Speaker 1: Hey, everyone, welcome back for another deep dive.
Speaker 2: Yes, welcome back.
Speaker 1: This time we're digging into tribe of hackers security leaders.
Speaker 1: Oooh yes, you know, I think everyone kind of gets
Speaker 1: by on the technical skills, but like actually leaving a team, yeah,
Speaker 1: and you know, making the tough calls.
Speaker 2: It's a different beast.
Speaker 1: Yeah.
Speaker 2: In this cybersecurity world is like a whole other.
Speaker 1: Absolutely, a whole other level.
Speaker 2: Yeah.
Speaker 1: And what I think is so interesting about this book
Speaker 1: in particular is that, you know, it's not just a
Speaker 1: technical how to manual r you know, it's really a
Speaker 1: collection of interviews with a whole bunch of different cybersecurity
Speaker 1: leaders and they share their strategic thinking and their war stories,
Speaker 1: you know, kind of their lessons learned along the way.
Speaker 2: I love it because it's like we're getting a peak
Speaker 2: behind the curtain exactly to see how their minds work. Yes,
Speaker 2: and you know, it makes this deep dive so valuable.
Speaker 2: And it's not just theory. It's like real world oil
Speaker 2: world wisdom from these people who've been in the trench,
Speaker 2: been they've done that exactly. So let's jump into that
Speaker 2: first big takeaway that really stood out to me. This
Speaker 2: idea of the evolving cybersecurity landscape. I mean, we hear
Speaker 2: all the time about how things are changing so rapidly constantly,
Speaker 2: but what does that mean, Like, what does that actually
Speaker 2: mean for security leaders?
Speaker 1: Yeah, it's a great question. And you know, one of
Speaker 1: the most thought provoking ideas I think comes from James Arln,
Speaker 1: who leads salesforce for Roku's production engineering team. Okay, and
Speaker 1: he argues that cybersecurity should be everybody's responsibility, okay, woven
Speaker 1: into every role, not just siloed within the security team.
Speaker 2: Yeah. That's a big shift from how most companies operate today.
Speaker 1: Huge And he even compares it to this idea of
Speaker 1: a chief electrification officer, which you know, that role essentially
Speaker 1: disappeared as electricity became commonplace. He's asking like, is cybersecurity
Speaker 1: headed in the same direction.
Speaker 2: So he's saying, like, could we get to a point
Speaker 2: where you don't need a specialist.
Speaker 1: Potentially yeah, to like, you know, handle every single security issue.
Speaker 2: Imagine if you didn't need, you know, a specialized electrician
Speaker 2: to change a light bulb. Could we reach a point
Speaker 2: where you don't need a dedicated team yeah, to handle
Speaker 2: every security issue.
Speaker 1: It's a really compelling idea. But it's also a little daunting, Yeah,
Speaker 1: a little bit like how do you even implement that?
Speaker 1: Like distributed responsibility?
Speaker 2: Well, and he suggests that this model could lead to
Speaker 2: greater accountability. Okay, if everyone has skin in the game,
Speaker 2: so to speak, when it comes to security, then they're
Speaker 2: more likely to take it seriously.
Speaker 1: Right, But it also means like a huge cultural shift.
Speaker 1: Oh absolutely, because right now most companies have these dedicated
Speaker 1: security teams. Would those just become obsolete.
Speaker 2: You know, not necessarily obsolete, but their roles might evolve. Okay,
Speaker 2: they could become more focused on oversight and compliance, ensuring
Speaker 2: that everyone's meeting their security responsibilities right, rather than handling
Speaker 2: all the technical tasks themselves.
Speaker 1: So it's almost like they become a coach instead of
Speaker 1: a player.
Speaker 2: Yeah. Think of it as a coach who empowers their
Speaker 2: team to succeed, rather than a player who does everything themselves.
Speaker 1: Right. It's empowering every single person to be a security advocate,
Speaker 1: absolutely relying on just this small group.
Speaker 2: Yeah, and this actually brings up another challenge that these
Speaker 2: leaders discuss, this idea of decision making under pressure. You know,
Speaker 2: you're constantly facing these high stake situations where you need
Speaker 2: to balance risk and business needs in human factors. So
Speaker 2: how do they approach that?
Speaker 1: Yeah, any practical advice we can get from their experience.
Speaker 2: There's some really great advice, and you can apply this
Speaker 2: to your own work. Andrew Bagrin, the founder of omninet.
Speaker 2: He gives you a framework for making those tough calls,
Speaker 2: but the business and your team's needs first, especially when
Speaker 2: it comes to personnel decisions.
Speaker 1: So that's interesting because it's saying, sometimes the technically right
Speaker 1: answer yeah, might not be the best for the organize.
Speaker 2: It might not be or even the people. Exactly. And
Speaker 2: you know Christopher Caruso who has extensive experience in both
Speaker 2: IT and OT cybersecurity. Now, what's ot OT is operational
Speaker 2: technology and it refers to the systems that control physical processes. Okay,
Speaker 2: so he adds another crucial element, understanding your audience.
Speaker 1: So it's not just about being right, it's about being persuasive.
Speaker 2: Yes, exactly. So when you're presenting security recommendations to leadership,
Speaker 2: you need to be factual, confident, and most importantly, understand
Speaker 2: the board's perspective.
