Podcasts by Category
- 152 - The CISO Scarlet Letter: How a Breach Actually Builds Your Resume
Zach Lewis has spent his career asking for things before anyone offered them. In this episode of The New CISO, he joins Steve Moore from Black Hat in Las Vegas to trace a path from fixing neighbors' laptops to running IT and security for a university — and to explain why he wrote a book about it.
The origin story is a series of conversations most people never start. A few weeks into a new job at a college, with the CIO gone and his own supervisor out the door, Zach walked into the interim CIO's office and said he could carry more. He was promoted days later. When the director of technical support announced he was moving, Zach said he wanted the job before it was posted, then shadowed the man he hoped to replace. The theme holds: if you want something, say so, and make sure the deciders know it.
One move breaks the pattern. A former boss invited him to a nearby college that needed its IT department rebuilt, five minutes from the house and weeks after his first child was born, and he said yes without asking why the rebuild was necessary. A team of twelve was down to two. Six months of interviews produced no hires. He worked overnights, burned out fast, and left for his old employer the first day back from winter break. His advice now: treat the interview as an advisory engagement — why is this role open, where did everyone go, what is the root cause.
Back at the college he became director, then CIO, then built a security program from nothing — and when he pitched hiring a CISO, leadership said there was no budget for another chief officer and asked whether he could just do it himself. He said yes. In April 2023 the institution was hit by LockBit. Zach walks through the morning it surfaced: hours of ordinary troubleshooting, a recovery that collapsed hours later, and a readme file in the hypervisor he knew was bad before opening it. Three calls followed — cyber insurance, the FBI, and his wife, to tell her this might be a resume generating event.
The conversation sharpens when Steve presses on the book's most contested line: would Zach trade everything the breach taught him for a guarantee he'd never face another one? He doesn't dodge it. That stigma is exactly why he wrote Locked Up — attackers trade notes about what works, defenders stay quiet, and the silence helps the wrong side. His closing advice: ask for things, remember it's reciprocal, and use the tool instead of being used by it.
Key Topics
Asking for the role before it is posted, and what tends to happen nextThe questions Zach wishes he had asked before a job that went wrongInterviewing as an advisor rather than a candidateBuilding a security program from scratch, then being handed the CISO titleThe morning the LockBit ransom note turned up in the hypervisorThree phone calls: cyber insurance, the FBI, and his wifeHolding the circle tight, and the debate over when to notify publiclyWhy announcing too early can force you to restate the numbersThe stigma around breaches, and why attackers share more than defendersWriting Locked Up on a chapter-every-ten-days deadlineGuest Bio
Zach Lewis is CIO and CISO at University of Health Sciences and Pharmacy, and the author of Locked Up, published by Wiley with a foreword by George Finney. He began in desktop and systems administration in St. Louis before moving into higher education, holds the CISM and CISA certifications through ISACA, and led his institution's response to a LockBit ransomware attack in April 2023.
GET A DEMO:
👉 Get a hands-on demo of the Exabeam products: https://www.exabeam.com/demo
🔔 Subscribe for more product demos and cybersecurity insights!
ABOUT EXABEAM:
Exabeam is the leader in Behavior Intelligence for the agentic enterprise. As organizations deploy digital workers and confront machine-speed adversaries, Exabeam applies agent-powered analytics to understand and govern the behavior of both human and non-human insiders. With integrated Exabeam Nova cybersecurity agents, Exabeam delivers flexible, industry-proven solutions for insider threat coverage of humans and agents and faster, more accurate threat detection, investigation, and response (TDIR). As the pioneer of user and entity behavior analytics (UEBA) and the innovator behind Agent Behavior Analytics (ABA), Exabeam is trusted by more than 3,000 enterprises worldwide to reduce risk, secure the digital workforce, and accelerate security operations. Learn more at www.exabeam.com.
Exabeam: Stop Insider Threats. Human or AI.
CONNECT WITH US:
X: https://x.com/exabeam
LinkedIn: https://www.linkedin.com/company/exabeam/
Blog: https://www.exabeam.com/blog/
Thu, 08 Oct 2026 - 1h 07min - 151 - Complacency Kills: Why More Discomfort Might Fix Your Burnout
Sean Murphy spent more than twenty years in the CISO chair and walked away from it while things were going well. In this episode of The New CISO, he returns to talk with Steve Moore about trading the operational seat for a field CISO role at F5 — and why getting too good at the job was the warning sign.
Sean reintroduces himself: 21 years in Air Force medicine, multiple post-retirement CISO gigs in highly regulated industries, and now field CISO for North America at F5. What drew him was not the title but the teaching. He calls his hobby recreational learning, has been an adult student for decades, and still teaches at Central Washington and Columbia Southern. The new role makes education the job rather than something done off the side of the desk.
The heart of the conversation is the exhaustion nobody names. Sean is blunt that his old role drained him less because it was hard than because it was the same — the same politics, the same pressures, the same day in and day out. Stability turned into autopilot, and autopilot is where complacency kills. Now he is drinking from the fire hose on post-quantum, AI security, and API security, admitting he has had to go learn the material before presenting it. His batteries are fuller than they were when the work was easier.
Steve turns that into a theory of time. An hour of play feels infinite to a child because everything in it is new; as we get older and repeat ourselves, the days speed up and disappear. Discomfort, then, is not the enemy — it is the thing that slows relative time back down. Sean adds the other half: focus, being genuinely in the moment rather than running on muscle memory.
Then Steve puts a hot one to him. He is often underwhelmed by people in field CISO roles, and he argues the position is overhead until it is not — frequently first on the chopping block. Sean does not flinch. If a company builds these roles without a strategic reason and hires people with no bench behind them, that is on the company. He walks through the questions he asked in his own interviews — what does success look like, what are the real pain points, how much selling is in the role — and how much the subtext tells you. The episode closes on narrative over geek speak, a Black Hat session, a possible third book, and his answer to the show's closing question: do not forget your roots.
Key Topics
Leaving the operational CISO seat while the program was running wellWhy F5 built a field CISO role around education rather than salesRecreational learning: teaching, certifications, and staying a studentComplacency, autopilot, and the exhaustion of samenessActual versus perceived time, and how novelty slows the clockThe hot take: is field CISO the first position to get cut?Interview questions for a vendor role, starting with what success looks likeReading the subtext of an interview: politics, pain points, and red flagsBuilding the narrative that ties security work to the businessStaying comfortable being uncomfortable in a brand new roleGuest Bio
Sean Murphy is field CISO for North America at F5, which he joined after more than twenty years as an operational CISO in highly regulated industries and a 21-year career in Air Force medicine. He has authored two cybersecurity books published by McGraw-Hill, contributed to ISC2 study material, and still teaches at Central Washington and Columbia Southern. He was a panel guest on The New CISO in 2022.
GET A DEMO:
👉 Get a hands-on demo of the Exabeam products: https://www.exabeam.com/demo
🔔 Subscribe for more product demos and cybersecurity insights!
ABOUT EXABEAM:
Exabeam is the leader in Behavior Intelligence for the agentic enterprise. As organizations deploy digital workers and confront machine-speed adversaries, Exabeam applies agent-powered analytics to understand and govern the behavior of both human and non-human insiders. With integrated Exabeam Nova cybersecurity agents, Exabeam delivers flexible, industry-proven solutions for insider threat coverage of humans and agents and faster, more accurate threat detection, investigation, and response (TDIR). As the pioneer of user and entity behavior analytics (UEBA) and the innovator behind Agent Behavior Analytics (ABA), Exabeam is trusted by more than 3,000 enterprises worldwide to reduce risk, secure the digital workforce, and accelerate security operations. Learn more at www.exabeam.com.
Exabeam: Stop Insider Threats. Human or AI.
CONNECT WITH US:
X: https://x.com/exabeam
LinkedIn: https://www.linkedin.com/company/exabeam/
Blog: https://www.exabeam.com/blog/
Thu, 17 Sep 2026 - 40min - 150 - The Player-Coach CISO: Engineering Trust in AI Agents with Open-Source Tools
In this episode of The New CISO, host Steve Moore welcomes Sherri Douville for a conversation that sits outside the show's usual lane — less war story, more blueprint. Sherri works alongside CISOs rather than inside the role, and arrives with a pointed argument about what the job is becoming.
She starts with why TTIC exists. IEEE UL 2933 gave healthcare a full-stack standard for clinical IoT device and data interoperability, but a standard on paper does nothing until it is adopted, implemented, and maintained. Getting there in a high-reliability industry means pulling in CIOs, CISOs, physicians, and engineers — and, Sherri admits, negotiating turf wars with bodies who assume you have come for their territory.
Then the headline: how to make security cool. Sherri's answer starts with visibility — getting CISOs onto stages, onto podcasts, and into print in front of clinical leadership. Underneath it is a claim about trust. In healthcare, trust is the core of the business rather than an adjacent concern, which makes the CISO its natural steward. With AI pushing trust to the center of every industry, she argues that is the opening to become the rock star of the C-suite.
Steve raises a banking CISO's framing of AI as a curious seven-year-old with a gun. Sherri pushes back on the spot: her analogy is the gifted teenager — capable, resource-hungry, and badly in need of direction. That leads to her real thesis. Scarce expertise used to carry economic value, and AI is rapidly compressing the worth of expert analysis. What appreciates instead is judgment, authority, execution, verification, organizational integration, and ownership of the outcome. Executives do not want more reports; they want the security problem to go away without adding coordination burden.
The last stretch turns practical. Sherri walks through running Exabeam's open-source Praxen against Medigram's own code — painless to run, with remediation effort scaling to whatever standard you are chasing — and pairs it with Observra for continuous runtime telemetry. She closes on why it matters: when systems go down in a hospital, the real damage is not the outage hour but the fortnight of delays, miscommunications, and pile-up that follows for clinicians and patients.
Key Topics
Why standards bodies stall at adoption, not authorshipMaking security “cool”: visibility, stages, and executive presenceTrust as the core of the business in high-reliability industriesThe gifted teenager vs. the curious seven-year-old with a gunJudgment, authority, execution, verification, integration, ownershipSelective depth and the player-coach executiveRunning Praxen pre-deployment; Observra for runtime telemetryWhat a healthcare outage really costs, 14 to 20 days outGuest Bio
Sherri Douville is CEO and Architect of Medigram and Founder and Chair of the Trustworthy Technology & Innovation Consortium (TTIC). She co-chairs the Trust subgroup of IEEE UL 2933 (TIPPSS), the standard for trust in clinical IoT. Medigram builds and operates Darwin, a governed AI decision platform whose agentic fleet runs in production and writes a sealed governance record at the moment of every agent action — an auditable trail for counsel, courts, insurers, and credit rating agencies. Sherri spent over a decade at Johnson & Johnson across a dozen disease states before physician leaders pulled her into healthcare IT and AI. She calls herself an accidental technologist: a domain expert who got into the code, logging 200 GitHub commits across June and July.
GET A DEMO:
👉 Get a hands-on demo of the Exabeam products: https://www.exabeam.com/demo
🔔 Subscribe for more product demos and cybersecurity insights!
ABOUT EXABEAM:
Exabeam is the leader in Behavior Intelligence for the agentic enterprise. As organizations deploy digital workers and confront machine-speed adversaries, Exabeam applies agent-powered analytics to understand and govern the behavior of both human and non-human insiders. With integrated Exabeam Nova cybersecurity agents, Exabeam delivers flexible, industry-proven solutions for insider threat coverage of humans and agents and faster, more accurate threat detection, investigation, and response (TDIR). As the pioneer of user and entity behavior analytics (UEBA) and the innovator behind Agent Behavior Analytics (ABA), Exabeam is trusted by more than 3,000 enterprises worldwide to reduce risk, secure the digital workforce, and accelerate security operations. Learn more at www.exabeam.com.
Exabeam: Stop Insider Threats. Human or AI.
CONNECT WITH US:
X: https://x.com/exabeam
LinkedIn: https://www.linkedin.com/company/exabeam/
Blog: https://www.exabeam.com/blog/
Thu, 27 Aug 2026 - 49min - 149 - Don’t Be a Risk Manager. Be a Trust Architect.
Ravi Soin has clear advice for anyone starting a security career today: don't be a risk manager, be a trust architect. In this episode, Steve Moore sits down with Ravi—CIO and CISO at Smartsheet—for a builder's-eye conversation on the modern CISO role, AI as an accelerant on old sins, and why the CISO who still says “no” is already obsolete.
Ravi traces his path through Sun Microsystems, RealNetworks, a decade at Microsoft, and 15 years at healthcare software leader Edifecs to his eight months at Smartsheet. He explains what it means to think about security the way builders do—understanding where corners get cut under sprint pressure—and why that inside-out perspective changes how you defend.
Steve and Ravi dig into how Smartsheet is deploying agentic AI across the enterprise: a centralized knowledge graph tied to every corporate system, Claude-powered threat models, DAST and SAST scans, SOC triage on the 80% phishing baseline, and MCP-connected asset and license management.
They name the old culture directly. It was an era of risk registers where lows and mediums were quietly punted, tens of thousands of known vulnerabilities were accepted as compensating- control fiction, and time-to-exploit was assumed to be forgiving. Both push back on the panicked reaction to the Mythos disclosures, arguing AI has simply closed the exploit window on the trash environments were already ignoring.
Ravi's core advice: build trust into the system, think about security through the customer's lens, and treat AI agents as first-class identities under the same IAM principles you apply to humans. He and Steve close on how incident response must be re-fit for the agentic era, why auditability is the non-negotiable foundation of AI governance, and why community remains the sharpest source of learning.
Key Topics
• Thinking about security like a builder, from the inside out
• Why the CISO who still says “no” is already obsolete
• Deploying agentic AI across engineering, SOC, and corporate systems
• MCP-connected asset and license management
• The old risk-register culture and how the industry was gambling
• Why the Mythos reaction missed the bigger story
• Advice to your 21-year-old self: be a trust architect
• Building security through the customer's lens
Guest Bio
Ravi Soin is the CIO and CISO at Smartsheet, where he leads global IT and security strategy for the AI-enhanced enterprise work management platform. He brings more than two decades of security and IT leadership, including 15 years as CIO and CISO at healthcare software leader Edifecs and product roles at Microsoft, RealNetworks, and Sun Microsystems. Ravi serves on the SeattleCIO advisory board and was named Seattle CIO of the Year.
GET A DEMO:
👉 Get a hands-on demo of the Exabeam products: https://www.exabeam.com/demo
🔔 Subscribe for more product demos and cybersecurity insights!
ABOUT EXABEAM:
Exabeam is the leader in Behavior Intelligence for the agentic enterprise. As organizations deploy digital workers and confront machine-speed adversaries, Exabeam applies agent-powered analytics to understand and govern the behavior of both human and non-human insiders. With integrated Exabeam Nova cybersecurity agents, Exabeam delivers flexible, industry-proven solutions for insider threat coverage of humans and agents and faster, more accurate threat detection, investigation, and response (TDIR). As the pioneer of user and entity behavior analytics (UEBA) and the innovator behind Agent Behavior Analytics (ABA), Exabeam is trusted by more than 3,000 enterprises worldwide to reduce risk, secure the digital workforce, and accelerate security operations. Learn more at www.exabeam.com.
Exabeam: Stop Insider Threats. Human or AI.
CONNECT WITH US:
X: https://x.com/exabeam
LinkedIn: https://www.linkedin.com/company/exabeam/
Blog: https://www.exabeam.com/blog/
Thu, 06 Aug 2026 - 51min - 148 - How Many Tokens to Breach Your Network?
What if your next breach came down to a token budget? In this episode, Steve Moore is joined by Lou Rabon, Founder and CEO of Cyber Defense Group, for a conversation on the modern CISO's world—from how to interview for the seat, to why AI agents are the next insider threat, to research that reframes breach cost as a token calculation.
Lou and Steve open on breach response, why making introductions during a crisis is a losing game, and the questions every CISO candidate should ask before accepting an offer. Lou lays out how many rounds of interviews a serious CISO role should include, why the CEO must be involved by the final round, and why he believes Legal—not the CIO or CTO—is the ideal reporting line for security.
The conversation pivots to AI. Lou argues we are watching a dot-com-speed shift, only compressed. They dig into the emerging insider-threat framing for autonomous agents, the recent incident where an AI slipped its sandbox to contact a researcher, and why attackers face none of the ethical guardrails defenders must respect.
Steve shares recent Cornell research showing that agentic tooling can already automate 22 of 32 steps in a corporate intrusion, compressing hours of expert work into seconds—with token spend as the only real limiter. If a breach can be priced in tokens, they argue, defenders must think in tokens too, and machine-to-machine defense becomes a necessity rather than a novelty.
The episode closes on what Lou calls “the dirty secret” of cybersecurity: the unglamorous hygiene work—asset lists, data maps, MSA notification clocks—that no one wants to fund. He and Steve explore how agentic AI could finally deliver the always-on trash collection defenders have wanted for decades, from dynamic breach-notification tracking to a security agent that flags every new device.
Key Topics
• Why making introductions during a crisis is a losing strategy
• The interview questions every CISO candidate should ask
• Why Legal is the ideal reporting line for the CISO
• The inverse curve between convenience and security
• AI agents as the next form of insider threat
• Cornell research: 22 of 32 intrusion steps automated
• Tokens as the new unit of breach cost
• Machine-to-machine defense in financial services
• The “trash collection” hygiene work at the heart of InfoSec
• Agentic AI for asset lists and breach-notification analysis
Lou Rabon is the Founder and CEO of Cyber Defense Group (CDG), a cybersecurity strategic advisory firm he launched in 2016 to help fast-growing organizations manage modern risk and threats. With more than two decades in security, privacy, and incident response, Lou has led response engagements against nation-state attackers and previously served as CISO at Spokeo. Connect with Lou on LinkedIn or learn more at cdg.io.
GET A DEMO:
👉 Get a hands-on demo of the Exabeam products: https://www.exabeam.com/demo
🔔 Subscribe for more product demos and cybersecurity insights!
ABOUT EXABEAM:
Exabeam is the leader in Behavior Intelligence for the agentic enterprise. As organizations deploy digital workers and confront machine-speed adversaries, Exabeam applies agent-powered analytics to understand and govern the behavior of both human and non-human insiders. With integrated Exabeam Nova cybersecurity agents, Exabeam delivers flexible, industry-proven solutions for insider threat coverage of humans and agents and faster, more accurate threat detection, investigation, and response (TDIR). As the pioneer of user and entity behavior analytics (UEBA) and the innovator behind Agent Behavior Analytics (ABA), Exabeam is trusted by more than 3,000 enterprises worldwide to reduce risk, secure the digital workforce, and accelerate security operations. Learn more at www.exabeam.com.
Exabeam: Stop Insider Threats. Human or AI.
CONNECT WITH US:
X: https://x.com/exabeam
LinkedIn: https://www.linkedin.com/company/exabeam/
Blog: https://www.exabeam.com/blog/
Thu, 16 Jul 2026 - 51min - 147 - CISO 3.0: The Playbook for Delivering Impact and Influence
What separates a CISO who survives from one who shapes the boardroom? In this episode, Steve Moore sits down with Walt Powell, Lead Field CISO at CDW and author of The CISO 3.0, to unpack the modern CISO playbook—why technical credentials alone no longer cut it, how to build personal eminence, and why most security leaders are still treated as second-class C-suite citizens.
Walt traces his path from teaching networking before stateful firewalls existed, to writing CISSP exam questions for ISC2, to running CDW's Global Security Strategy Office. He explains what a field CISO does, why the role is harder than ex-CISOs realize, and how one bad meeting can tarnish a brand built over decades.
He and Steve break down the four pillars Walt uses to measure his team—embedded advisory, eminence building, sales enablement, and voice of the customer—and how a karate-style “belt system” maps each consultant's competency. Walt explains why the same skills matrix from The CISO 3.0 works for any CISO trying to spot their own gaps.
Walt argues a CISO who is not liked cannot succeed: you are the talent magnet, the culture builder, and the person proving in every board meeting that you belong in the seat. He shares the questions every candidate should ask before accepting the role—from D&O coverage to 10-K disclosure access—and why the 30-60-90 plan should be written before the second interview, not after the offer.
The conversation closes with what Walt calls “strategic debt”—the identity and data governance work organizations skipped a decade ago that is now blocking AI adoption. Walt shares lessons from running OpenClaw on a Mac mini, why non-human identity tops every 2026 CISO worry list, and how Deep Research is reshaping senior architects.
Key Topics
• The modern field CISO role and the four pillars of impact
• Why CISOs are still treated as second-class C-suite citizens
• Building personal eminence through books, speaking, and writing
• The CISO 3.0 skills matrix and self-assessment spider wheel
• Two paths to the CISO seat: technical vs. MBA, and the gaps each leaves
• Why likability is not optional for a successful CISO
• Board readiness and proving you belong in the seat
• Interview questions every CISO candidate must ask
• Strategic debt: identity and data governance blocking AI adoption
• OpenClaw, non-human identity, and the future of senior architects
Guest Bio:
Walt Powell is the Lead Field CISO at CDW and a founding member of CDW's Global Security Strategy Office, where he leads a team of former CISOs advising security leaders in the field. A longtime executive coach and ISC2 exam development committee member, Walt is the author of The CISO 3.0: A Guide to Next-Generation Cybersecurity Leadership and Quantum Ready, his book on post-quantum cryptography.
Connect with Walt on LinkedIn or at ciso30.com.
GET A DEMO:
👉 Get a hands-on demo of the Exabeam products: https://www.exabeam.com/demo
🔔 Subscribe for more product demos and cybersecurity insights!
ABOUT EXABEAM:
Exabeam is the leader in Behavior Intelligence for the agentic enterprise. As organizations deploy digital workers and confront machine-speed adversaries, Exabeam applies agent-powered analytics to understand and govern the behavior of both human and non-human insiders. With integrated Exabeam Nova cybersecurity agents, Exabeam delivers flexible, industry-proven solutions for insider threat coverage of humans and agents and faster, more accurate threat detection, investigation, and response (TDIR). As the pioneer of user and entity behavior analytics (UEBA) and the innovator behind Agent Behavior Analytics (ABA), Exabeam is trusted by more than 3,000 enterprises worldwide to reduce risk, secure the digital workforce, and accelerate security operations. Learn more at www.exabeam.com.
Exabeam: Stop Insider Threats. Human or AI.
CONNECT WITH US:
X: https://x.com/exabeam
LinkedIn: https://www.linkedin.com/company/exabeam/
Blog: https://www.exabeam.com/blog/
Thu, 25 Jun 2026 - 58min - 146 - Rogue Agents: The New Era of AI Insider Threats (part 2)
What happens when an AI agent inside your company starts behaving like an insider threat? In part two, Steve Moore picks the thread back up with former FBI operative Eric O'Neill to explore how agentic AI is rewriting cybersecurity, the legal traps that follow a breach, and why the modern CISO must think like a spy hunter.
Eric opens with a sobering reality: ransomware victims who decline to pay are re-attacked at staggering rates. He explains why criminals treat cybercrime as a business, invest weeks in reconnaissance—mapping SharePoint, harvesting file trees, and studying access patterns—and why a botched recovery hands them the same door twice.
The conversation turns to the new insider threat hiding in plain sight: rogue AI agents. Eric shares a real case in which one executive's casual query exposed the next round of layoffs and triggered coordinated lawsuits. They unpack how agents inherit excessive access, how attackers hijack them once inside, and why organizations are now building insider-threat programs to monitor AI behavior.
Eric argues AI is an accelerant on every unresolved problem—weak identity management, entitlement drift, missing asset inventories, and absent data classification. They debate whether IT and security should be unified under the CISO, why the CISO needs a direct line to the board, and the legal landmines that follow a breach, from cyber insurance to the “reasonable steps” standard.
The episode closes with Eric's advice for any new CISO: put “spy hunter” on your resume. Counterintelligence, not perimeter defense, is the discipline that wins today. Tune in for part two of a story-driven conversation on why preparation, mindset, and threat hunting beat any single technology.
Key Topics
• Why ransomware victims who decline to pay get re-attacked
• How attackers map SharePoint, file trees, and access patterns
• The new insider threat: rogue and hijacked AI agents
• A real case of an AI agent exposing an HR layoff list
• Shadow IT and the cost of banning AI outright
• Permission structures and second-level reviews for agent actions
• Why AI exposes gaps in identity, asset, and data classification
• Unifying IT and security under the CISO
• Why the CISO needs a direct line to the board
• Legal traps: cyber insurance, reasonable steps, and missed alerts
• The CISO as counterintelligence officer and spy hunter
Guest Bio
Eric O'Neill is a former FBI counterintelligence operative, attorney, and bestselling author who helped bring down Robert Hanssen—the most damaging spy in FBI history. He is the founder of NeXasure AI and co-founder of The Georgetown Group, and his undercover work was dramatized in the film Breach. Eric is the author of Gray Day and Spies, Lies, and Cybercrime.
Connect with Eric on LinkedIn or at ericoneill.net.
GET A DEMO:
👉 Get a hands-on demo of the Exabeam products: https://www.exabeam.com/dem
🔔 Subscribe for more product demos and cybersecurity insights!
ABOUT EXABEAM:
Exabeam is the leader in behavior intelligence for the agentic enterprise. As organizations deploy digital workers and confront machine-speed adversaries, Exabeam applies agent-powered analytics to understand and govern the behavior of both human and non-human insiders. With integrated Exabeam Nova cybersecurity agents, Exabeam delivers flexible, industry-proven solutions for insider threat coverage of humans and agents and faster, more accurate threat detection, investigation, and response (TDIR). As the pioneer of user and entity behavior analytics (UEBA) and the innovator behind Agent Behavior Analytics (ABA), Exabeam is trusted by more than 3,000 enterprises worldwide to reduce risk, secure the digital workforce, and accelerate security operations. Learn more at www.exabeam.com.
Exabeam: Real Intelligence. Real Security. Real Fast.
CONNECT WITH US:
LinkedIn: https://www.linkedin.com/company/exabeam/
Blog: https://www.exabeam.com/blog/
Thu, 04 Jun 2026 - 43min - 145 - Lessons From a Spy Hunter: The Real Cost of a Breach (Part 1)
What does it feel like to stand in the smoking ruin of a ransomware attack? In this episode, Steve Moore is joined by former FBI undercover operative Eric O'Neill—the man who helped capture Robert Hanssen—to explain why modern cybercrime is just traditional espionage repackaged, and why the dark web has quietly become the world's third-largest economy.
Eric traces his path from the FBI's counterintelligence trenches to founding NeXasure AI and writing cybersecurity books that read like spy thrillers. He and Steve unpack the staggering scale of cybercrime, which Eric predicts could reach $20 trillion in global GDP within years—a marketplace selling everything from ransomware kits to stolen credentials.
They dismantle the “it won't happen to me” mindset that still lingers in boardrooms. Eric describes how attackers use AI agents to scan for vulnerable systems, walks through how Scattered Spider socially engineered MGM in a ten-minute phone call, and explains why disabled MFA remains the leading point of failure for small and mid-size businesses.
Eric then unpacks the painful calculus of paying a ransom. He explains why the FBI says never pay, when OFAC sanctions make payment a federal crime, and why—even after paying—an organization must still do the same forensic, legal, and architectural work. Steve and Eric also detail how attackers resell access and treat victims as repeat customers.
The episode closes with a candid look at recovery. Eric and Steve explore why most companies fail at restoration, why rolling back to “before the attack” leaves the original flaw wide open, and why preparation always beats panic. Tune in for a part-one masterclass for any leader who thinks their organization is too small to be a target.
Key Topics
• How traditional espionage evolved into modern cybercrime
• The dark web as the world's third-largest economy
• Why every organization is a target, regardless of size
• The MGM ransomware attack and Scattered Spider's playbook
• Disabled MFA as the leading cause of SMB compromise
• Vulnerability assessments versus fire-time remediation costs
• The pay-versus-don't-pay ransomware calculus
• OFAC sanctions and the legal risks of paying
• Why restoring backups is not the same as recovery
• The how, where, why, what, and when of breach forensics
Guest Bio
Eric O'Neill is a former FBI counterintelligence operative, attorney, and bestselling author who helped bring down Robert Hanssen—the most damaging spy in FBI history. He is the founder of NeXasure AI and co-founder of The Georgetown Group, and his undercover work was dramatized in the film Breach. Eric is the author of Gray Day and Spies, Lies, and Cybercrime.
Connect with Eric on LinkedIn or at ericoneill.net.
GET A DEMO:
👉 Get a hands-on demo of the Exabeam products: https://www.exabeam.com/dem
🔔 Subscribe for more product demos and cybersecurity insights!
ABOUT EXABEAM:
Exabeam is the leader in behavior intelligence for the agentic enterprise. As organizations deploy digital workers and confront machine-speed adversaries, Exabeam applies agent-powered analytics to understand and govern the behavior of both human and non-human insiders. With integrated Exabeam Nova cybersecurity agents, Exabeam delivers flexible, industry-proven solutions for insider threat coverage of humans and agents and faster, more accurate threat detection, investigation, and response (TDIR). As the pioneer of user and entity behavior analytics (UEBA) and the innovator behind Agent Behavior Analytics (ABA), Exabeam is trusted by more than 3,000 enterprises worldwide to reduce risk, secure the digital workforce, and accelerate security operations. Learn more at www.exabeam.com.
Exabeam: Real Intelligence. Real Security. Real Fast.
CONNECT WITH US:
LinkedIn: https://www.linkedin.com/company/exabeam/
Blog: https://www.exabeam.com/blog/
Thu, 14 May 2026 - 34min - 144 - Your Most Valuable Skills Aren’t Technical
Cybersecurity debates tend to center on tools, frameworks, and threats. But Rob Knoblauch has built a 25-year career in global security leadership by focusing on the soft skills that determine whether a CISO survives, thrives, or burns out. In this episode of The New CISO, Rob joins Steve Moore to trace the through-line from running a multi-node BBS as a kid to serving as Deputy CISO of one of the world’s largest banks — and the career lessons he’s carried through every chapter.
Rob’s path wasn’t engineered. It began with a VIC-20, a love of video games, and a side passion for DJing that eventually clinched his first big bank interview. Running a BBS taught him identity management, patching, and infrastructure long before those were industry terms, and responding to the Melissa and “I Love You” outbreaks as a twenty-something Toronto Stock Exchange analyst launched his pivot into information security.
The conversation turns to leading at scale. Rob walks through the three mentors who shaped him — “the teacher” who grounded him in fundamentals at Bank of Montreal, “the coach” who taught him the collaborative nature of global operations at Scotiabank, and “the general” who sharpened his leadership edge. He frames these not as phases but as lenses he still applies situationally today.
Rob and Steve dig into incident response — from taking down Canada’s first phishing site with no playbook to running tabletop exercises at the board, C-suite, and technical levels. Rob argues every organization needs a breach coach and that communications is the biggest make-or-break factor in a breach. He also offers a candid take on CISO politics — short tenures, CIO friction, and why trust with your boss matters more than being right.
The episode closes with Rob’s take on why this may be the best time in history to be a new CISO. AI is stripping away the commodity work that defined earlier generations of the role, leaving more room for strategy, leadership, and real influence. For anyone stepping into the seat, Rob’s message is simple: the most valuable skills aren’t technical at all.
Key Topics
• Rob’s path from a VIC-20 and a grade-school BBS to the CISO seat
• How DJing as “Robbie Knobs” clinched his first big bank interview — and why “notables” matter on a resume
• Taking down the first phishing website in Canada with no playbook and a lot of cold calls
• The three mentors who shaped his leadership: the teacher, the coach, and the general
• Why tabletop exercises at the board, C-suite, and technical levels each matter — and how they differ
• The case for engaging a breach coach before a breach happens, not during one
• Why communications is the single biggest make-or-break factor in incident response
• How AI is reshaping the CISO role by stripping away commodity work
Guest
Rob Knoblauch — Chief Information Security Officer
Rob Knoblauch is a seasoned CISO with 25+ years of global information security leadership. He began his career at the Toronto Stock Exchange during the Y2K era and later held increasingly senior roles at Bank of Montreal and Scotiabank, where he spent years as Deputy CISO and VP of Global Security Services. Rob is also a startup advisor and longtime house music DJ performing as “Robbie Knobs.” Connect with Rob on LinkedIn.
GET A DEMO:
👉 Get a hands-on demo of the Exabeam products: https://www.exabeam.com/demo
🔔 Subscribe for more product demos and cybersecurity insights!
ABOUT EXABEAM:
Exabeam is the leader in behavior intelligence for the agentic enterprise. As organizations deploy digital workers and confront machine-speed adversaries, Exabeam applies agent-powered analytics to understand and govern the behavior of both human and non-human insiders. With integrated Exabeam Nova cybersecurity agents, Exabeam delivers flexible, industry-proven solutions for insider threat coverage of humans and agents and faster, more accurate threat detection, investigation, and response (TDIR). As the pioneer of user and entity behavior analytics (UEBA) and the innovator behind Agent Behavior Analytics (ABA), Exabeam is trusted by more than 3,000 enterprises worldwide to reduce risk, secure the digital workforce, and accelerate security operations. Learn more at www.exabeam.com.
Exabeam: Real Intelligence. Real Security. Real Fast.
CONNECT WITH US:
LinkedIn: https://www.linkedin.com/company/exabeam/
Blog: https://www.exabeam.com/blog/
Thu, 23 Apr 2026 - 52min - 143 - From Chef to CISO: Unlocking the Recipe to Security Leadership
What does sharpening a knife over a case of onions have to do with incident response? For Myke Lyons, CISO at Cribl, the answer is everything. Myke trained at the Culinary Institute of America — learning speed and accuracy under the clock of a professional kitchen — before a summer IT job in Manhattan set him on an entirely different path. In this episode of The New CISO, host Steve Moore traces that journey and the surprising parallels between culinary craft and security leadership.
