Dr. Irvin Heard is an associate professor at the University of the Cumberlands with experience in cybersecurity, digital forensics, law enforcement, and federal research. His career includes work with NIST, the Department of Defense, and advanced cybersecurity education.
Summary of the episode
Dr. Irvin Heard discusses how his experience in the military, law enforcement, NIST, and digital forensics shaped his practical approach to cybersecurity education. He highlights the University of the Cumberlands’ hands-on, certification-aligned programs and explains pathways in information security, cyber engineering, and digital forensics.
Dr. Heard also encourages aspiring professionals to develop foundational skills such as Python and Kali Linux, participate in cybersecurity challenges, and prepare for the growing convergence of cybersecurity and artificial intelligence.
Listen to the episode
Read a full transcript of the episode
Steven Bowcut:
Welcome to the Cybersecurity Guide Podcast where we explore cybersecurity education, career pathways, and the programs preparing students to enter one of today’s most important and rapidly evolving fields. I’m your host, Steven Bowcut.
My guest today is Dr. Irvin Heard, associate professor in the School of Computer and Information Sciences at the University of the Cumberlands. Dr. Heard brings an unusually broad range of experience to cybersecurity education.
His professional background includes service as a computer scientist in the cybersecurity division of the National Institute of Standards and Technologies, work as a federal police officer with the Department of Defense, and a position directing and teaching advanced computer technology programs for Job Corps.
Additionally, he served as Dean of Kaiser University’s College of Advanced Technology and is also a United States Marine Combat veteran. His academic and research interests include cybersecurity, cryptography, networking, digital forensics, internet of things security, cloud security, encryption gateways, cyber defense and offense, and the ways people interact with computing devices.
Dr. Heard holds a doctor of computer science in cybersecurity from Colorado Technical University, a Master of Science in Information Technology with a concentration in information assurance and security from American Intercontinental University and a Bachelor of Science in Criminal Justice with a concentration in forensic science, also from American Intercontinental University.
At the University of the Cumberlands, students can pursue cybersecurity education through undergraduate, graduate certificate and doctoral pathways. The university is also designated as a National Center of Academic Excellence in cyber defense and supports applied learning through its Center for Cybersecurity, cyber competitions, student organizations, and programs designed for both traditional students and working professionals.
Today, Dr. Heard will help us understand those opportunities, how the university prepares students for cybersecurity careers, and what aspiring professionals should consider when selecting an educational pathway. With that, Dr. Heard, welcome to the Cybersecurity Guide podcast.
Irvin Heard:
Thank you for having me, sir.
Steven Bowcut:
All Right.
Irvin Heard:
So the introduction was like – I
Steven Bowcut:
Know, you’re thinking, who is that guy?
Irvin Heard:
Wow.
Steven Bowcut:
It’s amazing what PR people can do for us, make us look. But you do have a really interesting and broad range of experience, and that’s why I was really so excited to have you on the show today, because I think a lot of our audience will look at your experience and your background and say, “That is pretty cool. I want to do some of that stuff.” So hopefully they’ll pay close attention to what you tell us today.
Irvin Heard:
That’s awesome. Thank you.
Steven Bowcut:
So in fact, what we like to do on the show, we like to start with a little more in-depth background about our guests. We typically just start with that. So let’s get you to tell us a little bit about your professional and academic journey. So what led from one thing to another and why you made the decisions that you made to get to the point that you’re at today.
Irvin Heard:
Okay. Well, before we get to that, we got to talk about how it all got started then from the beginning. All right. So as a child, I actually grew up pretty poor. So things like your puzzles, your mysteries, things like that always kept me very, very curious. So we couldn’t afford to spend the money on puzzles. So what I would do is I would get my dad’s toolbox and I would take things apart.
So I would take apart the VCR and I would put them back together. So then I got curious of like, okay, what made these gears turn in the VCR? So my Aunt Kim, she got me a programming book called Java. So we didn’t have a computer back then, but I read the book. I begged my mother to get us a computer. She got us, it was an ACER computer with AOL on it.
So that’s how I started to learn how to program. So we fast-forward to when I joined the Marine Corps for the ASVAB test, I scored very, very low on that. Yeah. But if you didn’t know, for the ASVAB, there’s several different categories for the test. So there’s one category called EL. So the EL, that stands for electronic learning.
And I scored extremely high. So I had no idea that I scored very high for that one. So my first duty station, they called my name, “Hey, Private Heard, we’re going to send you over here to learn Python.” All right. Yeah. So I already knew Jabba already, but –
Steven Bowcut:
Nice.