Speaker 1: Okay, So you're saying, like you've got align your recommendations
Speaker 1: online with their priorities that makes a lot of sense,
Speaker 1: but it's not always black and white. Sometimes you have
Speaker 1: to make these judgment calls where there's no easy answer.
Speaker 2: Absolutely, and another leader, Rafel Loss Okay, talks about this
Speaker 2: delicate balance between data driven analysis and gut feeling.
Speaker 1: So you're saying, it's not just the hold hard data,
Speaker 1: not just the data, it's also like trusting your instincts.
Speaker 2: Yes, he emphasizes combining data with your intuition.
Speaker 1: Okay, and your passion. That makes sense because cybersecurity you're
Speaker 1: always dealing with the unknown you are and making decisions
Speaker 1: when you're not really sure what's going to happen next.
Speaker 1: So you've got this framework for decision making, but then
Speaker 1: you need.
Speaker 2: The right team absolutely.
Speaker 1: To help you execute those decisions for sure. What insights
Speaker 1: does the book offer on building and leading these high
Speaker 1: performing security teams.
Speaker 2: There's a lot of great advice, but Leslie Carhart, principal
Speaker 2: threat analyst at Dragos, really hit the nail on the
Speaker 2: head with her emphasis on team well being. She says
Speaker 2: that good leaders shield their teams from negativity and create
Speaker 2: a supportive environment where everyone can thrive.
Speaker 1: You know, that's so important, especially in cybersecurity, because burnout
Speaker 1: is such a real issue. It is how do you
Speaker 1: actually do that? How do you create this positive environment
Speaker 1: without ignoring the real concerns.
Speaker 2: It's a tough one. It is a delicate balance. You
Speaker 2: don't want to create this culture of toxic positivity where
Speaker 2: people are afraid to speak up, but at the same time,
Speaker 2: you don't want to overwhelm your team with negativity. It's
Speaker 2: about finding that balance, acknowledging the challenges but also focusing
Speaker 2: on the solutions and celebrating the successes.
Speaker 1: So it's that psychological safety where people feel like they
Speaker 1: can speak up exactly without being you know, or shut
Speaker 1: down exactly.
Speaker 2: Yeah. And there's another leader, David Evenden, founder of Standard
Speaker 2: User Cybersecurity okay, and he talks about evolving from a
Speaker 2: more assertive leadership style okay, to a more empathetic approach okay,
Speaker 2: really focused on teen growth and satting clear expectations.
Speaker 1: So it's about adapting, adapting your leadership style to fit
Speaker 1: the needs of your team and this ever changing security landscape.
Speaker 2: So not being stuck in your waist right.
Speaker 1: Not just doing it because that's how you've always done it.
Speaker 1: And Charles Mowatu, an engineering manager at Netflix, adds that
Speaker 1: transparency and vulnerability and creating a supportive environment for growth
Speaker 1: are really crucial for building that trust for sure, and
Speaker 1: empowering your team.
Speaker 2: Absolutely. I love that he emphasizes vulnerability. Yeah, it's so
Speaker 2: important for leaders to show that they're human too, and
Speaker 2: that they're not afraid to ask for help or admit
Speaker 2: when they don't have all the answers.
Speaker 1: Right. It creates a culture where everyone feels safe to
Speaker 1: take risks and learn from mistakes.
Speaker 2: Absolutely, And speaking of learning, the book also delves into
Speaker 2: the cybersecurity skills gap. Oh yeah, which is a huge topic.
Speaker 1: Yeah, that's a big one. It is what concrete solutions
Speaker 1: did these leaders offer.
Speaker 2: There's a little bit of debate, okay about the nature
Speaker 2: of the gap.
Speaker 1: Okay.
Speaker 2: Andrew Bagrin argues that there's no shortage of you and
Speaker 2: your talent, but a lack of experience senior professionals.
Speaker 1: So it's not just about getting people in. Not just
Speaker 1: getting them in, it's about helping them move up.
Speaker 2: Helping them get to that senior level.
Speaker 1: Yeah, and that seems to be a common theme, is
Speaker 1: that development and mentorship are really key to addressing this.
Speaker 2: Absolutely. Steve Christy Coley principal INFOSEC engineer at my tr Okay,
Speaker 2: he stresses the need for the industry to invest in
Speaker 2: training okay, and support for less experienced individuals, basically saying,
Speaker 2: we can't just expect these season pros to magically appear.
Speaker 2: We need to create opportunities for mentorship, training, and career advancement.
Speaker 1: You Know, it's interesting because sometimes these job descriptions for
Speaker 1: cybersecurity roles want people to be unicorns, they do. They
Speaker 1: want them to have all this experiences of experience in
Speaker 1: every single technology.
Speaker 2: Right, and that's something that Steven A. Ridley, a cybersecurity
Speaker 2: consultant Okay, he criticizes this.
Speaker 1: Okay.
Speaker 2: He highlights the importance of giving young professionals a chance
Speaker 2: and challenging those unrealistic expectations and requirements often found in
Speaker 2: those job.
Speaker 1: Descriptions because it can be really discouraging, I bet very
Speaker 1: discouraging for someone new.
Speaker 2: Yes, so there needs to be a mindset shift, Okay,
Speaker 2: not just focusing on years of experience, but looking at
Speaker 2: potential and aptitude.