The conversation moves through a career that evolved organically: a summer job moving refrigerator-sized printers in a Manhattan ad agency, a crash course in executive white-glove IT support, a breakthrough moment finally cracking subnetting, and a slow expansion from NOC operator to global security leader. Myke credits the kitchen — its insistence on precision and calm under fire — for instilling an operator's mindset that still defines how he leads through incidents today.
Mentorship, both formal and accidental, threads through Myke's story. A curmudgeonly colleague who threatened to "replace him with a script" taught him the value of continuous improvement. A trusted mentor reframed the CISO's role with a single line about house fires and lock changes. And years in executive IT support gave Myke an early education in empathy and knowing when not to fix what wasn't asked.
Myke and Steve examine a vendor incident where a product leader's dismissive response to a forensics question destroyed credibility with hundreds of customers. The lesson: saying "I don't know, but we'll find out" is not a weakness — it is the most powerful tool a leader has. The same insight applies to M&A due diligence, where reframing technical conversations as expectation-setting exercises turns adversarial interviews into collaborative ones.
For Myke, the new CISO is defined by empathy and culture. Know your audience. Think like your customers. Communicate policy changes as explanations, not mandates. Find your internal advocates and invest in them before you need them. The recipe for great security leadership is less about technology than it is about people — and that lesson translates perfectly from the kitchen to the boardroom.
Key Topics
• Career pivots: from culinary school to IT and cybersecurity
• Speed, accuracy, and craft — what kitchen discipline teaches security professionals
• Building an operator's mindset and staying calm during security incidents
• White-glove executive IT support and the patience, precision, and empathy it develops
• Mentorship — formal and accidental — and the lessons that only land in retrospect
• The dangers of filling silence with false confidence vs. the power of saying "I don't know"
• Crisis communication best practices and what not to do during a vendor incident call
• Managing M&A security due diligence with low-emotion, expectation-setting conversations
• Building security culture through empathy, clear communication, and internal advocates
• Telemetry, log management, and Cribl's role as the data engine for IT and security
Guest Bio
Myke Lyons is the Chief Information Security Officer at Cribl, the AI platform for telemetry trusted by organizations worldwide — including half of the Fortune 100 — to manage IT and security data at any scale.
He trained at the Culinary Institute of America with aspirations of becoming a food critic — until a summer IT job in Manhattan set him on an entirely different course. Myke went on to build expertise across networking, NOC operations, and log management, holding CISO positions at Snyk and Collibra before joining Cribl in 2024.
Connect with Myke on LinkedIn and learn more about Cribl at cribl.io.
GET A DEMO:
👉 Get a hands-on demo of the Exabeam products: https://www.exabeam.com/demo
🔔 Subscribe for more product demos and cybersecurity insights!
ABOUT EXABEAM:
Exabeam is the leader in behavior intelligence for the agentic enterprise. As organizations deploy digital workers and confront machine-speed adversaries, Exabeam applies agent-powered analytics to understand and govern the behavior of both human and non-human insiders. With integrated Exabeam Nova cybersecurity agents, Exabeam delivers flexible, industry-proven solutions for insider threat coverage of humans and agents and faster, more accurate threat detection, investigation, and response (TDIR). As the pioneer of user and entity behavior analytics (UEBA) and the innovator behind Agent Behavior Analytics (ABA), Exabeam is trusted by more than 3,000 enterprises worldwide to reduce risk, secure the digital workforce, and accelerate security operations. Learn more at www.exabeam.com.
Exabeam: Real Intelligence. Real Security. Real Fast.
CONNECT WITH US:
LinkedIn: https://www.linkedin.com/company/exabeam/
Blog: https://www.exabeam.com/blog/
Thu, 02 Apr 2026 - 44min - 142 - Architect and Firefighter: How a Modern CISO Leads in Crisis
Alan Lucas always wanted to be an architect or a firefighter — as CISO of Worldstream and Greenhouse Datacenters, he has become both. In this episode, he joins host Steve Moore to explore leading cybersecurity at the intersection of design and crisis response.
Alan traces his path from Fox-IT through a Dutch cryptocurrency exchange where he arrived post-breach to an organization under near-constant attack from nation-state threat actors. Leading a technically sophisticated but security-anxious leadership team, he learned the lasting power of transparency and directness — and his most memorable measure of success was not a technical control, but a CTO who finally slept through the night.
The conversation goes deep into crisis communication. Alan and Steve discuss how the industry has matured from reflexive silence around breaches to embracing transparency as a trust-building tool, the danger of well-meaning legal edits that send customers chasing the wrong narrative, and why the CISO should hold final review over all public incident communications. He also shares his Security Champions Program, tabletop exercise design, and why knowing who to call in a crisis must be mapped out before that crisis arrives.
Alan also covers his volunteer work with the DIVD, coaching ethical hackers and supporting responsible disclosure worldwide — an extension of his belief that security, done well, creates trust and enables growth for everyone.
The episode closes on "bouncing forward" — the idea that true resilience means using every incident as a forcing function for improvement, not just a return to baseline. Alan frames lessons learned as the most important resilience KPI a security team can own. A masterclass in leading through both calm and chaos.
Key Topics
• The architect-and-firefighter mindset: building security programs while fighting live fires
• Alan's career path from Fox-IT (MSSP) to post-breach CISO at a cryptocurrency exchange
• Leading security post-breach — and what "sleeping well again" actually means
• The unique threat landscape facing cryptocurrency companies, including nation-state adversaries
• The Dutch Institute for Vulnerability Disclosure (DIVD): coordinated, ethical vulnerability disclosure worldwide
• Mentoring young ethical hackers: communication, confidence, and responsible disclosure process
• Crisis communication: balancing transparency with operational security during active incidents
• Why legal edits to breach notifications can mislead customers and create dangerous distractions
• The CISO's role as final reviewer of all incident communications
• Security Champions Programs: bridging the gap between security and non-technical departments
• Tabletop exercise design: running effective simulations in under an hour with non-technical staff
• Writing the breach notification letter before the breach happens
• Bouncing forward, not bouncing back: using lessons learned as a resilience KPI
• Security as a business enabler: positioning the CISO role for organizational growth and confidence
Guest Bio
Alan Lucas is CISO at Worldstream and Greenhouse Datacenters, two of the Netherlands' leading cloud and data center infrastructure providers. With over a decade of cybersecurity experience, he leads security strategy for mission-critical IT and cloud environments. Prior roles include Fox-IT (MSSP) and LiteBit, a Dutch cryptocurrency exchange where he served as CISO post-breach. Alan also volunteers as a coach at the Dutch Institute for Vulnerability Disclosure (DIVD), mentoring ethical hackers and supporting responsible disclosure globally. He is passionate about security as a catalyst for innovation — and about building a safer digital society, one step at a time.
LEARN MORE:
👉 Connect with Alan on LinkedIn.
GET A DEMO:
👉 Get a hands-on demo of the Exabeam products: https://www.exabeam.com/demo
🔔 Subscribe for more product demos and cybersecurity insights!
ABOUT EXABEAM:
Exabeam is a leader in intelligence and automation that powers security operations for the world’s smartest companies. As a global cybersecurity innovator, Exabeam provides industry-proven, security-focused, and flexible solutions for faster, more accurate threat detection, investigation, and response (TDIR). Cutting-edge technology enhances security operations center performance, optimizing workflows and accelerating time to resolution. With consistent leadership in AI innovation and a proven track record in security information and event management (SIEM) and user behavior analytics, Exabeam empowers global security teams to combat cyberthreats, mitigate risk, and streamline operations.
Real Intelligence. Real Security. Real Fast. Learn more at: https://www.exabeam.com/
CONNECT WITH US:
X/Twitter: https://x.com/exabeam
Instagram: https://www.instagram.com/exabeam/
LinkedIn: https://www.linkedin.com/company/exabeam/
Facebook: https://www.facebook.com/Exabeam/
Blog: https://www.exabeam.com/blog/
Thu, 12 Mar 2026 - 48min - 141 - Six Steps for Better Communication as a CISO
In this episode of The New CISO, host Steve Moore speaks with Dean Sapp, CISO and Data Protection Officer at Filevine, about one of security's most critical yet overlooked skills—written communication. Drawing from a brutal college English class that failed students for a single typo and over 20 years building security programs in the legal tech industry, Dean reveals why the ability to articulate security findings clearly separates average professionals from exceptional leaders who drive real business impact.
After abandoning architecture when he learned it would take six years to become licensed, Dean leveraged his dual skills in computer-aided drafting and IT to launch a career at Novell, eventually earning nine certifications in two years and a master's degree from SANS Institute. His background in design thinking shapes how he approaches security program development—viewing it like building a structure that requires solid foundations, functional systems, and even window dressing like SOC 2 compliance.
After interviewing over 100 candidates for SOC positions, Dean identifies the biggest missing skill as the inability to translate security findings into business language executives understand and act upon. He introduces the BLUF (Bottom Line Up Front) principle from military communications, explaining why security professionals have roughly eight seconds to capture executive attention. Dean champions radical transparency through simple frameworks—using stoplight systems or report card grades to communicate security posture, deliberately giving his own program failing marks in areas needing improvement to build trust.
Dean tackles operational communication breakdowns that create real security risk, emphasizing mandatory peer review before escalating incidents. This two-person rule dramatically improves report quality while reducing false positives that waste senior leadership time. He shares how this high-standards approach helped Filevine achieve best-in-class cyber insurance rates, with underwriters calling their security program superior to any SaaS provider they'd evaluated. Drawing on Erik Durschmied's "The Hinge Factor," he illustrates how small communication failures doom missions—just as cavalry troops charging cannons failed because not one rider carried the nails and hammer needed to disable them.
Throughout the discussion, Dean emphasizes holding yourself to impossibly high standards so that external auditors find you excellent. He advocates for brutal honesty about program gaps, documenting accepted risks clearly, and using tools like Grammarly Premium to improve writing quality. His philosophy combines military precision, architectural thinking, and pedagogical discipline—all in service of making security programs that actually work rather than just looking good on paper.
Key Topics Discussed:
* Why written communication is security's most critical missing skill
* BLUF (Bottom Line Up Front): Capturing executive attention in 8 seconds
* Using stoplight or report card systems for transparent board reporting
* Giving your security program honest grades to build executive trust
* Mandatory peer review before escalation to reduce false positives
* How Filevine achieved best-in-class cyber insurance rates
* The two-person rule for improving incident report quality
* Lessons from "The Hinge Factor" about preparation and tools
* Holding impossibly high standards so external auditors find you excellent
* Translating technical findings into business impact language
LEARN MORE:
👉 LinkedIn: https://www.linkedin.com/in/deansapp
Company Website: https://www.filevine.com
GET A DEMO:
👉 Get a hands-on demo of the Exabeam products: https://www.exabeam.com/demo
🔔 Subscribe for more product demos and cybersecurity insights!
ABOUT EXABEAM:
Exabeam is a leader in intelligence and automation that powers security operations for the world’s smartest companies. As a global cybersecurity innovator, Exabeam provides industry-proven, security-focused, and flexible solutions for faster, more accurate threat detection, investigation, and response (TDIR). Cutting-edge technology enhances security operations center performance, optimizing workflows and accelerating time to resolution. With consistent leadership in AI innovation and a proven track record in security information and event management (SIEM) and user behavior analytics, Exabeam empowers global security teams to combat cyberthreats, mitigate risk, and streamline operations.
Real Intelligence. Real Security. Real Fast. Learn more at: https://www.exabeam.com/
CONNECT WITH US:
X/Twitter: https://x.com/exabeam
Instagram: https://www.instagram.com/exabeam/
LinkedIn: https://www.linkedin.com/company/exabeam/
Facebook: https://www.facebook.com/Exabeam/
Blog: https://www.exabeam.com/blog/
Thu, 19 Feb 2026 - 48min - 140 - The Four Cs: Why a Schoolteacher Makes a Great CISO
In this episode of The New CISO, host Steve Moore speaks with Manuel "Manu" Ressel, CISO at SAUTER Group, about his unconventional journey from classroom teacher to cybersecurity leader—and why the "Four Cs" of modern education provide a powerful framework for building effective security programs. Drawing from years as both a teacher and school principal in Germany, Manu introduces Critical Thinking, Communication, Collaboration, and Creativity as essential leadership skills that fundamentally challenge how the industry approaches awareness training and incident response.
After growing frustrated with Germany's outdated education system that prioritized memorization over critical thinking, Manu left his position as principal and reinvented himself as a digital transformation consultant. Working with schools and mid-sized companies to adopt cloud technologies, he eventually landed the CISO role at SAUTER, an international building automation company with 4,000 employees across multiple countries.
The conversation tackles security's most persistent failure: awareness training that doesn't work. Manu reveals that 37% of security incidents in Germany could be prevented if users made better decisions, yet most organizations rely on boring click-through programs. He advocates for scenario-based, role-specific training—an approach now mandated by Europe's NIS 2 regulation—that treats people as the biggest opportunity in cybersecurity rather than the weakest link.
One of the episode's most practical frameworks is Manu's Observation-Description-Interpretation method for analyzing security incidents. He explains how humans naturally jump from observation directly to interpretation, skipping the crucial middle step of accurately describing what actually happened. This leads to finger-pointing, misdiagnosis, and hasty decisions. By training security analysts to pause and describe incidents factually first, teams make better decisions and build trust with the business.
Manu challenges the punitive approach many organizations take toward security failures, particularly companies that fire employees for repeatedly clicking phishing simulations. He champions building positive fault cultures where employees feel safe reporting mistakes. His three crisis questions—Is anyone dying? Major financial impact? Will someone be hurt?—provide a simple framework for staying calm and deciding when immediate action is necessary versus taking time to think strategically.
Key Topics Discussed:
- Why the "Four Cs" (Critical Thinking, Communication, Collaboration, Creativity) define effective security leadershipThe Observation-Description-Interpretation framework for incident analysis without biasTransforming ineffective awareness training into engaging, scenario-based programsBuilding positive security cultures where employees report issues without fearNIS 2's mandate for role-specific cybersecurity training across organizational levelsWhy Germany and European mid-market companies lag in cloud adoptionThree critical crisis questions: Is anyone dying? Financial impact? Risk of harm?Why punitive phishing training destroys trust and cultural engagementApplying teacher skills to security leadership and de-escalation techniquesStaying calm as a CISO's most important superpower during incidents
LEARN MORE:
👉 Guest LinkedIn: https://www.linkedin.com/in/manuel-ressel-9279b997/
Company website: https://www.sauter-controls.com/
GET A DEMO:
👉 Get a hands-on demo of the Exabeam products: https://www.exabeam.com/demo
🔔 Subscribe for more product demos and cybersecurity insights!
ABOUT EXABEAM:
Exabeam is a leader in intelligence and automation that powers security operations for the world’s smartest companies. As a global cybersecurity innovator, Exabeam provides industry-proven, security-focused, and flexible solutions for faster, more accurate threat detection, investigation, and response (TDIR). Cutting-edge technology enhances security operations center performance, optimizing workflows and accelerating time to resolution. With consistent leadership in AI innovation and a proven track record in security information and event management (SIEM) and user behavior analytics, Exabeam empowers global security teams to combat cyberthreats, mitigate risk, and streamline operations.
Real Intelligence. Real Security. Real Fast. Learn more at: https://www.exabeam.com/
CONNECT WITH US:
X/Twitter: https://x.com/exabeam
Instagram: https://www.instagram.com/exabeam/
LinkedIn: https://www.linkedin.com/company/exabeam/
Facebook: https://www.facebook.com/Exabeam/
Blog: https://www.exabeam.com/blog/
Thu, 29 Jan 2026 - 54min - 139 - Safety Third: Why Security Shouldn't Be Your Top Priority
In this episode of The New CISO, host Steve Moore speaks with Alex Rice, Founder, CTO, and CISO at HackerOne, about challenging one of cybersecurity's most deeply held beliefs—that security should be the top priority. Drawing from his journey building security programs at Facebook and founding HackerOne, Alex introduces the "safety third" philosophy and explains why accepting that security is never first can actually make you more effective as a leader.
Alex shares his unconventional path into cybersecurity, starting as a 14-year-old programmer in rural Florida and eventually leading product security at Facebook during its explosive growth. He reveals how Facebook ran 70+ penetration tests annually with top-tier vendors and still wasn't finding enough vulnerabilities—until they opened the doors to the hacker community and received over 300 valid findings in a single weekend. This experience became the foundation for HackerOne's bug bounty platform.
The conversation tackles critical leadership challenges facing modern CISOs, including the toxic tendency toward victim blaming when breaches occur, why security teams struggle with customer-centric design, and how to avoid becoming the team everyone knows only for blocking work and sending phishing tests. Alex argues that security professionals must stop drinking their own Kool-Aid and recognize that usability and business outcomes will always take precedence over security controls.
In the episode's second half, Alex addresses AI's role in security operations with refreshing pragmatism. Rather than chasing grandiose AI visions, he advocates for starting with narrow, well-defined tasks where agents can replace security toil—like automated CVSS scoring or vulnerability triage—building trust and expertise before tackling more ambitious projects. He warns against the current trend of AI tools that find more problems when security teams desperately need help fixing the mountain of issues they already know about.
Alex also challenges CISOs to stop over-owning problems like asset inventory management that rightfully belong to other executives, emphasizing the importance of cross-functional collaboration over building security-owned solutions that ultimately fail. Throughout the discussion, he champions a philosophy of empathy, customer-centricity, and accepting hard truths about security's actual place in business priorities—a mindset shift that paradoxically makes security leaders far more effective.
Key Topics Discussed:
- Why "safety third" should be every CISO's operating philosophyThe problem with victim blaming in cybersecurity incidentsBuilding customer-centric security programs that enable rather than blockLessons from scaling Facebook's security program with 70 pen tests per yearThe origin story of HackerOne and crowdsourced security testingHow to avoid becoming the security team everyone resentsPractical AI implementation: Starting with toil elimination, not transformationWhy CISOs over-own asset management and other problemsThe importance of process mapping before deploying AI agentsAligning security teams closely with AI and software development
Thu, 08 Jan 2026 - 1h 06min - 138 - Just Starting in Security? Here’s What You Need to Succeed
In this episode of The New CISO, host Steve Moore speaks with Iain Paterson, Chief Information Security Officer at Well Health Technologies, about his unconventional path into cybersecurity and the lessons learned from building programs across industries—from banking and healthcare to breach response and beyond.
From skipping college to take an eight-month technical boot camp to leading enterprise security programs, Iain shares how curiosity, hands-on experience, and communication skills shaped his journey. He opens up about the realities of hiring in cybersecurity, why foundational IT work still matters, and how soft skills like empathy and composure are essential for effective leadership. Iain also reflects on leading through high-stress incidents, including the Ashley Madison breach, and explains why staying calm, communicating clearly, and maintaining emotional intelligence define the “new CISO.”
Key Topics Covered:
A nontraditional start: skipping college for certifications and hands-on learningWhy technical foundations—servers, networks, and support—still matterThe problem with “boilerplate” resumes and lack of real-world experienceWhy soft skills are a security superpower: communication, patience, and empathyTransitioning from technician to business enabler in cybersecurityHow early help desk experience builds composure and problem-solving abilityLessons from running vulnerability management in large-scale bankingLearning resilience and resourcefulness as a one-person security team in healthcareBehind the scenes of the Ashley Madison breach: stress, responsibility, and empathyWhy composure, calm communication, and credibility matter in crisis responseThe leadership evolution from technical expert to executive decision-makerBuilding peer networks and finding mentorship to combat isolation as a CISOIain’s story highlights how real experience, emotional intelligence, and community support transform good technologists into exceptional leaders. His insights remind us that cybersecurity isn’t just about defense—it’s about communication, composure, and connection.
Thu, 04 Dec 2025 - 49min - 137 - Think Outside the Job: How to Shift Your Career Mindset
In this episode of The New CISO (Episode 137), host Steve Moore speaks with Gideon Knocke, CISO at Visage Imaging, about rethinking how we grow in our careers and why learning to “think outside the job” is key to long-term success.
From studying cybersecurity when the field was still new to leading security for millions of patient records in healthcare, Gideon shares how his early curiosity and “career accidents” helped shape his mindset as a modern CISO. He reflects on shifting from technical problem-solving to people-centric leadership, learning how visibility and credibility shape opportunity, and why networking—inside and outside your company—is essential for resilience and growth. Gideon also explains why risk quantification isn’t just about numbers, but about decision-making, communication, and understanding what your organization truly values.
Key Topics Covered:
Early lessons from studying cybersecurity before it went mainstreamWhy some of the best careers evolve through “happy accidents” and curiosityHow to build visibility and relevance beyond doing good workThe difference between being seen as an asset versus a personHow networking and outreach can transform your mindset and open new doorsTurning fear of public speaking into confidence through preparation and iterationThe leadership balance between taking accountability and fostering team candorWhy large-organization politics can hinder honest communicationThe art of quantifying risk for better decision-making, not just reportingWhy the new CISO must start with company beliefs and build security on shared valuesGideon’s journey reveals that career success often comes from stepping outside your comfort zone—whether that’s reaching out to 100 strangers on LinkedIn, giving your first talk, or reframing how you communicate risk. His insights remind leaders that growth begins when you stop thinking only about your job and start thinking about your impact.
Thu, 13 Nov 2025 - 52min - 136 - Pick Your Pain: A Methodical Approach to Career Growth
In this episode of The New CISO (Episode 136), host Steve Moore speaks with Carl Cahill, CISO, about a deliberate, methodical approach to career growth—and why every leader must “pick their pain” to progress.
From combat arms in the U.S. Army to Active Directory engineering and large-enterprise incident response, Carl shares the pivotal choices that shaped his leadership. He opens up about moving from certifications to business fluency, using a personal gap analysis to chart his path to the C-suite, and how feedback like being called a “propeller head” pushed him to translate geek speak into the language of finance, law, and strategy. Carl also explains his five-phase 100-day plan, why IR readiness comes first, and how “radical collaboration” defines the modern CISO.
Key Topics Covered:
Early career pivots: Army leadership, perseverance, and precision → IT foundationsCertifications as a fast track (then) vs. blended learning and passion projects (now)The “pick your pain” decision: staying comfortable vs. returning to school to advanceBuilding a CISO gap analysis from job reqs and targeting stretch assignmentsUpgrading the lexicon: finance, legal, and general management (e.g., Wharton GMP)Turning tough feedback into growth: from geek speak to boardroom dialogueConsulting variety vs. ownership: when to switch for long-term impactThe 100-day plan: assess → plan → act → measure → adjust (with IR first)Stakeholder mapping, team SWOTs, and making strategy stick beyond 90 daysMetrics as a “health language” and why today’s CISO must be a radical collaboratorCarl’s story shows how intentional trade-offs—education, language, and leadership style—compound into career momentum. His roadmap helps CISOs and aspiring leaders navigate transitions with discipline, communicate across the business, and build resilient teams that lead with clarity.
Thu, 23 Oct 2025 - 45min - 135 - From Breach to BISO: Becoming a Security Influencer
Most security professionals know what a CISO does. But what about a BISO? And why are Fortune 500 companies increasingly creating this executive role?
In this episode of The New CISO Podcast, host Steve Moore sits down with Evan Ferree, Staff Vice President and Business Information Security Officer at a Fortune 50 company, to decode one of cybersecurity's most misunderstood leadership positions.
What You'll Learn:
Understanding the BISO Role:
What a Business Information Security Officer actually does (and how it differs from a Deputy CISO)When organizations need a BISO - the size, industry, and complexity indicatorsWhy the BISO serves as a "force multiplier" for the security organizationHow to measure and defend BISO value during organizational changeThe Career Journey:
Evan's unconventional path from IT infrastructure to executive security leadershipHow a major cybersecurity breach became his "MBA in cybersecurity" in six monthsWhy volunteering for uncomfortable work during crisis creates career opportunitiesThe progression from vulnerability analyst to SOC leadership to Staff VPThe 90% Influence Principle:
Why the BISO role is about influence, not authorityHow to navigate multiple business units with different security needsMastering the "why" behind security initiatives for non-technical audiencesBuilding relationships and organizational awareness over timeExecutive Skills That Matter:
The "log lines" storytelling framework from Deloitte CISO AcademyDeveloping executive presence through failure and self-awarenessWhen to end a meeting and start over (and why that's okay)Speaking plain English vs. technical jargon with business leadersPractical Career Advice:
Transitioning from tactical security operations to strategic leadership rolesWhy getting uncomfortable is essential for growthBuilding business acumen alongside technical expertiseWhy Evan's best security hires came from outside cybersecurityKey Insight: "You are 90% an influencer in this role. Unlike tactical security work where authority and urgency create credibility, the BISO must master explaining why security matters to the business - in terms the business understands."
Whether you're a security professional planning your path to executive leadership, a CISO considering adding a BISO function, or a business leader trying to understand how security enables business outcomes, this episode delivers actionable insights from someone who's lived the journey.
Guest: Evan Ferree, Staff Vice President & Business Information Security Officer at a Fortune 50 company, with 11 years of progressive security leadership experience spanning Security Operations, threat management, vulnerability management, and business information security.
Hosted by: Steve Moore | Produced in partnership with: Exabeam
Thu, 02 Oct 2025 - 41min - 134 - Are You Relying on the Right Tools?
In this episode of The New CISO, host Steve Moore speaks with Dr. Timo Wandhöfer, Group CISO and Head of Information Security & Business Continuity Management at Klöckner & Co, about the evolving responsibilities of modern CISOs and why influencing—not just convincing—stakeholders is essential for success.
From his early career as a researcher in computer science to leading global security and resiliency efforts in the steel industry, Timo shares how critical thinking, skepticism, and cross-functional collaboration shaped his leadership style. He reflects on the dangers of overconfidence in detection, the risks of over-relying on tools, and the lessons learned from merging information security with business continuity. Timo also explores how AI can both accelerate remediation and introduce new risks, and why resilience planning and transparent communication are at the core of effective leadership.
Key Topics Covered:
The evolving role of the CISO: from protection to resilience and adaptabilityHow research skills translate into critical thinking and cross-functional collaborationWhy overconfidence and lack of visibility remain major pitfalls in security programsThe importance of transparency, maturity, and asset inventory for strong defensesResiliency planning: ransomware recovery, crisis management, and operating modelsInsider threat investigations and the role of HR, Legal, and IT in responseThe shift from convincing to influencing stakeholders through dialogueThe promise and risks of AI and automation in remediation and decision-makingWhy today’s CISO must be a communicator, storyteller, and business leaderTimo’s journey highlights how resilience, adaptability, and influence define the “new CISO.” His insights provide a roadmap for leaders who want to strengthen security programs, build trust with stakeholders, and guide their organizations with both technical and business acumen.
Thu, 11 Sep 2025 - 44min - 133 - Teachable Moments: How to Learn from Career Challenges
In this episode of The New CISO, host Steve Moore speaks with Steve Lodin, VP of Information Security at Sallie Mae, about the career challenges that shaped his leadership style and the lessons he’s learned across decades in cybersecurity.
From breaking into his high school to experiment with Apple II computers to leading global security teams in Europe, Steve shares the pivotal experiences that defined his career. He opens up about career missteps, the importance of asking the right questions before accepting a new role, and how succession planning and crisis preparation are critical for every security leader. Steve also reflects on how medical emergencies, breach response, and shifting industries—from automotive to healthcare to financial services—taught him resilience, adaptability, and perspective.
Key Topics Covered:
Early career pivots, from engineering to cybersecurity leadershipLessons learned from career missteps and short-lived rolesThe five factors Steve now evaluates before taking a new jobSuccession planning and preparing teams to lead during emergenciesWhy tabletop exercises and exposure to executives matter for resilienceManaging stress, staying calm, and keeping perspective in high-pressure rolesThe long-tail business impact of breaches beyond immediate costsWhy financial services foster collaboration and innovation in securityThe importance of mentoring and introducing students to cybersecurity careersSteve’s story reveals why the most valuable lessons often come from challenges, not successes. His insights provide a roadmap for CISOs and aspiring leaders who want to navigate setbacks, lead with composure, and build stronger teams for the future.
Thu, 21 Aug 2025 - 41min - 132 - How to Score a Security Role — Without Collecting Certifications
In this episode of The New CISO, host Steve Moore speaks with Marius Poskus, Chief Information Security Officer at Glow Financial Services and creator of the Cyber Diaries podcast. Marius shares his journey from physical security into cybersecurity leadership—and how he did it without relying on traditional certifications.
Marius reflects on how self-directed learning, mentorship, and a strong personal brand helped him pivot careers and thrive in the FinTech space. He explains why the security industry needs to stop glorifying certifications, how to break in through SOC roles, and what truly makes a candidate stand out in interviews. From coaching new talent to advising startups on go-to-market strategies, Marius emphasizes that attitude and aptitude matter far more than credentials.
Key Topics Covered:
Why Marius walked away from a career in physical security—and how that experience shaped his cyber pathThe critical difference between certification collecting and real-world skill developmentWhy most entry-level cybersecurity roles are in SOCs—and how to leverage thatHow sharing your learning journey online builds credibility and unlocks job opportunitiesThe two A’s that matter most when hiring: attitude and aptitudeCommon mistakes startups make when targeting CISOs and building security toolsThe growing risks of “AI-washing” and what real AI innovation should look likeWhy mentorship only works when mentees are willing to put in the workHow to shift from security awareness “stick” tactics to culture-based collaborationWhat it means to build a personal brand that outlasts your job titleMarius’ story proves that cybersecurity success doesn’t come from certificates—it comes from curiosity, consistency, and community. Whether you’re just starting your career or leading a security team, this episode will inspire you to focus on what really moves the needle.
Marius Poskus Podcast - Cyber Diaries Podcast
Thu, 24 Jul 2025 - 51min - 131 - Ask the Right Questions: How Building Trust Brings Value
In this episode of The New CISO, host Steve Moore speaks with Aleksandar Radosavljevic, Global CISO at Global Fashion Group, about building trust, measuring resilience, and the evolving role of the security leader.
Aleksandar shares how his unexpected pivot from electrical engineering to cybersecurity sparked a passion for protecting systems and solving problems. With over two decades of experience across pharma, manufacturing, and tech, he offers insights into how security leaders can establish trust, drive business value, and focus on what really matters.
The conversation covers the art of starting strong in a new CISO role, navigating interviews with curiosity and care, and avoiding common traps like overcomplicating metrics or chasing the latest tools without mastering the basics.
Key Topics Covered:
Why pharma’s mission-driven work made a lasting impact on AleksandarCareer advice for cybersecurity newcomers: follow learning, not just industryHow CISOs can build early trust by listening and understanding the businessRed flags and green lights during the CISO interview processWhy being challenged in an interview signals a healthy security cultureThe problem with vanity metrics—and what to track insteadAleksandar’s favorite KPIs: time to detect, respond, and contain incidentsThe role of situational awareness in building cyber resilienceHow simplifying language helps CISOs align with executive teamsWhy mandate and mindset matter more than reporting linesAleksandar’s story is a reminder that cybersecurity leadership is about more than tools and tactics—it’s about trust, transparency, and transforming security from a blocker into a true business enabler.
Thu, 03 Jul 2025 - 50min - 130 - The Challenge of Securing Critical Infrastructure
In this episode of The New CISO, host Steve Moore speaks with Keith Price, Chief Security Officer at National Highways, about the evolving responsibilities of modern security leaders and the critical role of convergence between cyber, physical, and people security.
Keith shares real-world stories from his work protecting England’s strategic road network—used by over four million people daily—and explains why understanding both legacy infrastructure and cutting-edge technology is essential for building a resilient security strategy. From managing insider threats and recovering stolen radar equipment to championing mental health and developing junior talent, Keith offers a holistic approach to leadership in critical infrastructure.
Key Topics Covered:
How converging physical, cyber, and personnel security leads to stronger protectionReal-life insider threat examples—and how sensors helped prevent major damageThe challenge of managing decades-old asset tracking systems across regionsWhy availability and integrity of data now outweigh confidentiality in certain sectorsHow Keith’s team detected stolen highway radar for sale on eBayThe importance of empathetic leadership and supporting mental health in security teamsHow "Cyber Coffee" sessions create safe spaces for vulnerability and connectionUpskilling IT staff into cybersecurity roles through “pay-it-forward” learningThe case for offering security-as-a-service to small but critical supply chain partnersKeith’s insights reveal why successful security leadership requires more than just technical knowledge—it demands communication, humility, and a deep understanding of human behavior. This conversation is a must-listen for any security professional working to bridge silos and lead with impact.
Thu, 12 Jun 2025 - 1h 00min - 129 - Is Done Better Than Perfect? Self-Awareness as a CISO
In this episode of The New CISO, host Steve Moore speaks with Ben, Director of Group Security and Architecture at Bilfinger, about the role of self-awareness, confidence, and communication in effective cybersecurity leadership.
Ben shares his unconventional path to becoming a CISO, how he applies the “done is better than perfect” philosophy, and why embracing vulnerability, curiosity, and creativity is key to building strong teams. From baking sourdough to producing his own podcast, Ben highlights how personal passions can shape professional growth.
Key Topics Covered:
Why done is better than perfect can be a strength—not a flaw—in cybersecurityThe surprising connection between baking sourdough and fostering security cultureHow Ben’s podcast, Infosec Theater, educates non-technical audiences using humor and storytellingThe creative interview question he uses to gauge mindset: “If cybersecurity were an animal, what would it be?”Why hiring for attitude and resilience beats hiring for experience aloneHow podcasting sharpened his ability to listen, simplify, and leadBen also emphasizes the importance of recognizing your own strengths and surrounding yourself with people who balance them out. His perspective offers actionable takeaways for CISOs and security professionals seeking to grow into thoughtful, human-centered leaders.
