In this episode of The New CISO, Steve is joined by guest Frank Vesce, CISO for Allvue Systems.

Beginning his life in a Brooklyn orphanage, Frank is now a cyber security leader, government advisor, youth mentor, and community advocate. Today, he joins Steve to discuss the technical and human side of cyber security. Tune into today’s episode to learn more about Frank’s professional journey, his approach to interviewing, and his motivation to mentor.

Listen to Steve and Frank discuss the power of communication and the four types of complaints that can affect your organization:

Meet Frank (1:36)

Host Steve Moore introduces our guest today, Frank Vesce, who has over twenty years of experience, including global leadership positions.

Frank first became intrigued by cybersecurity through the Matthew Broderick film War Games. During a coding class at university, Frank became even more interested in this field after reading the book The Cuckoo's Egg. 

First Gig (4:23)

Frank's first security position was at Goldman Sachs. Before, Frank worked in IT and technology, but in 2010, Frank transitioned from infrastructure to security risk, and things moved forward from there.

The Interview (5:16)

Frank shares his unique approach to interviewing. He would call the interviewee by the wrong name to understand their personality. 

The best response would be when someone would politely and quickly correct him, how people answered demonstrated if they would fit on the team.

Being Human (12:59)

When people come to work and complain, it typically has nothing to do with their employer. They may have something going on in their personal lives, so it’s essential to get to the root of the problem before making assumptions.

Frank then shares the different kinds of complainers in the workplace and how to work around them to strengthen your team.

The US Coastguard (19:24)

Steve presses Frank on his experience with the US Coastguard.

Frank gained this opportunity from a few colleagues who asked Frank to join. The coastguard wanted someone from the financial sector to do tabletop exercises, and Frank was the right fit. Ultimately, these exercises helped inform public policy.

Working in government also taught him the importance of communication chains and how to determine which phrases and words can or cannot be shared. Steve and Frank discuss managing your words effectively when security is essential.

Bad Advice (29:51)

Frank tries to learn from his mistakes and turn them into positives. However, he has one example of bad advice.

He shares a story where his boss took him to coffee to yell at him for a mistake. However, Frank told his boss he wasn’t coached on that aspect of his job. Frank lacked advice during this circumstance. 

Different Philosophies (36:21)

To Frank, teams need to be transparent with boards today as boards get savvier. Especially if there is a breach, you don’t want to lose your reputation with your firm.

Learning how to translate what’s on the technology side to the business side is critical. Everything boils down to communication.

What’s In A Word? (39:21)

When Frank returned to Goldman Sachs, he was tasked with creating a change management system.

During this project, Frank had an issue with a colleague over the word “re-engineer.” The colleague felt more comfortable with the word “enhance.” When new to a firm, using the right words to gather the most support is critical.

Origin Story (43:50)

Steve presses Frank about his life in an orphanage. 

Frank spent some time there but was later adopted by a caring family. This motivated Frank to give back, and now Frank works with the organization A Year Up, which helps inner-city kids break into the corporate world.

The New CISO (47:51)

To Frank, being a new CISO means translating the technology side of security for less technical people. It is crucial to explain risk to the business side.

It is also important to recognize the human side of the job.

Links mentioned:

LinkedIn

In this episode of The New CISO, Steve is joined by guest Brad Sexton, Chief Information Officer, and Information Security Officer at Terrible’s.

After having issues with a Dot Matrix printer, Brad was inspired to transition from a career in education to IT. Through conflict, change, and self-reflection, Brad has become the effective leader he is today. Tune into today’s episode to learn more about Brad’s career journey, the consequences of “ego,” and how to leave a job gracefully.

Listen to Steve and Brad discuss how leaders can walk the fine line between confidence and arrogance and the right motives for becoming a leader:

Meet Brad (1:44)

Host Steve Moore introduces our guest today, Brad Sexton, who started working at Terrible’s in Las Vegas last April.

Brad shares that before becoming a CISO, he worked at a boys and girls type club where they all shared one printer. Wanting to be able to print from different areas of the office, Brad took on the task of updating the printer to fit his office’s needs. Brad has been in IT ever since.

Next Steps (5:09)

Brad reveals the next steps of his career transition. His boss at the education center asked Brad for IT-related help. Brad was then moved into the IT department and used this moment to finish his education.

During this time, Brad could see tech from a bigger picture and eventually was designing a forklift upgrade for the theater. He started working with routers and did more and more. By the time Brad settled in Vegas, he could use his experience to manage teams successfully.

Checking The Ego (11:13)

Steve presses Brad on the lessons he learned from his first IT job. 

Brad believes that his ego got in the way of his ability to do his job. After many years, Brad finally understood what he could have done differently. Thankfully, his boss knew he had potential and was willing to have a difficult conversation that resonated with him later.

The Clues (16:30)

Brad explores the clues of a person with an ego problem. In addition, Brad explains that leaders should always create a safe space for their employees to communicate with them.