Irvin Heard:
Python was something new. All right. So what the military had me do was I was programming these little black boxes for the MPs that they would put the black boxes in these government vehicles. So during a traffic accident, they can pull the data if they had their seatbelts on, if there was speeding.
Steven Bowcut:
Oh, okay.
Irvin Heard:
Yeah,
Steven Bowcut:
Kind of like the black box in an airplane.
Irvin Heard:
Right. All right. So then we fast-forward and I became a federal police officer. All right, so this was the time when Apple had put the iCloud lock on the phones. All right. So say for example that you were trying to get into an iPhone and it would time out. So you can try again after 15 minutes. You get it wrong again.
Try again after two weeks, four months. So this particular phone, there’s some information in there that I needed for my court case. We couldn’t get in it. So I think I spent about maybe two months trying to figure out a way to get inside of this phone.
So I figured it out. Maybe I shouldn’t say this on your podcast, but I figured it out, and then I wrote a blog about it. So I got some letters, some stop letters, and then I got some other letters from other organizations that were trying to hire me.
And then I started training the sheriff’s department, local city police departments of how I got past it. I actually NIST saw it, and then they recruited me, and then they put me on their applied cybersecurity team. And if you Google my name, and if you put OSX after my name, there’s a NIST publication. Basically what they did was the vulnerabilities that I found, they made it into a publication.
Steven Bowcut:
Okay.
Irvin Heard:
Right. And I made a patch off of it. So from that. Oh, yeah. So while at NIST, I did a lot of different projects at NIST. I also met this guy named Vincent Surf. So Vincent Surf is the godfather of the internet. And I was on some of his teams too. Yeah, very cool.
While at NIST, they used to have me go to these middle schools and I guess a presentation of programming languages and stuff like that. So that’s when I fell in love with teaching. Yeah. So I’ve never sought out to be a teacher. It just happened. Yeah.
Steven Bowcut:
So if I’m getting this story right, this is fascinating to me. So literally your whole career was just, well, really it was built on the fact that you’re just very curious as a child. Very curious, yes. And bold enough to just start taking stuff apart whether dad liked it or not.
And hopefully you’ll be able to put most of those things back together. But the big break came with this Apple phone thing, right? That were able to identify a vulnerability and it kind of spiraled from there.
Irvin Heard:
Yes, that’s what started. So I would tell all my students to put your name out there. If I had a monthly blog, they would never found me.
Steven Bowcut:
Right.
Irvin Heard:
Right. Yeah.
Steven Bowcut:
That is so cool. I love that. All right, so you get an interest in teaching, and that’s what you’re doing today. So it would be interesting to get your perspective on all these experiences we’ve talked about, all the things that led up to where you’re at today.
How do those different experiences shape the way you teach or how you mentor students? And maybe you’ve just talked about part of it is you tell your students, look, be curious, be a little bit bold, push the envelope a little bit.
Irvin Heard:
Right. So my viewpoint on teaching, it changes us a little bit. Okay. All right. This is how I see things. And I’m a realist, so I see things as they are. All right. Okay. In the industry now, well, let me take it a step back. So most universities, when you log into your Blackboard or to your Canvas or to your Moodle, it’s pretty much going to be set up like this.
Research papers and maybe a discussion board, PowerPoint presentations, things like that. All right. Now, when you’re looking for a job, they can care less of how well you can do a research paper, you can do a PowerPoint.
They want to know, can you actually do the work? So they want to know, can you put your hands on the keyboard? Can you do it? So for my classes and also for the University of the Cumberlands, we teach the practical aspect of it.
We train our students to be ready for the workforce. That’s how we teach them. So once you graduate, we know for a fact that on your first day, you can do a penetration test that you’re actually ready to work.
Steven Bowcut:
I love that. So not only do you know some stuff, you can actually do some stuff.
Irvin Heard:
Right, right. You can actually do it on day one at the job.
Steven Bowcut:
All right. Let me back up or take a little broader view here. So for students or the families of students and they’re thinking about getting into cybersecurity and they’re really not that familiar with the University of Cumberlands, can you give us a broad overview of the cybersecurity information security education opportunities that are available at that school?
Irvin Heard:
Yes. All right. Well, I primarily teach the PhD courses, but I have been with the university for, I think, 8 years, 9 years, 10 years. I don’t know. Yeah, it’s been a long time. All right.
But for the undergraduate courses, so the study areas are programming, systems, networks, data science, and security. So for the students, I mean, there’s a big range there.