🔗 Listen to Ben’s podcast, Infosec Theater: https://www.infosec.theater/
Thu, 22 May 2025 - 47min - 128 - Classroom to Boardroom: How Teaching Makes Leaders Better
In this episode of The New CISO, host Steve Moore talks with Nithin Reddy, Global VP of Cybersecurity at Dayforce, about how his dual roles in cybersecurity leadership and education shape his approach to building stronger, smarter teams.
Nithin reveals how teaching cybersecurity not only amplifies his impact but also sharpens his communication and leadership skills. From protecting millions of users’ data to mentoring students and influencing curriculum design, he shares why simplifying complex ideas is the key to inspiring both executives and future security professionals.
The conversation explores:
The link between teaching and leadership growthHow to manage stress in high-stakes security operations—and tell the difference between “good” and “bad” stressDayforce’s in-house employee risk scoring model and the power of just-in-time access controlsThe impact of generative AI on phishing threats and how awareness training must evolveA real-life story of using a fake $200 gift card to teach conference-goers a lesson on social engineeringWhether you’re leading a SOC or standing at the front of a classroom, this episode is a masterclass in turning knowledge into influence—and purpose into performance.
Thu, 01 May 2025 - 51min - 127 - What Can Cutting Cake Teach a CISO?
In this episode of The New CISO, host Steve Moore speaks with Rich Durost, Chief Information Security Officer at Froedtert ThedaCare Health, about his journey from West Point cadet to cybersecurity leader—and what slicing cake has to do with building effective security programs.
Drawing from 23 years in the military and over 15 years in cybersecurity, Rich shares how discipline, preparation, and teamwork—skills first sharpened during plebe year dessert duty—translate directly into the responsibilities of a CISO. He reflects on the shift from tactical to strategic thinking, the value of mentoring deputies, and why authentic leadership and relationship-building are vital in today’s remote work environment.
Rich also explores the unique challenges of healthcare cybersecurity, the importance of aligning with clinical goals, and how CISOs can move from being the "department of no" to strategic business enablers by simply asking “how” instead of “no.”
Whether you're a rising security professional or a seasoned executive, you’ll gain practical leadership takeaways—and maybe a new appreciation for cake.
Thu, 10 Apr 2025 - 45min - 126 - Why the Best Security Leaders Stay Curious
In this episode of The New CISO, host Steve Moore sits down with Michael Mendelsohn, CISO at Majesco, to discuss his journey in cybersecurity—from his early days as a software developer to leading security for a major insurance software company.
Michael shares insights into the evolving role of a CISO, the intersection of security and technology, and how curiosity and problem-solving have shaped his career. He dives into his experience building Arcus, an early security tool designed for software inventory and patch management, and how grassroots security engineering played a pivotal role in his professional growth.
Other key topics include:
✅ The changing landscape of cybersecurity leadership
✅ The balance between open-source tools and enterprise security solutions
✅ AI’s impact on security automation and risk management
✅ How security leaders can work effectively with legal teams
✅ The importance of curiosity, adaptability, and mentorship in a security career
Whether you're a seasoned security professional or an aspiring CISO, this episode offers valuable insights into the challenges and opportunities of leading security in today’s rapidly evolving digital landscape.
🔗 Listen now and learn how to navigate the complexities of cybersecurity leadership with a strategic and technical mindset!
#Cybersecurity #CISO #Leadership #SecurityEngineering #AI #CyberThreats #RiskManagement #DataSecurity #TechLeadership
Thu, 20 Mar 2025 - 51min - 125 - Embracing Naivety as a New CISO
In this episode of The New CISO, host Steve Moore sits down with Yannick Herrebaut, Cyber Resilience Manager at the Port of Antwerp-Bruges, to explore his unconventional journey from intern to security leader. Yannick shares how his early passion for technology, sparked by gaming and building his own PCs, laid the foundation for his career in cybersecurity.
They discuss the importance of strong internship programs, the transition from network engineering to security leadership, and the key lessons learned when stepping into a CISO role for the first time. Yannick also reflects on the challenges of building a security program from scratch and the critical skills needed to lead a growing security team.
Key topics include:
How internships can shape future cybersecurity leadersThe transition from network engineering to security leadershipThe importance of business alignment in cybersecurityLessons learned in managing a growing security teamAdvice for aspiring CISOs on stepping into leadership roles00:00 - Introduction & Meet Yannick Herrebaut
02:30 - From Gaming to Cybersecurity: A Passion for Technology
06:30 - Internship at the Port of Antwerp: A Career Launchpad
10:00 - The Value of Cybersecurity Internships & Mentorship
17:00 - From Network Admin to CISO: A Big Career Leap
27:00 - Building a Security Program from Scratch
35:00 - Lessons in Leadership & Team Growth
45:30 - What It Means to Be a New CISO
Links: LinkedIn
Thu, 27 Feb 2025 - 50min - 124 - Take a Preemptive Strike on Your Career
In this insightful episode of The New CISO, host Steve Moore reconnects with Azzam Zahir to explore his career evolution, from cybersecurity leadership to his recent role as a vertical CIO at General Motors. Azzam shares candid reflections on his conscious decision to leave his 12-year tenure, embracing change, and navigating personal growth in leadership roles.
Dive into Azzam’s inspiring journey as he discusses:
Overcoming Career Burnout: How to recognize signs of exhaustion and take proactive steps toward rejuvenation.Navigating Career Pivots: The importance of calculated risks and stepping beyond the traditional boundaries of cybersecurity.Building Trust Through Relationships: Insights on fostering trust and credibility within organizations to facilitate career growth.Maintaining Mental Health: Practical tips on incorporating wellness into demanding careers, from mental health check-ins to daily habits for balance.The Gartner Hype Cycle of Careers: Azzam's unique perspective on managing career highs and lows and knowing when to make a change.This episode is a must-listen for IT and security professionals considering career transitions, aspiring leaders seeking inspiration, or anyone looking to balance professional growth with personal well-being. Tune in to gain actionable advice and deep reflections from a leader who’s successfully embraced transformation.
0:00 Introduction and Guest Overview
1:43 Announcing a Career Change
5:54 Transitioning from Cybersecurity to CIO
13:03 The Emotional Impact of Cybersecurity Careers
22:36 Prioritizing Health and Wellness
30:10 The Power of Non-Traditional Thinking
35:34 The Gartner Hype Cycle of Careers
41:55 Advice for Career Transitions
Links: LinkedIn
Thu, 23 Jan 2025 - 45min - 123 - When and How to Find Your Next Role
In this insightful episode of The New CISO, host Steve Moore sits down with Sanju Misra, Chief Information Security Officer (CISO) at Alnylam Pharmaceuticals, to explore the pivotal moments that have shaped her impressive career in cybersecurity leadership. Sanju shares her strategies for navigating career transitions, the importance of aligning with a company’s mission, and how to identify the right time to move on from a role.
Listeners will gain valuable insights into:
How Sanju built her career by embracing challenging projects and maintaining authentic professional relationships.The decision-making processes behind her moves from GE to Praxair, and eventually to Alnylam Pharmaceuticals.The evolution of her leadership style from a technical expert to a business risk executive.Why aligning with a company’s culture and mission is crucial for long-term success.Tips for aspiring CISOs on taking initiative, growing their networks, and articulating risk in business terms.Sanju’s reflections on imposter syndrome, professional growth, and the rewards of working in a patient-focused organization offer both inspiration and practical advice for leaders at every stage of their careers. Tune in to hear her story and discover actionable strategies for thriving as a modern CISO.
0:00 - Introduction and Show Overview
1:10 - Sanju Misra’s Career Path: From GE to Praxair
4:00 - Building Security Programs and Leadership Growth
6:30 - Navigating Mergers and the Role of Culture
10:00 - Transitioning from Technologist to Business Risk Leader
15:50 - Career Advice for Aspiring CISOs
22:00 - Key Takeaways: Communication and Leadership Evolution
Links: LinkedIn
Thu, 26 Dec 2024 - 25min - 122 - Don’t Check Every Box of the Job Description
In this episode of The New CISO, host Steve Moore is joined by Sanju Misra, CISO and IT Risk Leader at Alnylam Pharmaceuticals. Sanju shares her journey from a college side hustle on a typewriter to becoming a security leader in the pharmaceutical industry. Along the way, she reflects on the importance of taking risks, embracing roles outside of your comfort zone, and the power of transferable skills.
Listen to Steve and Sanju discuss career transitions, building diverse teams, and why not checking every box on a job description might be the best career move:
00:00 - Meet Sanju
06:15 - The Start of a Tech Journey
18:30 - Taking the Leap
27:00 - Advice for Job Seekers
39:45 - Hiring from Within
51:15 - Networking and Career Growth
Links: LinkedIn
Tue, 03 Dec 2024 - 31min - 121 - How to Tackle Tough Interviews and Career Transitions
In this episode of The New CISO, host Steve Moore welcomes Ryan Shaw, Director of Information Security at Bond Brand Loyalty. Ryan shares his unique journey from working in kitchens and warehousing to becoming a leader in cybersecurity. He reflects on the importance of career change, battling imposter syndrome, and the challenges candidates face in a tough job market where companies often hunt for "unicorn" candidates.
Listen to Steve and Ryan discuss the transition into IT security, why hiring practices need to evolve, and the importance of mentorship for both personal and professional growth:
00:00 - Ryan Shaw’s Journey: From Warehousing to InfoSec Leadership
03:00 - Career Pivot: Entering Technology
06:00 - Overcoming Imposter Syndrome in IT
09:00 - The Importance of Mentorship and Support
13:00 - Navigating the Challenges of Job Hunting
17:00 - Advice for Better Hiring Practices in Security
20:00 - Building Visibility and Breaking Into InfoSec
24:00 - What It Means to Be a Security Leader
Links: LinkedIn
Thu, 07 Nov 2024 - 41min - 120 - Taking the First Step Toward Your Career Dreams
Summary:
In this episode of The New CISO, host Steve Moore speaks with Nicola Sotira, Head of CERT at Poste Italiane, about his journey from technical expert to business leader, all while following his dreams. Nicola shares the importance of mentorship, the value of building strong teams, and how he applied a Viking mentality to overcome challenges in his career. Listen in as Nicola reflects on leaving a prestigious role in Italy to embrace new opportunities abroad and what aspiring leaders can learn from his story. Whether you're thinking about making a career change or simply looking for advice on leadership, Nicola’s insights will inspire you to take action and move toward your dreams.
Listen to Steve and Nicola discuss:
00:00 -Nicola Sotira's Career Journey and Mentorship
03:37 - Balancing Business and Technical Roles
06:40 - Adapting to Technological Disruption
08:47 - Taking Risks: Moving to Sweden at Age 40
15:12 - Leadership Lessons from Peter: The Viking Mentality
18:17 - Hiring and Building a Strong IT Security Team
23:23 - Making Work Fun and Following Your Passion
28:52 - Advice for Aspiring CISOs: Follow Your Dreams
Links: LinkedIn
Thu, 17 Oct 2024 - 30min - 119 - What Legacy Tech Can Teach New Leaders
Episode Summary: In this episode of The New CISO, host Steve Moore is joined by Nicola Sotira, head of CERT at Poste Italiane. Nicola shares his journey from working on cryptographic devices in the pre-internet era to leading security teams today. His early work with assembly language, hardware security, and cryptanalysis offered unique challenges, but it also taught him the value of persistence, creativity, and mentorship. Steve and Nicola discuss the evolving role of hardware in cybersecurity and the importance of securing the supply chain. Listen in to hear about the lessons Nicola learned from breaking hardware before it was sold and how they continue to inform his approach to security today.
Listen to Steve and Nicola discuss the importance of hardware security, debugging code, and supply chain risks:
00:00 - Nicola Sotira: Career in Cryptography
04:46 - The Realities of Debugging Without Modern Tools
07:58 - Key Lessons from Early Hardware Security Work
12:43 - The Importance of Hardware in Cybersecurity
16:26 - Supply Chain Security Risks and Real-World Examples
23:00 - Criminal Collaboration and Emerging Cyber Threats
Links: LinkedIn
Thu, 26 Sep 2024 - 27min - 118 - What CISOs Get Wrong: Advice From a Cybersecurity Entrepreneur
In this episode of The New CISO, host Steve Moore sits down with Larry Pfeifer, CEO and President of Metrics That Matter, for a deep dive into the evolving role of the CISO and the increasing importance of cybersecurity insurance. Larry offers valuable insights drawn from his unconventional career in cybersecurity, sharing advice for CISOs and entrepreneurs alike. From the need for CISOs to shift from awareness providers to business decision-makers, to the surprising connection between cybersecurity and insurance, this episode is packed with thought-provoking discussions.
Listen to Steve and Larry explore the intersection of risk, metrics, and cybersecurity decision-making, and how customer service strategies from the Ritz-Carlton are being applied to improve client relations in cybersecurity.
00:00 - Introduction: Board Level Metrics in Cybersecurity
01:02 - Larry Pfeifer's Journey in Cybersecurity
01:56 - Cybersecurity’s Future: Insurance and Risk
03:56 - The Challenges of Cybersecurity Insurance
08:04 - Key Lessons for CISOs and Risk Management
12:00 - Client Management Post-Breach
17:30 - Optimizing Cybersecurity Investments
21:05 - Entrepreneurship: Realities and Advice
Links:
Larry Pfeifer on LinkedInThu, 05 Sep 2024 - 26min - 117 - Why the Best Salespeople Are Engineers
In this episode of The New CISO, host Steve is joined by Larry Pfeifer, CEO and President of Metrics That Matter. Although Larry is not a CISO, he has worked in many adjacent fields, including the US military, university IT research, sales engineering, and more. As a result of his vast experience, Larry has a unique lens on cybersecurity. Listen to the episode to learn more about Larry’s fascinating career journey, what salespeople and IT professionals have in common, and why he decided to start his own business.
Listen to Steve and Larry discuss what makes working in IT at a university invaluable and when to talk about the vendor selection process:
Meet Larry(1:39)
As a CEO and entrepreneur, Larry does many different things in his daily life. His professional origins started in his high school Apple IIe classes, and later, he worked with new computer technology in the military.
Overall, Larry compares his career journey to Forest Gump, acknowledging the exciting and extensive path he’s taken.
After Service(6:39)
Larry details his next moves after completing his military service. He helped run an educational network at a university, which led to him being interviewed on Leonard Nimoy’s technology show.
Although there was no position like “CISO” at the time, Larry also led a checkpoint on Salaraboxes, among other cyber-related projects.
Sound Advice(11:30)
Steve presses Larry on whether it is worthwhile for students to work in education networks at a university. Larry believes that if you have the opportunity, you should take advantage of it. After all, it’s high-paying, flexible, and allows you to do real, hands-on work.
Becoming an Entrepreneur(15:04)
Larry shares how he broke into sales engineering and started working for the Philadelphia Stock Exchange, among other places. He went from a career in IT research to sales engineering to becoming a salesman, adding another layer to his professional skills.
He also stresses the importance of discussing vendors and helping his peers determine what they like about their services, what they don’t like, and their costs. This interest led him to become the CEO of his own information-sharing business.
Building a Brand(26:27)
Reflecting on the beginning of his entrepreneurial journey, Larry shares how he worked with potential clients and narrowed in on his focus.
Now, Larry is the CEO of a business that serves as a cyber-security platform. To do this job well, he understands the industry thoroughly.
The Right Metrics(33:32)
Through Metrics That Matters, Larry aims to simplify the cyber-security process by providing information that reports on a business’s weak points and what they could do better.
Larry’s company fills in the technology gaps of CISOs, though he also knows there is no silver bullet to perfect cyber security. You must understand your environment and what your environment needs to secure your business properly.
Links:
Thu, 15 Aug 2024 - 40min - 116 - How to Become a “T-Shaped” Leader
In this episode of The New CISO, Steve is again joined by guest Grant Lockwood, Comedian, DJ, and the Chief Information Security Officer at Virtus Health. Today, Grant returns to explain how his approach to effective communication has evolved since becoming a security leader. Listen to the episode to learn the difference between safety and security, how stand-up comedy gave Grant an efficient framework for his CISO role, and the importance of having balance outside of work through hobbies.
Listen to Steve and Grant discuss how to maintain confidence in work and life and how to optimize your message to make the best first impression:
Comedy and Cyber Security (1:34)
Steve asks Grant why stand-up comedy has made him a better CISO. To Grant, stand-up helped him learn how to operate in a degraded state, which he finds comparable to dealing with cyber programs.
Like when a joke bombs, sometimes the most protected security programs can get hacked. Grant shares why these two mediums are similar and how both have given him the confidence to succeed in challenging situations.
Comfort and Confidence (4:12)
Grant shares how he determines his stand-up set lists and how to use that to get the audience on his side. He finds these lessons to also help in the workplace and understands the confidence that this framework provides.
Studying Delivery (6:45)
Grant reflects on the resources he’s utilized to become a better comedian, including listening to comedy podcasts. Ultimately, Grant expresses the importance of being economical with words—whether at work or on stage—to become an effective communicator.
Good Advice (9:22)
Steve presses Grant on what advice he would give his younger self, especially reflecting on his journey from an admin role to where he is now. Grant advises listeners to stay curious and teachable since there is much to learn.
He also reveals why people should be well-rounded, T-shaped individuals and how hobbies can provide transferable skills.
Getting There (12:31)
Reflecting on his career, Grant explains what he meant when he said, “The thing that got you there isn’t what will keep you there.” He clarifies how his measures of success have changed as he’s learned more about how running a business works.
Learning From Community (27:12)
As both a comedian and a CISO, Grant explores how the security community could learn from the stand-up comedy community. Both communities are very supportive, but comedy is entirely audience-dependent.
Therefore, comedy can teach security professionals to have better communication by “knowing your audience.”
The New CISO (19:09)
To Grant, being a new CISO means being adaptable, learning both the business and security side, and improving those around you.
Links mentioned:
Comedy Podcasts/Resources:
The Comedian’s Comedian Podcast
Thu, 25 Jul 2024 - 20min - 115 - Is Security Funny - What Hobbies Can Teach a CISO
In this episode of The New CISO, Steve is joined by guest Grant Lockwood, Chief Information Security Officer at Virtus Health.
After starting his career in an administrative position, Grant found himself getting bored. After being urged by his wife, Grant turned things around and is now a DJ, comedian, and, of course, a successful CISO. Listen to the episode to learn more about Grant’s impressive career journey, how to make your content compelling, and the transferable skills from performing comedy.
Listen to Steve and Grant discuss how hobbies can make you a better security leader and the importance of adapting to your surroundings:
Meet Grant (1:33)
Before becoming a CISO, Grant was a health sector chief information officer for a health department. Although his current role is very different, he can see the similarities between the two positions.
Before these two roles, Grant had spent years in an administrative position. Not sure what he wanted to do, his wife encouraged him to take up some hobbies, leading him to become a more well-rounded security professional.
Being a DJ (7:18)
Grant explains what people don’t know about being a DJ. He understands that what makes him a strong DJ is that he’s good at computers, demonstrating the similarities between cyber security and music.
Besides being a stress relief, Grant feels that being a DJ helps him with timing and being present, which he applies to his CISO role.
The Funny CISO (11:40)
Becoming a stand-up comedian has proven to be a transferable skill set for Grant. He reflects on how comedy helped him with his presentation skills and the ability to compel an audience.
Truth to Power (18:55)
Steve presses Grant on whether doing comedy has improved his ability to deliver truth to power. Grant understands how stand-up has expanded this skill set because he learned to hold others’ attention.
Grant also shares his feelings on the “lizard brain” and how this influences how we interact with others. Comedy taps into people’s lizard brains because it's an involuntary reaction that can bond us.
Being Adaptable (23:18)
Grant explains how stand-up forces you to adapt to your environment and use it to your advantage. This mentality also applies to presentations because you can shift gears based on your audience’s reaction.
When you can adjust your performance to the mood of others, you can hold their attention long enough to communicate your ideas effectively.
A Better Training (27:12)
If Grant could advise a security training leader, he would suggest they ask themselves, “Would this be entertaining to my mom?” Teaching potential CISOs how to make their work captivating to a wider net will make them better security leaders overall.
Links mentioned:
Thu, 04 Jul 2024 - 31min - 114 - Be the Coach of Your Security Team
In this episode of The New CISO, host Steve is joined by returning guest Sándor Incze, CISO at CM.com.
In part two of his interview, Sándor shares his strategies for boosting team productivity. As a long-time security leader, Sándor understands how to get the best out of his team. Listen to the episode to learn more about the difference between nervousness and excitement, the benefits of his CM model, and how running a cyber security staff is like soccer.
Listen to Steve and Sándor discuss how software development is like an F1 race and how to make a candidate confident during an interview:
In the Interview(1:33)
Sándor and Steve discuss high-stakes, stressful job interviews and how they can make candidates nervous. Although some security professionals are proud to make someone fumble during the interview process, Sándor and Steve share how to bring out the best version of someone to see if they are the right fit.
CM Squared(8:56)
Sándor shares the CM (or CM Squared) Model, a document he uses when auditing different companies' security systems to find their faults. With this model, Sándor can simplify technologies for business leaders and enhance their protections.
Like an F1 Race(15:30)
Like F1 racing, Sándor believes software development is a team effort. To help emphasize this metaphor, Sándor explains how different members of security teams mirror the roles of a racing crew.
Team Strategies(19:49)
When Sándor evaluates his role as a leader, he thinks of his staff as a soccer team. His team needs to score “goals,” and as their “coach,” it is his job to guide them.
He also shares his motto, “Do something you like, do something you’re good at, and contribute.”
The New CISO(27:12)
To Sándor, being a new CISO means “keep it simple.”
Making things too complicated does not stop cyber crimes. However, learning to talk to each other does.
Links:
Thu, 13 Jun 2024 - 29min - 113 - Perspectives on Security as a CISO and Police Officer
In this episode of The New CISO, host Steve is joined by guest Sándor Incze, CISO at CM.com.
Today, Sándor shares his untraditional path to a dual career in the Infosec and law enforcement industries. Through diligence, initiative, and automation, Sándor has been able to balance both of his life’s passions. Listen to the episode to learn more about Sándor’s extensive professional journey, the benefits of automation, and how personal interactions can shape your perspective on a crisis.
Listen to Steve and Sándor discuss what a police officer and a CISO have in common and when it’s appropriate to be “lazy”:
Meet Sándor(1:33)
Sándor has been passionate about tech since he was eleven years old. After tinkering around with an old computer at school, he became his school’s first administrator.
He credits this experience as his professional origin story.
An Opportunity With Law Enforcement(6:21)
Sándor shares that he has been interested in law enforcement professionally since his youth. Although this path didn’t initially work out, he was able to eventually combine his two passions into the dual career he has today.
Young and Successful(12:40)
By eighteen years old, Sándor was already establishing a successful career and saw the financial benefits alongside that. Amusingly, he would buy a new motorcycle every six months, an impressive luxury for his youthful age.
A Man In a Suit(14:03)
After finishing his computer science degree, Sándor tried to move into a law enforcement career. This attempt didn’t work out as intended, so Sándor had to go to a job wearing a suit rather than a preferred police officer’s uniform.
The Benefits of Laziness(16:18)
Sándor jokingly admits he is lazy because of his love for automating repetitive tasks. However, this method has proven effective, revealing much about Sándor’s perspective on work.
Lessons For the Listener(19:13)
After his third opportunity, Sándor successfully transitioned into a law enforcement role. He initially started as a volunteer, but he was able to use his automation skills to gain respect, leading him to become a police officer finally.
Life In the Academy(24:50)
Sándor reveals the age at which he joined the police academy and what being a security leader and officer have in common. A deep understanding of people and an accurate perspective on life are crucial mindsets to carry into both fields.
Thu, 23 May 2024 - 29min - 112 - Work Smarter: How to Empower Your Team and Yourself
In this episode of The New CISO, host Steve is joined again by guest Ash Hunt, Global CISO at Apex Group Ltd.
Today, Ash shares how he transitioned from his career as a jazz musician into the vastly different world of cyber security. He also reveals his tips as a leader and a decision-maker. Listen to the episode to learn more about Ash’s unique professional journey, how security leaders inhibit their candidate search, and the secrets behind an empowered staff.
Listen to Steve and Ash discuss the power of delegation and how to determine the best time to find a new role:
Ash’s Return(1:39)
Ash returns to the podcast to share how he achieved his cyber security start. Initially touring as a jazz musician in London, Ash acknowledges how his past has helped him with his current career.
Fresh Challenges(10:13)
Ash explains when to seek new challenges to avoid professional stagnation.
He believes that when a company gets more out of him than he is out of that company, it is time to move on. This mentality has helped him decide when to leave an opportunity for a fresh one.
Being Creative(17:21)
Steve and Ash discuss the impact that they can have on others early in their careers. Ash tries to expose his interns to the industry as much as possible because there are so many exciting things to do in tech.
He believes leaders should be more creative when judging and developing talent. For Ash, creative compromise, persuasion, stakeholder management, and communication are skills that he considers when evaluating potential candidates.
Ownership and Delegation(22:01)
While discussing the importance of enabling your staff, Ash asserts what makes an effective leader. Allowing your team to own their work and delegating tasks creates an empowered and productive company culture.
Evaluating Loss(26:37)
Steve presses Ash on how he handles approaching inefficiencies at work, such as issues with AI, to the executive team. Ash’s answer is to follow the money and expose what people think is true, but it turns out to be the opposite.
Loss is rarely tracked, but pinpointing those causes can benefit your organization.
The Cost of a Breach(33:19)
Staying on the topic of loss, Steve and Ash reflect on the vast cost of a data breach and inefficient client management. Although Ash acknowledges that technology will be able to solve these issues over time, there is no harm in prioritizing clear data reports now.
New CISO(38:01)
To Ash, being a new CISO means converging cyber with technology. Ultimately, it is about working smarter, not harder, as a team.
Links:
Thu, 02 May 2024 - 41min - 111 - Change the Way You Think About Loss, Risk, and Revenue
In this episode of The New CISO, Steve is joined by guest Ash Hunt, Global CISO at Apex Group Ltd.
Today, Steve and Ash dive into the action of M&A (mergers and acquisitions) and how to conduct it well. As a CISO at one of the world’s largest administrators, Ash shares his valuable insight on loss, risk, and revenue generation in a constantly changing IT environment. Tune in to learn more about what causes loss during a merger, why decision management and risk management are one and the same, and the cultural changes in the security industry.
Listen to Steve and Ash discuss how to quantify loss and what jaywalking and cyber security have in common.
Meet Ash(1:34)
Ash shares that he is proud to work for a fast-moving organization that has expanded worldwide. This growth has led to an exciting time from a technology and cybersecurity perspective.
Successful M&A(5:16)
Steve presses Ash on how to conduct M&A successfully. What hurts a business during an acquisition is when there are breaks in infrastructure that get overlooked.
Luckily for Ash, he has a strong team that prioritizes infrastructure integration to avoid loss and increase revenue.
Things in Common(12:25)
Ash reveals what jaywalking and risk have in common. For example, everyone in London jaywalks, but like in cyber security, there is a degree of risk.
Risk Management (15:10)
According to Ash, risk management is decision management. Decision science is a critical part of Ash’s approach to security.
Psychological barriers in the workplace halt optimal investment decisions that can generate revenue.
Adding Value (25:36)
Ash acknowledges that his most significant contribution toward his company is successfully integrating their infrastructure into one operating platform. He knows it will rationalize his tool stacks and clean up his budget, amongst other benefits.
He has seen other companies experience operation inefficiency, access control failure, and inadvertent data disclosure, which he actively prevents.
Changing the Operation Process (30:48)
Steve and Ash marvel at the operational changes that need to be done in security. For example, many people still default to email versus a more secure portal for data exchange.
In order to mitigate risk, cultural changes need to be made to operational processes.
Links:
Thu, 11 Apr 2024 - 34min - 110 - Keep Calm and Communicate Better: Advice for Young Managers
In this episode of The New CISO, host Steve is joined again by guest Ron Banks, CISO at Toyota Financial Services.
In part two of his interview series, Ron shares his career advice for new cyber leaders. Listen to the episode to learn more about Ron’s take on China’s strategies, the importance of being inquisitive, and why we must be calm under chaos.
Listen to Steve and Ron discuss key attributes CISOs look for in a young manager and the importance of communication and leadership:
Where We Left Off(1:43)
Piggy-backing from the last episode’s conversation, Ron explains the current state of our security concerning China and how they’ve recently gone dark. According to Ron, China has been playing 3D chess for a while and has found tangible ways to disrupt American life.
A Shoutout To Ron(10:19)
Steve gives a shoutout to Ron’s book, highlighting the state of American security and its relationship with China. Academic with numerous footnotes, Ron’s work provides readers with meaningful context related to cyber security.
Valuable Advice(12:20)
Ron reflects on the advice he wishes he could have given his younger self. He asserts that there is a path to cyber if you gain a technical foundation. He also shares how you need to be creative and curious to thrive in this industry.
Evaluating Young Leaders(15:16)
Steve presses Ron on how he evaluates young leaders in the security field. For the young manager, you must have the technical chops in addition to the personality.
Managers need leadership and communication skills to inspire their teams. And, of course, practice makes perfect.
Calm Communication(21:50)
Ron and Steve discuss why leaders should practice calm communication. Leaders must put their teams at ease when there is chaos.
New CISO(28:00)
To Ron, being a new CISO means also being a business leader. Bridging the gap between the worlds is becoming more and more necessary as the world progresses.
Links:
Thu, 21 Mar 2024 - 30min - 109 - Public-Private Partnership: How to Punish Bad Actors, Not Organizations
In this episode of The New CISO, host Steve is joined by guest Ron Banks, CISO at Toyota Financial Services.
In part one of his two-part interview, Ron shares how he transitioned from a fighter pilot to a cybersecurity leader. He also digs into what is required for a joint government, private industry, cyber offensive response. Listen to the episode to learn more about Ron’s years as a combat veteran, how the government can improve security strategies, and the necessity of political will.
Listen to Steve and Ron discuss the importance of public-private partnerships and the challenges of posing consequences on adversaries:
Meet Ron(1:35)
Steve introduces guest Ron Banks, a CISO, author, veteran, and academic. Ron details his duties as a fighter pilot and how he transitioned to education and then cyber security.
What He Misses Most(5:17)
Ron shares that what he misses most about his fighter pilot days is the rush from flying. However, he found the transition into cyber security simple because he gets to evaluate offensive and defensive security strategies reminiscent of his time serving.
Possible Friction(8:10)
Steve presses Ron on whether there is friction between cyber teams, their capabilities, and the grounds they are trying to defend on the private side.
Ron explains that the virtual defense of the United States contains over 200 government organizations, each controlling a different lane. The cyber camp mainly covers the DOD, which comes with problems.
On the Private Side(12:07)
When discussing the lack of consequences for bad actors, Ron shares the great strides the FBI has made to improve their relationships with law enforcement in other countries. Despite these efforts, the behavior of cyber criminals has not changed enough, demonstrating that there is more our government can do.
Things to Work On(17:54)
Ron shares some advice for new security leaders working within the government. He suggests focusing on public/private partnerships because sharing information is critical.
How Breach’s Occur(21:54)
Ron discusses his tips for dealing with a breach and why they occur. There is a strategy where they can impose consequences on cyber criminals, which his team has accomplished by focusing on counter-terrorism.
Ultimately, no more money needs to be invested, the relationships are built, and the technology is there, but there has to be the political will to defeat threat actors effectively.
Advice to Lobby(29:01)
Steve presses Ron on what it would take to lobby the government and get the necessary resources. Since the capability is there, Ron reaffirms that change is in the president’s control.
Links:
Thu, 29 Feb 2024 - 35min - 108 - Why CISOs Need to be Champions of AI
In this episode of The New CISO, host Steve is joined by guest Mani Masood, Head of Information Security and Applied AI at a prominent healthcare MSP.
Also a professor and family man, Mani’s various life experiences shaped his impressive decades-long career. Today, he shares his insight on balancing education with experience and embracing AI as a security leader. Listen to the episode to learn more about Mani’s career and education journey, the importance of having real-world skills, and what inspired Mani to write a book.
Listen to Steve and Mani discuss how to adapt to new technology advancements and if InfoSec professionals should champion AI:
Meet Mani(1:35)
Steve introduces guest Mani Masood, who has worked in the security industry for two decades. First, Mani started in IT before transitioning into Information Security. Now, AI has quickly become a significant component of his role.
Mani shares a story when a college professor saw his nervousness before an exam and suggested he get a job. His professor assured him that getting real-world experience would be extremely valuable.
Real World Expertise(6:49)
Mani reflects on how getting a degree is not the be-all-end-all of getting a job. Often, employers want to know what you’re capable of, which comes from having tangible skills applicable to your field.
He also explains to Steve why it took him six years to finish his education instead of four: because he was gaining real-world experience.
Times Have Changed (18:18)
Steve asks Mani about his perspective on the famous quote, “For those who can’t do, teach.” As technology has changed, Mani shares that nowadays, what you can do is more important than doing things right or following the status quo.
The Time For AI(24:28)
Like the tech boom, the AI era allows professionals to adjust to new advancements. Mani reveals that they have been trying to use artificial intelligence to solve InfoSec problems for some time, and this will become increasingly more possible as the tech matures.
Defending The Tech(28:49)
Mani discusses why security leaders should support AI and champion the technology within their organizations. Since InfoSec professionals have been working with AI for years, they should inspire others to believe there is a way to interact safely with this tech.
Mani’s Recommendations(32:18)
Steve presses Mani on his recommendations for security leaders when supporting artificial intelligence. Mani suggests that these leaders become comfortable with the tech themselves.
