Maeve Security Podcast

IT auditor Amanda Ehrhart on finding cybersecurity through a digital forensics elective, why professional skepticism sits at the heart of audit, speaking your stakeholders' language, deciding where to sit as the only woman in the room, and why the industry has to keep creating entry-level roles.

Kendra talks with Amanda Ehrhart, an IT auditor who helps banks and AI startups with everything from SOC 2 to PCI attestations. Amanda studied computational math and planned a career in finance until a digital forensics elective in her master's year changed her course. She shares how consulting led her to audit, why delivering a hard finding works best when you speak your stakeholder's language, and how she reads a room where she may be the only woman. She also makes the case that GRC needs real entry-level roles, and that nobody should build a career without a community behind them.

Recorded live at Hackfest in Quebec City, Kendra sits down with Cheryl Biswas, Deborah Turner-Chappell and Bee Mallory to talk about first conferences, finding your people, and what it's really like to be a woman at a security conference. Plus hot takes on phishing simulations, security awareness month and AI.

In this episode

The very first Maeve Security Podcast LIVE comes home to Hackfest, the conference where Maeve was born two years ago. Kendra is joined by three women at very different points in their careers: Cheryl Biswas, a threat intelligence researcher who spoke on Arctic sovereignty; Deborah Turner-Capel, a business analyst who hacked her way into cybersecurity and attended her first Hackfest; and Bee Mallory, a master's student who gave her first keynote while still in high school. They trade stories about the conferences that made them feel they belonged, the moments that made them feel they didn't, and what organizers can do better. Then come the hot takes: why phishing simulations under-deliver, why awareness month has lost its punch, and why AI is a tool, not a replacement for thinking. Also included: Airhorn magic. 

Topics

What if the question isn't just "Do you like your work?" but "Do you like who you become when you do it?"

Kendra talks with Michelle Croak, an independent GRC consultant, CRISC instructor and mentor, about a career that began in a tiny college risk management major and stumbled into security when a new job asked her to build an IT general controls program from scratch. Michelle explains why GRC is really people management with no one reporting to you, what changed when she went independent, and how reading over a hundred books last year made her more empathetic at work. She speaks candidly about being the only woman in the room, and closes with advice to find work you love being yourself in.

"I think it's not only if you like it, you should do it, but you should also like the version of you that comes out when you do it." – Michelle Croak

CONNECT WITH MICHELLE LinkedIn: https://www.linkedin.com/in/michellecroak/

GRC, Simply: https://grcmichelle.com/what-is-grc-simply/

ABOUT MAEVE SECURITY

Maeve Security spotlights the women shaping cybersecurity and technology, in their own words.

New episodes every other Wednesday as part of our Women in Cybersecurity and Tech Spotlight Series.

🔔 Subscribe: https://www.youtube.com/@maevesecurity

🌐 Website: https://maevesecurity.com

📸 Instagram: @maevesecurity

💼 LinkedIn: Maeve Security

Want to be a guest or know someone who should be? Reach out to Kendra at [email protected]

#WomenInCybersecurity #WomenInTech #GRC #RiskManagement #Cybersecurity #MaeveSecurity

In this episode of the Maeve Security Podcast, Kendra sits down with Clea Ostendorf, co-founder and CEO of Wolfpack Security, to talk about her winding 15-year path through sales, delivery, advisory, and product management before landing in cybersecurity — and eventually building her own company.

Clea shares the leap of faith it took to leave a comfortable field CISO role and start Wolfpack with a co-founder she barely knew, why she initially resisted pen testing as the company's focus, and how she balances founder life with family, friendships, and her own wellbeing (hint: it involves 5am walks and a theory about "four burners").

The conversation also digs into AI's growing role in security — why "human in the loop" isn't just a buzzword, and what gets lost when we trust AI-generated answers without the expertise to know what's actually right. Clea gets candid about being underestimated in the industry, the advice she wishes she'd gotten starting out, and why she believes cybersecurity needs more diverse paths and diverse thinkers.

In This Episode:

- Clea's winding road from tech staffing into cybersecurity

- The leap of faith behind co-founding Wolfpack Security

- Balancing founder life, family, and friendships

- Why "human in the loop" matters more than ever in the age of AI

- Being underestimated as a woman in tech — and what's changed

- Her best advice for anyone starting out in cyber

Connect with Clea: Wolfpack Security | LinkedIn

About Maeve: The Maeve Security Podcast spotlights the people shaping cybersecurity — their paths, their lessons, and the community behind the work.