For the master’s is cyber engineering, secure systems. I’m trying to think what else. For the PhD, there’s 8 focus areas. It’s AI, blockchain, computer science, cyber engineering, data science, forensics, and security, and just your basic IT.
So there’s so many concentrations and there’s so many focus areas. If you can’t find what you’re looking for at the Cumberlands, I don’t know what to tell you. Yeah, so there’s –
Steven Bowcut:
I believe that that’s true. I mean, it sounds to me like you could walk in the door as a freshman, stay at the University of the Cumberlands, and come out the other side with a PhD.
Irvin Heard:
Right, right.
Steven Bowcut:
So that is totally awesome. Another thing that I talked about in the top of the show here during the introduction part is this National Center for Academic Excellence in Cyber Defense Designation.
So for some people, they may not know exactly why that’s important. So what does that designation tell people? What does it mean about the quality of the instruction, the faculty expertise, hands-on preparation? What does it mean?
Irvin Heard:
Okay. Well, excuse me. For the average person, they may not know that actually NIST is a partner with this as well too. You know that? All right.
Now, so the second point is that basically what this mean is that the Cumberlands, they have not a promise, but it’s their mission to make sure that the students, that they’re ready for the workforce once they graduate.
That’s our purpose, that’s our mission. So with that mission, every course is. How can I say this? For the undergraduate students, just about actually every course is either tied to a certification or it is prepared to a certification. And for the master’s students, it’s the same thing as well too.
And for the PhD students, some of the courses are, just not all of them. But when they graduate, our mission is to make sure that for the industry side of things, that we can meet that demand for the industry.
Steven Bowcut:
Yeah. And for any of our audience, if it may not be obvious to them why that’s important. So when you go talk to a hiring manager, when you go on a job board and you look for jobs, they’re going to say, “You need to have this certification and that certification and that certification.” And there’s a couple of ways you can get those certifications.
You can go take special classes, different classes that will teach you those things, but if it’s already built into the curriculum that you got your undergraduate degree or your master’s degree or even your PhD, you’re that much further ahead. Right.?
Irvin Heard:
Right.
Steven Bowcut:
Yeah. And then additionally, I would assume, particularly in government or DOD jobs, this National Center for Academic Excellence with Cyber Defense, that carries some weight. They look for people that have gone to a school that has that designation. Is that true?
Irvin Heard:
Yes, sir.
Steven Bowcut:
Okay. And that’s my understanding as well. So it is a big deal. It’s something that the students and their families need to understand why it’s important. So let’s retract a little bit. So here at the undergraduate level, Cumberlands offers a Bachelor of Science in Information Technology with a cybersecurity concentration.
If we were to pick your average student who does well and succeeds in that program, what kind of a student is a good fit for that pathway? Do they need to be a technical student or not so much? Are there any characteristics about someone who is successful in that program that you can identify?
Irvin Heard:
For the cyber, which one?
Steven Bowcut:
This is the Bachelor of Science and Information Technology with the concentration, a cybersecurity concentration.
Irvin Heard:
Oh, okay. For the cybersecurity concentration, this is what I look for. Well, how can I say this one? All right, so there’s two ways that I can answer that question.
Steven Bowcut:
Okay.
Irvin Heard:
All right. Any student that has a curious mind that’s passionate about it, we take any student. All right. But what truly, truly stands out, these are things that I look for. All right, so this is my personal viewpoint, and I’m not speaking for the university, this is just Dr. Heard’s viewpoint. All right, so for cybersecurity, the best students are a student who’s already doing it already.
So for example, if you’re already tinkering with actually Linux on your own, that’s the best student because they already have an interest in it already. They’re already doing it. So that student, they already have some type of eyes about the field. Real good in chess or if you like to play chess. So cybersecurity. Yes.
Steven Bowcut:
That’s interesting. So that ability to think multidimensional and strategize, that kind of thing is important. Okay.
Irvin Heard:
Good. So at the highest level of cybersecurity, it’s just like a game of chess. The person who can outsmart the other person, that’s who wins. Okay.
Steven Bowcut:
Yeah. So for instance, I’m just going to put myself in the shoes of a student who’s thinking about getting into cybersecurity and maybe they have the opportunity to go to the University of the Cumberlands, but maybe they don’t know any programming languages yet.
I mean, would that preclude them or is it more of the interest in what they want, not what they’ve done? So if they have that interest and that curiosity, they may not have taken apart their dad’s VCR. Of course, these kids today, they don’t even know what a VCR is. So they may not have an instance of Ubuntu on their computer at home, but they have an interest in those things. Is that true?