Speaker 1: So focusing on those qualities and recognizing that raw talent
Speaker 1: can be nurtured.
Speaker 2: Absolutely, and they also emphasize the importance of providing opportunities
Speaker 2: for mentorship where experience professionals can guide and support those
Speaker 2: who are just starting out.
Speaker 1: Mentorship is so crucial, it is. It's passing on knowledge,
Speaker 1: building confidence, creating a sense of community.
Speaker 2: Absolutely, But it's not just about developing individual skills. There's
Speaker 2: also a strong emphasis on collaboration and communication.
Speaker 1: Because cybersecurity can't operate in a silo, no, it can't.
Speaker 1: Leaders need to break down these barriers, build relationships with
Speaker 1: other teams, from executives to developers.
Speaker 2: Absolutely, and that starts with communication.
Speaker 1: So how do they suggest we go about building these bridges?
Speaker 2: You know? Edward Prevostky, staff security engineer at Squarespace, has
Speaker 2: a great reframing. He suggests that infosec should transition from
Speaker 2: a no team oh to a collaborative partner.
Speaker 1: So instead of shutting down ideas, security teams should be
Speaker 1: offering solutions, offering solutions, working together, working together to achieve
Speaker 1: those shared goals exactly.
Speaker 2: He talks about clearly defining risk, appetite and offering options
Speaker 2: rather than just saying no outright.
Speaker 1: That's so important. It is because if security is seen
Speaker 1: as a roadblock, people are going to find ways to
Speaker 1: go around it. They will, but if they see it
Speaker 1: as a partner, then they can work together.
Speaker 2: To find secure solutions.
Speaker 1: But that requires a high level of communication and trust.
Speaker 2: It does, absolutely, and Christopher Adneck, founder of Social engine
Speaker 2: Near LLC, really hits on this point. He emphasizes transparency,
Speaker 2: frequent communication, and creating a culture of trust okay. He
Speaker 2: believes that when everyone's on the same page right and
Speaker 2: feels comfortable sharing information, that's when it's easiest to identify
Speaker 2: right and address security risks.
Speaker 1: So it's building those relationships, creating that environment where people
Speaker 1: feel safe speaking up exactly.
Speaker 2: And Charles Watu, who we mentioned earlier, adds that top
Speaker 2: down security awareness okay, embedded in the company culture is essential.
Speaker 2: He also stresses the importance of building relationships with engineering
Speaker 2: teams working collaboratively to integrate security into the development process.
Speaker 1: It makes sense when you put it that way.
Speaker 2: It does.
Speaker 1: Security is just an afterthought. It's always going to be
Speaker 1: playing catch up, absolutely, but if it's baked into the
Speaker 1: culture from the top down, it becomes part of everyone's mindset.
Speaker 2: Exactly.
Speaker 1: So we've covered a lot here, But did these leaders
Speaker 1: offer any reading recommendations?
Speaker 2: Oh? Yeah, they did. For aspiring cybersecurity pros who want
Speaker 2: to level up their leadership skills, Yeah, they did. They
Speaker 2: offered a really diverse range of bucks, catering to different
Speaker 2: leadership styles and interests.
Speaker 1: So like, what kind of stuff? Well?
Speaker 2: Some were business and leadership classics Good to Great by
Speaker 2: Jim Collins. Okay, yeah, what got you here? Won't Get
Speaker 2: You There by Marshall Goldsmith, and The Hard Thing About
Speaker 2: Hard Things by Ben Horowitz.
Speaker 1: Those are all fantastic books. They are with timeless advice
Speaker 1: on building strong teams, making tough decisions, navigating the challenges
Speaker 1: of leadership.
Speaker 2: Yeah, regardless of your industry.
Speaker 1: What about books specifically focused on cybersecurity?
Speaker 2: Of course?
Speaker 1: What did they say?
Speaker 2: Some popular choices were Tribe of Hackers, Naturally, Security Metrics
Speaker 2: Replacing Fear, Uncertainty, and Doubt by Andrew Jackwith, and Applied
Speaker 2: Cryptography by Bruce Schneier.
Speaker 1: Those are must reads for anyone serious about cybersecurity for sure.
Speaker 1: What about books on communication, teamwork, and decision making skills
Speaker 1: that are essential for any good leader?
Speaker 2: They covered those two Team of Teams by General Stanley McCrystal,
Speaker 2: Death by Meeting by Patrick Lincioni, Radical Candor by Kim Scott.
Speaker 1: Wow, that is quite the list, the reading list. This
Speaker 1: could keep me busy for a while. You know, it's
Speaker 1: inspiring to see how these leaders are not just experts
Speaker 1: in their field, but also well rounded individuals. Yes, who
Speaker 1: value continuous learning and personal growth, for sure. But I'm
Speaker 1: also curious what keeps them up at night?
Speaker 2: Oh, good question.
Speaker 1: What are their biggest concerns? Yeah, when it comes to cybersecurity.
Speaker 2: Well, you're right, these leaders are incredibly knowledgeable and passionate. Yeah,
Speaker 2: but they're also realistic about the challenges we face in cybersecurity.
Speaker 1: Yeah.
Speaker 2: One recurring theme is this constantly evolving threat landscape. They're
Speaker 2: keenly aware of new vulnerabilities, sophisticated attack techniques. It's relentless,
Speaker 2: relentless pressure to stay ahead of the bad guys.
