd been putting out. That's what put me over the edge for him.
Moral of the story: the CFP you don't think matters is sometimes the one someone's already decided they want you for. Put in the effort anyway.
Picking a Topic
My approach is embarrassingly simple: I think about what I'm actually working on at work right now, and then I make it open-source and vendor-agnostic. It's wild how much you think you're just doing business as usual, when really, your workflows and solutions could unblock someone who doesn't have access to the tools you use or hasn't thought about the problem the way you have.
Between "Accepted" and Actually Presenting
This part is a lot. If it's a brand-new talk, you're writing the whole thing from scratch. For me, that usually takes about a month of writing it all down, then going back through and iterating, iterating, iterating.
One thing that genuinely helps: pick a slide deck theme that makes you excited to work on it. For one talk, I went spooky, graffiti and tattoo graphics, for a presentation on using AI to help analyze intel collection. If the deck is fun to build, you'll actually build it.
I also run my presentations into the ground before I give them. I want to feel so comfortable that if something goes wrong (and it will, it did at Intellic0n, my slides got completely messed up), I can just roll with it. Which leads to my biggest tip: send your presentation as a PDF if you can. Try to get a run-through with the actual con equipment if possible, and if you can't, ask how it'll work and watch how the keynote and earlier speakers handle it.
Have a point of contact at the con, and don't be afraid to actually use them. Ask about accommodations. Ask if the talk will be recorded or streamed, and if there's anything you can post on LinkedIn beforehand. Basically, try to be the speaker an organizer loves working with: show up on time, participate, and evangelize the con.
Packing for Travel Days
Bring backups of everything, including comfy shoes and a change of clothes. And this is not a joke: bring a belt. You might prefer a blazer for a lav mic, or you might need it clipped around your waist instead of on your ear, and if that's the case, you need something to clip it to.
Give Something Away
Yes, always. I want my audience to walk away with something useful: the content, the slides themselves, and if I'm presenting on a project or script, that gets open-sourced too. I am 12000% about sharing with the community first.
Q&A, Pacing, and Reading the Room
I always leave time for discussion, unless the whole con is running so far behind that I'm told not to. I like framing that time as a discussion rather than strict Q&A, because the topic people know the most about is themselves. Letting them talk about what they've done tends to spark more questions and solutions than a straight Q&A ever does, and everyone in the room benefits.
If your time window changes, know your key points well enough that you can cut examples on the fly, or stretch with more detail if you've got room to fill. Do a dry run of a condensed version of your talk before you go, so you're not discovering it live.
How Deep Do You Go?
Depends entirely on the audience. At Intellic0n, I can absolutely nerd out on intrusion analysis and get into the specific CVEs Salt Typhoon used on Fortinet hardware. At something like BSides, some people in the room aren't even in the field yet, they're just hoping to learn, so I'll talk more generally about threat actors and how to profile one and assess the risk to your org.
Do You Need the Flashy Slides?
I do enjoy a little pizzazz. Maybe not zooming text, but in the right talk, who knows. There's a genuinely cool blog post about SVG clickjacking that's a great example of using inline demos to actually illustrate what you're talking about. If you can add something that demonstrates your point, and it doesn't require a sacrifice to the demo gods first, add it. Keep people awake. You don't need a ton of it, especially for a more technical audience, but even then, a little automation that types out a SIEM query line by line, or types in a YARA rule as you explain it, goes a long way.
Pacing Your Content
Also depends on the topic. If I'm profiling Handala Hack, I'm packing the talk with details on their campaigns and everything we know about Iran's Ministry of Intelligence and Security. If I'm talking about how to become a CTI analyst, I'll hit some key points and then open it up for questions and comments so I can go deeper where it's actually useful.
Where Do Your Credentials Go?
First. Every time. That's why they should listen to you on this topic.
Can You Pitch Something for Sale?
Depends entirely on the con. If you're planning to showcase a tool in your talk, ask the organizer first.
Handling Nerves
I do the opposite of blending in. I wear all my favorite, most distracting things as armor: loud boots, chains, cheeky t-shirts. That's what makes me feel comfortable, so even if I'm nervous, I still feel good delivering the content.
Self-Promotion vs. Actually Delivering Value
I put my accomplishments up front because I genuinely worry people are thinking "why should I listen to her?" But I always make myself available afterward, sharing my socials and email so people can find me however works for them. I never do the "oh, follow me!" thing. Just shoot me an email, the least flashy way to reach me, and know that I try to make everything I present as open-source as possible so people can actually walk away with it.
I think a lot of this comes down to picking an agnostic topic in the first place. If you're walking through an intrusion, it's fine to say what tooling you used, especially if it did something unique, so nobody in the audience is left thinking "wait, why doesn't my TIP do that."
Do You Want People to Reach Out After?
Oh, 1000%, and say it out loud on the mic. Whatever channel is easiest for them, usually LinkedIn for me. Funny enough, I once had my LinkedIn locked down so tight that people couldn't find me. If we weren't already connected, I was just a picture-less "Jen." Learn how to pull up your QR code too, and get comfortable sharing your profile that way.
Some people genuinely don't want to share how to reach them after a talk, and that's completely okay. It's overwhelming. I never want to send templated responses, but when five people a day are asking for help with different things, and you've also got a real job, you're coaching at your local gym, you're trying to keep up friendships and see your family, mow the lawn, fix the stoop, and there's always laundry, oh, and you're also writing CFPs and presenting at cons. I get it. You don't have to accept every LinkedIn request, and you can turn off message requests entirely.
As for right after you leave the stage: take care of yourself first. Grab water, take a bio break, even just fifteen seconds to shake off the adrenaline of talking for close to an hour straight. You're allowed to tell someone "I'll be right back," I've done it. I once had to take a call in my hotel room mid-conference and told a room full of people "I'll be back in an hour!" When I came back, people were still standing outside the door waiting to say hi.
Freebies
Yes, 12000% yes, but make them useful. If you want business cards, print them on plantable seed paper. Or put something functional on the back: the intelligence lifecycle, the cyber kill chain, or a different threat actor per card with a QR code linking to detections based on their TTPs or their MITRE ATT&CK page.
My husband hates stickers. I love them, and I'm pretty sure most of cybersecurity does too, so I'm firmly pro-sticker, but also pro-give-them-something-actually-useful.
Huge thanks to Reanna Schultz, Chris Honda, and ZeroSignal for being incredible co-panelists, and to everyone in Simply Cyber's Public Speaking Group for building something that's genuinely helped so many people land their first talk. If you've been sitting on a CFP, this is your sign to finally submit it.