Irvin Heard:
Right. So this puts other things too, but it’s a person that they are. They may like actually puzzles, solving mysteries or something like that. But just basically just to drive challenges, if you’re just curious about it, that’s what started me. Yeah, just to
Steven Bowcut:
Trigger this. Yeah, that is so interesting. I love that perspective. Those are the qualities or the characteristics. They may or may not be good qualities, but they’re characteristics of someone. If they can’t put the VCR back together, the parents may not think that’s a good characteristic. Or a good quality, but it’s a good characteristic. All right.
So one of the things that we talked about is that there are a couple of master’s degrees at the graduate level. So there’s a master’s degree of science and information systems and security, and then there’s also the MSIS. I guess what I’m looking for is maybe some clarification of what’s the difference between those two master’s degree? Why would a student pick one over the other? Obviously, there’s a big enough difference that you offer both the different degrees.
Irvin Heard:
Yes. To keep it simple, the MSISS, put cybersecurity first and then compliance. And then for the second one, the MSCE, you put cybersecurity first and software engineering. So yes, so they both –
Steven Bowcut:
So they’re both cybersecurity centric, but one is more compliance.
Irvin Heard:
Compliance is the first one. Yes, engineering.
Steven Bowcut:
And then engineering is the other one. Okay.
Irvin Heard:
All right. So let’s talk about the first one. So the one that has compliance with it. All right.
So with the information systems security, you can expect to have risk, governance, incident, response, disaster recovery, information insurance, things like that. Okay.
Steven Bowcut:
So if you’re a student and you like cybersecurity, but you’re interested in those things, and those might tend towards management, leadership roles, that kind of thing, right? Then that might be a better solution. Okay.
Irvin Heard:
Right. And then for the engineering one, all right, now this one is more technical, but it’s the design of a secure system. All right. Yeah. So you still have a network, but you want to be building the network from the ground up. So the reason that we have this one right here is because of history. All right.
Yeah, so let’s talk about the history part first. All right. The reason that we even have cybersecurity is because the software engineers, when they’re building programs, they don’t never put security first. So that’s why we have the problems that we have right now. So this program here is building programs with security first that’s in mind with the emphasis on cybersecurity.
Steven Bowcut:
Perfect. Yeah, I love that. And there is a real need for that in our industry. As you’ve said, historically, we’ve not been done well. We kind of bolted on security later as an afterthought. It needs to be baked in and built when the.
So if I could summarize that, so the Master of Science and Information Systems and Security, if you’re the kind of person who’s attracted to governance compliance management, that might be a good solution. But the Master of Science in cyber engineering would be a better solution if you like to build stuff. You actually want to build systems and programs of those kinds of things. Is that fair?
Irvin Heard:
Yes, sir.
Steven Bowcut:
All right. That is excellent. I think that’s a great explanation of the two different master’s degrees and why someone would pick one over the other. Well, let’s see. So this is an interesting question, and I hope it’ll be interesting to you. I think it will because it’s kind of in your wheelhouse here.
So you offer a graduate certificate in digital forensics, and so that’s an area that connects very closely with your own expertise and background. So what should students understand about digital forensics as a career path? Tell us what that’s even about. So if I’m a student, I’m thinking, well, what exactly is digital forensics? You’re an expert in that area, so tell us what it is.
Irvin Heard:
Okay. That’s my first job actually. Okay. So the difference between digital forensics and cybersecurity, it’s the before and after. Forensics is when you’re gathering evidence of the attack. Yeah.
Steven Bowcut:
Okay. Rather than being a defender, you’re not stopping the attack, right? You come in after the attacks. Okay. Right. Let’s see what happened here.
Irvin Heard:
Right. Yeah. After the attack, gathering evidence, copying files. You’re trying to figure out what did they steal? Where did they go? Things like that. So it’s like an after actions report.
Steven Bowcut:
Oh, see, this makes sense to me now because at the beginning of the show, you said something about one of the important characteristics of students would be they like to solve mysteries. Yes. That’s exactly what this is, right?
Irvin Heard:
Yes, exactly
Steven Bowcut:
What it is. Am I getting that right? They come in, you solve the mystery. What happens? Solve the
Irvin Heard:
Mystery. Right.
Steven Bowcut:
Yeah, very cool.
Irvin Heard:
Right. So this is really cool too though. Yeah. So this is where you start to see how the pieces fit together. So when you do the forensics, it’s kind of like highways. It’s like a feed of information.