Speaker 1: Like these sentinels, always on watch, yes, for the next
Speaker 1: big attack.
Speaker 2: That's a good way to put it. It's a lot
Speaker 2: of responsibility, it is, and that actually ties into another
Speaker 2: major concern they share, the talent shortage we talked about earlier.
Speaker 2: You know, it's a constant struggle to find and keep
Speaker 2: skilled cybersecurity professionals, especially those with experience and leadership potential. Yeah.
Speaker 2: The competition for talent is fierce and it's only getting tougher.
Speaker 1: And then on top of that you add the rapid
Speaker 1: pace of technological change. Absolutely new technologies emerging constantly, which
Speaker 1: brings opportunities, yes, but also new security risks so many
Speaker 1: it's like this never ending game of cat and mouse.
Speaker 2: I like that analogy. Yeah, that's a good way to
Speaker 2: put it. You're constantly trying to secure new systems and
Speaker 2: applications while also dealing with legacy technologies that might be
Speaker 2: riddled with vulnerabilities.
Speaker 1: Yeah, and let's not forget the growing complexity of IT environments.
Speaker 1: As organizations adopt cloud computing, right, mobile devices, the Internet
Speaker 1: of Things, It's expanded tack surface is just.
Speaker 2: It's getting bigger and bigger. It's like trying to build
Speaker 2: a fortress with walls that are constantly shifting and expand
Speaker 2: how do.
Speaker 1: You even begin to defend something like that?
Speaker 2: That is the million dollar question. Yeah, that's the challenge
Speaker 2: these leaders grapple with every day.
Speaker 1: Yeah, and of course you can't forget about the human element,
Speaker 1: the human elament. Even with the best technologies and processes
Speaker 1: in place, human error is.
Speaker 2: Still it's still a major risk.
Speaker 1: Yeah, A single phishing email, or a weak password, or
Speaker 1: just a careless mistake.
Speaker 2: One wrong click can open the door to a devastating attack.
Speaker 1: It's like, you can have all the fancy tools and
Speaker 1: technologies in the world, but ultimately security comes down to people.
Speaker 2: It really does.
Speaker 1: Yeah, leaders understand that.
Speaker 2: They do.
Speaker 1: They worry about the impact of a successful attack on
Speaker 1: their organization's reputation, romance's customer trust.
Speaker 2: It's a heavy burden to carry, it is, for sure.
Speaker 1: So given all of these challenges, the book also asked
Speaker 1: these leaders what they would change about cybersecurity leadership if
Speaker 1: they had a magic.
Speaker 2: Wand a magic wand I love it.
Speaker 1: What did they say?
Speaker 2: What are their big dreams for the future For the
Speaker 2: future of cybersecurity leadership? Well, one common theme was this
Speaker 2: desire for greater alignment between security and business goals. You know,
Speaker 2: they want to move away from security being seen as
Speaker 2: a roadblock and instead be viewed as a strategic partner
Speaker 2: that helps enable business growth and innovation.
Speaker 1: Which makes sense because if it's just seen as a
Speaker 1: cost center or like a compliance burden, it's always going
Speaker 1: to be an uphill battle.
Speaker 2: It is, But if it's viewed as a key enabler
Speaker 2: it becomes a real competitive advantage exactly. Leaders also expressed
Speaker 2: a desire for a more proactive and preventative approach okay
Speaker 2: to cybersecurity.
Speaker 1: So instead of always putting out fires, yes.
Speaker 2: Moving away from that reactive firefighting mentality that's so prevalent
Speaker 2: in the.
Speaker 1: Industry, They want to prevent the fires from starting in.
Speaker 2: The first place, absolutely, and they recognize that this requires
Speaker 2: a different mindset, different skills, different investment. Another wish was
Speaker 2: for greater investment in security awareness and training. They envision
Speaker 2: a world where everyone in the organization, from the CEO
Speaker 2: to the newest intern, understands their role in protecting the organization.
Speaker 1: So creating a culture of security.
Speaker 2: Yes, where it's not just the security team's job, but
Speaker 2: everyone's responsibility.
Speaker 1: To be vigilant absolutely, and to understand.
Speaker 2: The risks yes, and how to mitigate them.
Speaker 1: There is also a strong desire for greater diversity and
Speaker 1: inclusion in the workforce.
Speaker 2: Yes. Many leaders recognize that we need to attract and
Speaker 2: reat talent from a wider range of backgrounds and experiences.
Speaker 1: Diversity of thought is so crucial.
Speaker 2: Yes, especially in cybersecurity, where you're constantly facing new threats,
Speaker 2: new challenges.
Speaker 1: Having those different perspectives can only make you stronger.
Speaker 2: Absolutely. And finally, some leaders expressed a desire for a
Speaker 2: future where cybersecurity is simply baked in to every aspect
Speaker 2: of technology.
Speaker 1: So you're saying like they envision a world where security.
Speaker 2: Is just an integral yeah, of the design and development process.
Speaker 1: Not just an afterthought, but a bold on solution. So
Speaker 1: making security a fundamental principle, yes, that guides every aspect
Speaker 1: of our digital lives, just like.
Speaker 2: Safety is a fundamental principle right in the physical world.