Every InfoSec tool now has some AI faction, so security leaders should learn as much as possible about its benefits before championing it. Ultimately, CISOs must do their homework to ease their organization’s worries and create the necessary safeguards.
Writing A Book(41:32)
Mani shares why he is writing a book and what drives this project. He was first inspired to do so by a conversation with his wife. He initially sought to write a guide for his children, which led him to write a guide for other professionals.
The New CISO(48:23)
To Mani, being a new CISO means dealing with a new crossroads with technology. Whether you’ve been in the business for a long time or are new to the role, you must adjust quickly, pivot, and learn with your team.
Thu, 08 Feb 2024 - 51min - 107 - A CISO’s Advice On Learning, Earning, and Dodging Burnout
In this episode of The New CISO, Steve is joined by returning guest Dr. Adrian Mayers, VP and CISO at Premera Blue Cross.
As a veteran CISO, Dr. Adrian reveals his stress management and career tips. He also shares his thoughts on AI and its effect on the current threat landscape. Tune in to this week’s episode to learn more about determining your next career move, giving yourself grace, and why we shouldn’t vilify artificial intelligence.
Listen to Steve and Dr. Adrian discuss evolving technology and approaching the research part of the job:
Welcome Back, Dr. Adrian (1:32)
Dr. Adrian reintroduces himself and his current CISO role to the audience. Steve also reveals why Dr. Adrian is a pleasure to have as a guest and his appreciation for the spark he brings to the conversation.
Cutting CISOs Slack (5:40)
Dr. Adrian unpacks why CISOs deserve grace as the role evolves and the stresses change. Detecting threat actors is a lot of responsibility, which creates tremendous pressure and leads to burnout.
You can do better in your role long-term by understanding your limits and providing accurate expectations for the role.
Working Together (12:33)
Nowadays, taking criminal entities down requires foreign governments and the FBI to work together. Dr. Adrian shares his thoughts on this dynamic and how it takes a village to cover the defensive and offensive bases needed in the digital space.
The Right Research (19:28)
Steve presses Dr. Adrian on how he conducts research related to the job. Dr. Adrian has taken MIT classes and uses many online resources to obtain information.
There are many sources to pull from, but you must use common sense to determine your gaps on various security topics, including AI.
The Benefits of AI (25:02)
Dr. Adrian discusses the benefits of artificial intelligence and how it is a technology that will open up the possibilities of what cybersecurity professionals can do. Although people fear this new tech will replace jobs, it fits the natural order of human progress.
What Comes Next? (28:10)
Steve and Dr. Adrian contemplate the off-ramps of what can come after being a CISO. To move up, you must understand the industry's business side or have enough knowledge to transition into teaching.
Sponsorship is another aspect that CISOs can gain to determine their next career move. Ultimately, Dr. Adrian would like to redefine the work environment to support CISOs on their professional journey.
Keeping Your Eyes Open (36:56)
Steve asks Dr. Adrian how he knows when a CISO should seek new opportunities. How does he manage that internally?
Dr. Adrian believes people should be self-aware enough to understand if they want to move on based on interest or if they want a new professional environment. It is an individual decision.
Do CISOs Need Sports Agents? (45:46)
Steve presses Dr. Adrian on his quote about how CISOs need sports agents. Dr. Adrian means by that quote that security professionals, like many others, need management to guide them and help them find new opportunities.
Links mentioned:
Thu, 18 Jan 2024 - 52min - 106 - How to Respond When You Don’t Get the Job
In this episode of The New CISO, guest Chris Fredrick, Deputy CISO at Baxter International, returns for the final part of his interview series with host Steve.
In parts one and two, Chris shared his background and the lessons he’s learned during a breach. Today, Chris joins host Steve to discuss maintaining a productive outlook while looking for a new position. Listen to the episode to learn more about the lessons you can learn at every role, the importance of perception, and job-hunting challenges.
Listen to Steve and Chris discuss the best time to leave a position post-breach and how to stay positive in the face of rejection:
A New Job(1:40)
After working on the SOC with Steve, Chris felt ready for a new challenge. He then saw a role that scared him, making him believe that that was the right position. This decision set him down his CISO path.
However, this new position was temporary because when he threw his hat in the ring for the permanent role, it didn’t work out. Ultimately, this rejection caused Chris to reflect on his career journey.
Doing Things Differently(6:03)
Steve asks Chris if he would have done things differently in his interview, knowing what he knows now. Chris would make the same decisions, especially since his time there had many challenges.
Even though that role didn’t pan out, Chris learned a lot during this time. He built confidence in his presentation skills and had the opportunity to meet more established CISOs. By networking with other CISOs, Chris realized he truly belonged in the security world.
The Value of Stoicism(10:05)
Chris advises on how to handle job rejection. He refers to Stoicism, which states we cannot control the outcome but can control our perception.
When bad things happen, we can perceive it as a positive that will set us on the right path.
Looking For Work(15:35)
Despite Chris’ impressive career history, it took him months to find his next role. After evaluating his many interviews, Chris recommends that security recruiters learn more about the field to better choose candidates.
Chris and Steve then discuss the other lessons Chris learned during the job-hunting process, including what questions interviewers should or shouldn’t ask. Referring to Stoicism again, Chris also recommends structuring a routine around job hunting, including doing a positive hobby you enjoy.
The New CISO(28:32)
To Chris, being a new CISO means understanding that we are tasked with the impossible. Therefore, it’s essential to build an environment where people never feel like they are being asked to do the impossible for the ungrateful.
Links:
Thu, 28 Dec 2023 - 30min - 105 - Great Leaders Make Leaders — Especially During a Breach
In this episode of The New CISO, guest Chris Fredrick, Deputy CISO at Baxter International, returns for the second part of his interview series with host Steve.
In part one, Chris shared his background and the beginning of his professional journey. Today, Chris joins host Steve to discuss a pivotal moment in their careers: a significant breach. Listen to the episode to learn more about how Chris transitioned into a managerial role and stepped up during a crisis.
Listen to Steve and Chris discuss who managers really work for and the mark of a great leader:
Welcome Back, Chris(1:52)
Steve and Chris discuss where they left off in the last episode when they left their security team for a new opportunity.
Focusing on insider threats, Chris shares his daily work for this specific role. During this time, Chris focused less on operations and built a program instead. He also researched what would be in an insider program.
Vulnerability Management(4:10)
Chris reflects on the lessons he learned while doing vulnerability management that made him the leader he is today. Chris believes this time taught him how to tell a good story and have clear metrics to back himself up.
Network Security(9:28)
After working in vulnerability management, Chris moved into network security with Steve and created a Soc. Chris initially came in as an individual contributor until he became a team lead before eventually becoming the manager.
When he was a manager, Chris realized his role now was to worry about his team and less about himself. It was a profound moment for Chris when he discovered this truth.
The Breach Itself(15:14)
Chris shares what lessons he learned from a significant security breach. Chris and his team noticed for a while that there were warning signs of the breach but were initially ignored.
However, when the event happened, they could take what they knew and move forward. Because Chris had working partnerships with other teams, he was able to get the help they needed, showcasing the importance of building your relationships before a crisis.
Client Management(20:48)
Steve presses Chris on what he remembers regarding the client management side of this time. Chris recalls dealing with many calls from clients who were understandably concerned.
Many of these calls became heated, but one client assured Chris he understood what he was going through. As a result, Chris tries to be empathetic with others since they could be having a bad day, which could affect their behavior.
Pride In Their Team(28:25)
Steve reflects on how working with this incredible team was one of the best memories of his career. He has immense pride in this group, which Chris shares.
Chris loved building something from nothing and seeing the great things their colleagues have done since. Forming a great team requires a healthy culture that brings people together.
Stepping Up(31:38)
After Steve left, Chris had to step up into a higher leadership role. This change became a pivotal moment in Chris’s career, coinciding with the birth of his first child.
Links:
Thu, 07 Dec 2023 - 36min - 104 - How One Job Taught Five Important Leadership Lessons
In this episode of The New CISO, Steve is kicking off the first part of a three-part series with guest Chris Fredrick, Deputy CISO at Baxter International.
Chris began his career as a technician and met Steve on a small security team managing a large network. Now, Chris joins today to share key lessons from his early career and set the stage for the next upcoming episodes. Listen to the episode to learn more about Steve and Chris’ time working together, the process of changing companies, and learning to be a better leader.
Listen to Steve and Chris discuss how to deliver the news you’re leaving a company and how managers should accept said news:
Meet Chris(1:46)
Chris has worked in IT security for over twenty years and knew since college that this area of the industry was his passion. Since starting a leadership role, he has found his new calling: becoming the best leader he can be.
Infosec Memory Lane(5:04)
Chris shares the memories of his time working with Steve on their small infosec security team. Chris remembers feeling overwhelmed initially but learned to handle the scope of his many responsibilities.
Steve and Chris reminisce about the positives of this experience and the challenges. The best part was the camaraderie they felt as a team.
Lessons Learned(9:43)
Steve presses Chris on the lessons he learned during their time on the infosec team. This experience taught Chris the importance of curiosity and building credibility.
Another valuable lesson was learning to have respectful conversations when colleagues disagree.
Changing Companies(18:23)
While working together, Steve and Chris had the opportunity to change companies after their CISO left.
Chris walks through what occurred and the communication lessons it taught him. He wishes he had done some things differently since multiple people leaving put his manager in a tough spot, but he also learned valuable leadership skills.
Links:
Thu, 16 Nov 2023 - 28min - 103 - Why CISOs Should Solve Business Problems, Not Technology Problems
In this episode of The New CISO, Steve is joined by guest Scott Moser, CISO at the Sabre Corporation.
After twenty-five years, Scott retired from the Air Force to try his hand at the private sector. Now, Scott is transforming the CISO role from technical expert to business executive. Listen to the episode to learn more about Scott’s professional journey, being a customer-focused security professional, and what he learned from the Sabre interview process.
Listen to Steve and Scott discuss contributing to the success of your organization and the importance of transparency:
Meet Scott(1:44)
Scott explains that Sabre is a software often used by hotels and airlines since the sixties. As a result, data protection is of the utmost importance to Scott in his CISO role.
Scott then explores his career journey, where he started in the Air Force and eventually retired as a Colonel. During this time, he did cybersecurity-related work, which led him to the career he has today.
Broad Experience(9:33)
Scott shares how he had the opportunity to lead and mentor many people during his time in the Air Force, including police officers, firefighters, and more.
He believes this time gave him the broad experience to communicate with business leaders. Now, he also meets with his customers, where he can easily explain the value that Sabre software can provide them, showing the value of a customer-focused CISO.
The Importance of Trust (16:05)
As CISOs, it’s essential to represent your company to customers and business leaders alike successfully. To do that, Scott recommends building trust, which requires significant transparency.
A culture of trust will help your team through challenging times, so you should prioritize this when times are good.
Effective Prep(24:40)
Scott mentors his team by giving effective feedback and assessing his employee’s strengths. He works with his team to perfect their skill sets, including public speaking since that is a crucial part of business leadership.
As long as people are doing the right thing, they shouldn’t be afraid to make mistakes, learn, and grow because it strengthens the company in the long run. Ultimately, we must transform ourselves to be what our organization needs.
Scott’s Presentation (28:55)
Steve asks Scott about his popular CISO leadership presentation. Scott reveals that this presentation is a passion project of his because he wants to be more than just a technical expert but a business leader.
Scott had to evaluate his strengths and weaknesses to become the CISO he wanted to be, which informed his presentation.
An Aha Moment (33:44)
For Scott, his interview process at Sabre informed his perspective on becoming a business leader. When board members interviewed him, he understood what they wanted from their CISO.
Board members want security professionals who think about improving the business, not just the technical side of the job.
One Last Thing (41:46)
Steve presses Scott on the last piece of advice he wishes to share. Scott tells the audience always to take advantage of a good crisis because it is the smartest time to get your organization to make a necessary change.
The New CISO (44:42)
To Scott, being a new CISO means being a business executive leader focused on the customer and financial success of the company.
Links:
Thu, 02 Nov 2023 - 45min - 102 - The CISO Triforce: Preparing Your Post-Breach Go Bag
In this episode of The New CISO, Steve is joined by guest Mike Melo, CISO and VP of IT Shared Services with LifeLabs.
After switching his studies from human viruses to computer viruses, Mike dedicated his career to technology and the people who use it. Today, he shares his methodologies for post-breach cyber-security transformations and leading remote teams. Listen to the episode to learn more about Mike’s career journey, the importance of the customer mindset, and the three tenets of his Zelda-inspired CISO Triforce.
Listen to Steve and Mike discuss how to build human connections in a remote environment:
Meet Mike (1:40)
Mike has worked at LifeLabs for over five years and balances two positions.
Although Mike faces many challenges, he has created synergy between the two teams.
Getting His Start (4:02)
When Mike was a teenager, he originally wanted to be a musician. Instead, he went into computer studies and studied human viruses. At the end of the day, he realized he didn’t want to be in a lab and instead wanted to explore his love for cybersecurity.
The Customer Mindset (7:02)
Mike recommends new security professionals go and see how businesses work. Learning the customer mindset early in your career will have great benefits later because you will understand what users need.
Ultimately, security professionals must better interact with their customers and understand how humans behave daily. You must find ways to show up to the business and show you are here, especially in remote work environments.
Socializing And Remote Work (16:42)
Mike feels we’ve lost social currency with remote work because people are social beings.
However, there are pros and cons to being in remote environments. As a leader, Mike developed a team charter to ensure better communication and created opportunities for positive socialization.
Going Back In Time (27:28)
Steve presses Mike on his time in university when he also worked as a security analyst. A double major as well, Mike had to balance a lot while he learned.
However, Mike wouldn’t change anything because it allowed him to push his capabilities in the classroom and set him apart from his peers.
Modern Learning (31:08)
As a mentor, Mike recommends new professionals talk to many people. When you put yourself out there, you’ll find that people are receptive to teaching you about their experiences.
Being Successful During a Breach (35:02)
Steve asks Mike about his presentation on “Being Successful During a Breach.” From that presentation, Mike discusses his CISO Triforce, which he based on Zelda.
You must have a wish list, an effective execution strategy, and assurance with your stakeholders. When you have those three pieces, you will be prepared to get through a breach.
The Coaching Experience (44:46)
Mike has found that mentoring has always come easy to him. He has always been passionate about it since he tutored other students in his youth and has found helping others incredibly fulfilling.
The New CISO (49:43)
To Mike, being a CISO means being agile and having a customer mindset. It’s essential to improve yourself constantly as a security professional and leader.
Quote: “Just because you get a bucket of money doesn't mean that solves your problems. And one of the biggest challenges of the post-breach world is the actual transformation. You got this, okay, you get this money, you have this wishlist. Cool, now you have to find, hire onboard, ramp up, transition, ramp down, and then sustain, right? Those are such complicated stages in the whole process, and you have to start giving some of that thought.”
Links mentioned:
Thu, 19 Oct 2023 - 52min - 101 - What About Third-Party Risk? A CISO’s Questions for the SEC
In this episode of The New CISO, Steve is joined by guest Dan Creed, CISO at Allegiant.
Dan first discovered his love for computers as a teenager. He has since then channeled his skills into a career in security leadership, where he balances his technical expertise with business acumen and storytelling. Today, he shares his thoughts on supply chain risk and the SEC’s new changes to cyber security guidelines. Listen to the episode to learn more about the importance of coding, coping with stress, and his critiques of the SEC.
Listen to Steve and Dan discuss how reporting protects shareholders and the new stakes for CISOs :
Meet Dan (1:30)
Today’s guest, Dan Creed, is the CISO for Allegiant, a travel company.
Dan discovered how to take over his school’s television channel in high school, which stemmed from his friend getting dumped. Dan and his friend used the cable TV channel to post some unflattering messages about his friend’s ex.
Although Dan was rightfully punished at the time, he was allowed to take over the school’s computer lab, and his career journey began.
Maintaining Excitement (7:02)
Dan maintains his excitement for technology by keeping up with all the changes in the industry, like changes in coding. If you love learning and learn fast, you will have a rewarding and lasting career in cyber security.
An Important Role (13:23)
Steve presses Dan on the importance of Absec. Dan reveals that Absec is related to code and that the most essential security aspect is code.
If you are in a customer-facing role, you need to be able to install software on other people’s machines and make sure their vulnerabilities are shielded.
Coping Mechanisms (16:45)
Dan copes with workplace and personal stress by understanding that humans are imperfect and make mistakes. There’s risk in everything we do, so keeping a balanced perspective is critical when mitigating potential cybersecurity issues.
Ultimately, the stress in the security industry is building as the stakes grow, so finding ways to cope is necessary.
SOAR Review (19:27)
Steve asks Dan about his opinion on the automation software SOAR. He thinks it has its place, but finding people who can automate themselves is better. People need to use the right tool for the job.
Building a Response Playbook (21:58)
Dan shares the first thing to automate when building a response playbook for the first time. First things first, make sure you can monitor strange behavior. Starting there allows you to work on the more complex procedures.
His Driving Force (26:16)
Dan reflects on his reasons for finishing his degree later in life. He wanted to learn how to “speak business,” in addition to his computer skills, which drove him to complete his undergraduate degree and MBA.
Choosing One (31:02)
Steve presses Dan on which one to choose if you could only pick one: storytelling or culture. Dan says it depends on the person and what they are good at.
If you look at what’s more important, it would be building work culture first and seeing how your team reacts to phishing and annual security training.
What is Material? (33:23)
Dan and Steve discuss how reports influence the stakeholders and what they invest in. Dan is critical of how the SEC changed the cyber security guidelines, partly because they are poorly organized and confusing.
There are good things, but more context is needed to determine materiality. These guidelines also do not factor in how to deal with third-party risk and supply-chain issues.
Reporting Issues (41:23)
The SEC has intended to help shareholders with these guidelines so that they can protect the share price. Although Steve applauds their efforts, Steve questions if this reporting should be used for something else.
Dan believes these guidelines will not be as helpful to business leaders as believed.
The New CISO (49:24)
To Dan, being a new CISO means keeping up with the times and evolving. It’s essential to speak to the business side in addition to knowing your skills.
Quote: “I don't have an issue with it being reported, but like you said, then what are they doing with that data? What is it really accomplishing? It's not really protecting the share price. It's not really protecting the shareholder and telling, oh, well, I don't know if I should invest in this company because they got breached or not. As any company can be breached, we've been shown that time and time again, and the government can be breached. They should know this. They have been breached.”
Links mentioned:
Thu, 05 Oct 2023 - 50min - 100 - 100th Episode: Six Mentorship Questions with Two Top Leaders
In this episode of The New CISO, Steve is joined by returning guests Michael Meis, Associate CISO at The University of Kansas Health System, and Mark Weatherford, the Chief Strategy Officer at The National Cybersecurity Center.
For the 100th episode, Mark and Michael are back to share their thoughts on decision-making, mentorship, learning, and leadership, amongst other topics essential to the security industry. Tune into today’s episode to learn more about the career opportunities Mark and Michael didn’t take, how to measure your journey and the importance of an effective team.
Listen to Steve, Michael, and Mark discuss managing stress while diving head-first into challenging situations and how to maximize the growth of junior team members:
Welcome Back (1:32)
Jumping in, Steve presses returning guests Mark and Michael on the most interesting career opportunities they didn’t take.
While in the navy, Mark received a call transferring him to Virginia for a promotion. Although he did not want to go, this transfer was great for him.
For Michael, when he was in the army, he turned down a promotion multiple times. He decided early on in his career that the military would not be his long-term career.
Sound Career Advice (13:04)
Determining when you feel fulfilled professionally allows you to make better career choices. Although our goals evolve, it’s important to reevaluate our priorities at different life stages.
From a leadership perspective, it’s valuable to not think of yourself as the most intelligent person in the room but instead surround yourself with people who can fill in the gaps in your skillset. Leaders need their junior-level colleagues to succeed, and giving these employees real responsibilities allows them to transition into more significant roles.
Best Mentorship Books (21:30)
Mark and Michael share the books they would recommend to new and future leaders. These books are worthwhile resources that help prepare CISOs to take on higher-level work when it is presented.
New To The Job (28:02)
Mark and Michael explore what new CISOs should assess when new to running their teams.
It’s essential to determine if you have good people who have lacked effective mentorship or if your organization lacks talent. Ultimately, you must ensure you have the right employees to succeed.
Ultimately, you need to see if people add value or not in a crisis.
Owning A Crisis (35:40)
Steve presses Mark and Michael on their leadership perspective in a crisis.
Mark reflects on an experience involving the government, where one of his employees took ownership of their security breach. Mark is still in touch with this colleague today and credits his help resolving a high-level issue.
Michael reflects on a junior analyst who quickly worked his way up because he had a can-do attitude. The best career advice is to take work off of other’s plates because the people you help will never forget.
Staying Grounded (40:46)
To close, Steve asks Mark and Michael a more individualized question. What helps them stay grounded during stressful times in the field?
For Mark, he admits he’s not great at taking a step back from work. He is passionate about the business and understands a 9-5 clock would not work for most security professionals. He can manage his stress, but he knows he lacks life balance. Though to relax, he keeps honey bees.
Michael encourages everyone to eliminate the preconceived notion that this path is like other jobs. Security professionals are all-in on their work and must decide what balance means to them. For Michael, he does meditation to center himself and regulate the physical manifestations of stress.
Links mentioned:
Thu, 21 Sep 2023 - 46min - 99 - Know Your Strengths: How to Lead with Skills You Already Have
In this episode of The New CISO, Steve is joined by guest Maria Sexton, Chief Information Officer at the University Medical Center of Southern Nevada.
Before starting her security career, Maria worked as a self-described secretary, seeking a better financial future for her family. Now, with her dream job, she shares how to become a strong communicator and leader. Tune into today’s episode to learn more about Maria’s passion for the healthcare industry, her strong people skills, and why you shouldn’t fake it until you make it.
Listen to Steve and Maria discuss being confident in your strengths while understanding your weaknesses and what first-graders and board members have in common:
Meet Maria (1:36)
Maria reflects on why her current role is her dream job. With a diverse background, Mara found that healthcare customers were the people she wanted to serve.
She didn’t plan on landing in healthcare, but she resonates with the mission of the field, which is why she feels she has her dream job. She recommends that everyone find an industry that aligns with them.
Getting Her Start (6:00)
Before starting her IT path, Maria worked as a secretary, a term not often used today. During this time, Maria went through personal family issues and needed to evaluate her financial future for herself and her children.
Always interested in computers, Maria talked to the IT department at her company and asked how to get involved. Their advice led Maria to get a certificate, thus beginning the rewarding career she has today. It was scary initially, but Maria allowed herself to try and fail to succeed.
Successful Communication (13:39)
Steve presses Maria on whether she always had the clarity and confidence she showcases today.
Maria understood she would never be an engineer, but her strengths lay in being diligent and taking notes. Therefore, she was excellent at communicating technology to people without a technology background, giving her a robust career skill set. Empathy, communication, and public speaking abilities made her the leader she is today.
Explaining to a First Grader (16:33)
Maria shares her experience talking to her granddaughter’s first-grade class about her job. She found these kids incredibly bright and showed a firm understanding of technology and computers.
Learning how to communicate technology ideas to an audience without experience is critical.
Standing Out (23:45)
When evaluating a resume, Maria likes to see if they have motivation. Nowadays, more people than ever are interested in security. So, it’s essential to evaluate if the people coming in are serious.
Maria is looking to hire a self-starter who takes advantage of the resources available to work in security. She also admires when applicants understand their strengths and weaknesses and where they can be best utilized.
Confidence In Communication (27:22)
Maria could always communicate effectively. As the child of Italian immigrants, Maria was responsible for speaking on behalf of her parents and helping them navigate the US.
Her childhood also gave her empathy and the ability to read non-verbal cues, which has been helpful throughout her career. Learning to communicate with those around you is critical, no matter your role.
Don’t Fake It Until You Make It (39:51)
In terms of security, you really can’t fake it because the consequences could be dire. But outside of security, Maria has never liked the phrase “fake it until you make it.”
This saying irks Maria because she thinks it is terrible advice. If you don’t know something, you should learn it. If you need a mentor, find one. You should want to get whatever you don’t have because that will make you better.
If you wish to apply to a job in which you don’t have direct experience, show your confidence in your skills and demonstrate how applicable experience has prepared you for that role.
Valuable Tips (48:04)
Maria reflects on her rules to follow when evaluating a new company.
If you are interviewing for a leadership position, you already have a robust resume and a breadth of experience. Now that you’re in the room, you need to interview the organization as much as they are interviewing you.
You and the company must be a personality fit for the opportunity to work.
The New CIO/CISO (51:37)
To Maria, being a new CIO/CISO means understanding the importance of security to the organization and that you are bringing this information to your peers.
You are making business decisions, so you need to speak in terms of business.
Links mentioned:
Thu, 07 Sep 2023 - 55min - 98 - What’s In a Word? Managing Your Message More Effectively
In this episode of The New CISO, Steve is joined by guest Frank Vesce, CISO for Allvue Systems.
Beginning his life in a Brooklyn orphanage, Frank is now a cyber security leader, government advisor, youth mentor, and community advocate. Today, he joins Steve to discuss the technical and human side of cyber security. Tune into today’s episode to learn more about Frank’s professional journey, his approach to interviewing, and his motivation to mentor.
Listen to Steve and Frank discuss the power of communication and the four types of complaints that can affect your organization:
Meet Frank (1:36)
Host Steve Moore introduces our guest today, Frank Vesce, who has over twenty years of experience, including global leadership positions.
Frank first became intrigued by cybersecurity through the Matthew Broderick film War Games. During a coding class at university, Frank became even more interested in this field after reading the book The Cuckoo's Egg.
First Gig (4:23)
Frank's first security position was at Goldman Sachs. Before, Frank worked in IT and technology, but in 2010, Frank transitioned from infrastructure to security risk, and things moved forward from there.
The Interview (5:16)
Frank shares his unique approach to interviewing. He would call the interviewee by the wrong name to understand their personality.
The best response would be when someone would politely and quickly correct him, how people answered demonstrated if they would fit on the team.
Being Human (12:59)
When people come to work and complain, it typically has nothing to do with their employer. They may have something going on in their personal lives, so it’s essential to get to the root of the problem before making assumptions.
Frank then shares the different kinds of complainers in the workplace and how to work around them to strengthen your team.
The US Coastguard (19:24)
Steve presses Frank on his experience with the US Coastguard.
Frank gained this opportunity from a few colleagues who asked Frank to join. The coastguard wanted someone from the financial sector to do tabletop exercises, and Frank was the right fit. Ultimately, these exercises helped inform public policy.
Working in government also taught him the importance of communication chains and how to determine which phrases and words can or cannot be shared. Steve and Frank discuss managing your words effectively when security is essential.
Bad Advice (29:51)
Frank tries to learn from his mistakes and turn them into positives. However, he has one example of bad advice.
He shares a story where his boss took him to coffee to yell at him for a mistake. However, Frank told his boss he wasn’t coached on that aspect of his job. Frank lacked advice during this circumstance.
Different Philosophies (36:21)
To Frank, teams need to be transparent with boards today as boards get savvier. Especially if there is a breach, you don’t want to lose your reputation with your firm.
Learning how to translate what’s on the technology side to the business side is critical. Everything boils down to communication.
What’s In A Word? (39:21)
When Frank returned to Goldman Sachs, he was tasked with creating a change management system.
During this project, Frank had an issue with a colleague over the word “re-engineer.” The colleague felt more comfortable with the word “enhance.” When new to a firm, using the right words to gather the most support is critical.
Origin Story (43:50)
Steve presses Frank about his life in an orphanage.
Frank spent some time there but was later adopted by a caring family. This motivated Frank to give back, and now Frank works with the organization A Year Up, which helps inner-city kids break into the corporate world.
The New CISO (47:51)
To Frank, being a new CISO means translating the technology side of security for less technical people. It is crucial to explain risk to the business side.
It is also important to recognize the human side of the job.
Links mentioned:
Thu, 24 Aug 2023 - 50min - 97 - Confidence or Arrogance? Ego Problems and How to Solve Them
In this episode of The New CISO, Steve is joined by guest Brad Sexton, Chief Information Officer, and Information Security Officer at Terrible’s.
After having issues with a Dot Matrix printer, Brad was inspired to transition from a career in education to IT. Through conflict, change, and self-reflection, Brad has become the effective leader he is today. Tune into today’s episode to learn more about Brad’s career journey, the consequences of “ego,” and how to leave a job gracefully.
Listen to Steve and Brad discuss how leaders can walk the fine line between confidence and arrogance and the right motives for becoming a leader:
Meet Brad (1:44)
Host Steve Moore introduces our guest today, Brad Sexton, who started working at Terrible’s in Las Vegas last April.
Brad shares that before becoming a CISO, he worked at a boys and girls type club where they all shared one printer. Wanting to be able to print from different areas of the office, Brad took on the task of updating the printer to fit his office’s needs. Brad has been in IT ever since.
Next Steps (5:09)
Brad reveals the next steps of his career transition. His boss at the education center asked Brad for IT-related help. Brad was then moved into the IT department and used this moment to finish his education.
During this time, Brad could see tech from a bigger picture and eventually was designing a forklift upgrade for the theater. He started working with routers and did more and more. By the time Brad settled in Vegas, he could use his experience to manage teams successfully.
Checking The Ego (11:13)
Steve presses Brad on the lessons he learned from his first IT job.
Brad believes that his ego got in the way of his ability to do his job. After many years, Brad finally understood what he could have done differently. Thankfully, his boss knew he had potential and was willing to have a difficult conversation that resonated with him later.
The Clues (16:30)
Brad explores the clues of a person with an ego problem. In addition, Brad explains that leaders should always create a safe space for their employees to communicate with them.
Everyone has strengths and weaknesses, and it’s helpful when leaders can help their employees identify theirs. Ultimately, there is a “fine line between confidence and arrogance,” and leaders must have the confidence to articulate challenging feedback.
The Right Motives (25:54)
Steve presses Brad on what his motives were for becoming a leader. Brad reflects that he wanted a sphere of influence and recognized that he could make more of a difference in a higher position.
Brad suggests always knowing your “why” before approaching leadership roles.
The Wrong Fit (29:53)
Brad worked in government and realized two things. He was in the wrong place, and they didn’t want them there either. Knowing there was tension from the beginning made Brad’s time in this role very challenging.
Brad learned later that this company did not want anyone in that position, but he was the most qualified. Now, Brad understands the importance of finding the right fit for a role and considers that when interviewing future colleagues.
Mutual Contact (34:58)
Brad and Steve discuss a mutual connection named David, who is an individual who helped Brad move into the casino gaming space. Brad appreciates that David took a chance on him and is still in touch.
Relationships are critical as you advance in your career because no one knows everything.
Leaving Gracefully (40:04)
Brad shares his tips on leaving a job gracefully. He suggests managing the emotion that you let someone down.
Having an open communication line with your boss and feeling comfortable articulating your goals makes this process less challenging—the key is to cultivate that relationship before it gets to this point.
The New CISO (47:50)
To Brad, being a new CISO means understanding your staff and the challenges that they’ve had. You then must build relationships in the business.
Thu, 10 Aug 2023 - 49min - 96 - The 70-20-10 Rule: Steps You Can Take for Professional Growth
In this episode of The New CISO, Steve is joined by guest Andrew Wilder, Adjunct Professor at Washington University in St. Louis and a multi-time CISO.
After eighteen years, Andrew left a job he loved to transition into global security. Now, he gives back to the cybersecurity community by sharing his insight as a professor and mentor. Tune into today’s episode to learn more about his IT journey, expanding your network, and company red flags.
Listen to Steve and Andrew discuss his five-step mentorship plan and essential interview guidelines for CISOs:
Meet Andrew (1:38)
Host Steve Moore introduces our guest today, Andrew Wilder, who has worked in cyber security for twenty years.
Andrew got his start in cybersecurity by working at a paper company, where he worked in marketing, sales, inventory, customer service, and more. One day the owner came to him, wanting to change their computer systems. Being the youngest in the office, Andrew was given the project, beginning his IT journey.
Eighteen Years (6:23)
Andrew reveals why he stayed at Nestle for eighteen years. Andrew loved the people and culture and even met his wife on the job.
Steve presses Andrew on why he didn’t stay longer, and Andrew reveals that he progressed as far as he could go. Wanting to move forward in his career, Andrew felt inclined to make the jump.
A Difficult Move (8:12)
Andrew shares how challenging it was to leave Nestle. Although his co-workers were shocked, Andrew knew going was right for him.
If you’re in a similar situation, you may always find something to regret, but no situation is perfect. Ultimately, you have to do what’s best for you.
Care About Your Career (11:50)
When contemplating a career transition, Andrew recommends finding a mentor. Of course, no one will care for your career for you. You will make time for something and seek the necessary resources if you care about it.
The Five-Step Plan (13:59)
Andrew shares his five-step plan for changing careers, which includes creating a development plan with your mentor and filling in the gaps in your desired skill set.
In addition, Andrew shares a helpful tip he received from Nestle, which is that 70% of your learning should be learning by doing. 20% of learning is through relationships, while 10% should be through a course or learning program.
Getting In The Room (20:00)
Steve presses Andrew on what steps CISOs should take to get in the room. Andrew recommends ensuring people know who you are and your expertise.
If people don’t know you, you’ll never be able to prove yourself. That is the value of expanding your network.
What To Ask (24:47)
If you’re offered a board-type position, it’s essential to learn about the company culture and the CEO and review any incident reports that allow you to bring your expertise to the position.
Interview Questions (28:24)
Enterprise risk management is an excellent framework to focus on during an interview. Asking questions based on prior risks will reveal much about an organization, including red flags.
Andrew also reveals other red flags to look for in an interview. If companies don’t show change or progress with security, the work culture will be less desirable for a CISO. The worst cyberculture you could join is one where they won’t admit when they’ve experienced a breach.
