Finding Leverage: A Consultant's Journey to AI Security

‍Michael Jacob went from National Security Agency (NSA) counterproliferation analyst to McKinsey consultant to AI security researcher at RAND—all in pursuit of leverage. He spoke with us about finding high-impact work, why malaria interventions captivated him, and how consulting skills translate to high-stakes policy work.

You had an unusual journey into McKinsey, starting at the Department of Defense. Why McKinsey, and what drew you to that path?

I started my career at NSA doing counterproliferation intelligence. I enjoyed it and felt it was impactful—preventing the spread of nuclear weapons is valuable! But I got interested in making broader organizational change in the intelligence community. 

The problem with the federal government is that it takes time. Whenever I brought up ideas for improvement, people said that it would take 15-20 years before I'd be in a position to influence things. That was hard to hear as someone young and ambitious. Even though it's probably the truth and there are benefits to that experience, it made me consider where else I could have an impact and actually change organizations. That's what drew me to McKinsey.

You mentioned consulting as an alternative to an MBA. Is that how you saw it?

I thought instead of getting an MBA, I could get practical experience in a consulting firm. I got exposed to low and high performing companies, saw what works and what doesn't, and carried that with me. I had already completed my master's in international affairs and international economics, but I wanted to learn how the private sector operated.

How did you find your way back to public service?

I knew that even when leaving consulting, I wanted to eventually come back to the D.C. area and do impactful public sector work. It was through exposure to organizations like yours and 80,000 Hours that helped me think through how to have an impactful career and apply my skills to other causes. 

Originally, I was interested in public health. Some of the work I did with Civis Analytics was as a consultant to the President's Malaria Initiative. Third-party evaluators like GiveWell recommend malaria interventions as high impact because you can do so much relatively cheaply. I was able to bring consulting and data science skills to help deliver antimalarials and bed nets to the right places at the right time—using data science to anticipate where needs will be. Small improvements in these calculations and operations can pay dividends because of the public health benefit.

Do you think other McKinsey folks have any idea how many lives they could save if they applied their process improvement methodologies elsewhere?

I don't think many have thought about it explicitly. They're coming from the business world with a clear idea of their value—increasing share price, improving the efficiency of business operations. There’s also less knowledge about thinking about cost-effectiveness in public health interventions or public services. There are interesting skills and process improvements that could help these organizations. That's a good message. Organizational improvements can deliver shareholder value, but they can also deliver real impact on the ground.

Speaking of organizational improvements, if we fast forward, you're back in security, thinking about AI. Why the shift?

Over the last few years, I've come to believe that AI is going to be transformative for good or bad, and making sure AI policy goes well is something I've become passionate about. It's a high leverage opportunity—small things we do to get AI right could have huge multiplier effects on the economy, public health interventions, bio-economy, and more. My niche is AI security: preventing anyone from stealing model weights from frontier model companies. Making sure non-state or state actors don't misuse them. It's a small niche within broader AI policy, but it could use additional thinking.

Do you have any advice for someone just getting their feet wet in AI policy?

Even with all the thinking and debate, there's still uncertainty about what the government can do and where the right spot for government policy is. As the government builds institutions that deal with AI, like the Center for AI Standards and Innovation (CAISI), figuring out how those organizations can operate better and collaborate with the private sector is important. Most AI innovation comes from private sector companies. So, figuring out where the government can help without slowing things down is where there's still thinking to be done. That's probably more of an opportunity for generalists than hardcore machine learning work. Generalists can contribute more to thinking about how to make the government work with AI in a way that's productive for all industries.

We know that uncertainty can be paralyzing. What would you say to someone on the fence about whether they should get involved in the first place?

Honestly, I'm not sure how I feel day-to-day sometimes. The public health work has a much more certain impact—I'm confident those actions are net positive and actually help people on the ground. A lot of AI policy is more uncertain. It depends on whether AI is transformative and whether our policy interventions are correct. Being willing to think about whether you want to take bets on possibly high-impact work that may not pay off is important. The probability that my particular work will be impactful on AI policy is probably pretty small. But if it goes well and we influence policy in the right direction, it could have a high impact. You have to consider whether you want to take those big bets. It's perfectly respectable and rational to take more evidence-based approaches and focus on interventions like public health that are more proven and definitively improving welfare right now, as opposed to AI policy, which is inherently more speculative.

That framing of evidence-based is interesting, because it used to be the golden watchword for high-impact careers. But a lot of security work is preventative, where you're hoping not to have a track record of issues. Can you talk about your mindset towards your own career moving forward, even if that's uncertain?

I'm always trying to find high-leverage opportunities and where I can build high-performing teams—that's something I learned from consulting. I worked in the recovery and transformation practice a lot, with firms that weren't doing well or were near bankruptcy. I saw how bad culture can be detrimental and what good culture looks like. So I'm trying to find and join organizations where I can have high leverage and work with motivated people who can build a good culture and have a magnified impact. It's not just me working in a vacuum—it's working with a large group that's excited and motivated. That's my goal when thinking about next career steps.

Could you tell us a story about something you learned in McKinsey that you still use?

I learned early that driving impact isn't about having all the answers—it's about connecting the right people to the problem. On a project reducing software costs, something I knew little about, I had to find the experts both inside the firm and at the client, then help them communicate effectively to executives.

As a generalist, I rarely have the deepest expertise on any topic. Instead, I identify the people who do and help them present their ideas persuasively to decision makers. In 12-week McKinsey studies, you can't learn everything—you just get up to speed enough to ask the right questions. That skill has proven valuable throughout my career.

What was the hardest part of consulting for you?

I learned that we're not working for the client company—we're working for the executive teams, and the incentives don't always align. Sometimes you're working on shorter-term things like making sure the share price hits targets through financial engineering, as opposed to creating long-term value. That was challenging. 

More mundanely, starting work in a completely new industry every time is exciting but challenging. You don't know where to start when you hit the ground and are expected to have an answer on the first day. I did telecom, retail, and intelligence community work—it's hard to get up to speed quickly, but it was a good skill to learn.

That seems like an especially good skill with the madhouse of AI and changing administrations, offices, and new titles.

We have to communicate the same principles to the Biden administration and the Trump administration, but the way they're communicated, the arguments, and how we frame policy are very different. 

Any last words of wisdom to your younger self just starting at McKinsey?

Don't be afraid to find teams where you're not the person who knows everything - you can learn from others who are smarter than you. The best opportunities for impact come from working with motivated people who can have magnified effects together.