Speaker 1: So these magic wand wishes, Yeah, they really paint a picture,
Speaker 1: they do, of where these leaders see cybersecurity heading. Absolutely,
Speaker 1: But what about concrete advice? Yeah, for these aspiring leader
Speaker 1: what do they suggest for those who are looking to
Speaker 1: step into leadership roles in cybersecurity?
Speaker 2: Will they emphasize a lot of the themes we've already discussed,
Speaker 2: continuous learning, staying ahead of the curve in this rapidly
Speaker 2: evolving field, developing both technical skills and leadership qualities.
Speaker 1: So it's not enough to be the tech expert. You
Speaker 1: also have to be able to lead people, communicate effectively,
Speaker 1: and make those strategic decisions.
Speaker 2: And they highlight the importance of building relationships, networking with
Speaker 2: other professionals, seeking out mentors who can guide and support you.
Speaker 1: Mentorship is so valuable, absolutely, especially in a field like this.
Speaker 2: Or experience is often hard one. Having someone to bounce
Speaker 2: ideas off of, ask for advice, Yeah, learn from their mistakes.
Speaker 1: It's invaluable, it is. Yeah. They encourage these aspiring leaders
Speaker 1: to develop their communication skills sure, learning to explain those
Speaker 1: complex technical concepts in a way that resonates with different
Speaker 1: audiences executtives to developers.
Speaker 2: Absolutely, that's crucial. And as a leader, you're always going
Speaker 2: to be communicating, whether it's presenting to the board, explaining
Speaker 2: a security incident to your team, advocating for resources.
Speaker 1: It's a big part of the job.
Speaker 2: It is. And finally, these leaders urge you to embrace
Speaker 2: the challenge of cybersecurity, to see it not just as
Speaker 2: a job, but as a mission to protect organizations, communities,
Speaker 2: our digital lives.
Speaker 1: To find meaning and purpose in your work, knowing that
Speaker 1: you're making a real difference.
Speaker 2: And inspiring others to join you in that mission to
Speaker 2: build a more secure and resilient digital future for everyone.
Speaker 1: I love that.
Speaker 2: It's a great mission.
Speaker 1: This has been a fantastic deep dive. I feel like
Speaker 1: I've learned so much from hearing these leaders insights and perspectives.
Speaker 1: It's really inspiring to see their passion and their commitment
Speaker 1: to excellence, and just their unwavering belief in the importance
Speaker 1: of their work.
Speaker 2: And what's so great about Tribe of Hackers Security Leaders
Speaker 2: is that it goes beyond those technical aspects of cybersecurity
Speaker 2: and it really explores that human side of leadership. It
Speaker 2: gives you a glimpse into the challenges I triumphs, the
Speaker 2: wisdom these leaders have gained from years of experience.
Speaker 1: It reminds you that behind every successful cybersecurity program, Yeah,
Speaker 1: there's this team of dedicated and passionate individuals committed to
Speaker 1: protecting their organizations and the people they serve.
Speaker 2: And this deep dive has been a call to action.
Speaker 2: Embrace the challenge, develop your skills, build relationships, strive to
Speaker 2: become the leaders the world needs in this ever evolving field.
Speaker 1: Well said, So, if you're ready to dive deeper into
Speaker 1: these ideas and learn from the best, yeah, I highly
Speaker 1: recommend checking out Tribe of Hackers Security Leaders.
Speaker 2: It's a treasure trove of insights and inspiration it is
Speaker 2: for anyone who aspires to a leadership role right in
Speaker 2: this exciting and challenging field.
Speaker 1: Yeah, and as you continue on your own leadership journey,
Speaker 1: remember the advice of these incredible leaders. Stay curious, stay adaptable,
Speaker 1: say connected, and never stop learning.
Speaker 2: The future of cybersecurity depends on it.
Speaker 1: Well said, Thanks for joining us on this deep dive. Yes,
Speaker 1: thank Until next time, stay safe, stay secure, keep on learning.
Speaker 2: Absolutely. Yeah, it's cuff. You don't want to, you know,
Speaker 2: create that culture of toxic positivity where people are afraid
Speaker 2: to raise concerns, but you also don't want to overwhelm
Speaker 2: people with negativity. It's finding that balance, acknowledging those challenges,
Speaker 2: focusing on the solutions, and celebrating the successes.
Speaker 1: That makes a lot of sense. It's about creating that
Speaker 1: sense of psychological safety where they feel like they can
Speaker 1: speak up absolutely without fear of being.
Speaker 2: Punished, punished or shut down.
Speaker 1: Yeah, exactly. And there's another fascinating leadership journey shared by
Speaker 1: David Evenden, founder of Standard User's Cybersecurity, and he talks about,
Speaker 1: you know, evolving from a more assertive leadership style to
Speaker 1: a more empathetic approach, you know, focused on team growth
Speaker 1: and clear expectations. So adapting, adapting your leadership style, yes,
Speaker 1: to fit the needs of the team.
Speaker 2: To fit the needs and the ever changing landscape.
Speaker 1: Right, and not just being stuck in your ways because
Speaker 1: that's how it's always been.
Speaker 2: Done, exactly. And Charles and Watouka, an engineering manager at Netflix,
Speaker 2: adds that transparency, vulnerability, and creating that supportive environment for
Speaker 2: growth are crucial for building trust and empowering the team.