Business Continuity Planning (37:20)
Business continuity planning is ignored a lot in cybersecurity because it is business driven. In Andrew’s opinion, cybersecurity should be separate.
Andrew and Steve discuss other business dynamics and what should or shouldn’t be the responsibility of the CISO.
Why Teaching (41:43)
Steve presses Andrew on why he teaches. Andrew likes to think it’s to give back, but he recognizes it’s a two-way street.
Andrew teaches deputy CISOS, CIOs, and executives seeking to transition into the CISO role. He has created his own lesson plans from scratch to give security professionals the highest value in their education.
The New CISO (47:55)
To Andrew, being a new CISO means seeing cyber security as a business enabler. This mindset can include expanding your network and learning what different people in the field do.
Quote: Well, I'm a strong believer that if we're not constantly learning and growing and progressing, that we will become obsolete. The skills you were using five years ago are not the ones you're using. And the same thing goes for five years from now. [00:50:30] They also talk about the jobs that our kids are gonna have don't exist today. So whenever I have people reporting to me, I dedicate 10% of their time to learning and training, and growing so that they will develop the new skills and be able to take on those n
Thu, 27 Jul 2023 - 49min - 95 - Security Engineer to CEO: Taking a Chance on Yourself
In this episode of The New CISO, Steve is joined by guest Suid Adeyanju, CEO and Co-Founder of RiverSafe Ltd.
Although his parents dreamed of Suid becoming a lawyer or a doctor, Suid had a passion for technology. Although his path was challenging, Suid shares how he successfully transitioned from a security engineer to an entrepreneur. Tune into this week’s episode to learn more about Suid’s early career journey, the mindset differences between engineering and business leadership, and the catalyst for starting his business.
Listen to Steve and Suid discuss navigating the corporate ladder and how security professionals can become business leaders:
Meet Suid (1:39)
Host Steve Moore introduces our guest today, Suid Adeyanju, a security professional and entrepreneur. At RiverSafe Ltd., Suid’s team specializes in cyber security, data operations, and demo.
Since childhood, Suid wanted to work in technology. Recently, he found his old yearbook from Nigeria and saw that he wanted to be a computer engineer even then. Even though that goal was unusual then, it demonstrates that Suid always wanted to be in technology.
At University (6:24)
While at university, Suid initially went for computer science and mathematics. After studying accounting for two years, his professor steered him toward business information systems.
As much as Suid loves computers, understanding how organizations deliver their services was a better fit.
Think About Impact (10:26)
Steve and Suid discuss how security leaders need to consider how their security work impacts the business.
If leaders focus on making the business secure, they need to work with the business and understand the risks associated with the work.
The Transition (13:40)
Suid reflects on his transition from engineer to entrepreneur.
As an engineer, Suid saw things in black and white. To run his business, he needed a different mindset because there is a difference between working with people versus computers.
Workplace Challenges (20:03)
Steve presses Suid on his time at Reuters.
After two years of contracting, Suid saw that he was stuck in his role while his teammates gained more responsibility. Initially, Suid believed he needed to work harder and gain his master's in information security. Now, he understands that this mindset is common with ethnic minorities and reflects on the challenges he’s faced.
Valuing Yourself (28:55)
Suid realized that this particular work environment did not value the additional education he had gained or the extra work he put in. Without another job lined up, Suid decided to quit.
Suid could take this risk because he had made good financial decisions, which gave him enough savings to rely on. Suid also had the proper professional skill set, preparing him to take a chance.
Starting A Business (34:24)
Suid reveals that this time led him to start his own business. Although it’s challenging to transition from engineer to entrepreneur, Suid knew his team was talented and could show value to their customers.
The Big Break (38:14)
Suid’s company got their big break when a senior manager at a major corruption chose to work with them. This manager took a chance on them with a significant project, which set Suid up for future momentum.
Sound Advice (43:43)
For the listeners who feel that the corporate world is not for them, Suid shares his advice.
First, take a course that teaches how to set up a business. Secondly, find a mentor who can share with you valuable insight.
The New Security Leader (47:21)
To Suid, a new leader focuses on people. One must have empathy and the mentality that leaders are meant to serve.
Links mentioned:
Thu, 13 Jul 2023 - 49min - 94 - The ABCs of Threat Actors: How to Stop Attackers From Becoming Insiders
In this episode of The New CISO, Steve is joined by guest Jeff Schilling, Global CISO for Teleperformance.
Jeff returns to discuss a pressing issue for CISOs: Insider threats. With credentialed attacks on the rise, Jeff shares his take on the “flattening” of this evolving threat. Tune into today’s episode to learn more about the ABCs of bad actors, how Covid has contributed to the problem and complex recruiting scams.
Listen to Steve and Jeff discuss which strategies are being employed to comprise employees’ credentials:
The Return Of Jeff (1:42)
Host Steve Moore introduces our returning guest today, Jeff Schilling of Teleperformance.
Steve reveals this is Jeff's third time on the podcast. Unlike other episodes, where guests discuss their career journeys, Jeff is here to share necessary research regarding insider threats.
The Problem (4:24)
Jeff explores the fundamental issue of insider threats. He reveals the different levels of the skill pyramid that threat actors can be evaluated at.
The “A” actors become insiders to exploit specific targets, which should be considered when creating a security system.
The Flattening (12:46)
Steve presses Jeff on what he means by “flattening techniques” that have led to our current state of attacks. Jeff explains how malware software and targeted phishing scams have been used to access their mark, an issue exasperated by remote work.
Adversaries and Targets (19:54)
Jeff explains how to communicate threat issues across departments, especially when there are language barriers. The biggest challenge is making messaging as simple as possible.
Depending on the job functions of others, there are different responses and success results. This is why Jeff’s team focuses on training and additional monitoring and security control.
More Tactics (23:28)
There are many strategies that threat actors use to breach one’s security. Bad actors target companies through social media, such as Linkedin.
Threat actors also learn about their target countries and reach out to them through more region-specific platforms. Jeff then asserted that insider threats must be part of every CISO’s security plan.
Preventative Steps (31:42)
Jeff assures us that there are things we can do to detect threats and explains those actions. Identifying the machine where phishing emails come from and implementing new technologies is key.
The Near Future (35:50)
With the evolving functions of AI, it may be easier for threat actors to be more convincing in their scams. Their messaging is getting more believable, which is why Jeff believes they are taking advantage of new technologies, despite there being safeguards.
However, Jeff is not convinced that certain aspects of AI, like voice mimicking, will get more sophisticated.
The New CISO (39:42)
To Jeff, being a new CISO is constantly learning and having your finger on the pulse. If you think you know everything, it is likely you do not.
Links mentioned:
Quote:
“I used to say multifactor authentication at the edge was a big barrier for the threat actor to get over. That's no longer, I can't say that anymore. It's more like a small fence. And now, you got to look at how do you manage your privileges and how do you conduct IT operations inside of your wire, and how would a threat do it if they were an insider? And then what controls do you have to be able to detect that activity because they're going to be using IT tools, and they're going to look like they're coming in with a legitimate account.”
Thu, 29 Jun 2023 - 36min - 93 - Great Minds Think Differently: Neurodiversity and Vulnerability in Leadership
In this episode of The New CISO, Steve is joined by guest Chris Nolke, multi-time CISO, and founder of Skycrane.
Chris had decades of cybersecurity experience before starting his own company. As a neurodivergent leader and life-long learner, Chris navigates the workplace with self-reflection and candor. Tune into today’s episode to learn more about Chris’ professional journey, his human approach to leadership, and his definition of happiness.
Listen to Steve and Chris discuss the values that drive career decisions and how vulnerability can serve or harm you in the workplace:
Meet Chris (1:41)
Host Steve Moore introduces our guest today, Chris Nolke, the founder of Skycrane.
Chris first started his cybersecurity journey while studying electrical engineering in college. From there, he got a job as an engineer, which eventually led him to his current path. As a life-longer learner, Chris followed the most interesting path to him: cyber security.
Defining The Interesting Path (8:36)
Chris wishes he had done a “values” exercise earlier in his career to determine his professional wants. He advises other people joining the workforce to consider a process where they discover what they believe in.
When you understand your values, you can make more straightforward choices toward your career.
Evaluating Jobs (10:59)
Chris admits that every job he’s taken has been different than he initially believed. In those circumstances, it’s essential to determine your desire to stay in that position or pivot.
Personal Characteristics (14:40)
Steve presses Chris on what three bullet points his colleagues would list for him. Chris states that vulnerability, being a conversationalist, and expertise have become his brand in the workplace, which has made him successful.
Going Further By Saying Less (25:16)
Chris shares that many people who practice impulsive communication use that as a means of connection. Reflecting on this, Chris acknowledges the difference between impact and attention.
After trial and error, Chris learned he would go further in his career if he said less.
Sound Advice (30:31)
For leaders, Chris shares that neurodiversity is a superpower. If you can harness the pattern-recognizing skills of neurodivergent employees, you can build an incredible security team.
To understand how to use this superpower, Chris recommends leaders have mindful conversations with their employees. People need to learn what they’re good at to get ahead.
The Subject of Happiness (40:06)
As a CISO, Chris is fascinated by the construct of happiness and what comes with it. Happiness is made up of joy but also contentment. Balancing between the two is the key to understanding and taking advantage of this construct.
Chris recommends that every CISO creates a “happiness” process to avoid burnout, though burnout led Chris to start his own business.
The New CISO (49:10)
To Chris, being a new CISO is about creating a system of business relevance. You can improve your job when you understand the business's daily needs.
Links mentioned:
Thu, 15 Jun 2023 - 51min - 92 - The Power of Automation: Which Tools Can Help Your Security Team?
In this episode of The New CISO, Steve is joined by guest Peter Frochtenicht, National Manager for Security and Compliance and CISO at NEC Australia.
A technician by nature, Peter has decades of experience across multiple countries. Today, he joins the podcast to discuss the complexities of AI and the benefits of time-saving tools. Tune into today’s episode to learn more about Peter’s technical journey, the most common security threats, and his advice for new CISOs.
Listen to Steve and Peter discuss why automation is a critical component of security tools and how the threat landscape has changed globally:
Meet Peter (1:36)
Host Steve Moore introduces our guest today, Peter Frochtenicht, who has worked at NEC for nine years.
Before NEC, Peter started his career as a systems engineer twenty years ago. Peter has worked in Africa and Australia and has worked his way up through different organizations.
Catching Up (5:21)
Ten years ago, the CISO role in Australia would be rare. Steve presses Peter as to why.
Since the Australian population is smaller than the states with fewer big-name organizations, it took Australia longer to catch up in the security industry.
Australia’s Biggest Threats (9:37)
From a defense perspective, Australia is doing much business with the states, especially with submarines. From a threat perspective, they border China and some of the eastern countries, which makes a security threat from those countries more imminent.
Increased Attacks (13:17)
The most typical security attack that Peter witnesses is phishing, which affects organizations and citizens. According to Peter, it is human nature to be curious about and click on an email link. For outside threats, financial benefits and access to information are to be gained.
AI has also advanced quickly, which can contribute to increased threats since you can mimic someone's voice. Organizations should be prepared to use AI for good but also be prepared for when there are more insidious reasons for using this new technology.
The Benefits of AI (18:05)
Steve presses Peter on what defense benefits he predicts will come from AI.
Peter shares the automation tools his team uses that help reduce his analysts' headcount and save time. Chat GPT may help you personally, but Peter believes in partnering with known vendors that can help limit human error.
What To Look For (21:11)
Peter shares what CISOs should or should not look for when choosing AI tools. Analytic tools are standard and can save much time and effort. As a result, organizations can save money and trust that there will be an increase in accuracy.
If tools can help CISOs detect abnormalities with less effort, that would be of service. Of course, abnormal actions may not be malicious but could be a mistake by a well-meaning person.
Investing In Employees (28:32)
Peter believes in training his people to bring the best out of them. People don’t always have the right skills at the right time, but you build a strong team when you invest in your employees and their relationship with your vendors.
Adding Skillsets (31:05)
Steve asks Peter what skillsets he had to add, besides technical abilities, to perform his role. Peter discusses his career journey, including his transition into leadership.
Peter had to gain a governance mindset and consider policies and when to update said policies. It’s challenging to ask for money to pursue your endeavors, but if you have a budget, you must spend it.
Sound Advice (38:56)
Looking up back at his career, Peter wouldn’t change much. But Peter recommends getting training and certifications to keep yourself up to date. You don’t need to wait for your company to suggest it to take on a new challenge.
The New CISO (42:41)
To Peter, being a new CISO means supporting the business and business structure. The biggest challenge for a CISO is adapting fast to new security changes while asking for money as needed.
Links mentioned:
Thu, 01 Jun 2023 - 45min - 91 - Taking Extreme Ownership: How 3 Common Excuses Hurt Security Leaders
In this episode of The New CISO, Steve is joined by guest Michael Meis, Associate CISO of the University of Kansas Health System.
Beginning his career in the U.S. Army Signal Corp, Michael eventually transitioned into government consulting and the private sector. Today, he shares his philosophies on leadership and ownership in the cybersecurity field. Listen to the episode to learn more about his extensive technology background, the importance of inter-department friendships, and how he helps fellow service members make their professional transitions.
Listen to Steve and Adam discuss how to navigate bureaucracy and adapt to corporate environments:
Meet Michael (1:41)
Host Steve Moore introduces our guest today, Michael Meis. Michael has been in IT and security for fifteen years and healthcare for two years. Michael met Steve a year ago during a security conference, leading to their connecting around the industry and their philosophies on leadership.
Michael also reflects on his role in the military, which began with him working with radios and evolved into performing general technology support.
Getting His Start (6:09)
Michael was always interested in computers but initially never saw it as a career. He decided to join the military instead. However, his military recruiter encouraged him to take a tech-related job, and his security journey began.
This first army signal corps job was less computer-heavy than expected, but Michael still learned a lot.
Dealing With Corporate Politics (9:07)
For ten years, Michael worked as a government consultant. This experience taught Michael to navigate complex bureaucratic dynamics to get past red tape.
Michael highlights the importance of having solid relationships in different departments to get things done. You can determine which workplace rules to bend when you understand how things are and how your organization operates.
Finding a Path (14:01)
Michael expands on the importance of relationships in a corporate setting. You can leverage those relationships when needed to promote your department’s agendas.
The more you understand your organization’s rules and politics, the less friction you will face, and the more you can build a trusted security culture.
Government Challenges (22:44)
Steve presses Michael on his quote, “Governance is important, but alone won’t solve all of your problems.”
Anyone who has worked in government understands that there are always challenges within its IT environments. Since the government has total control over its IT, Michael learned early on that more than governance is needed to perfect these systems. Collaboration is needed between parties.
Excuses, Excuses (28:13)
Michael shares the security community’s common excuses that tend to irk him.
Budget professionals can be challenging to work with from a leadership perspective. He also gets frustrated when people use a lack of training as a reason not to try something. Michael values training, but he understands that sometimes you have to take action before that formal training comes.
Behavioral Norms (33:50)
Michael explores the behavioral norms that came out of his military service.
Learning how to function in a corporate environment is essential for people to know when leaving the military. The benefits of this experience were the rigor and structure, which can provide direction in life. On the flip side, it can be challenging to transition from that structure because you can grow dependent on it.
Helping Others (39:07)
As a leader, Michael tries to help other service members remove their need for a manual when making corporate transitions. That way, they can learn to embrace their creativity, benefiting their long-term careers.
Ultimately, Michael aims to empower his teams and shift their professional mindsets.
The New CISO (47:27)
To Michael, being a new CISO means recognizing that they are not just security practitioners but business executives. The more security evolves as an industry, the more CISOs can adapt to these modern changes.
Links mentioned:
Thu, 18 May 2023 - 48min - 90 - How To Build Trust Within Your Team, Your Business, and Yourself
In this episode of The New CISO, Steve is joined by guest Adam Currie, CSO at HCL Software.
Adam started his career 27 years ago, working the night shift as a main frame operator before working his way up in the security world. Today, he shares how he builds trust within his team, company, and himself. Listen to the episode to learn more about his expansive career journey, when to encourage your team, and dealing with imposter syndrome.
Listen to Steve and Adam discuss the right time to challenge yourself and when leaders should foster an environment where it is safe to fail:
Meet Adam (1:38)
Host Steve Moore introduces our guest today, Adam Currie.
Adam was first the head of security operations and architecture at HCL before transitioning into the CSO role. When Adam joined HCL, he brought his breadth of technical knowledge and understanding of how their user base consumed their tools. In this business, it's essential to understand how these programs are used while ensuring they are secure, a mentality that helped Adam move into the CSO position.
The Main Framer (4:41)
Steve asks Adam about his experience on the main frame.
When Adam was a student, he worked as a tape librarian. This after-school job led to him taking classes and learning about mainframe operations and basic coding language.
Desktop Support (8:26)
Adam believes that having a desktop support background benefits security professionals because it provides an understanding of how end users operate. Communicating with this community with empathy adds significant value to any security team.
Unexpected Steps: CISO to Soc to CISO (12:38)
Adam did end-user support work at Bloomberg before moving into backend enterprise applications. Then he was asked to run Bloomberg's tier one and tier two service desks, a type of work Adam did not plan on returning to. However, this opportunity offered Adam his first management role, and he credits this position as getting him to where he is today.
Building Trust With Your Team (20:05)
Upon reflecting on his job journey at Bloomberg, Adam shares why people seek new opportunities.
When people leave positions or accept roles, it is for job growth. Most people want to consider how a job will help their families and goals before making a career transition. Adam would rather help his team explore their options than subdue it–though no one wants to lose valuable employees. He wants his team to trust him enough to be honest with him about when they want to make a change.
A Challenge (25:21)
For Adam, it is always a struggle to stay out of the weeds of the tech side of the business. He gravitates toward technology but understands that that is different from his role now.
For leaders, it is more important to nurture an environment where employees are safe to fail because that is how people learn and grow. You shouldn't be reckless, but being inactive is more risky.
Owning Failure (29:02)
Steve presses Adam on how far he will go to own his team's failures. Adam thinks it is his job to communicate with senior management and shield his team from scrutiny.
No matter what, we must be honest about what we can do to improve and have productive, unemotional conversations.
Building a Brand (36:13)
Building a brand comes with trial and error but is critical to success. Often this comes with changing the perception that security is a necessary evil. Demonstrating that security is a value-add partnership that leaders actively want to engage in is essential.
Putting Yourself Out There (47:54)
Though Adam is not a fan of public speaking, he believes in pushing himself past his comfort zone. Although he has experienced imposter syndrome about his experience, he is putting himself out there as a podcast guest today to share his career journey.
The New CISO (54:23)
To Adam, a new CISO establishes a strong team and establishes trust within the business and with your peers. Trust is necessary to claim success.
Links mentioned:
Bio:
A proprietor of service excellence and incubator of change, operating at the intersection of people, processes, and technology with 26 years' experience successfully partnering with business leaders to build strategies aligning to corporate and client needs, resulting in realization of value-add with a holistic approach to business, technology, and security.
Thu, 04 May 2023 - 55min - 89 - Be Comfortable Being Uncomfortable: Managing New Roles and Next Steps
In this episode of The New CISO, Steve is joined by guest Mike Kelley, CISO of the E.W. Scripps Company.
Mike worked as an auditor before eventually jumping into cyber security. Reflecting on his past, Mike shares how balancing ambition with transparency is critical to success. Listen to the episode to learn more about Mike’s auditing experience, falling into cyber security, and his advice for CISOs when interviewing.
Listen to Steve and Mike discuss how leaders should assist their team with career development and why “fake it until you make it” makes for bad career advice:
Meet Mike (1:44)
Host Steve Moore introduces our guest today, Mike Kelley.
Mike shares his role in the enterprise and consumer-based security field and how his duties differ from those in an internal security environment. Although he would say that consumer-based security is not clearly defined, his goal is to keep all things related to the consumer secure, in addition to the typical CISO goals.
His Start (3:36)
Before working at E.W. Scripps, Mike worked at KPMG, one of the big four firms. There, Mike performed external audits but also did some compliance consulting as well.
Although no one wanted an auditor there, especially to answer his questions, Mike had to work on building a rapport with people in difficult situations. Through this role, Mike was exposed to numerous companies, allowing him to learn constantly. He may not have wanted to start in audits if he could do it all again, but this experience prepared him for his cyber security career.
Adapting With Transparency (9:02)
Mike has become comfortable with being uncomfortable and transparent when he doesn’t know something. When he got his CISO job, he told HR that this position was new to him and that he had a lot to learn.
Being confident enough to say “I don’t know” is Mike’s mental motto because he knows he can adapt to new challenges. Ultimately anything is learnable as long as you push yourself, a mentality he encourages in his team.
The Burn the Boats Method (17:42)
After reflecting on his career decisions, including telling a company to fire him if he didn’t succeed as a director, Steve presses Mike on how he would react to someone sharing this approach.
If one of Mike’s employees wanted to try a position out and see what happens, Mike would like to ease them into that role. He would let them transition through responsibilities first before changing that person’s title. Ultimately, trying and failing is okay, but Mike wants his team to fail soft versus hard.
Falling Into Cyber Security (21:42)
After looking for cyber security jobs for three years, Mike eased into this field through a position in compliance. Working side-by-side with security professionals, Mike was able to dip his toes.
After lunch with his manager, he was offered the CISO role, and Mike immediately said yes. Mike admitted he didn’t know what he was doing but was encouraged to take this job.
Rolling With It (25:01)
Steve asks Mike if he ever wishes he said no when offered the CISO job. Mike knew this was the field he wanted to pursue, and he felt comfortable being transparent about his experience.
Interview Questions (31:18)
If you are a new CISO wanting to ask good questions in an interview, Mike suggests asking the purpose of that role at that company. Another helpful question concerns the company’s approach to trying new things and handling challenges.
The Definition of Success (34:13)
When evaluating a company during an interview, it’s essential to find out what that company’s definition of success is. Mike defines success as being aligned with the business that employs you and being seen beyond the security status.
The Important People (36:50)
If you don’t know where to start when beginning a new position, Mike suggests finding out who has influence in the organization and who delivers results.
Once you know who those people are, you can nurture those relationships and get their input about the initiatives you want to implement.
Bad Advice (42:21)
The worst advice Mike received was “fake until you make it.” Although that approach may have good intentions, it is better to be transparent about your abilities.
A quick way to imposter syndrome is to fake it. When you have humility, more people are inspired to help you toward your career goals.
The New CISO (44:04)
To Mike, a new CISO is having input in your organization’s strategic direction and getting an opportunity to take that to the next level. Having a leadership position is how he defines a successful CISO.
Links mentioned:
Thu, 20 Apr 2023 - 47min - 88 - The Patient Safety Model: Developing a Hospital’s Security Culture
In this episode of The New CISO, Steve is joined by Martin Fisher, CISO at Northside Hospital.
An information security veteran, Martin has worked in the commercial aviation, finance, and healthcare industries and was an award-winning podcast host. Today, he shares how to build a unified team and his approach to managing mental health. Listen to the episode to learn more about the value of hobbies, defining company culture, and being an empowering leader.
Listen to Steve and Martin discusses the importance of shared team culture and how CISOs can balance the stress of the job:
Meet Martin (1:50)
Host Steve Moore introduces our guest today, Martin Fisher. Over his decades-long tech career, Martin has worked in several industries.
His podcast, Southern Fried Security Podcast, lasted ten years and was an incredible learning experience. While a podcast host, Martin discovered that he used too much jargon for non-security listeners, encouraging him to expand to a larger audience.
Other Hobbies (5:52)
Martin considers himself an original nerd, playing Dungeons and Dragons as a kid and an adult. A fan of role-playing tabletop games, Martin has backed many Kickstarters and has a great gaming community within his group of friends.
Mental Healthcare (8:22)
A CISO for a hospital, Martin stresses that mental healthcare is healthcare. Martin believes in what his non-profit-based workplace stands for, which is why he has chosen this role.
The Bad Day Factor (10:27)
Martin manages his mental health by setting boundaries. People need to separate their work and personal life because it’s essential to have time to decompress.
In the IT and security fields, there is a high percentage of neurodivergent employees who may need additional support in dealing with stress. Leaders must have employee assistance programs to help their staff with mental healthcare safely.
Being Authentic (16:50)
To build lasting relationships, you have to be your authentic self. When Martin looks for people to promote within his team, he looks for genuine individuals.
Growing the Team (18:33)
When Martin started his current position, he and the company culture aligned.
Starting as the original security employee, Martin has been able to grow his team. His company understands that security is an investment and helps protect its patients, which has led to its success. Martin hires employees with their personalities in mind and how they fit the company culture.
Patient Safety (22:53)
Confidentiality is paramount to uphold in the medical security field. Since they are a patient-safety-first organization, Martin ensures he hires employees who understand that mentality.
Defining Work Culture (28:25)
Northside lists its company culture on job listings to attract the right candidates, which includes kindness. Since Martin focuses on patient safety and quality care with his CISO work, he hires people who match those ideals.
When you have this approach to hiring, you can create a positive feedback loop while forming a strong team.
Culture Over Security? (33:35)
Steve presses Martin on what’s more important: culture or preventing security issues?
For Martin, security is still, of course, the focus. People are human and make mistakes, but they’ve never had a problem they couldn’t control.
Bad Advice (38:43)
The worst career advice Martin ever received was to work for a hedge fund. This environment was not a good fit for Martin, further emphasizing his point on authenticity's value.
Military Experience (39:56)
Martin explores how he has applied his military service experience to security crises. He has confidence in his CISO role because he has gone through worse. Having army training, he has a quiet confidence that has made him a better leader who empowers his team rather than micromanages them.
The New CISO (48:18)
To Martin, being a CISO at Northside is the best role he’s ever had. Protecting patients is both gratifying and terrifying, but he believes in his colleagues and the company’s mission.
Links mentioned:
@armorguy@infosec.exchange
Thu, 06 Apr 2023 - 49min - 87 - What Would a Breach Cost You? Personal Risk vs. Reward as a CISO
In this episode of The New CISO, Steve is joined by guest Jeff Farinich, SVP of Technology Services and CISO at New American Funding.
First starting his career as a general contractor, Jeff now prides himself on solving security problems. Today, Jeff shares how he makes career decisions and manages his organization’s risks. Listen to the episode to learn more about Jeff’s extensive career journey, his development relationship with vendors, and how CISOs take on a great deal of personal risk.
Listen to Steve and Jeff discuss the right time to leave a company and the personal and monetary cost of a breach:
Meet Jeff (1:45)
Host Steve Moore introduces our guest today, Jeff Farinich.
In his early twenties, Jeff studied accounting but realized it wasn’t for him. He then became a general contractor, but by his mid-twenties, he was still determining what he wanted to do. He soon took a course that kickstarted his IT career, putting him on the path to becoming a CISO.
Adjusting To The Job (4:20)
When Jeff started his first IT job, he was excited by the change of direction.
However, Jeff realized he always dabbled in tech because even at his first accounting job, he helped manage PCs.
Multiple Paths (6:28)
Jeff reflects on his job at a large property management company and his position as an MS manager at a small movie studio.
He soon began his path into security management and leadership. Through the movie studio, he also went to the premiere of a Jean-Claude Van Damme movie.
Advice To His Younger Self (10:45)
If Jeff could give his younger self advice, he would suggest getting as much tech experience as possible on the VAR side. He also would have stayed in Silicon Valley longer, possibly having an even more explosive career.
A MacGyver Type (15:38)
Steve presses Jeff on whether he would ever consider stepping away from the technical side of security to get on the strategy/VAR side.
Jeff is very open but also likes to fix things. He refers to himself as a MacGyver type “born with a screwdriver in hand.”
A Development Relationship (19:30)
Jeff enjoys having a development partnership with partners by trying new, untested tech at a low cost.
This type of relationship allows both parties to win and allows Jeff to be creative and drive innovation for that vendor.
Evaluating Vendors (22:13)
There are fewer IT vendors than security vendors, so there have been fewer decisions for Jeff to make. Evaluating vendors to work with is a process and can leave room for great, collaborative relationships.
A Small Step (27:35)
Before jumping into vendor development, Jeff recommends understanding the industry and being knowledgeable about the vendor space you’re interested in.
If you are someone who doesn’t always want to contact your VAR but doesn’t know where to start, it’s essential to begin by learning and choosing carefully.
Moving Up and Out (32:59)
Steve presses Jeff on clarifying his belief that “the best way to move up is to move out.”
Jeff is far from a job hopper, but if you wait to the point where you are desperate to leave your company, you probably should have left sooner. If you are not fixing the problems you want to repair, or there are a lot of risks, it’s valid to seek new opportunities.
Managing Liability (34:51)
CISOs always need to evaluate how much risk they are taking on. Whether you are an officer or director, you should realize that liability can reach you. Jeff has pushed for ways for CISOs not to be personally liable for breaches.
Individual Risk (36:20)
Jeff and Steve share the costs of a breach and how that can trickle down to the CISO, whether monetarily or mentally. CISOs have bad day factors that can outweigh other members of a company.
The New CISO (43:44)
To Jeff, a new CISO is someone who deals with ever-growing cybercrime. You may not get everything you need on day one, but being a CISO is a journey of learning.
Links mentioned:
Thu, 23 Mar 2023 - 44min - 86 - Self-Sufficient Security: The Perks of Being a vCISO
In this episode of The New CISO, Steve is joined by guest Laura Louthan, Founder & vCISO at Angel Cybersecurity.
Originally from Britain, Laura moved to Los Angeles to explore new opportunities before transitioning into IT. Eventually starting her own business, Laura shares her self-sufficient approach to cyber security. Listen to the episode to learn more about Laura’s unconventional career journey, why it’s more efficient when you understand your abilities, and how she handles being a contracted CISO.
Listen to Steve and Laura discuss embracing challenges but avoiding struggle and tackling likeability when applying for jobs:
Meet Laura (1:45)
Host Steve Moore introduces our guest today, Laura Louthan.
CISO and only employee at Angel Cybersecurity, Laura, had an eclectic past before settling into the security field. She worked as a scuba instructor, can-can dancer, and temp before getting her first IT job. She feels she was fortunate to break into IT when she did.
London and LA (5:04)
Laura explains why London and Los Angeles didn’t suit her well. She had a job in London that she didn’t enjoy, but her brother worked in Los Angeles in the film industry.
When she got to LA, she realized that the movie business was not for her, bringing her to her Club Med job. When something didn’t sit right with her, she left and is grateful that she used her twenties to explore. She advises people looking for work to try temping because you just need to meet someone to get your foot in the door.
Learning On The Job (9:47)
While working in IT at Equifax, Laura had to teach herself how to do things. She figured out how to get answers and become self-sufficient, which is a valuable skill.
She knows how to get things done but also understands her skillset. She believes that it is more efficient to be truthful about your abilities.
Challenges, Not Struggles (14:09)
Laura admits that while she likes a challenge, she does not want to struggle. For example, she understands that privacy and security are different, although overlap exists.
If her clients asked her to fulfill their privacy needs, she believes that would be inefficient since that is not her area of expertise. She would be happy to refer that client to a privacy professional instead.
The Privacy Question (16:24)
Steve asks Laura if there is a greater need for privacy help. Laura believes this is external pressure for CISOs, and that privacy pressure comes after security.
Laura thinks privacy is exciting and intellectual but recognizes it as a different CISO mindset. She is very comfortable with her specialty in security.
Her Time At Sephora (22:48)
At Sephora, Laura was the head of Information Security. After working in the credit industry, she found the retail space to be a fascinating change.
Although Laura is not the archetypal security type, she found her personality and gender made her a good fit for this female-focused company.
The Likeability Index (27:41)
Steve and Laura discuss how “likeability” is typically higher in women, which can hurt them during negotiations because women tend to want to be liked.
Women also tend to apply for jobs they are overqualified for. Laura advises women to apply for jobs they think are reaches for themselves instead, which is what men do. We should all hope for a job that challenges us.
In The Interview (31:22)
Laura and Steve explore different questions candidates should ask or consider during the interview process.
For Laura, she asks what technology the potential client uses, their industry, and other questions that clarify if she's the right fit. Before taking a client on, you want to ensure you can help them. Ultimately, if you do good work, clients will typically recommend you.
Legally Speaking (36:20)
Since Laura is not an employee of her clients, she explains how she handles legal risk.
Laura has errors and admissions insurance and details that she is not responsible for other companies' compliance. Since Laura is not full-time, she can’t be there for every meeting, but she works hard to discuss how she can get them where they want to go.
The Challenges of Being a CISO (41:55)
Laura shares that the worst part of the cybersecurity industry can be the negative security person. She believes that what CISOs can do better is to collaborate with other departments outside of IT.
The New vCISO (43:45)
To Laura, a new vCISO is a chance to be pragmatic and enable the business. Working together is a joint decision, so building relationships with the people you work with is important.
Links mentioned:
Thu, 09 Mar 2023 - 45min - 85 - 5 Top Tips for Boosting Security Mindfulness
In this episode of The New CISO, Steve is joined by guest Rupa Parameswaran. At the time Rupa joined the show, she was Head of Security at Amplitude. Now, she’s transitioned to a new role as VP of Security & IT at Handshake.
Growing up, Rupa was initially given a choice: to marry or become a doctor or engineer. With the support of her family, Rupa pursued her passions as a leader in the cyber security world. Listen to the episode to learn more about Rupa’s advice to the listeners, her first product development opportunity, and why every CISO needs to understand the power of influence.
Listen to Steve and Rupa discuss the importance of having allies across the security business and how to build a culture of mindfulness in your organization:
Meet Rupa (1:40)
Host Steve Moore introduces our guest today, Rupa Parameswaran.