#Cybersecurity #WomenInTech #AI #MaeveSecurityPodcast #WolfpackSecurity

In this episode, Kendra sits down with Coleen Coolidge, a two-time CISO with over 25 years in tech (20 of them in security), who built security and trust programs from the ground up on the belief that great security is a team sport. Now a self-described "recovering CISO," Coleen invests in early-stage startups and works as a Field CISO at formal.ai, all while thinking hard about what AI means for both defenders and attackers.

Coleen's origin story is one many in security will relate to: she didn't choose this field, it chose her. What started as a mortgage data project in 2004 turned into a career-defining moment when a security reviewer named Ian showed up, tore the project apart, and changed the entire trajectory of her career.

In this episode, Coleen shares:

- How being "tricked" into security by a mentor led to two decades in the field

- Why the best security leaders are well-versed generalists, not narrow specialists

- The real day-to-day of being a CISO (hint: it's more politics and advocacy than pure technical work)

- Retiring, and immediately getting pulled back in by founders who wouldn't let her leave the industry alone

- Becoming a Field CISO and what that role actually looks like

- Why people skills matter more than technical expertise when it comes to getting things done

- The Security Padel community she started to get security people off their screens and away from unhealthy happy-hour culture

- The surprising parallels between sales teams and security teams, and what security can learn from GTM

- How the experience of being a woman in security has shifted since she started in 2005

This conversation is packed with hard-earned wisdom on burnout, mentorship, and building a career that outlasts any one job title.

🔗 Connect with Coleen: Find her on LinkedIn under Coleen C

Learn more about formal.ai, a protocol-aware proxy security company

This week, the tables turn as Kendra welcomes a fellow podcast host to the show: Dawn Butler, host of Bytes, Bits, and Brilliance and a 23-year veteran of senior leadership at Citi, most recently in Global Identity and Access Management under the CISO organization.

Dawn's path into cybersecurity started far from where it ended up: an electrical engineering degree, and nearly two decades as a software engineer before pivoting into governance and policy. Her story is candid, funny, and refreshingly honest about the messier parts of a "successful" career.

In this episode, Dawn shares:

- How a college friend's phone call led her into a computer programming job she never expected to take

- Teaching herself Oracle databases in a single intense weekend

- The shift from hands-on technical work to global governance and leadership, and the mental adjustment that came with it

- Getting physically burned out early in her career (including tendonitis from overwork) and what it taught her about limits

- Getting laid off in 2024 while on leave, and the surprising relief that came with it

- From Pause to Power, the healing circle she created to support women navigating layoffs, unemployment, and career transitions

- Why representation and visibility still matter, and her call for more women and people of color to show up and be seen in this industry

This is a conversation about burnout, reinvention, and giving yourself permission to not have it all figured out, even 20+ years into a career.

🔗 Connect with Dawn: Podcast: Bytes, Bits, and Brilliance (wherever you listen)

Find her on LinkedIn Reach out directly to learn more about From Pause to Power

Welcome to the very first episode of the Maeve Security Podcast! Host Kendra sits down with cybersecurity analyst and researcher Cheryl Biswas for a conversation that's equal parts inspiring, honest, and hard-won wisdom.

Cheryl's path into cybersecurity is anything but traditional. She holds a degree in political science, was once told she "couldn't learn computers," and worked her way up through help desk, admin, and mainframe roles before landing in the threat intelligence world — where she now tracks APTs, ransomware, botnets, and supply chain risks to critical infrastructure.

In this episode, Cheryl opens up about:

- Her unconventional career journey — from being discouraged in math class to becoming a leading voice in threat intel

- Getting laid off after a long career at a bank, and how she's navigating the job search with resilience

- Her passion project on critical infrastructure resilience and a talk on Arctic sovereignty and cybersecurity for Canada

- Burnout, isolation, and mental health in cybersecurity — and why checking in on people who go quiet matters

- Her work as a founding board member of The Diana Initiative, supporting women, transgender people, and neurodivergent folks in security

- The power of mentorship, community, and just saying "yes" to opportunities Whether you're new to cybersecurity, considering a career change, or just need a reminder that persistence pays off, this conversation is packed with heart and hard-earned advice.

🔗 Connect with Cheryl:

Blog: cyber-watch.ca

Find her on LinkedIn Catch her at DEF CON's Adversary Village and Hackfest

🔗 Learn more about The Diana Initiative: supporting women and underrepresented groups in cybersecurity through mentorship and an annual conference in Las Vegas.