It’s just going everywhere. So it’s like you get to see how everything just comes together. Once you start there, it’s going to branch you out into cybersecurity, engineering, all right, programming languages. Yeah, once
Steven Bowcut:
You start. Yeah, I hadn’t really though about that. So in forensics, you’re going to need to know a lot about everything, maybe even more so than. A little about a lot of things rather than maybe a lot about one thing, because you got to be able to see the big picture and know where to look for clues.
Irvin Heard:
Build for clues. Right.
Steven Bowcut:
Oh, that’s an interesting way to put it. That makes sense.
Irvin Heard:
Dr. Sherlock Holmes. Right.
Steven Bowcut:
Yeah, exactly. I could see why that’d be something you’d be attracted to. That would be fun. All right, so Dr. Heard, we’re about out of time, but I’d like to finish with an advice kind of a question. I think that’s helpful for our audience.
So what advice can you give our audience? And if you want to picture our audience, they’re typically students that are just getting into cybersecurity or still even trying to decide whether cybersecurity is the right field for them.
Or maybe they’ve been working in a SOC or something and they want to build their career, so they want to know what kind of education they need to build their career.
But what kind of advice would you give them about building technical skills, gaining confidence using the competitions and the cyber clubs? We didn’t talk much about that. How important are those things and choosing the right educal path?
What advice would you give them to help them choose the right educational pathway?
Irvin Heard:
To help them choose the right educational pathway?
Steven Bowcut:
Yeah.
Irvin Heard:
I always think about the future. So what do we have right now? What field that’s coming that we know that’s going to be around for a really long time?
Steven Bowcut:
Okay.
Irvin Heard:
Right. What is that? That’s AI.
Steven Bowcut:
That’s AI.
Irvin Heard:
That’s AI. All right. So we also keep hearing about this, the methods and these AI models now. As you’re breaking into different networks and things like that. We just heard about what? Anthropic, they have a AI model that can break into a network in less than what, 10 seconds.
So that also falls into cybersecurity. So at some point, cybersecurity is probably going to be right along up there with the AI. So it’s about to merge. Yeah. So cybersecurity and AI, they’re about to be parallel with each other.
Steven Bowcut:
So I guess maybe one way to look at that is because AI can give the threat actors a big advantage because they can act so quickly and they don’t even know how to code. They don’t even have to know how to code. Any script kitty can write a prompt and do things that they couldn’t do before AI. So for the defenders, that means now that you’ve got to be able to use AI as well. As well. You can’t do it fast enough, right?
Irvin Heard:
Right.
Steven Bowcut:
So you need to learn how to use AI as a defender.
Irvin Heard:
With cybersecurity.
Steven Bowcut:
But on the forensic side, I suppose you also need to understand AI well enough to dive in there and see what it is that the AI did to get into your system.
Irvin Heard:
Right. So there’s about to be this push and pull, this yin and yang thing going on. So getting into cybersecurity, that’s going to be a guaranteed job as long as we have AI and it’s not going anywhere. All right. Now for the students, just do not always depend on actually AI. Try to learn some manual skills too, like Kali Linux and also Python.
So the NSA Code Breakers, that’s a really cool challenge that you can jump into. I I think there’s seven levels to it. Sometimes they do hire from these challenges, groups. So outside of IT, if you choose to go into this field or not, just always go with your passion. So it doesn’t matter what it is, just go with your passion and then just be the best at whatever you do, the money will –
Steven Bowcut:
Go with something you love to do. I love that advice because people like me who have spent lots of decades here on earth in my life, I’ve learned that one thing. You got to do what you love to do. If it’s not cybersecurity, then yeah, don’t let somebody talk you in a good native cybersecurity.
You got to do something, so do something that you love. Don’t necessarily just chase the job that’s going to pay you the biggest money, although there’s p plenty of good money to be made in cybersecurity. It’s a good paying field, but if you don’t love it, you won’t be happy. So that is great advice. I appreciate that.
All right, so we’re out of time. Dr. Heard, thank you so much for joining us and helping our listeners understand the cybersecurity educational opportunities that are available to them if they are fortunate enough, be able to go to the University of the Cumberlands.
Irvin Heard:
All right, thank you so much, sir. Thank You
Steven Bowcut:
All right. For our listeners, if you’d like to learn more about the University of the Cumberlands, School of Computer and Information Sciences and its cybersecurity programs, please visit the university’s website at ucumberlands.edu.
You can also find additional information about cybersecurity degrees, certifications, scholarship, careers, and educational pathways at cybersecurityguide.org.
Thank you for listening to the Cybersecurity Guide podcast. And until next time, stay informed, stay prepared, and keep building the skills needed to protect our increasingly connected world.