With decades of experience and a deep-rooted technical background, Rupa has seen how security has evolved over the years and why CISOs need to grow with these new procedural changes. As the head of security at Amplitude, Rupa ensures that the product and employees are secure in both privacy and culture.
Engineering Background (4:00)
Before starting her career in cyber security, Rupa first studied engineering. Growing up in India, she felt she had a choice between getting married or going down an engineering or medical path.
Rupa determined that becoming a doctor was not for her and became interested in computer engineering. In university, she worked on an AI project, leading her to move to the United States and the security industry.
A Clear Path (7:08)
Pre-Amazon, Rupa and her colleagues were trying to create a marketplace for books with AI security technology. After this incredible experience, it was clear to Rupa what her career should involve.
Having Support (9:04)
Rupa shares that India has been a typically male-dominated society, which is changing slowly. Many more parents are interested in helping their daughters pursue careers and become self-sufficient versus getting married.
Rupa’s mother fought for independence, which she wanted for her children. Grateful for the support, Rupa was able to pursue her passions.
Rupa’s Advice (13:50)
Whether someone is a woman or just someone determining what they want to do, Rupa recommends that everyone find their passion. If you discover something that excites you, seek mentors or people you can trust to discuss your interests.
You will be on a good path if you can build a support group. It may be a slow process, but it is a critical one. With mindfulness, you can build credibility with your work, and nothing can stop you.
Post University (17:09)
After university, Rupa was at a crossroads. Should she go into academia or not? As she determined this, she got an opportunity to be a software engineer with a new company.
Interested in the GDPR security product they were building, Rupa was able to be a developer on the project. Believing in the company’s vision, Rupa was excited to get immediate security industry exposure across different team initiatives.
Having Influence (25:19)
Rupa reflects on what she learned from the GDPR project. She became skilled at building ally support groups and influencing security development without having to manage people directly.
This unique opportunity gave her essential leadership skills and the ability to spread security mindfulness throughout the company.
Her Definition (28:48)
Steve presses Rupa on her definition of “security mindfulness.” To Rupa, this phrase demonstrates a willingness to include security in every initiative you pursue.
If you build out a unique group of security-minded professionals, each person can preface the importance of this topic in meetings without you. Having another person speak up on your department’s behalf shows successful security mindfulness.
Find Your Allies (32:19)
As a security leader, finding your security allies is critical. When you need resources, education, or policy changes, you need to have people in your corner to help you.
Rupa advises the listeners to find these allies early and “catch the wave when you see it.”
The Currency Of Credibility (35:17)
Rupa defines the currency of credibility as building trust amongst your colleagues.
If you can show your coworkers you have this knowledge and the data to back your proposals, it’ll be easier for others to agree with your judgment. Understanding your product allows you to be a better security leader.
Holding Executives’ Attention (40:00)
When it comes to leadership, you must build allies and know your audience. By having relationships with executives, you can better understand what piques their interest and convey to them that the company’s security is equally important to you.
The New CISO (47:38)
To Rupa, a new CISO is someone who is constantly evolving. Keeping the wheel of security turning is the primary goal of any security professional because security is a journey.
Links mentioned:
Thu, 23 Feb 2023 - 49min - 84 - Are You Ready to be a CISO? Why Mentors Matter with Mark Weatherford
In this episode of The New CISO, Steve is joined by returning guest Mark Weatherford, CSO and SVP of Regulated Industries at AlertEnterprise.
In last week’s episode, Mark shared how he set the foundation for his incredible career, from his start in the Navy to his time working for Governor Arnold Schwarzenegger. Today, Mark delves into his lasting legacy in the cyber security field. Listen to part two of this episode to learn more about being the plus one at security meetings, Mark’s mentorship perspective, and putting in the work to succeed.
Listen to Steve and Mark discuss what it means to be coachable and the importance of experience:
The White House Basement (1:33)
Host Steve Moore presses his guest Mark Weatherford on a meeting he attended in the White House basement.
Mark was initially instructed to use this meeting as a learning experience to see how things worked. Unexpectedly, John, the National Security Advisor, asked Mark his thoughts on an issue, and Mark answered on the spot.
Strong Leadership (6:44)
John asking Mark a security question showed strong leadership because it allowed Mark, who was new to the team, to be included.
When you’re the CISO in charge, you should bring a team lead or a middle manager to meetings, so they can learn and provide input. This type of experience will allow them to build skills and develop confidence, which they will need as they climb the cyber security ladder.
Mentorship Advice (10:29)
Mark advises the younger leader to always look for opportunities to mentor people. Generally, Marks tries to be available to those who ask him to chat about leadership and security.
On the other side, younger people need to be willing to ask for help.
The Mentorship Exchange (16:10)
Steve asks Mark what people should expect from mentorship lunches. Is it just lunch or something more pressing?
Mark explains how in his case, he was friends with his mentor, so they mostly just enjoyed meals together. However, his mentor would ask him questions about work to see how he could help. Of course, different dynamics operate differently, but the main thing mentees should consider about themselves is, “am I coachable?”
Steering The Mentee (19:47)
Mark and Steve discuss how to guide mentees away from vanity. Nowadays, new security professionals may focus too much on the job title than becoming a leader.
Mark then further explains what it means to be coachable: a willingness to take in the tough feedback to improve.
In the Meeting (21:24)
When Mark meets with potential mentees, he’ll give them a homework lesson and ask them what their goals are. He will also ask them what efforts they’ve made to achieve their goals.
With so many CISO opportunities out there, people are getting jobs without putting in the hard work, though having experience is essential.
The New CISO (24:08)
To Mark, being a new CISO is a wide-open field. One must understand the job's responsibilities and be creative with their resources. Ultimately, being a new CISO is having the experience that validates your position in the role.
Links mentioned:
Thu, 26 Jan 2023 - 26min - 83 - Be the One Who Gets the Call - The Keys to Landing New Opportunities
In this episode of The New CISO, Steve is joined by guest Mark Weatherford, CISO and Head of Regulated Industries at AlertEnterprise.
After many years in CISO roles, Mark eventually found himself in the White House. Reflecting on his incredible career journey, Marks evaluates the opportunities that led him to success. Listen to part one of this episode to learn more about Mark’s navy experience, the importance of delegating in leadership, and how to become the guy who always gets the call.
Listen to Steve and Mark discuss when to put the fear aside and embrace the possibility of failure and the willingness to take on new opportunities:
Meet Mark (1:51)
Host Steve Moore introduces our guest today, Mark Weatherford. The current Chief Security Officer at AlertEnterprise, specializing in IT and OT security.
Before starting his cyber security career, Mark wanted to build dams and roads in the navy. Instead, the navy had other ideas and picked Mark to be placed in the advanced electronics program, leading him to the CISO industry.
Measuring Your Day (7:21)
Mark measures his work day by the goals his team achieved or when a project is done. Although it’s a different set of standards than when you see a road or other construction projects completed before you, cyber security work can also be assessed.
Life After The Navy (9:08)
By the time Mark started his job at Raytheon, the Navy had a contract to complete a security project with them. Already determining when he would leave the Navy, Raytheon called him about a position that fit his skillset: building a security operations center from the ground up.
Relying On Your Team (14:14)
Steve presses Mark on what he learned from managing the start of the security operations center. Mark gathered that no one can do everything and that it’s essential to have a core group of leaders to rely on.
Good leadership comes from delegating authority to people without micro-managing, empowering them to excel at their jobs.
Working With Fear (22:07)
“That’s all part of learning. Things are going to break now and then,” Marks explains when expanding on his leadership philosophy.
Reflecting on his own experience with gaining new skills, Mark’s advice to anyone is that mistakes happen when you’re learning. We may be uncomfortable when things are unfamiliar, but as long as we’re not doing anything malicious, we can figure things out.
What Happens Next (24:14)
One day Mark received a call from his boss about a project with the Federal Government in Colorado. A year later, Mark got another call from his next job, leading him to a cabinet position.
Through his impressive work experience, Mark was considered for exciting political opportunities impacting our country.
That’s Politics (28:53)
Mark discovered pretty quickly in politics that people aren’t always truthful. Unfortunately, he understands that this is the industry's nature, and that is how things are. As a result, it’s natural to become wary and not take everything you hear at face value, although Mark still gives people the benefit of the doubt.
Working With The Legislature (31:13)
Mark’s work in government allowed him to influence policy as well. Mark learned about the trade-offs in politics during this experience and why opposition can create barriers to security policy.
Becoming The Terminator’s CISO (34:58)
After leaving Colorado, Mark was called for the opportunity to work for Governor Arnold Schwarzenegger in California.
Mark recognizes that the secret to his success derives from being prepared for new positions when they arise. Mark never directly worked with Governor Schwarzenegger, but having this role gave him a lot of respect in the security world.
Having Pride (38:06)
Mark is very proud of his time in California. With over 160 departments, agencies, and organizations operating there with different security needs, Mark worked with them all to find solutions. This level of collaboration and relation-building was an incredible experience with lasting, positive results today.
Links mentioned:
Thu, 12 Jan 2023 - 41min - 82 - Learning From a Layoff: Career Growth, Change, and Opportunity
In this episode of The New CISO, Steve is joined by guest Sandy Dunn, Lead Consultant, and Founder at Quark IQ.
After spending years in healthcare, Sandy pivoted into a start-up before being laid off. Now embarking on the next stage of her career, Sandy shares the valuable lessons she’s learned and how she embraces life’s challenges. Listen to the episode to learn more about Sandy’s strengths as a CISO, the correlation between motherhood and leadership, and how to navigate the start-up industry.
Listen to Steve and Sandy discuss the benefits of failure and maintaining an authentic mentor/mentee relationship:
Meet Sandy (1:43)
Host Steve Moore introduces our guest today, Sandy Dunn. Sandy has been a CISO for eight years at both a healthcare company and a startup.
As she tackles her newest endeavor as the lead Consultant at Quark IQ, Sandy acknowledges that her strengths in the cyber security world are her persistence and passion for creating well-functioning systems. Although she may not think of herself as the most brilliant person in the room, her determination has been an asset everywhere she goes.
Nothing To Prove (4:26)
Sandy recognizes the leadership benefits of not needing to prove her brilliance. Since she doesn’t mind admitting when she doesn’t understand something, others can gain clarity, and she can identify unknown issues. She asks the questions others are afraid to ask for the benefit of her team.
Although others may feel subject to imposter syndrome, Sandy reminds listeners that everyone has a vital role in the room.
Having a Softer Side (10:46)
As an executive who is also a mother, Sandy can use that nurturing skill set to motivate and manage her team. Sandy has become a stronger leader by putting her employees’ needs first, much like her children.
Managing In The Moment (13:46)
Steve presses Sandy on how she deals with team members prone to tantrums. Similar to her approach with her children and horses, Sandy’s first instinct is to understand her employees, how they think, and what upsets them. Like what drove her to cyber security, Sandy loves puzzles, including what puzzles her about people.
In general, Sandy believes diversity in views and backgrounds is highly beneficial to a department because different perspectives bring different skills and abilities to the table.
Potential Red Flags (20:09)
Sandy is consistently asked to be a mentor, which she is grateful to do. However, she feels a person lacks curiosity if they ask her questions answerable through a quick google search.
If someone fails to take the initiative to learn themselves, a job in cyber security would not be a good match for them.
Resume Review (21:38)
During a cyber security career day, Sandy reviewed resumes and determined who she felt were great candidates.
Sandy, also an adjunct professor, found this experience rewarding because she had the chance to talk with and guide individuals on their CISO journeys.
The Mentee/Mentor Relationship (25:21)
Steve and Sandy discuss the mentor and mentee relationship.
Sandy doesn’t love those terms because it’s too official for the nature of the dynamic: relationship-building. Instead of asking someone you admire to be their mentee, ask them what they are working on and how you can help, and a mutually collaborative relationship can form.
Taking A Chance (30:31)
Steve presses Sandy on her move from an established company to a start-up.
Sandy recognized that she was no longer growing as a CISO at her healthcare job, so she jumped into a start-up business. Although she put too much trust into this company before they earned it, she did feel like it was a risk worth taking.
Insight For Next Time (35:56)
Reflecting on her seven months at the start-up, Sandy reveals what she wishes she would have done and what she learned from this experience.
The best advice would be to study start-ups, how they function, and what they need to do to expand. Doing your homework is always a good idea when joining a new company.
The Aftermath (39:00)
Sandy shares how she felt after being laid off, which happened the day after she was asked to conduct mock interviews and give career advice to students.
Although she did not feel like the best person to advise others at that moment, she is grateful for the people she met during those seven months and the experience as a whole. Her main advice now is to “run towards the pain” and let your failures facilitate growth.
The New CISO (43:56)
To Sandy, being a new CISO means constantly evolving. If you’re in this unique position, it’s best to find new ways to collaborate, cooperate, and make positive changes for your customers and team alike.
Links mentioned:
Thu, 29 Dec 2022 - 45min - 81 - Protecting Your Revenue with Machine Learning and Data Science
In this episode of The New CISO, Steve is joined by returning guest Steve Magowan, VP of Cyber Security at Blackberry.
Steve returns to dig into the reality of data science and AI and ML in cyber security. Breaking through the buzzwords, Steve understands the current state of technology and how it's used to protect revenue today. Listen to the episode to learn more about communicating expectations, using risk management to generate funding and the current landscape of security threats.
Listen to Steve and Steve discuss educating executives and how utilizing data science in your security program can reduce friction and translate risk:
Welcome Back, Steve (1:45)
Host Steve Moore reintroduces our guest today, Steve Magowan. As a reminder, Steve manages everything security-related for Blackberry, from corporate security development to spearheading IoT initiatives.
When asked to define AI, Steve Magowan explains that what AI means to the security world today is machine learning, both unsupervised and supervised, to prevent risk. In general, AI is still being widely researched and is often a buzzword thrown around, but full-on AI remains theoretical.
Turning AI Into Action (6:22)
Steve asks Steve Magowan how he handles the AI suggestion from executives, who may need more clarification on how this tech is used.
Steve Magowan recognizes that he is a business enabler whose job is not only to protect data but to protect revenue. He would need to keep his company's resources in mind when discussing AI and determine if this type of tech is necessary for the goals ahead.
Protector of Revenue (11:30)
Steve Magowan has the unique position of protecting revenue for his company, an uncommon skill set for CISOs. Steve uses ML technology to map business activities and relate that to security. Having that ability allows him to communicate with executives in business terms to ensure their funds remain safe.
Clear Lines (15:34)
Although Steve has this authority, he believes CISOs should refrain from reporting to a CFO or CIO because their mandates conflict. Although executives wish to simplify their correspondence by going to a CIO for a one-stop shop, conflating their roles with a CISO would downplay both positions and render them less effective.
Understanding Risk Management (19:10)
Steve Magowan always tells leaders that risk management is the language in which security leaders gain money because you can turn security problems into dollars and cents. Pulling data allows you to understand and pitch how to receive resources based on the security issues faced.
Ultimately, Steve's job is not to separate operations and business. His role is not to achieve technical outcomes but business outcomes using technical outcomes.
Walking Through Detection Triggers (27:22)
Steve asks Steve Magowan why the detection of bad things has shifted from signatures to "normal vs. abnormal."
Steve Magowan explains how the landscape has changed and that cybercriminals now have more money to commit crimes and have the same education as security professionals. With cyber criminals getting more clever, ML is the only way to detect patterns that don't make sense, though even that is getting challenging.
Staying Resilient (32:42)
When facing sophisticated threats, you must ensure that you have data backups that cannot be breached and limit the scope of the hacker's blast radius for any hit. There will always be threats, but you must do your best to remain resilient.
The Bias Problem (34:58)
Steve Magowan outlines the risks of building your own ML program, such as personal biases that can skew the results of your data. The biggest lesson is that data can lie and lead you in the wrong direction if you let it.
The Flow Of Output To Input (39:22)
From a data science perspective, the data doesn't always cooperate. Although the goal is always to make the data readable to executives and reduce friction, these systems have been designed by different people from different systems during different times. Every security leader must parse through the information and bake it together into something usable for the business.
Helpful Tips (43:48)
Steve Magowan recommends mapping your tools, determining the problems they solve, and then relating that to your greater security framework. You can then review what works and what tools can be removed or added. The main goal is finding your problems and then mapping your solutions accordingly.
What It Means To Be An Executive (39:47)
Steve presses Steve Magowan on what it means to be an executive who leverages data science and ML. To Steve, it means you must use your technical skills to protect revenue if you want a seat at the table.
Links mentioned:
Thu, 15 Dec 2022 - 48min - 80 - Life After Breach: How Hospitals Can Protect Patient Data
In this episode of The New CISO, Steve is joined by Jackie Mattingly of Owensboro Health.
With a passion for technology since childhood, Jackie first began her career in IT. Today, she shares how an experience with a malicious insider transitioned her into a career in information security. Listen to the episode to learn more about Jackie’s career journey, navigating company acquisitions, and protecting patients’ data.
Listen to Steve and Jackie discuss the unique challenges of working as a healthcare CISO and handling security breaches:
Meet Jackie (1:51)
Host Steve Moore introduces our guest today, Jackie Mattingly. Jackie is the CISO for Owensboro Health, a three-hospital system in Kentucky serving eighteen counties and two states.
Jackie knew she wanted to work in technology since she was a little girl, first sparked by the game Oregon Trail. Getting her degree in computer programming, Jackie reflects on how she gained the work experience needed to have the career she wanted.
News Days (7:04)
Steve asks Jackie about her time working at a local news publication and if she has met anyone interesting while there. Jackie shares that she mainly worked alone at night, loading the news articles to the website.
The Radiology Center (8:41)
Jackie’s next move into information technology was at a radiology imaging center, whose owner understood the importance of keeping up with technology.
In one of the first radiology centers with an MRI machine, Jackie reflects on connecting the other radiology systems to that machine and what you should consider when working with a new device.
Transitioning Through Acquisitions (13:18)
When Owensboro Health acquired the radiology center, Jackie’s lifestyle changed. Now at a much larger organization with never-ending hours, Jackie had to meet the challenges of serving a 24-hour operation.
Preventing Burnout (17:17)
To prevent her staff from burnout, Jackie rotated calls and cross-trained each person so no matter what, people could take on each other’s roles during their on-call shift.
Jackie would also be available to dive into on-call sessions because she likes to help and get into the weeds of technology.
Leveraging The Team (20:30)
Jackie has tested new technology for her companies throughout her career. Now managing the information technology for a hospital, Jackie recognized the difficulty of getting advanced technology for a larger company.
While it is understandable that the hospital focuses more on patient care than tech, Jackie shares how she and her staff were leveraged to get the hospital’s systems up to par.
Updating The Voice Network (25:43)
Steve presses Jackie on her role in upgrading the hospital’s voice network. With so many providers’ offices and clinics to service, Jackie did have to hire a consulting company to help with the project.
Although Jackie does not have a project management certificate, she does believe that training is valuable.
Phasing Into Information Security (29:32)
One day the FBI showed up at the hospital to state that an employee was stealing patients’ identities through their systems. Still, in her IT management role, Jackie was less information security-minded at the time.
Jackie was brought on to navigate this investigation and fell in love with the security world, leading to the next phase of her career. During this time, Jackie learned that she couldn’t quit obsessing over this breach and had the drive to solve security problems.
Becoming The CISO (34:22)
In 2013, Jackie moved from being the IT leader to officially the security leader. She then started auditing access to patients’ charts and finding other ways to protect others’ personal information.
Soon Owensboro acquired another hospital, and the FBI arrived again to share that there was an even more significant security breach from a malicious outsider. Since this breach was inherited from the newly merged hospital, Jackie had to work through their systems and determine how to handle the issue.
Money and Momentum (39:47)
Steve presses Jackie on how she handled having money and momentum in the security space for the first time. Jackie immediately put inscriptions in place and built a security team who could help them with the organization’s overall mission.
Getting Involved Early (43:27)
After getting involved with another acquisition, Jackie explains how much easier that process was since they were brought on early. They were able to do their due diligence more effectively using their own products.
The New CISO (46:01)
To Jackie, being a CISO in healthcare is rewarding because you protect patients and their data.
Links mentioned:
Thu, 01 Dec 2022 - 47min - 79 - Building Your Framework for Fulfillment
In this episode of The New CISO, Steve is joined by Demetrios “Laz” Lazarikos, three-time CISO and Co-founder of Blue Lava Security.
A naturally curious child, Laz became interested in technology early, prompting his life-long love of learning. Today, he shares how different lessons from childhood and the airforce led to his fulfilling CISO career. Listen to the episode to learn more about Laz’s fascinating cybersecurity journey, the influence of his family, and how to become a more effective mentor.
Listen to Steve and Laz discuss his approach to career development and how his passion for learning led to his success:
Meet Laz (1:43)
Host Steve Moore introduces our guest today, Laz Lazarikos. With over thirty years of security experience, Laz wanted to build a platform where security leaders could measure, optimize, and develop their security programs, which he accomplished with Blue Lava.
As a child, Laz’s mother encouraged his interest in technology. Passionate about solving tech problems at an early age, Laz credits his childhood interest as his cyber security start.
Growing Up Greek (6:56)
Laz shares what it was like growing up in a traditional Greek family, which he compares to the film My Big Fat Greek Wedding. From a family of entrepreneurs, Laz felt pressure to take over the family business but instead started a security career.
At twelve years old, Laz’s mother advised him to go to his uncle, a loan shark, for a loan to buy tech, which he paid back with interest. Laz appreciates the lessons he received from his mother and credits her for giving him valuable life experience.
Meeting Carl Sagan (10:46)
At ten years old, Laz heard Carl Sagan, of the original Cosmos fame, speak during a field trip. Much of Carl’s speech resonated with Laz, including that anyone could do anything they wanted if their actions aligned with their goals.
Going Into The Airforce (13:13)
Steve asks Laz about his time in the airforce. While being recruited, Laz became interested in how systems and machines worked. Before he joined, the airforce promised he would get much training and education around security communications, which secured his interest.
At seventeen, Laz’s mother allowed him to emancipate, and he officially joined the airforce and learned foundational lessons for functioning in society.
A Foundation Of Learning (18:30)
Steve presses Laz on what he is doing today in his pursuit of education. Laz shares how his mother took him to the library every weekend as a kid and how his father had him complete writing exercises based on the newspaper.
Today, Laz looks at education as something you can never lose and can apply to life and work. Still a lover of libraries, Laz has three library cards for three cities and looks to history to improve his efforts.
Working Backward To Move Forward (22:32)
In terms of mentorship, Laz recommends thinking about your goals and working backward. This approach has always worked for Laz and other CISOs as well.
Laz puts thought into how he uses his time for personal growth and looks to the great CISOs of history to evaluate actions for success.
MBA Or Side Hustle (30:00)
Steve presses Laz on if CISOs should get an MBA or do a side hustle to build a security network.
To make this decision, you should evaluate the cost and time investments required and determine if either opportunity is needed for your overarching goals. You have to make choices based on what’s best for you.
Advancing Through Mentorship (36:58)
To Laz, your CISO career boils down to mentorship, and he acknowledges that his mentors were his family and, later, the airforce. With meaningful relationships, training, and academic learning, you can advance your career and succeed at your job.
The Missing Piece (39:32)
Steve asks Laz what senior security professionals are missing in terms of mentorship tactics. Laz recognizes that CISOs should understand their goal as leaders and then work backward. He also suggests being open to feedback and working on teaching effectively.
Laz felt inspired to teach to give back to the community and share his life lessons with his students.
A New CISO (49:25)
To Laz, new CISOs should ask themselves if they are coachable, open to feedback, and willing to learn new ways. Although the old tactics were helpful, we must look to new strategies as we move forward.
Links mentioned:
Thu, 17 Nov 2022 - 50min - 78 - Bridging the Effectiveness Gap: A CISO's Perspective on New-Scale SIEM with Tyler Farrar
In this episode of The New CISO, Steve is joined by Tyler Farrar, the CISO at Exabeam.
With malware-free attacks becoming increasingly common, Tyler understands the best ways to bridge the effectiveness gap. With this in mind, he shares his SOC philosophy and the importance of threat detection. Listen to the episode to learn more about the act of prevention, the pillars of a SIEM product, and why attackers gravitate toward credential techniques.
Listen to Steve and Tyler discuss the steps to success in an age of constantly increasing data :
Meet Tyler (2:06)
Host Steve Moore introduces our guest today, his colleague, Tyler Farrar. Before working at Exabeam, Tyler was a customer.
With his impressive background in the security field, Tyler explains Exabeam's perspective on "defender behavior" and balancing incident response and crisis management with prevention.
The Focus On Prevention (5:50)
Steve presses Tyler on how you should balance your methods to increase prevention. Tyler lists different preventative tools, such as firewalls, and stresses the importance of detecting suspicious activity early on.
Tyler gives his take on how response becomes prevention in crisis management. Preventative tools can fail, so being able to detect suspicious behaviors is critical.
Addressing The Gap (10:36)
Addressing the gap in analytics, Tyler recognizes that there is a difference between what the security team needs and what the SIEM product delivers.
Every company faces an immense volume of data, an inefficient manual cyber process, and software that can fail to detect the attacker's behaviors. Tyler lists the solutions that can counteract these problems, including behavioral analytics.
The Rise Of Malware-Free Attacks (14:32)
Steve points out how 71% of cyber-attacks are credentialed and malware-free. Tyler explains that attackers use the compromised credentials approach because it is easy. CISOs can miss the mark because legacy software can be ineffective at detecting threats.
New-Scale SIEM (20:43)
According to Tyler, new-scale SIEMs would be able to securely ingest data from anywhere, parse through that information quickly, and then store that information and make it searchable.
Tyler also explores his philosophy on how to design a SOC. One example of a productive SOC is conducting risk assessments throughout the organization to identify gaps and then acting on those results.
Life Of The Analyst (28:52)
Steve presses Tyler on how the experience of the investigation factors into meaningful work for the analyst.
Tyler stresses the importance of SOC leadership to make the team effective. A stressed SOC can lead to the loss of talented workers and affect the company's security.
New Software Ahead (33:16)
Tyler discusses the products he is looking forward to on the horizon. Every CISO's goal is to keep their company safe. Being able to show all the threats and vulnerabilities in place would be hugely valuable, which is why Tyler is interested in Systems Navigator.
SOC Philosophy (49:55)
Tyler's top SOC philosophy is to be aligned with your adversaries and learn how they think in addition to your defenders. Understanding both perspectives can create a culture of empowerment and protect the organization from threats.
Links mentioned:
Thu, 03 Nov 2022 - 43min - 77 - Storytelling For CISOs – How to Make Your Message Resonate with Tom August
In this episode of The New CISO, Steve is joined by Tom August, a seasoned CISO with over thirty years of experience.
First starting his career as an accounting intern, Tom has since had an incredible journey where he not only wrote the CISO Handbook but created a risk-management methodology. Today, he shares what he's learned from his years in the cybersecurity industry and the importance of storytelling. Listen to the episode to learn more about Tom’s unique transition into cybersecurity, the inspiration behind the CISO Handbook, and selling your “why.”
Listen to Steve and Tom discuss how to captivate executives without fearmongering and navigating hard conversations with the broader organization:
Meet Tom (1:55)
Host Steve Moore introduces our guest today, Tom August. Over his decades-long career, Tom has worked across multiple industries, from healthcare to military defense to financial services.
A lifelong fan of electronics, cybersecurity became a life-changing move for Tom, despite having an initially unrelated start.
Tom’s Take (5:30)
Steve presses Tom on what it was like watching the famous John McAfee and his team work when Tom was an accounting intern.
Tom saw they had an organized methodology and plan when handling a security breach and appreciated being brought in. A wide-eyed college student, Tom was fascinated by everything he learned and wanted to do more.
The Move To Financial Services (9:07)
While building out the security program at a financial organization, Tom had the opportunity to be mentored by one of the original CISOs, Micki Krause. Recognizing that Micki is a trailblazer in the cybersecurity industry, Tom appreciates that he learned technical skills from her and how to communicate with chief executives.
After being challenged by Micki, Tom was encouraged to write security books, leading to the CISO Handbook.
The CISO Storyteller (15:50)
To Tom, every CISO needs to be a storyteller, though few have mastered that. Often CISOs will speak to executives using different buzzwords and acronyms versus adequately explaining the problem they are trying to solve. To combat this, Tom urges listeners to work on their communication skills.
The IT Audit (17:07)
Tom led many audits and learned many facts about the organizations. Tom had to present a lot of research to international executives as a result.
Although Tom can’t share much information about this time, he acknowledges that specific cultural differences made it challenging to tell the story of the problem at hand.
A Lever of Influence (27:55)
Due to his mentor relationship with Micki, Tom learned a simple but valuable risk-management methodology. Tom decided to take that further by meeting with executives individually to see what they cared about in terms of risk.
As a result, Tom ensured that he could meet the needs of his organization. By the time he met with the board, there were no surprises about his security plans.
Improving Our Stories (36:50)
Steve presses Tom on why so many CISOs lack comprehensive storytelling skills, which Tom credits as their need to be correct. Recognizing that CISOs have good intentions, Tom also understands they can miss the bigger picture.
If you are a CISO, you should know why your problem is compelling, and if you can sell that, the “where, ” “when,” and funding will follow. The main thing is not to be confusing with your delivery to maintain captivation and promote clarity.
Risk Vs. Compliance (44:46)
Due to his accounting background, Tom understands that auditors are well-intentioned but limited due to their checklists. Knowing that risk does not follow the rules, Tom explains that compliance is not always the most helpful approach.
Risks are difficult to quantify and require everyone involved to be on the same page about the next steps.
The Modern CISO (49:55)
To Tom, being a new CISO means you are a fantastic listener, business partner, and someone who understands both risk and compliance. And, of course, you need to be a good storyteller who knows how to put everything together.
Links mentioned:
Thu, 20 Oct 2022 - 48min - 76 - Translating Your Military Skills for Security Success with Jason Hamilton
In this episode of The New CISO, Steve is joined by Jason Hamilton, CISO at Mutual of Omaha, to discuss how having a military background leads to security success.
After twenty-two years in the U.S. Marine Corps, Jason was able to take his skillset and move into the cyber security industry. Today, he shares what he learned over the years that prepared him for the career he has today. Listen to the episode to learn more about Jason’s military experience, tips for officers entering the civilian workforce, and the importance of corporate mentorship.
Listen to Steve and Jason discuss ways for veterans to transition into the corporate world:
Meet Jason (1:45)
Host Steve Moore introduces our guest today, Jason Hamilton. Jason shares his first mission as a Communications Systems and Information Officer. Jason also divulges what a higher-ranking officer should do, such as refining leadership skills and managing efficiently.
Essential Lessons (8:30)
Steve presses Jason on what else he learned from his early days as an officer.
Jason explains that there’s no such thing as a perfect leader, and everyone makes mistakes. The key is to learn from your mistakes when you’re young, which applies to both the military and corporate world.
Civilian Training (10:01)
When Jason first joined the Marine Corps, information technology was separate from his role.
To move up, Jason had to learn to work with data on the battlefield and eventually took on an instructor position. To get smart fast, he took civilian classes to ensure he could adequately train other officers on information and data.
Part Of The Job (14:56)
As Jason rose through the ranks, working with data remained. Jason learned about Cyber, formerly known as Information Assurance, and how it became a priority of the Marine Corps. As Cyber became part of the military, it became more and more a part of Jason’s career.
The Last Ten Years (19:22)
Jason reflects on his last ten years in the corps. Like anyone who has long served, he had to broaden his horizons to reach a different level, often through education. Jason had a strictly cyber role by the end of his military career and focused on leadership.
Ultimately, Jason credits everything he did in the Marine Corps for preparing him for the corporate world.
General Feeback (22:55)
Steve presses Jason for advice he can give other officers looking to transition into civilian work.
Jason reminds officers to humble themselves when entering the corporate sector because co-workers may not care about their military past. Also, he urges officers to work on resume writing and seek mentorship when looking for a job.
Lessons On Corporate Culture (32:10)
When veterans come into an interview, there is a natural culture shock, primarily because workers are not as likely to be Type A outside the military. Other differences are incorporating empathy and listening into your leadership style.
While it is up to you to quickly solve a problem in the military, in the corporate world, there is much more emphasis on nurturing your team to fix workplace issues.
The Mentor Relationship (35:31)
Jason used to meet his corporate mentor once a month and learned after his first meeting that he would need to drive the conversation. Jason then would send his mentor his agenda two weeks ahead of time to ensure that he would make the most out of every encounter.
Ultimately, veterans need to show initiative when transitioning into civilian work.
The End Of The Mentorship (37:37)
Steven asks Jason what officers should gain from a corporate mentorship program. Besides resume writing, Jason urges veterans to learn how to negotiate salaries and familiarize themselves with corporate culture.
Finally, A CISO (41:58)
Now a CISO, Jason shares his goals when starting his cyber security career. His first goal was to give himself two years in the corporate world to see how he fared. His next goal was to learn how to influence the program and take the necessary steps.
To Jason, being a new CISO means having the ability to set a direction in the corporate world. It also means giving back to his company and associates as he continues to hone his leadership abilities.
Links mentioned:
Thu, 06 Oct 2022 - 50min - 75 - Broad Knowledge is Power: Building a Better Security Team with Bryan Willett
In this episode of The New CISO, Steve is joined by Bryan Willett, CSO at Lexmark International, Inc, to highlight the importance of collaboration and team building.
With over two decades of experience, Bryan understands the CISO role and how to support your team. With this in mind, he shares what CISOs can do once they achieve this status to develop their skills further. Listen to the episode to learn more about transitioning into management, sharing your knowledge, and the benefits of diversity.
Listen to Steve and Bryan discuss how to build a diverse security team and the skills needed to be a better CISO:
Meet Bryan (1:50)
Host Steve Moore introduces our guest today, Bryan Willett. Bryan has worked at Lexmark for over 25 years and prioritizes minimizing risk for the business.