Speaker 1: You know, I love that he emphasizes vulnerability. Yes, it's
Speaker 1: so important for leaders to show that they're human, it is,
Speaker 1: and that they don't have all the answers.
Speaker 2: Yeah, and that it's okay to ask for help, right.
Speaker 1: And it creates that culture where everyone feels safe to
Speaker 1: take risks exactly and learn from mistakes.
Speaker 2: And learn from their stakes. Absolutely. And speaking of learning,
Speaker 2: the book also delves into the cybersecurity skills gap.
Speaker 1: Oh, the skills gap, Yeah.
Speaker 2: Which is a topic that's hey top of mind for
Speaker 2: a lot of these leaders.
Speaker 1: It feels like everybody's talking about the skills gap. But
Speaker 1: what concrete solutions did these leaders offer.
Speaker 2: Well, there's a little bit of a debate, I would say,
Speaker 2: about the nature of the gap. Andrew Bagrin argues that
Speaker 2: there's no shortage of junior talent, okay, but a lack
Speaker 2: of experienced senior professionals.
Speaker 1: Right. So it's not just about getting people in, not
Speaker 1: just getting them in, it's about providing those pathways for
Speaker 1: them to move up exactly.
Speaker 2: Moving up to those senior roles.
Speaker 1: And that seems to be a common theme. It is
Speaker 1: this idea that development and mentorship are key to addressing this.
Speaker 2: Yes, absolutely. Steve Christy Coley, principle INFOSEC engineer at ITIRE,
Speaker 2: he stresses the need for the industry to invest in
Speaker 2: training and support, okay for less experienced individuals. Right. He's saying,
Speaker 2: you know, we can't expect season pros to just magically appear.
Speaker 2: We need to create those opportunities for mentorship, training, career advancement.
Speaker 1: You know, sometimes it feels like these job descriptions for
Speaker 1: cybersecurity roles, they want people to be unicorns. They want
Speaker 1: them to have all of this experience in every single technology,
Speaker 1: years and years of experience, and it can be really discouraging,
Speaker 1: oh yeah, for newcomers, very discouraging for someone new to
Speaker 1: even try to get into the field exactly.
Speaker 2: And that's something that Stephen A. Ridley, a cybersecurity consultant, criticizes.
Speaker 2: He highlights the importance of giving young professionals a chance
Speaker 2: and challenging those unrealistic expectations that are often found in
Speaker 2: those job descriptions. You know, those expectations can really discourage
Speaker 2: newcomers from even entering the field.
Speaker 1: So it sounds like there needs to be this mindset shift. Yes,
Speaker 1: not just focusing on years of experience, but really looking
Speaker 1: at potential.
Speaker 2: Pidental and aptitude.
Speaker 1: Aptitude and recognizing that raw talent can be developed.
Speaker 2: Absolutely, and many of the leaders advocate for changes in
Speaker 2: hiring practices, Okay, focusing more of those qualities, recognizing that
Speaker 2: raw talent can be nurtured and developed into cybersecurity expertise.
Speaker 2: They also emphasize the importance of providing opportunities for mentorship
Speaker 2: where experienced professionals can guide and support.
Speaker 1: It's so important.
Speaker 2: It's about passing on that knowledge, right, building confidence, creating
Speaker 2: a sense of community, And it's not.
Speaker 1: Just about developing those individual skills right. There's also this
Speaker 1: emphasis on collaboration and communication.
Speaker 2: Yes, cybersecurity can operate an asylum.
Speaker 1: Leaders need to break down those barriers and build relationships
Speaker 1: with all the different teams from executives, executives, developers, legal, everybody, everyone,
Speaker 1: and that all starts with communication.
Speaker 2: It does.
Speaker 1: So how do they suggest we build these bridges?
Speaker 2: Well. Edward Prevost, a staff security engineer at Squarespace, has
Speaker 2: a great reframing. He suggests that infosec should transition from
Speaker 2: a no team to a collaborative partner.
Speaker 1: I like that.
Speaker 2: Yeah. Instead of just shutting down ideas, security team should
Speaker 2: be offering solutions, working with other teams to achieve those
Speaker 2: shared goals.
Speaker 1: So they're not just a roadblock exactly, They're a partner
Speaker 1: in the process.
Speaker 2: They are a partner. He talks about clearly defining risk,
Speaker 2: appetite and offering options rather than just saying no outright.
Speaker 1: Which is so important because if they are seen as
Speaker 1: a roadblock, yes, people are going to find ways to
Speaker 1: go around they wis security.
Speaker 2: Yeah, you can't stop progress, you can't.
Speaker 1: And if they see security as a partner, then they
Speaker 1: can work together to find those secure solutions.
Speaker 2: To find secure solutions exactly.
Speaker 1: But that requires a high level of communication and trust.
Speaker 2: It does, absolutely, and Christopher Hadnaggi, the founder of Social
Speaker 2: Engineer LLC, really hits on this point Okay. He emphasizes transperncy,
Speaker 2: frequent communication, and creating that culture of trust okay, he
Speaker 2: believes it. You know, when everyone's on the same page
Speaker 2: right and feels comfortable sharing information, that's when it's easiest
Speaker 2: to identify and address those security risks to.
Speaker 1: Building those relationships, creating that environment where people feel safe
Speaker 1: speaking up exactly.