With a unique scope of duties, Bryan has worked his way up the ranks and monitors security trends, such as supply chain measures. Ultimately, he understands the importance of collaboration to keep all company areas safe.
The Road Travelled (5:37)
Beginning his career in firmware development, Bryan wanted to transition into a position where he could learn more about the product development pipeline and work with people. He then went down the product management track, which set him up for the leadership side of the field.
The Best PM (10:27)
When asked about his stepping stone from product manager to manager, Bryan reflects on what motivates him to work hard and improve the team around him.
Feeling Intimidated (13:00)
Steve presses Bryan on how intimidation and imposter syndrome impacts career goals.
Bryan shares that he’s primarily looking for team members who are jacks of all trades and that he believes having a diverse set of knowledge will set you up for success. With multiple skills, you will be able to work well in the security field, even if it’s initially uncomfortable.
Developing as a CISO (16:26)
Bryan shares what CISOs can do in their position to develop further. Once getting into a management position, you should always support your team and prepare them for their subsequent roles.
Improving as a Salesperson (24:02)
As you pitch executive leadership on programs you want to implement, make sure you can explain what you need simply, without technical jargon, to convey the key points you are trying to make. Crafting a clear elevator pitch will help you make the sale.
Solving Business Problems (31:18)
Early in Bryan’s career, Lexmark was experiencing challenges due to the nature of the printing industry. Noticing that the company could experience a certain level of risk, Bryan built a highly capable team to harden the system and create a security development lifecycle for both the company and the customers.
Third-Party Risk Management (38:16)
When Bryan started his third-party risk management program at Lexmark, he had to partner with the procurement and legal team. Due to experience with other aspects of the business, Bryan was well-prepared to oversee this endeavor and communicate with others about their needs.
Business Savvy (42:07)
Steve presses Bryan on the future of CISOs.
Considering the CISO today, Bryan understands they likely worked their way up in the security field. However, Bryan recognizes that this field will mature as we uncover new risks, and the CISO role will change with it. Bryan predicts that future CISOs will have the immense business knowledge needed to keep the company moving and make necessary trade-offs.
The New CISO (45:47)
To Bryan, being a new CISO means focusing on diversity in the workplace by hiring individuals different than you. It’s essential to understand your weaknesses and fill in the gaps with other talented security professionals who can make your team complete.
Links mentioned:
Thu, 22 Sep 2022 - 47min - 74 - Success After CISO: How to Become Your Own Boss” with guest Aaron Bailey from The Missing Link
In this episode of The New CISO, Steve is joined by Aaron Bailey, CISO and co-founder of The Missing Link, to discuss what it takes to start your own security business.
Getting his first computer at eleven years old, Steve has always loved working with technology. Through explaining his professional journey, Steve shares the benefits and difficulties of being a cyber security founder. Listen to the episode to learn more about Aaron’s first jobs, joining an established startup, and success after being a corporate CISO.
Listen to Steve and Aaron discuss being your own boss and the challenges of being a co-founder:
Meet Aaron (1:32)
Host Steve Moore introduces our guest today, Aaron Bailey. Always a tinkerer with technology, Aaron explains how he started in cyber security, working his way up from entry-level positions.
After high school, Aaron struggled to find a job. After memorizing a manual per his father’s advice with a proposition of being quizzed, Aaron finally got hired at a computer shop, launching his career.
Why This Job (9:23)
Steve asks Aaron what the pay was like at his first job.
Through hard work, Aaron’s salary doubled within a year, and he was paid far more than other people his age.
Aaron’s Advice (11:52)
Although Aaron does not believe you need to be a staunch techie like himself for every job, what he looks for in an interviewee is passion, intelligence, perseverance, and dedication to the field.
Essential Aid (19:42)
Steve presses Aaron on the guide Essential Aidand how to explain it to others. Aaron defines it as containing the top mitigation strategies for cyber intrusions. To use it properly, you have to embrace automation.
Becoming a Founder (25:53)
When Aaron’s colleague Sam resigned from their corporate job, Aaron learned he was starting his own business and wanted Aaron to come with him.
Sam prompted Aaron to meet with the other partners, beginning the next stage of his CISO career. Aaron then shares the early weeks of joining the Missing Link and the challenges along the way.
A Non-Startup Startup (33:05)
The Missing Link was already a successful startup before Aaron joined, but they did not have a cyber security department. Aaron and Sam then became the company’s security professionals, which came with tremendous planning and organizing.
The Entrepreneur CISO (38:48)
Host Steve presses Aaron on his advice for other CISOs wanting to start their own businesses.
Aaron shares what was difficult about being a corporate CISO where you’re not always listened to compared to his position at the Missing Link. As a founder, you have increased responsibilities, but it’s much easier to ask for what you need for your team.
More Advice (44:03)
Aaron is still learning the shareholding and equity aspects of being a founder. Success once does not always mean success every time, so Aaron’s main advice is to always ask for advice.
Starting your own cyber security department is the most incredible interview of your career, but this path is not always easy.
A New CISO Founder (50:59)
To Aaron, being a CISO and a boss means having a seat on the board. Training new CISOs and watching them leave to start their own companies gives him the most joy.
Ultimately, the new CISO strives for the top and is not afraid to bring others up in this increasingly necessary field.
Links mentioned:
Thu, 08 Sep 2022 - 53min - 73 - Leading with a Military Mindset: It’s We, Not Me with Steve Magowan
In this episode of The New CISO, Steve is joined by Steve Magowan, Vice President of Cyber Security at BlackBerry, to discuss how military teachings apply to tech.
First starting his career in the air force, Steve understands how the military mindset can make you an asset in the security field. Through evaluating the benefits of his experience, Steve shares what CISOs can learn from military professionals. Listen to the episode to learn more about the importance of understanding IoTs, the military work ethic, and how quality leadership stems from a lack of ego.
Listen to Steve and Steve discuss the key qualities of a leader and breaking into cyber security:
Meet Steve (1:39)
Host Steve Moore introduces our guest today, Steve Magowan. Steve reveals how long he’s worked for BlackBerry.
Steve Magowan explains how his background in the air force led to his cyber security career, where he utilizes his tech abilities and wears many hats.
A Canadian In The Air Force (4:44)
Steve asks Steve Magowan, a Canadian, what was more challenging about the air force: the cold in Canada or dealing with Americans?
Steve shares that the real difficulty is flying through the congestion above the United States. He realized how empty most of Canada is, which makes for great training grounds.
A Transition Opportunity (8:19)
Steve Magowan shares how his various skill sets suited him well for transitioning into cyber security and how there are more needs for people who understand IoT applications.
Although having this skill set is now recognized as vitally important, it’s challenging to find someone with tech abilities who can also manage a team. Due to their work ethic and unique perspective, the military has become a worthwhile option for recruiting cybersecurity professionals.
The Military Mindset (13:56)
Steve and Steve discuss the differences between non-military and military security professionals.
Host Steve notes that people who have served tend to be more willing to work long hours and share their perspectives to manage a crisis. Steve Magowan explains that much of this team mentality comes from the “us and we and ours” core of their military training.
Moving Into Cyber Security (17:00)
Although Steve did not have a direct cyber security background, a family friend knew of a job for him in the field. With years of consulting and IoT experience at 38 years old, Steve was well suited to transition into, at first, an IT team due to his leadership skills.
He recognizes that his military experience opened the door for him, but his hunger for knowledge made him succeed.
Bringing Leadership To The Table (22:38)
For aspiring CISOs, host Steve presses Steve on which qualities helped break him into the field and assure employers of his leadership abilities.
Steve reiterates that his military background made him a worthwhile candidate, partly due to his lack of ego. Steve knows he’s not the most intelligent guy in the room, which makes him want to learn and figure out how to solve any security problems that come his way.
The Emerging Problem (27:55)
Supply chain risks are a growing threat, a challenge to people in the cyber security world. Steve Magowan shares how security professionals have dealt with these types of breaches and the differing objectives between business leaders and CISOs.
Differing Agendas (31:15)
Steve and Steve discuss the conflicting agendas between CIOs and CISOs. Corporate America has not fully grasped the increasing cyber threats, making it harder for CISOs to do their jobs.
CISOs have accepted high-risk positions, which is why they must learn how to communicate with CFOs with their interests in mind: money and business outcome.
See You Next Time (41:16)
With so much to discuss, especially third-party and supply chain risks, host Steve invites Steve back to the show.
The New CISO (42:25)
To Steve Magowan, a CISO is someone who is an enabler versus a barrier. A CISO’s job is to protect the company against risk and allow the business to succeed.
Links mentioned:
Thu, 25 Aug 2022 - 44min - 72 - Landing a Seat in the C-Suite with Mike Woodson
In this episode of The New CISO, Steve is joined by Mike Woodson, Director of Information Security and Privacy at Sonesta International Hotel Corporation, to discuss the risk and rewards of being a CISO.
First starting his career in law enforcement and cybercrime investigation, Mike now applies his police mindset to cyber security leadership. With his varied experiences in mind, he shares how his unique background makes him a well-equipped CISO. Listen to the episode to learn more about getting to the root of a threat, working with global agencies, and why CISOs should be compensated well for their high-risk responsibilities.
Listen to Steve and Dr. Adrian discuss the value of mentorship and the ins and outs of a CISO career:
About Mike (1:46)
Host Steve Moore introduces our guest today, Mike Woodson. Mike reveals how long he’s worked for Sonesta International Hotel Corporation and how he started in the cyber security field.
Mike details his background in law enforcement and teaching, leading him to investigate global cyber crimes and begin his CISO career.
The Cyber Cop (9:09)
Steve presses Mike on how he applies his police investigative skills to the cyber security field.
Mike asks the right questions to understand what he’s dealing with during a threat. He understands that his various skill-sets are a unique asset to the CISO job and help him get to the root of the problem.
The Best Job (12:27)
When asked about his favorite job, Mike shares how much he enjoyed his time working for the Indonesian government. He worked with various global agencies investigating cyber crimes, which allowed him to make a difference and meet impressive people.
Mike’s Advice (14:53)
Mike’s advice to his younger self is not to settle and be adventurous. He did not plan to go to Indonesia or be a CISO, but he took his opportunities and listened to the mentors he had along the way.
Radio Days (18:57)
Mike shares his past as a radio DJ and how it was his first love. Steve also discusses his recent experience as a podcast host.
Interview Tips (22:35)
Steve presses Mike on his perspective on perfecting CISO interviews.
Mike reminds the listeners to be themselves and take the interview as it comes. Ultimately, you have to focus on being dynamic and asking probing questions. You have to “look before you leap.”
Why CISOs Quit (27:53)
Mike shares why some CISOS leave a position. If someone in this role is being treated as an afterthought by higher-ups, it can easily lead to dissatisfaction. For such a high-pressure job with crucial responsibilities, it’s essential to be taken seriously by management and paid appropriately.
Should We Ever Ask The CIO? (29:39)
Steve asks Mike if there are ever times a CISO should ever report to the CIO. To Mike, the answer is no.
The role of the CISO has grown, and if they are the chief executive officer of cyber security, they should have a seat at the table. For the business's survival, the CISO should be trusted based on their expertise.
Do We Need CSOs? (32:46)
Many companies have CISOs and CSOs, which share the same command line. Mike believes some organizations should have both positions, depending on their structure.
Setting The Tone (37:38)
Steve asks Mike how new CISOs can be proactive post-hire.
You'll do well if you focus on building relationships, listening to people, and learning the business. To Mike, a CISO is the person who looks, listens, and leans into his work.
Links mentioned:
Sonesta International Hotel Corporation
Thu, 11 Aug 2022 - 43min - 71 - Train the Way You Fight, Fight the Way You Train with Dr. Adrian Mayers
In this episode of The New CISO, Steve is joined again by Dr. Adrian Mayers, VP and CISO at Premera Blue Cross, to dig deeper into his knowledge of insider threat management and intelligence.
As an experienced CISO, Dr. Adrian understands the difficulties of a cyber security career. With this in mind, he shares the day-to-day obstacles of the profession and what aspiring CISOs can expect from the job. Listen to the episode to learn more about the pressures CISOs face, the psychology of insider threats, and how to work past life's challenges.
Listen to Steve and Dr. Adrian discuss how to get through difficult life hurdles and manage cyber threats:
The “Superhero” CISO (1:44)
Host Steve Moore reintroduces our guest today, Dr. Adrian Mayers. They acknowledge the stress and pressure a CISO may feel to play a superhero role, stopping every cyber threat.
Although no one can prevent every obstacle, Dr. Adrian insists that every CISO must consistently attempt with high motivation to stop every threat that comes your way.
Taking A “Bad” Job (5:26)
Steve presses Dr. Adrian if someone should ever take a “bad” CISO job.
Dr. Adrian brings up that every CISO needs their eyes wide open with every gig, but that early in your career, you may have to take less than ideal positions in exchange for experience.
The Bad Day Factor (9:53)
When asked about his worst day on the job, Dr. Adrian reflects that there is always something you can learn from your most challenging moments.
Insider Threat Management (13:01)
Dr. Adrian shares that his affinity for investigating insider threats first developed from his love of video games. After extensive research on counter-intelligence, he understands that specific triggers in people’s lives can lead to unattended consequences or malicious intent.
Evaluating The Insider Threat (15:35)
Steve questions why an insider psychologically may want to compromise the security of their company.
Dr. Adrian states that every insider who goes against their company has one thing in common: a desire to deviate from the norm. And determining that motivation helps the CISO manage their investigation.
How Far Should The Staff Go (20:46)
Dr. Adrian states that your team needs to understand exactly what their doing before talking to vendors or others. By discussing with your team the boundaries for their current investigation, you can gain additional insights that will put everyone on the right path.
The “Why” For Education (22:31)
Years ago, Dr. Adrian decided to get a doctorate in business administration specializing in international security. He then decided to get additional certificates in the security field. Ultimately, his desire for further education came from his immense curiosity but also was prompted by the grief of losing his daughter.
Defining Quality Intel Programs (28:49)
“Threat intelligence is full-spectrum intelligence,” according to Dr. Adrian. By leveraging the information from your intel program and applying context around it, every security team should be able to determine the motivation for the threat and paint a more holistic picture.
Surprising Information (32:00)
Steve presses Dr. Adrian on the most surprising things he’s learned from his background in threat management.
Dr. Adrian reflects on the amount of data vacuumed from our adversaries. Another shocking piece is the amount of data our allies gather on the U.S. Though, of course, the reasoning for gathering that information varies.
Ph.D. Proud (35:54)
Dr. Adrian always puts his doctorate before his name for several reasons.
As a Black man from Canada living and working in the United States, he realized he would experience more hurdles than others in the field. This put him on the path to being better, and getting his education has always put him in the position to thrive.
Links mentioned:
Thu, 28 Jul 2022 - 43min - 70 - Trusting Your Tech to Tackle Human Problems with Dr. Adrian Mayers
In this episode of The New CISO, Steve is joined by Dr. Adrian Mayers, VP and CISO at Premera Blue Cross, to discuss what to consider when interviewing for CISO positions and how to trust your tech in the security field.
Since fifth grade, Dr. Adrian Mayers has had a passion for computers. Now a CISO, he shares the role computers play in a security professional’s day-to-day life. Listen to the episode to hear more about Dr. Adrian’s advice for aspiring CISOs, the relationship between human behavior and tech, and his thoughts on the transition to automation.
Listen to Steve and Dr. Adrian discuss how to find the right security team and solve human problems with technology:
Meet Dr. Adrian (1:56)
Host Steve Moore introduces our guest today, Dr. Adrian Mayers, who shares a bit about his life before Premera Blue Cross and his childhood interest in computers.
The Power of Story-telling (5:43)
Dr. Adrian explains his love of narrative-based gaming and how escapism provides relief after difficult work days. He also shares how video games give him strategy ideas he uses in his current role.
The Character of a Leader (8:19)
When asked about his characterization of a leader, Dr. Adrian reflects that a leader is someone who has integrity at their core. He expresses the importance of evaluating who you are and ensuring you bring your values into a leadership position.
Advice For Aspiring CISOS (9:25)
Steve asks Dr. Adrian his advice for those interviewing for CISO positions.
Dr. Adrian shares why you should communicate how security plays into your day-to-day life and ask questions about the team's previous history when tackling security problems. The main thing is to be comfortable with who’s in front of you because you would build relationships with this team if offered the position.
Looking For Your Next Position (16:08)
There are different considerations if you’re courting a government position than evaluating a job at a start-up company. Ultimately, it depends on each security company's process and context when navigating the interview stages.
Solving Human Problems (18:25)
Steve asks Dr. Adrian about his thoughts on tech solving human problems.
Dr. Adrian reminds the listeners not to get so wrapped in the technology that they forget what they’re trying to do: tackle human problems. Ultimately, tech helps CISOs do this work, but focusing on the human elements will keep you centered and effective.
Not Trusting The Tech (21:44)
Dr. Adrian recognizes that many security professionals wonder if they can trust data platforms versus the insights of actual human beings.
He also understands that there is a difference between installing programs and implementing them. Overall, if you take the time to understand the tools, you can see how tech makes effective security decisions regarding human problems.
Defending Automation (26:27)
Steve presses Dr. Adrian on ways to convince security professionals to automate low-level tasks.
Dr. Adrian assures the listeners that these changes are being made daily in the security field. By clarifying to security professionals that they will not be replaced by automation but will have more space for high-level problem-solving, the transition will be easier for teams to accept.
The Definition of Good (29:49)
Dr. Adrian explains that the definition of “good” for security programs stems from people. If security professionals have a sense of purpose to show up every day and learn how to use the tech, then that is the measure of a quality program.
If you build a dialogue with your security team and understand their concerns and issues, they will have a sense of ease when moving in a technological direction.
Final Advice (38:45)
To Dr. Adrian, the most vital thing when interviewing for a CISO position is always to do your homework. If you are clear about your experience and how you can benefit the security team, you will be able to communicate why you are suitable for the role.
Ultimately, you want to show how you are ready to roll up your sleeves and get to work, despite potential difficult days ahead.
Links mentioned:
Thu, 14 Jul 2022 - 41min - 69 - Solving Security Puzzles with Kevin DeLange
On this episode of The New CISO, Steve is joined by Kevin DeLange, the VP and CISO of IGT, to discuss how Kevin’s love of problem-solving led him to a career in cyber security.
Before joining the information security field, Kevin served in the military and completed a degree in Anthropology. Now a CISO, he reflects on how the skills he developed throughout these experiences brought him to where he is now. Listen to the episode to hear more about Kevin’s career journey, solving puzzles in the workplace, and his advice for those applying for CISO positions.
Listen to Steve and Kevin discuss how to define a problem before solving it and the value of real-world experience:
Meet Kevin (1:30)
Host Steve Moore introduces our guest today, Kevin DeLange, who shares more about IGT, a global leader in casino games, and how long he’s worked there.
Life Before IGT (2:43)
At seventeen, Kevin joined the military and worked on nuclear missiles. He credits this experience as his first foray into the security world.
The Practicality of Anthropology (5:58)
After completing his service, Kevin finished a degree in Anthropology. Kevin explores how this discipline allowed him to solve complex problems, which he has applied to his security career.
A Crooked Path (7:49)
Steve asks Kevin what he means by his “crooked path” into cyber security.
Kevin explains that life is not a straight line and that although he couldn’t predict his career in his youth, he understands that he acquired the right skills along the way.
Generational Differences (9:32)
Although there are college degrees now in the security field, Kevin recognizes that there is no substitute for real-life experience. Kevin then lists the traits he looks for when hiring a security professional, particularly highlighting the value of soft skills.
Working With Senior Management (13:56)
Steve asks Kevin the best ways to present a problem in the workplace and how to stand out to senior management.
Kevin says that you need to tailor your communication to the audience in front of you, whether technical or business groups. It’s also essential to ensure you have advocates outside the company to support you, which comes from building relationships.
CISOS And Their Sales Teams (17:51)
Kevin explains that the company’s goal is to make money and that his job is to ensure that the company is securely making money. Although understandably, security professionals and sales teams may not see eye-to-eye, it is a necessary working relationship with a common goal.
Making A Choice (20:12)
Balancing three full-time jobs, Kevin eventually had to choose what he wanted to pursue. Ultimately, Kevin decided on information security because he finds it exciting and himself well-equipped for its problem-solving component.
Simplifying The Problem (23:28)
The most challenging thing for Kevin is to simplify the problem before trying to solve it, though that is what he strives to do most. Kevin laments that it’s “difficult to prove a negative,” but the more he condenses what he’s communicating to senior management, the more he can get the support he needs.
Let Things Fail (28:12)
You cannot oversee your own work as a CISO, so it’s critical to pass that duty to someone on your security team. Since you cannot do it all, it’s sometimes better to let things fail to move forward.
His Best Advice (35:18)
Steve asks Kevin what his red flags are for people applying for security leadership positions. Kevin provides his main criteria, which is paying attention to the hiring company’s definition of a CISO.
Links mentioned:
Thu, 30 Jun 2022 - 37min - 68 - Building The Right Relationships with Den Jones
On this episode of The New CISO, Steve is joined by Den Jones, the Chief Security Officer at Banyan Security, to discuss the importance of trustworthy and transparent relationships in the cyber security field.
Before joining the security intelligence industry, Den first worked as a postman walking the streets of his native Scotland and dreamed of becoming a musician. Now a CISO, he shares how to deal with misleading salespeople and create effective data security strategies. Listen to the episode to hear more about Den’s journey, the problems with vendors, and his thoughts on building relationships.
Listen to Steve and Den discuss the importance of building a network and proactive security intelligence:
Meet Den (1:40)
Host Steve Moore introduces our guest today, Den Jones, who shares a bit about his past and how he transitioned from postal work into cyber security.
The Must-Have Gear (3:31)
As a postman obsessed with music, Den saw his buddy's house and a Roland RSP-550 that he was dying to have. Seeing this quality of gear led Den to quit his job to find a more lucrative career path, which eventually brought him into the world of cyber security.
College in the UK (7:03)
Unlike college in the US, where you learn several subjects, Den only took classes focused on IT. Unable to finish his degree, Den reflects on how he had to drop out of school yet was the first out of his peers to get an IT job.
Get IT Started. Get IT Done. (12:18)
Den also discusses his Banyan Security podcast, Get IT Started. Get IT Done. Every episode, Den brings inspirational guests on to share their cyber security journeys and the full cycle of their business endeavors.
The Issue With Vendors (18:23)
Den recognizes that the hype around marketing distracts cyber security professionals from their work and that harassing salespeople can be a considerable frustration. Den explains how it’s better to have a “build relationships, not sell stuff” mentality in addition to ways to build transparent vendor relationships.
Building A Team (27:28)
Steve asks Den why he had the mission to build a strong security intelligence team.
Den explains that much of his motivation came from wanting to solve a major question the cyber security industry had not yet solved: “Was that you who logged in?” With a small team of college grads that Den organized, they built a data security platform that secures users from computer hackers through password protection.
Keeping Data Safe (32:58)
Den understands that executives do not share his interest in users' security and are motivated by staying out of the press, which a preventable security breach could cause. For practitioners, the goal then must be to help their firms maintain a solid reputation but also to find ways to use their work for good.
The Pillars Of The Job (36:35)
Steve presses Den on the ways to push and maintain proactive security intelligence.
Den explains how to determine the core questions that lead to protecting data and the vital importance of having users’ login information. By looking at identities, user devices, and the intelligence behind the users and the device, Den can develop data security strategies.
Tips and Recommendations (42:23)
All service accounts should be predictable because it allows their team to detect when there are deviations from the norm. Den recommends maintaining tight access and monitoring service accounts’ task functions to keep data safe.
What Does It Mean To Be A CISO Leader? (48:40)
To Den, being a CISO means building a solid network of healthy relationships. With the right people around you, you can leverage their wisdom and advice to be a productive leader in the cyber security world.
Links mentioned:
Podcast - Get IT Started. Get IT Done.
Thu, 16 Jun 2022 - 50min - 67 - Don’t Be Afraid to Break Things with David Lingenfelter
On this episode of The New CISO, Steve is joined by David Lingenfelter, the Vice President of Information Security at Penn National Gaming, to discuss the requirement to constantly learn and evolve in the IT security field.
After falling into his passion for IT, David quickly realized just how far his knowledge could take him if he constantly built upon it. Now after a nearly 30-year-long career in IT, with a focus on computer security, he shares his experiences growing and advancing through his work in the industry. Listen to the episode to hear more about David’s journey, his advice for beginners in the field, and his thoughts on IT management.
Listen to Steve and David discuss knowledge and advancement in security:
Meet David (1:20)
Host Steve Moore introduces our guest today, David Lingenfelter, who shares a bit about his past and how he got his start in cyber security.
The Wild West of IT (4:11)
When David began his career in IT in the early 90s, modern technology like remote access was not standard in work computers. Reflecting on his past, David discusses how he learned to market these new products to average users who didn't understand IT.
Constantly Learning (7:46)
Before beginning his career, David was told, "if you never want to be bored, if you want to constantly be learning, go into Security." As a beginner in the field, he constantly played with new technology and learned defense methods against the ever-evolving security attacks on IT systems.
Make It or Break It (11:44)
The IT security field is demanding new strategies and technologies to combat threats. David stays sharp by constantly theorizing with colleagues, "how can we make this work? And better yet, how can we break it?" He found that by working together to build something or tear it apart, you can learn how different technologies would typically work in the security space.
Go Play - Go Learn (15:12)
Steve asks David for his advice to those who wish to start or evolve in the IT security field. Additionally, they share their thoughts on creating educational lab environments and needing to have the genuine desire to learn and grow in computer security.
Business Management & Security Leadership (19:25)
David is now a VP of a company, which is a significant transition from where he started in IT. He describes the differences that he noticed between being a technical leader and being a business leader. Additionally, he and Steve discuss the new responsibilities that come with the business side of computer security, like product investments, protecting intellectual property, and more.
Mark Your Celebrations (28:50)
How do you celebrate when you receive funding to create technological advancements in computer security? David shares the ways that he demonstrates the value of his product creations to funders.
Operational Mantras (31:36)
David holds monthly meetings with his company's IT team to show them different things that they're doing from a security sprint, different threats coming up, etc. He values communication with his team as one of the ways to connect all operations of his business.
End User Maturity (34:12)
Implementing new security protocols for end users can often be met with resistance. David shares his thoughts on the topic and how to balance focus on implementing security and doing so in a way that has the least impact on end users.
Building Confidence & Asking Questions (38:04)
It is essential for leaders in the workplace to feel confident in their team. Steve asks David to share the one thing a security leader can do to increase their confidence in their team that represents the analytic capability of their organization. David cites the importance of communicating with team members, asking questions, and finding answers.
Thu, 02 Jun 2022 - 45min - 66 - Investing in Your Security Team with Zane Gittins
Episode summary:
On this special episode of The New CISO, Tim Lowe and Katie Hatch sit down with Zane Gittins, IT security manager. The co-founder of Rincon Security, Zane discusses what he’s learned building and managing an IT team. From computer science to consulting, Zane shares the journey of his career, and what has led him to focus on cyber security visibility. Listen to the episode to hear more about Zane’s day-to-day, his news intake, and how he manages his growing team.
Listen to Tim, Katie and Zane discuss security management:
Zane’s Background (1:58)
Zane discusses his background in IT security management and consulting with his company Rincon. A small organization, Zane wears a lot of hats and tackles a variety of issue.
Staffing (3:58)
Zane breaks down the misconception that it’s impossible to find good staff. He believes that if you invest in junior employees, as well as off the right packages, you can put together a great team.
He believes that people who are great communicators perform well in security. Zane sets up “lunch and learns” as a way to meet and bond with people in other areas of the business.
Education (7:01)
One internship can change the course of your career. At least, that’s what happened when Zane took on a security internship in college. Interested in computers from a young age, his education helped focus his path.
Advice to the Younger Self (8:54)
If Zane could change one thing about his journey in security, it would be to meet key members of the business sooner. Through making connections, Zane has learned what their concerns and risks are when it comes to security, and how he can help in those areas.
The Day-to-Day (11:00)
With security visibility as his top priority, Zane focuses on updating the systems and tools of the business, onboarding new people, helping the business move in the direction it desires.
Zane spends several hours a week staying up to date on current trends, utilizing Twitter to identify cybersecurity news. This preparation also helps him give context to family, friends and coworker who hear about security stories in the media.
Managing the Security (16:26)
A high-pressure job, Zane must stay on top of things to prevent threats. In particular, he is concerned about supply chain attacks and any new type of attack we do not yet know exists.
On the other side of the coin, Zane enjoys the technical side of the job. He shares a time where he had to act like a cyber detective while consulting.
Motivating the Team (20:17)
Hunting down false positives every day, all day, can be fatiguing. Zane shares how weekly practice challenges have boosted the confidence and knowledge of his team.
Growing Team (24:07)
Zane chats about the specific skills and tools he and his team have utilized as they’ve grown. As there are a lot of tools to learn, Zane encourages team members to become experts in certain tools and platforms.
Security Threats and People (27:44)
When consulting, Zane is most considered with external threats.
Overall, he believes that everyone has something to bring to this growing industry. When it comes to hiring and training, Zane looks to people with passion. By documenting everything, Zane and his team can better scale and onboard.
24/7 Coverage (32:25)
Zane talks about what it’s like to cover the environments 24/7 and still allow himself and his team to sleep.
Links mentioned:
Thu, 14 Apr 2022 - 35min - 65 - Cybersecurity Trends and Practices
On this special episode of The New CISO, Steve chats once again with Chuck Markarian and Sean Murphy. The CISO for Paccar and BEC U respectively, Chuck and Sean share their insights on the current trends in cybersecurity, as well as delve into their predictions for the field and the changing relationships within it. Listen to the episode to hear more about how the government has influenced cybersecurity, the importance of cyber insurance, and much more.
Listen to Steve, Chuck and Sean discuss cybersecurity trends:
Who are Chuck and Sean? (2:23)
Chuck and Sean explain their current roles at Paccar and BEC U respectively, as well as the backgrounds that led them there.
Political Influence (4:32)
Steve, Chuck, and Sean touch on the increasing presence of politics in cybersecurity. Sean weighs in on how relationships to law enforcement are altering, as well as how perceptions on cybersecurity have evolved and changed.
The Perception of the Hacker (9:57)
As the government becomes more involved, the blame on organizations for being attacked has now shifted to the attacker, rightfully so. No longer are hackers a kid in basement; hackers are real and dangerous threats that need to be stopped. This greater understanding of cyber warfare has better informed the public and organizations of what could truly happen.
Investment and Involvement (14:22)
With this increasing awareness of cybercrimes, boards and executes are more willing to invest in CISOs and their teams. It’s better to invest in preventative tools than to pay a bigger price after an attack. Steve, Chuck, and Sean also discuss what changes when the FBI gets involved and when organizations have to wait to fix problems.
Tabletops (21:30)
When simulating a breech, Chuck and Sean urge any leaders to really mimic the chaos that would naturally happen at that time. Be sure to include executives in this simulation, so they can gain practice and understanding of what will be a stressful situation in the future. In doing so, you’ll also be able to identify who is making what decisions before an event occurs.
Cyber Insurance (24:20)
Cyber insurance is becoming more common. CISOs need to educate themselves on policies and the language of cyber insurance. This brings up other questions such as, should individuals have coverage? Should CISOs and board members? Additionally, insurance forces companies and leadership to define what an incident and breech are. This helps in determining what to report externally.
A Third Party (34:43)
With a third party involved, like vendors, your risk level increases. From there, you need to assess how important that third party is and the level of risk with which you’re comfortable. It is part of the CISO’s job to help navigate those relationships and dynamics, and to make sure the organization is still protected.
The New CISO (45:27)
Before wrapping up, Sean touches on the importance of connecting and having conversations with other CISOs. If listeners have any questions, they can contact him via LinkedIn.
Links:
Thu, 31 Mar 2022 - 47min - 64 - Management Training: Learning How To Manage Managers
On this episode of The New CISO podcast, Jeremy Sneeden joins Steve to chat about needing management training to learn how to manage others, advocate for his team, and quantify risks. As someone with a technical background, Jeremy had to learn a whole new set of skills for his managerial role at Allina Health. He talks about how the “focus funnel” approach for his new team helped save time and money, as well as how he removes obstacles so his team can do their job. Now the Director of Operations and Engineering, Jeremy coordinates with other managers to ensure the different organizational groups are up and running. While he excels in his position, he believes in continuing to learn and support others.
Listen to Steve and Jeremy discuss management training:
Jeremy’s Background (1:47)
Jeremy chats about his current position as the Director of Operations and Engineering at Allina Health. Originally a technician, Jeremy still views himself as a security engineer, despite now being in management.
Management Training (6:35)
When asked to be a manager, Jeremy was terrified. He had to learn a new set of skills on his own. He advocates for better training for managers, as well as finding a philosophy that fits your style.
Tools for Your Team (10:30)
A great manager removes obstacles for their team. Jeremy discusses how his job is helping his people do their job, particularly in obtaining the right tools so that they can do so.
Talking Money and Partnerships (14:45)
Oftentimes, Jeremy needs to pitch higher-ups on a new tool or equipment. In order to gain approval, he recommends talking in specific dollars and cents. Additionally, he pairs up with other infrastructure groups who want the same things as he does. Together, they ask for additional money or tools for their teams.
Knowing Your Numbers and Team (19:10)
Know your assets—and their costs. When quantifying security risks, Jeremy had to understand the business better, as well as how important those assets are in dollars and cents.
The Focus Funnel (25:12)
After three years of managing, Jeremy became director. In charge of IT Asset Management, he sat down with his new team to examine their current tasks. If the task could be automated, they started that process. While it took time and upfront money, they saved hours and millions of dollars in the long-term.
Embracing the Fear (34:01)
A great manager pays attention, genuinely cares, take care of their people. They handle tasks that go unnoticed such as dealing with angry customers to advocating for your promotion. Jeremy believes that a great manager is also willing to get uncomfortable—or even scared—in order to grow and do what’s best for the team.
Manger of Managers (40:30)
As someone who manages other managers, Jeremy has learned when to get involved and when to back off. He has adapted to letting go of certain tasks and oversights, with the help of communication.
The CISO in Training (45:44)
Being a CISO-in-training to Jeremy means listening to his mentors, and continuing to learn and take care of his employees.
Links:
Thu, 10 Mar 2022 - 47min - 63 - Managing Your First Zero-Day Attack
On today’s episode, we are joined by Chris Wolski, the CISO of Port of Houston. He chats about job hunting, the aftermath of an attack and more.
Becoming a CISO
A returning guest, the last time Chris was on the show, he was unemployed. From being let go to landing his current position, the process took Chris six months. He chats about what that was like and the normal CISO versus the “Rockstar” CISO. Despite his limited experience in maritime, Chris took a chance and was rewarded.
Socializing as a CISO
Via events and even LinkedIn, Chris was able to expand his network. Through his connections, he was able to educate himself well enough in maritime transportation, laws and security to better understand his current job. Overall, Chris encourages you to do your homework on the industry, company and people when job searching.
The First CISO
The first CISO at Port of Houston, Chris has faced unique challenges. In part, he’s had to convince the port why cybersecurity is needed, and how it can impact cargo movement.
Attacks and Risks
Recently, the port had an attack. Having a zero-day used against them, Chris found the experience eye-opening. Thankfully, Chris already had an action plan, as well as a risk metrics to guide him. Within 2 hours, the attack was contained and fully remediated after 10 hours.
The Aftermath of an Attack
Although doubted initially, Chris found himself trusted, despite it being done after an incident. He documented everything and encourages other CISOs to do the same. As a result of his work, he was elevated within the organization and the maritime community. There was no doubt of Chris’s ability and purpose within the organization. Within two hours, the port saw its ROI.
After the incident, they shared what had happened in the hopes of opening up communication. By sharing, Chris can help others avoid what happened to Port Houston.
Getting Help
Due to the severity of the attack, Chris explains why the Coast Guard, FBI and other entities had to offer assistance. While it may be hard to juggle all those organizations, they have access to resources that Chris couldn’t have had otherwise. Again, it came down to reaching out to connections.
Indifferent Insiders
Do you need to have a major incident in order for an entire organization to believe in the role of a CISO? Chris explains how equating cybersecurity to something others already know can help convince them of its importance so they can better understand. With Port Houston, Chris compared cybersecurity to physical security to put everyone at ease.
Nowadays, cybersecurity impacts everyone. Any machinery, manufacturing and more has computer chips in their parts, which makes them susceptible to an attack. It’s important to convey the severity of cybersecurity to others.
The New CISO
To Chris, being a new CISO means doing your homework on your industry, company, and the people around you. Be willing to learn and you’ll find success.
Links:
Maritime Security Talk - YouTube Channel
Thu, 23 Dec 2021 - 39min - 62 - Demonstrating the Value of Your Program to the 'Layman'
On today’s episode, we are joined by Andrew Obadiaru, CISO and Head of IT for Cobalt. Andrew discusses using soft skills to build connections within an organization. Listen to the episode to hear his advice on
Two Roles in One
Andrew discusses what it’s like to oversee both security and IT. The fields overlap in many ways and differ in others. He’s not the only guest who has taken on this joint role of security and technology. Andrew explains how depending on the industry and the size of the company, having one person managing both departments can either be extremely helpful or burdensome.
For those entering that joint role with background in only one field, Andrew emphasizes getting to understand why IT or security is important and how it operates. With the help of good managers, you can overcome your lack of experience.
Challenges in Perspective
Andrew chats about the challenges in the industry, mainly how cybersecurity departments must prove their worth to their own company. Only when there’s a breach do many businesses see the importance of cybersecurity. As cybercrimes can happen due to anyone’s actions within an organization, it’s especially important to convey the purpose of the department.
Andrew believes that if you can point to related data points -- for example, how cybersecurity impacts the ROI – then you can properly convince others of its value add.
Developing Soft Skills
When selling the idea of cybersecurity to the rest of an organization, Andrew says to lean on soft skills. Learn the right balance between technical and business language to express yourself when talking to executives. Andrew encourages CISOs to focus on understanding concepts and get into the more technical details only if asked.
Budgeting Meetings
When entering budgeting meetings, your approach must be different than it is for other topics. Andrew encourages CISOs to really understand the crown jewels of the organization, as well as its risks. When you can figure out what’s valued within the company and how well – or not well – it’s protected, then you can properly convey what you need.
If you’re entering a routine optics meeting, you want to outline the current threats that the industry or competitors have seen and discuss how you plan to mitigate those.
Building Connections
Prior to entering a budgeting meeting, it’s important to have allies on your side. This doesn’t mean just someone who you ask to back you before the meeting begins. Andrew stresses that building connections and creating allies can take weeks or even months and should look like you conveying to leaders how cybersecurity will impact their departments. So when asking for a larger budget and explaining why, the other department heads will understand the relevance and are more likely to back you.
Andrew’s Background
Andrew has a background as an auditor, which he feels has benefitted him greatly. As he moved further into his career, he has found that his exposure to difficult conversations around money have helped him with his work now. He doesn’t feel intimidated, as he knows how to discuss difficult topics. Andrew believes that having a diverse background can be helpful in handling interpersonal relations or even conflict during meetings.
Maturity vs. Efficacy
Andrew differentiates a mature organization from an effective one. A mature organization may have a lot of documentation, repeatable steps and other solid processes. However, maturity within in an organization doesn’t always point to how effective they are in a crisis.
“Are We Secure?”
Oftentimes, the CEO or other execs will ask “are we secure, now?” Andrew shares his advice on how to answer without making promises you can’t guarantee. If asked this question in an interview, Andrew explains how sharing a plan of action may be the most impactful answer.
Overall, Andrew encourages CISOs to never rush to answer any question. You don’t need to prove how intelligent you are by answering quickly—instead, it’s more important to answer correctly.
Advice for the Younger Self
Andrew shares that he’d tell his younger self to be more mindful in his career. He says to be measured and clear, to examine the organization and see if he is a good fit for it.
The New CISO
Being a new CISO to Andrew is a big accomplishment and gives you a seat at the table.
Links:
Thu, 18 Nov 2021 - 49min - 61 - Don't Cut Corners When It Comes To Credentials
On today’s episode, Martin Littmann, CISO at Kelsey-Seybold clinic in Houston, joins us once again to discuss credentials. The systems in place to create them and protect them are essential. Hear his opinions on these systems.
Credentials
Martin outlines exactly what defines credentials. Credentials are the username and password created to log into an account. One question Martin attempts to determine is how do you know if the person using an account is someone who is authorized?
He shares his method for identifying this. Previously, it was largely based on trust before technology was advanced enough. Nowadays, it is very important to use technology to identify if account activity is normal or abnormal. Using the location of logins is very important. Correlating people’s activity and determining if it is abnormal is a good way to identify and flag abnormal activity.
Risk Management
How does this translate to risk management? If you notice suspicious trends, introduce a new challenge the user must answer to authenticate their identity. Learn how to discern between threats and simple bad IT.
Normal behavior is time of access, duration of access, and location of access. Use this to identify normal and assess the risk.
Frequent Questioning
Security personnel have access to analytical tools and therefore have a wealth of information. They can help to determine compromise. Thus, they often receive an influx of questions. While they can’t access everything, there is a lot of information that security personnel access. Other members in the company can use the information to determine productivity.
A piece of advice: present the facts without making assumptions.
Martin’s Steps to Account Protection
- Do we have a standard by which we create accounts? If the process is automated- is it bulletproof and unable to be overridden? How is the length and strength process? What is the process of creating the password?
Martin’s Advice
At a policy level, there will be certain requirements that a password must meet. However, there also needs to be technology behind it to enforce these requirements.
Marin suggests that organizations need to invest in protecting credentials. The password policy needs to be reasonable and specific.
Password Rotation and Lockout
What does Martin think about these topics? He believes that longer passwords are stronger but changing the password frequently does not help because people will simplify the password. He is not a fan of the 90 day password but believes passwords should be changed in certain incidents.
Martin also recommends utilizing a password vault.
Be Discrete
On a personal level, remember that your own data can be searched out. Using somebody else's data to answer your personal questions can help to protect you, as well.
Final Advice
- When doing two factor authentication, if you can use an app rather than receive an SMS, do it.
When talking about password vaults, don’t use the browser function to store passwords, use a dedicated app.Links:
Thu, 04 Nov 2021 - 50min - 60 - Invest in People as Much as Tools
On today’s episode, Luk Schoonaert, CISO for Exclusive Networks, joins us to discuss his experiences becoming a new CISO as well as the digital transformations and threat hunting.
Career/History
Currently based out of Belgium, Luk has been in security for over 20 years. Working in startups for years, he developed his passion for security. Newly, he has become the CISO for Exclusive Networks. He is a technology focused, goal oriented individual.
Working with the Buyer
If you are working with vendors or as a defender in a network, it is essential to equip the buyer and teach them how to sell internally. Leaving them with a clear picture, number or story that enables them to get their job done is an important skill to have. Luk advises to listen and ask questions in your meetings. Talk about the big picture and be transparent.
Representation
What should a CISO report to the board? How should they represent their program? Be there for the business so the business can function. Think about how you can best help the business to grow in what they are doing.
Digital Transformation
With the cloud becoming more in use, sometimes the security team gets left behind when the data transfer occurs. Adapting to such changes requires extra help and can also lead to mistakes or attacks. If you lose your logs, it can cause many problems to arise. However, it can be a great opportunity - if you get ahead of it.
Focus
As a CISO, pick one thing and do it well. If you focus on one thing and succeed, you’ll be able to build some credibility and gain leadership merit.
Threat Hunting
Luk has helped to build a Threat Hunting Academy. People can oftentimes stay too connected to old technology. He is giving workshops where, using a lab environment, they show how a breach occurs. This visualization of an attack is something many people never see or truly understand. Their program has received positive feedback and they now have an even more hands-on class.
By showing how an intrusion happens, it can help people realize where they may be lacking. This is an ongoing effort but it helps things to not go undetected. Ask the “what ifs.” You will get a good idea at how well you could do should an attack occur.
Through this, you can measure efficacy and tell the story of your business.
Being a New CISO
To Luk, being a new CISO is a very exciting expeirene. Being able to implement security practices in a company and drive the direction of certain practices is exciting. Ensuring secure functions of a company is something he takes very seriously.
Links:
Thu, 21 Oct 2021 - 48min - 59 - Empowering People to Bring Their “Whole Self” to Work
On today’s episode, we are joined by Azzam Zahir, Global Director of Insider Threat and Security at General Motors. He discusses his journey in becoming a leader in his field and what he has learned in that process.
Journey to Leadership
After finishing school, Azzam took it upon himself to seek opportunities and work extremely hard in any job assigned to him. His inquisitive mindset helped to forge his path. In 2007/2008 was when his title changed to being a leader. His strengths in managing with influence helped him to take on that leadership role. The transition to the role involved understanding the new responsibility of managing people.
His biggest fear going into the position was the fear of failing as a people leader. He worried about giving them the necessary time and attention to allow them to succeed. An unexpected challenge was the day to day management tasks.
Review
How does Azzam review people and give them feedback? Contrary to the typical HR review process, he does it early and often. Don’t wait until a review period to give constructive feedback. This can eliminate some of the nervousness and help people to be more receptive to the feedback.
What cornerstones of leadership does Azzam expect? Leaders should allow people to be their individual selves and bring their uniqueness to the table. Let them do work that makes sense with the skills they already have.
Young Azzam
What advice would Azzam give to his younger self? One thing, which is challenging, is don’t chase the money. Focus on the career, not the jobs being offered to you. If the job doesn’t offer you great opportunities for career growth, reconsider taking it.
It is important to know how to leave a job if that is what you want. Receiving a counter to make you stay doesn’t fix the reasons why you wanted to leave the job. When young, it can be hard not to want things to go really fast.
Job Vs Career
How can you know the difference between a job and a career? Mentorship is really helpful with this. Have both an internal and external mentor. Your internal mentor will help you navigate politically within the organization and avoid pitfalls. Your external mentor has no association with the company so they can give outside perspective. The mix of the two insights provides a happy medium. The internal mentor will likely be more challenging to establish.
Diversity and Inclusion
Azzam presents an exercise that has benefits for diversity and inclusion. The exercise surrounds coming up with a short questionnaire. It asked things such as: Where did you grow up? How many languages do you speak? What is your educational background? They anonymously answered and mapped out the responses. You can watch people making assumptions of who they think answered. You can discover new similarities and discover people’s strengths in the differences. This is a great way to connect your teams and build trust/awareness.
Who to Look for in a Team
Look for active learners. The education you have is in the past. What are they still learning? You want a team that will continue to grow and evolve.
Being a New CISO
Azzam advises that the information is out there. Don’t sit around waiting for change. The CISO needs to be proactive in moving their teams towards the change versus reacting to it.
Links:
Fri, 08 Oct 2021 - 50min - 58 - Building Your First Cybersecurity Program
On today’s episode we are joined by Benjamin Edelen, former CISO of the City of Boulder. Leading with people first strategy, he aims to serve and protect the community and discusses his transition in and out of the CISO role.
Starting from Scratch
5 years ago, Edelen was chosen to be the first CISO of the City of Boulder. With no security programming or procedures in place, he had to build the program from scratch. This was a large challenge he had to face. His solution was to pour a lot of himself and his personality into the company. Ultimately, the program became deeply intertwined with his personality.
Although he has since left the position, he tried to figure out how to leave while keeping the system in tact. Having connection and passion for your job is important. However, it can make it hard to discern work from personal life.
Turning Point
When did Edelen realize it was time to move on? He notes that the CIO of the organization was very transformative with a thorough plan of advancement. He speaks on the fact that she wanted to guide him on being successful both in the company and beyond. He was encouraged to go out into the world, even if that was with another organization.
There is often a point when someone needs to move on in order to continue to grow.
Passing the Torch
Passing a role that you served in for a long time can be very challenging. It is important to learn how to move on. It can be difficult to see the role fade away or change. Sometimes the company may not listen to your advice or continue to take the role in the ways you envisioned it. Emotional reactions during these times are natural.
Transitioning Documents
What is Edelen’s advice for leaving the role? He had to decide how to transition out of the role as he was leaving. This can be deciding to recommend people to take on the roles. Writing down the tasks is important. The biggest challenge was a request/business case for the continuation of the role he was leaving.
As he was creating the transition documents, he realized he was also creating a document he could use to begin his next role.
Recognition
Edelen notes that the recognition he needed was knowing he was protecting the people. Recognizing successes within the company is very important. In cyber security, the focus is often the failures. However, focusing on success can make a large difference.
Employment Contracts
CISOs are not always the best at creating employment contracts. Putting together a list of questions and topics can be a great thing to consider. Contract negotiation is pretty standard. It is powerful to outline certain expectations you have of the job.
Steeve Moore encourages listeners to reach out to him on LinkedIn.
Being a New CISO
To Benjamin Edelen, being a new CISO means placing an organization and their people under your protection. He builds an organization intertwined with who he is as a person, and he would do it again. Helping other people navigate mistakes is a large part of the role. Taking on the role means making a commitment to the people and standing against risk.
Links:
Thu, 16 Sep 2021 - 41min - 57 - Knowing When It's Time to Move Onto New Challenges
On today’s episode we are joined by Jerich Beason, senior vice president and CISO at Epiq. He delves into advice on networking, knowing which job is right for you, and how to build trust as a CISO.
Advice to Younger Self
Beason says he would have spent more time on relationships. While he had relationships, he wishes he had done more to maintain those relationships across gigs. Keep up contact with people, you never know when you may want to connect down the line.
So how do you upkeep relationships? Being intentional with your responses is important. Reach out and update those you are connected with. Who you know is extremely important in the job market. Keep in mind those people who have helped you along the way. A simple thank you goes a long way.
Network
Don’t focus all your energy networking at the top. Network with everyone. It will help with hires and building teams. So who should you reach out to? Network with people who are where you want to be. Also reach out to a peer group. Mentor when you have the chance, as well.
Wasted Time?
Young Jerich wasted time chasing a lot of certifications. An ongoing list of certifications takes a lot of time to obtain, but they do not necessarily stay relevant. Be deliberate about the ones you go after. His most valuable certifications are IT focused.
Epiq Cyberside Chats
Beason hosts a podcast of his own which he discusses. It is relatively new with goals of working to be a leader in the industry of cybersecurity.
New Opportunities
You have a current position but are offered a new opportunity. What do you do? How do you make that decision? Beason walks us through his experience choosing a new job and what influenced his decision. He thought about his personal brand and what he wants to do as a CISO.
He had open discussions with his boss about being torn in his decision. It was a brief discussion but helped provide clarity in the situation.
Personal Branding
Think about what success means to you and what you want to achieve. How do you want to look back on your career?
Trust
As the first CISO in the company, much of his role early on was teaching people what a CISO was. He gained the trust of people in the company over time. He helped rebuild trust in the business. Strategy can only be successful if there is trust behind it.
How do you know if you have trust? Trust is a combination of character and competence. Beason tries to demonstrate trust by showing that his goal is to help the organization succeed.
Reaching out to top customers is extremely important. Communicating changes both short term and in strategy is necessary.
Three Phases
1). Foundation to work on preventing attacks
2). Play with more cutting edge technologies to build on foundations
3). Reach back and have transparency
Be Knowledgeable
You have to know about what you are protecting in order to succeed. Having a complete picture is essential. Utilizing technology to gain visibility can be useful. Beason feels as if he has knowledge of 99% of their devices.
Recommendations
Beason recommends several books that have helped him along his journey as a CISO. He suggests several books on trust including “Speed of Trust.”
Being a New CISO
To Jerich, being a new CISO is different in every scenario. Being able to speak the lingo and have a seat at the table is important as is understanding security fundamentals. Most importantly, recognize the changing nature of the job.
Links:
Thu, 02 Sep 2021 - 44min - 56 - Leading Cybersecurity as a Key Business Driver
On today’s episode we are joined by Dr. Tim Proffitt, managing director of information security at a Houston based company as well as a professor at several institutions. He discusses his own education as well as his experience educating others and how this impacts his job.
Advice to Younger Self
Young Tim wasted a lot of time doing unnecessary things. Tim would advise his younger self to not waste so much time playing video games and late night TV.
Education
Proffitt has always valued seeing things through. He always planned on getting a bachelor's degree and decided to continue his education. After qualifying for a new masters program, he wanted to see that through. Proffitt then saw it through to getting his PHD. He values expanding his knowledge and challenging himself.
Would Proffitt advise doing the same? It depends on self reflection and the individual. Formal education is not required for being successful in your field but it can develop some great traits. If you can see what you would get out of your masters degree, then go for it.
Getting a masters does not always equate to earning more money. However, when you choose to go through with this program, you will be stretched. It will open doors you didn’t have access to before.
Credentials
Credentials are important at a certain level, but experience is just as important. Listing and talking about your credentials and experience can help some conversations and hinder others so self awareness is important.
Successful Written Communications
Proffitt explains that seeking out writing skill sets is important. It takes time and effort. Bouncing ideas off someone can be very useful too. Find that resource and mentor. A simple Google search can help you find seminars that can assist you in bettering your writing skills, as well.
Networking, Mentors and Career Arcs
Seek out and try to find a mentor early on in your career. A mentor is someone that can offer help and advice during your career. Proffitt wishes he found a mentor sooner.
After you become a CISO what is the career arc? A progression often occurring is becoming a member of the board of directors. It could also be becoming a CEO or beginning to teach.
Teaching
What would Proffitt suggest to people thinking about teaching? Teaching at a community college would likely require a master's degree. Teach one class and see what you think. His goals were to be an engaging professor and getting students to want to go into his field. You can change the generations and introduce new people to the field.
How does being a college professor better Proffitt at his day job? He can view the challenges with a different lens by interacting with the viewpoints of his students. It forces him to think in different ways.
What Do We Miss in Security?
We often do not dive deep enough into issues. There is always more information about why things are the way they are. Taking time to listen to the engineers is important and can aid in decision making. People may be managing problems, but not reaching the core.
Every security program should be expending time on a risk register. This can transform the business. Presenting a simple risk register can be very profound. Consider using tools such as the 5 “whys?” or a SWOT analysis.
What Do CISOs Not Get Enough Credit For?
No credit is given when things are running smoothly. However, when things are not running well, they are criticized quickly. A lot of people don’t realize the manpower behind having the internet and technologies work. How does this get solved? As leaders, more credit can be given if metrics are improved. Proffitt dives into metrics and discusses which provide the most value.
New CISO/Advice
One piece of advice that Proffitt has is to develop a feel good security packet to outline your security processes to an extent. Your sales team and liaisons can hand this out to help make people comfortable. It is pretty easy to build a template that will answer most of the questions coming at your industry. Obtaining this information shouldn’t be too difficult. This packet will be relatively simple to assemble.
What does being a new CISO mean? You have to be a business enabler. You must help people get to their goals in a secure fashion.
Links:
Thu, 19 Aug 2021 - 50min - 55 - Defending Data and Corporate Systems Without Sacrificing Revenue and Velocity
On today’s episode, Tyler Farrar, CISO for Maxar Technologies, joins us to discuss the ins and outs of threat intelligence. He delves into the importance of not assuming malicious intent and his approach to compliance versus security.
Introduction to Tyler Farrar
Maxar Technologies is a satellite imagery and satellite manufacturing company. Farrar got his start with IT in the U.S. Navy. Working with the Cyber National Mission Forces to protect critical United States infrastructure. He was responsible for managing and leading a team of navy sailors and civilians. They would gather data and intelligence and he was responsible for commanding the mission of the operations.
Threat Intelligence
Farrar notes that many people misuse the term threat intelligence. Taking legitimate sources, forming a hypothesis about what this means within the company network and then acting on the hypothesis is the true process of threat intelligence.
Farrar discusses how standstills can occur. Sometimes companies will find the source, but fail to use the information to better the company. A repeatable process in acting on intelligence is essential and should be used in the private sector. Farrar discusses misconceptions in log sources within threat intelligence. Working through key outcomes and identifying desired achievements can help formulate use cases.
Outcome
How would Farrar define an outcome as it relates to threat intelligence? It is centered around quick identification and action upon a threat. After identifying use cases, narrow down what information will identify a certain use case to be used.
Consider making a chart of your company’s process. This can allow the process to be explained to others with more ease. Farrar notes the importance of working with key stakeholders in this process, as well.
Insider Threat
Insider threat is also a misconstrued area. People are very complex and thus insider threat is a challenging area. While there is no one approach, Farrar discloses advice to approach this: managing cyber security, reaching out to the employee when necessary and working with them to understand why an activity took place.
From here, determine the right steps to take. How and when do you reach out and what do you say? With data loss on the line this can become challenging.
Analysts
How do we train analysts to have cognitive management and have a trust first mentality? Analysts can become quickly overwhelmed with a constant influx of alerts and false positives. When this continues, they can become burnt out. As leaders, try to motivate your employees to feel positive about their work environment. If they can tie their work directly back to the mission of the organization, this can be a large factor. Being mission centric can help align the employees to the business.
Look at your goals. How much time is necessary for achieving them? Understand what activity from your employees is normal to avoid spending time and technology on unnecessary activities.
Community Culture
It takes time to change the culture of your business partners and the community as a whole. Many organizations want to be in a place where people come to them, but still need to gain confidence from others. It is easiest to utilize lessons learned from a crisis as a conversation starter with your customers. With much focus on cybersecurity, providing cyber assurance to your customers is valuable. To do this, you must discuss the risks.
Frustrations in the Industry
Farrar opens up about some of his frustrations within the industry. He explains that people get caught up in fixating on a compliant environment and are willing to wait for others to get to the compliant state. We need to utilize forward leaning technologies and not wait for compliance. Balance is important and we need to be moving faster. Just checking boxes is not enough, we must push to get to the next level. This can drive us far ahead.
What does being a new CISO mean?
Farrar has his answer down to a tee. Defending data and corporate information systems when enabling revenue and business philosophy.
Links
Thu, 05 Aug 2021 - 44min - 54 - Growing Your Confidence as a Young Leader
On this Episode of The New CISO, Steve Moore is joined by special guest Michael St. Vincent, the CISO of The Cosmopolitan of Las Vegas. They discuss the importance of networking as well as advice for succeeding as a CISO and in the workplace.
Introduction to the Cosmopolitan of Las Vegas.
St. Vincent has been the CISO for 6 years at The Cosmopolitan of Las Vegas, a resort hotel in Vegas. He shares that his favorite thing about the hotel is the artsy and off beat culture of the hotel and the joy of just walking through the building. “Secret Pizza” is a delicious stop, as well. Moore shares his experience grabbing a slice at Secret Pizza, too.
Advice to a Younger Self
St. Vincent shares that he wishes he would have networked more. Diving into the community is important. Being slightly more closed off can pose challenges and lead to missed opportunities. Just start talking to people and see how this can help your career. Many people feel as if they don’t have enough experience to share perspective but having confidence in yourself can help greatly. St. Vincent shares two main pieces of advice.
1). Confidence. Accepting that you don’t have to know everything can make networking easier. Look at it as a learning process.
2). Don’t Dominate The Room. Offer an idea and see where it goes. This opens up a conversation and allows room for others to share their ideas.
Coaching Networking
Learn from listening. Being present and listening to who is speaking is how you show respect to the speaker and learn. Being kind is also important. Present an opposing opinion in a kind way, but let people respond. Being a coach to the next generation is an incredible opportunity. This will create a strong and successful community going forward.
Networking Opportunities
In Las Vegas, they have a networking cocktail hour with industry professionals, as well as a few students who get invited to participate in these events. Getting a feel for the room is an extremely beneficial experience for up and coming individuals.
St. Vincent holds one-on-one meetings with his staff to offer feedback. He speaks on the importance of having conversations and growing communities. These outreaches end up being very worth it in the long run.
The Hiring Process
Not everyone can get hired for positions they interview for. St. Vincent and Moore advise to always reach out to the hiring manager and ask for an off the record debriefing. Giving and getting feedback is important and can help you grow and this honest feedback can be very helpful in the future.
Admitting “I Don’t Know”
Why is it so hard to admit you don’t know something? Lacking confidence can be partly to blame. There is also an expectation that we need to know everything. This is a common way to feel. It is worse to make up a solution than admitting you don’t know something. Asking for help is okay, and there will be many people willing to help you out. Admitting we have limits can be challenging, but it is human. Being overconfident and “showboating” is not the way to go. This indicates that things will not go well, most likely.
360 Review: Confidence vs Arrogance
St. Vincent shares about his 360 review and the realization that some people perceived him as arrogant. There is a fine line between confidence and arrogance. Behind this is attitude and self awareness. A 360 review takes a certain type of openness. You must be willing to listen to the feedback you will receive. Making informed changes based on this feedback provides a lot of room for growth.
Relational Confidence
Opening up and sharing on a personal level is important. St. Vincent welcomes others to argue with him, as long as they come with a reason. This opens grounds to more productive conversations and problem solving in the workplace.
Where is Credit Due?
Security programs are often only evaluated on failures. What gears are St. Vincent trying to fix? He answers how the fixes can sometimes be hard to spot and are often operational. Overtime, credit will be given and problems will be solved. Being part of the solution helps people realize the controls. Moore also shares his experience in finding expired servers.
Trying to Own too Much
Oftentimes, people agree to owning too much, but it can be too much to be doing all of this alone. Many companies have a security program in place but no asset control. The CISO will be responsible for protecting what they own, but if it is undefined this can be challenging. This leads the CISO to overcompensating. St. Vincent shares his advice for situations like this. Trying to own everything is not a path to success. Registering everything you own to an owner is helpful. This model will be more successful and having a motivation owner is important as well.
What Does Being a New CISO Mean?
In St. Vincent’s experience, being a new CISO is about looking at the technology and processes already there, determining which ones people think are broken and trying to work these problems out.
Segments:
8:44-10:47 Coaching the next generation
25:30-26:50 360 Reviews
27:49-29:46 Relational Confidence
36:38-39:37 Assets
Links
Mon, 26 Jul 2021 - 43min - 53 - Four Key Elements of a Security Strategy
On this Episode of The New CISO, Steve Moore is joined by special guest Mark Ferguson, the CISO for a cyber security company Bombardier. They discuss roles of a CISO in cybersecurity and the strategies involved in dealing with breaches and building teams.
Moving to Canada
Originally from Scotland but now residing in Montreal, Canada, Ferguson shares some background on where he has lived in the past and the process of moving to Canada. Ferguson expresses his excitement of experiencing Montreal when it becomes more open. He has been taking some French classes to become better acquainted with the language.
Travel
Ferguson has been able to travel often and live in many places for his job. Opportunities to relocate have been present multiple times throughout his career. Ferguson advises taking opportunities to relocate for a career. He has moved to the United States, to Poland, and now to Canada. He enjoys the experiences of new places. Moore discusses how relocation may be less common in companies based out of the United States.
First CISO Role
Ferguson reflects on the decision to become a CISO. He honestly admits that some days it can be exhausting and doubts can arise. There are good days and bad days in the role. At the end of the day, he knows he is capable of solving any problems that arise. The role brings a lot of diversity.
Getting to be a CISO/4 Pillars
How did you get to the point of being a CISO, Moore asks? Ferguson says he had a great mentor and was able to help identify his assets. Getting things done and strategic planning are important as well. The four main pillars of strategy are.
1). Educational awareness
2). Strong Identity Management/Data Security
3). Strong basics of IT management and maintenance
4). Using agile technology
Building a program & Facing Challenges
You have to know what players you need to make things work. Building strong relationships is important and will assist with the aspect of vulnerability management. It can be a challenge to identify where problems lie and explaining the problems can be a challenge as well. Ferguson notes these are things he still actively is working on.
Moore notes that the CISO position can be nearly impossible at times. However, others pulling their weight in the company is essential. IT systems are extremely complex and joining everything to work as one can be difficult. This is, realistically, not a simple problem to solve.
Breaches with assets could be a big detriment to the company. Holding people accountable and working together is one way to avoid these breaches. Running audits is time consuming, but important to keep everything in check.
Best parts of the job
Ferguson shares some of the best parts of his job. One of his favorite things is building great teams. Finding great people to work with is very rewarding. These people don’t have to be perfect, but finding what makes them an asset to the team is great. Inevitably, these team members will come and go, but developing great teams is one of the best parts of the CISO role, says Ferguson.
Breach Response Plan
One of the first lessons to learn is that a cyber breach is not a cyber security problem. Ferguson mentioned that they recently faced a breach, and there is a lot to learn from the situation. This occurred at a critical time. They assumed the breach would be coming from the bottom up, however it was at a more executive level. Their team learned about internal response from this.
A good response to a breach is having the right people involved in the situation. A business team to be involved in the response is important because it is a business problem. Quickly building out this team is very important. Making sure everyone knows what the problem and objective are is essential.
Once a breach occurs, there is a lot of responsibility involved. People often don’t understand the size of this responsibility until it occurs. With the right culture and leadership, response will occur more smoothly.
Important response tactics are
- Heat of the moment
Assumptions don’t matter
Speed
Scale
Openness to any idea
Understand your role in the processCommunicating with the Customer
Ferguson states that this is one of the most important ways of responding to a breach. Notifying the customers off the bat is necessary. How do you notify them? Ferguson shares how he approached communication. Turn to key stakeholders first and listen to others as well during the process. Having conversations will be time consuming but will ultimately go a lot further than sending an automated message. Many people will want to speak with the people directly involved because it gives them confidence with the answers they are receiving.
Growing
Ferguson shares how this has helped him to grow as a leader. He was balancing a lot at the time of the breach so it forced him to test and extend himself to tackle the series of events. He now has a new capacity he can operate at. Real life experience is truly the only way to learn a situation like this.
Ferguson also notes he is not always going to be the smartest person in the room, although that is the expectation of the CISO. Being ready to handle this challenge is important when taking on this role. Be sure to convey confidence when coming up with a plan. Working through challenges grows us professionally.
Being a new CISO
What does being a new CISO mean to Ferguson? A key piece is being the crisis manager. Managing many things successfully can be a challenge, so managing these crises is a large part of being a CISO. Having a high stress threshold is a necessary skill, as well.
Segments:
12:50-14:45
22:16-23:55
30:33-31:37
45:50-47:16
Links
Thu, 08 Jul 2021 - 48min
Podcasts similar to The New CISO
El Partidazo de COPE COPE- Herrera en COPE COPE
- La Linterna COPE
- Panda Show - Sin Picante El Panda Zambrano
- Es la Mañana de Federico esRadio
- La noche de Cuesta esRadio
- La Trinchera de Llamas esRadio
- Hondelatte Raconte Europe 1
- Affaires sensibles France Inter
- LEGEND Guillaume Pley
- El colegio invisible OndaCero
- La Rosa de los Vientos OndaCero
- Les grands dossiers de l'Histoire par Franck Ferrand Radio Classique
- Espacio en blanco Radio Nacional
- Enquêtes criminelles RTL
- Entrez dans l'Histoire RTL
- Le grand récit RTL
- Les Grosses Têtes RTL
- L'Heure Du Crime RTL
- El Larguero SER Podcast
- Nadie Sabe Nada SER Podcast
- SER Historia SER Podcast
- Todo Concostrina SER Podcast
- Un Libro Una Hora SER Podcast