Speaker 2: And Charles Nawatu, who we mentioned earlier, yea as that
Speaker 2: top down security awareness embedded in the company culture is essential.
Speaker 1: Okay.
Speaker 2: He also stresses the importance of building relationships with engineering
Speaker 2: teams working collaboratively to integrate security into that development process.
Speaker 1: It makes so much sense, he does, when you put
Speaker 1: it that way. If security is just an afterthought, it's
Speaker 1: always going to be playing catch up. Absolutely, But if
Speaker 1: it's baked into the culture from the top down, it
Speaker 1: becomes part of everybody's mindset.
Speaker 2: Exactly.
Speaker 1: So we've covered a lot, but I'm curious, did these
Speaker 1: leaders offer any reading recommendation.
Speaker 2: They did okay for aspiring cybersecurity pros who want to
Speaker 2: level up their leadership skills. Yeah. They offered a really
Speaker 2: diverse range of books, okay, catering to different leadership styles
Speaker 2: and interests.
Speaker 1: Okay, like what kind of stuff?
Speaker 2: Well, some were business and leadership classics. Okay, you know,
Speaker 2: like Good to Great by Jim Collins, What Got You Here,
Speaker 2: Won't Get You There by Marshall Goldsmith, The Hard Thing
Speaker 2: About Hard Things by Ben Horowitz.
Speaker 1: Those are amazing books.
Speaker 2: They are.
Speaker 1: They really offer timeless wisdom on building strong teams, making
Speaker 1: those tough decisions, navigating the challenges of leadership.
Speaker 2: Regardless of your industry.
Speaker 1: Yeah. What about books specifically focused on cybersecurity?
Speaker 2: Of course did they recommend Some of the popular choices
Speaker 2: were Tribe of Packers, Naturally, Security Metrics Replacing Fear, Uncertainty,
Speaker 2: and Doubt by Andrew Jaquith. Okay, Applied Cryptography by Bruce Schneier.
Speaker 1: Those are must reads for anyone serious about cybersecurity.
Speaker 2: Absolutely.
Speaker 1: What about books on communication, teamwork, decision making, you know,
Speaker 1: skills that are essential for effective leadership?
Speaker 2: Oh, they covered those two?
Speaker 1: Okay, what did they say?
Speaker 2: So? Some of their recommendations included Team of Teams by
Speaker 2: General Stanley McCrystal. Okay, Death by Meeting by Patrick LENCIONI. Yeah,
Speaker 2: Radical Candor by Kim Scott.
Speaker 1: Wow. What a treasure trove of reading material.
Speaker 2: It is quite the list.
Speaker 1: It's going to keep me busy for a while, it will.
Speaker 1: You know. It's inspiring to see how these leaders are
Speaker 1: not just experts in their field, but they're also really
Speaker 1: well rounded individuals. Yes, who value continuous learning and personal growth.
Speaker 2: You do.
Speaker 1: But I'm also curious what keeps them up at night?
Speaker 2: Oh that's a great question.
Speaker 1: What are their biggest concerns when it comes to cybersecurity?
Speaker 2: Yeah they are, and they worry about the potential impact
Speaker 2: of a successful attack, you know, on their organization's reputation, finances,
Speaker 2: and customer trust.
Speaker 1: Yeah. It's a heavy burden.
Speaker 2: It is very yeah, for sure. So given all these challenges,
Speaker 2: the book also asked these leaders what they would change
Speaker 2: about cybersecurity leadership. Oh. Interesting, if they had a magic
Speaker 2: wand a magic wand what would they change? I like it.
Speaker 2: What are their big dreams for the future of cybersecurity leadership? Yeah?
Speaker 1: What did they say?
Speaker 2: Well, a common theme was this desire for greater alignment, okay,
Speaker 2: between security and business goals. You know, they want to
Speaker 2: move away from security being seen as just a roadblock
Speaker 2: and instead be viewed as a strategic partner. Yeah, that
Speaker 2: helps enable business growth and innovation.
Speaker 1: Makes sense because if security is just seen as a
Speaker 1: cost center or a compliance burden, it's always going to
Speaker 1: be an uphill battle.
Speaker 2: It's always going to be a struggle.
Speaker 1: To get the resources and the buy in that you
Speaker 1: need exactly.
Speaker 2: But if it's viewed as a key enablers, then it
Speaker 2: becomes a competitive advantage. Several leaders also expressed a desire
Speaker 2: for a more proactive and preventative approach to cybersecurity.
Speaker 1: So instead of all always putting out those fires.
Speaker 2: Moving away from that reactive firefighting mentality that we see
Speaker 2: so much of in the industry.
Speaker 1: So they want to prevent the fires from even starting.
Speaker 2: Absolutely, and they recognize that this requires a different mindset,
Speaker 2: different skills, and different investments.
Speaker 1: Makes sense.
Speaker 2: Another wish was for a greater investment in security awareness
Speaker 2: and training. You know, they envision a world where everyone
Speaker 2: in the organization, from the CEO to the newest intern,
Speaker 2: understands their role in protecting the organization.
Speaker 1: Wow. So it's really about creating that culture of security.
Speaker 2: Yes, where it's not just the security team's job, but
Speaker 2: everyone's responsibility to be vigilant and aware.
Speaker 1: And to understand the risks and how to mitigate them.
Speaker 2: Absolutely. Yeah, there was also a strong desire for greater
Speaker 2: diversity and inclusion in the cybersecurity workforce. Yeah, many leaders
Speaker 2: recognize that we need to attract and retain talent from
Speaker 2: a wider range of backgrounds and experiences.
Speaker 1: Diversity of thought is so important.
Speaker 2: It is especially in cybersecurity.
Speaker 1: Especially in this field where.
Speaker 2: You're constantly facing new threats and new challenges.
Speaker 1: Right, having those different perspectives and different approaches can only.
Speaker 2: Make you stronger, exactly. And finally, some leaders expressed a
Speaker 2: desire for a future where cybersecurity is simply baked in, okay,
Speaker 2: to every aspect of technology.
Speaker 1: So you're saying they envision a world where security is
Speaker 1: just an integral part, a fundamental part of the design
Speaker 1: and development process.
Speaker 2: Yes, not an afterthought, not a bolt on solution.
Speaker 1: Right, making it a fundamental principle that guides every aspect
Speaker 1: of our digital.
Speaker 2: Lives, just like safety is a fundamental principle in the
Speaker 2: physical world.
Speaker 1: So these magic wand wishes, they really paint a picture,
Speaker 1: they do, of where these leaders see cybersecurity. Heading they do,
Speaker 1: But what about concrete advice for aspiring leaders?
Speaker 2: That's a good question.
Speaker 1: What do they suggest for those who are looking to
Speaker 1: step into leadership roles in cybersecurity.
Speaker 2: Well, they emphasize a lot of the things that we've
Speaker 2: already talked about, continuous learning, staying ahead of the curve
Speaker 2: in this rapidly evolving field, developing both technical skills and
Speaker 2: leadership qualities.
Speaker 1: So you're saying it's not enough to just be a
Speaker 1: technical expert, No, you also need to be able to
Speaker 1: lead people, communicate effectively, and make those strategic decisions.
Speaker 2: They also highlight the importance of building relationships, networking with
Speaker 2: other professionals, and seeking out mentors who can guide and
Speaker 2: support you.
Speaker 1: Mentorship is so valuable. It is especially in a field
Speaker 1: like cybersecurity, where that experience is so hard.
Speaker 2: One exactly having someone to bounce ideas off of, to
Speaker 2: ask for advice, to learn from their mistakes, it's invaluable.
Speaker 1: And they encourage aspiring leaders to develop those strong communication skills, yes,
Speaker 1: you know, learning to explain those complex technical concepts in
Speaker 1: a way that resonates with different audiences from executives to developers.
Speaker 2: Absolutely, you know, as a leader, you're always going to
Speaker 2: be communicating in some way, whether it's presenting to the board,
Speaker 2: explaining a security incident your team, or advocating for resources.
Speaker 1: It's a big part of the job, it is.
Speaker 2: And finally, these leaders urge you to embrace the challenge
Speaker 2: of cybersecurity, okay, to see it not just as a job,
Speaker 2: but as a mission. Okay, to protect organizations, communities, our
Speaker 2: digital lives.
Speaker 1: To find meaning and purpose in the work that you do.
Speaker 2: Yes, knowing that you're making a real difference in a
Speaker 2: world that's increasingly reliant on technology.
Speaker 1: And inspiring others to join you in that mission.
Speaker 2: Absolutely, to build a more secure and resilient digital future
Speaker 2: for everyone.
Speaker 1: Wow, this has been a fantastic deep dive.
Speaker 2: It has.
Speaker 1: I feel like I've gained so much from hearing these
Speaker 1: leaders insights and perspectives. It's really inspiring to see their passion,
Speaker 1: their commitment to excellence, and their unwavering belief in the
Speaker 1: importance of their work.
Speaker 2: And what's so great about Tribe of Hackers Security Leaders
Speaker 2: is that it goes beyond just the technical aspects of cybersecurity,
Speaker 2: and it really explores that human side of leadership. You know,
Speaker 2: it gives you a glimpse into the challenges, the triumphs,
Speaker 2: and the wisdom these leaders have gained from year's experience.
Speaker 1: It really reminds you that behind every successful cybersecurity program,
Speaker 1: there's a team of dedicated and passionate individuals absolutely who
Speaker 1: are committed to protecting their organizations and the people they serve.
Speaker 2: And this deep dive has been a call to action, Yes,
Speaker 2: it has. Embrace the challenge, develop your skills, build relationships,
Speaker 2: and strive to become the leaders the world needs in
Speaker 2: this critical and ever evolving field.
Speaker 1: Well said, So, if you're ready to dive deeper into
Speaker 1: these ideas and learn from the best, I highly recommend
Speaker 1: checking out tribe of hackers security leaders. It's a treasure
Speaker 1: trove of insights and inspiration for anyone who aspires to
Speaker 1: a leadership role in this exciting and challenging field.
Speaker 2: And as you continue on your own leadership journey, remember
Speaker 2: the advice of these incredible leaders. Stay curious, stay adaptable,
Speaker 2: stay connected, and never stop learning. The future of cybersecurity
Speaker 2: depends on it.
Speaker 1: Well said, Thanks for joining us for this deep dive.
Speaker 1: Until next time, stay safe, stay secure, and keep on learning.