Everyone has strengths and weaknesses, and it’s helpful when leaders can help their employees identify theirs. Ultimately, there is a “fine line between confidence and arrogance,” and leaders must have the confidence to articulate challenging feedback.

The Right Motives (25:54)

Steve presses Brad on what his motives were for becoming a leader. Brad reflects that he wanted a sphere of influence and recognized that he could make more of a difference in a higher position.

Brad suggests always knowing your “why” before approaching leadership roles.

The Wrong Fit (29:53)

Brad worked in government and realized two things. He was in the wrong place, and they didn’t want them there either. Knowing there was tension from the beginning made Brad’s time in this role very challenging.

Brad learned later that this company did not want anyone in that position, but he was the most qualified. Now, Brad understands the importance of finding the right fit for a role and considers that when interviewing future colleagues.

Mutual Contact (34:58)

Brad and Steve discuss a mutual connection named David, who is an individual who helped Brad move into the casino gaming space. Brad appreciates that David took a chance on him and is still in touch.

Relationships are critical as you advance in your career because no one knows everything.

Leaving Gracefully (40:04)

Brad shares his tips on leaving a job gracefully. He suggests managing the emotion that you let someone down. 

Having an open communication line with your boss and feeling comfortable articulating your goals makes this process less challenging—the key is to cultivate that relationship before it gets to this point.

The New CISO (47:50)

To Brad, being a new CISO means understanding your staff and the challenges that they’ve had. You then must build relationships in the business.

In this episode of The New CISO, Steve is joined by guest Andrew Wilder, Adjunct Professor at Washington University in St. Louis and a multi-time CISO.

After eighteen years, Andrew left a job he loved to transition into global security. Now, he gives back to the cybersecurity community by sharing his insight as a professor and mentor. Tune into today’s episode to learn more about his IT journey, expanding your network, and company red flags.

Listen to Steve and Andrew discuss his five-step mentorship plan and essential interview guidelines for CISOs:

Meet Andrew (1:38)

Host Steve Moore introduces our guest today, Andrew Wilder, who has worked in cyber security for twenty years.

Andrew got his start in cybersecurity by working at a paper company, where he worked in marketing, sales, inventory, customer service, and more. One day the owner came to him, wanting to change their computer systems. Being the youngest in the office, Andrew was given the project, beginning his IT journey.

Eighteen Years (6:23)

Andrew reveals why he stayed at Nestle for eighteen years. Andrew loved the people and culture and even met his wife on the job.

Steve presses Andrew on why he didn’t stay longer, and Andrew reveals that he progressed as far as he could go. Wanting to move forward in his career, Andrew felt inclined to make the jump.

A Difficult Move (8:12)

Andrew shares how challenging it was to leave Nestle. Although his co-workers were shocked, Andrew knew going was right for him.

If you’re in a similar situation, you may always find something to regret, but no situation is perfect. Ultimately, you have to do what’s best for you.

Care About Your Career (11:50)

When contemplating a career transition, Andrew recommends finding a mentor. Of course, no one will care for your career for you. You will make time for something and seek the necessary resources if you care about it.

The Five-Step Plan (13:59)

Andrew shares his five-step plan for changing careers, which includes creating a development plan with your mentor and filling in the gaps in your desired skill set.

In addition, Andrew shares a helpful tip he received from Nestle, which is that 70% of your learning should be learning by doing. 20% of learning is through relationships, while 10% should be through a course or learning program.

Getting In The Room (20:00)

Steve presses Andrew on what steps CISOs should take to get in the room. Andrew recommends ensuring people know who you are and your expertise.

If people don’t know you, you’ll never be able to prove yourself. That is the value of expanding your network.

What To Ask (24:47)

If you’re offered a board-type position, it’s essential to learn about the company culture and the CEO and review any incident reports that allow you to bring your expertise to the position.

Interview Questions (28:24)

Enterprise risk management is an excellent framework to focus on during an interview. Asking questions based on prior risks will reveal much about an organization, including red flags.

Andrew also reveals other red flags to look for in an interview. If companies don’t show change or progress with security, the work culture will be less desirable for a CISO. The worst cyberculture you could join is one where they won’t admit when they’ve experienced a breach.

Business Continuity Planning (37:20)

Business continuity planning is ignored a lot in cybersecurity because it is business driven. In Andrew’s opinion, cybersecurity should be separate.

Andrew and Steve discuss other business dynamics and what should or shouldn’t be the responsibility of the CISO.

Why Teaching (41:43)

Steve presses Andrew on why he teaches. Andrew likes to think it’s to give back, but he recognizes it’s a two-way street.

Andrew teaches deputy CISOS, CIOs, and executives seeking to transition into the CISO role. He has created his own lesson plans from scratch to give security professionals the highest value in their education.

The New CISO (47:55)

To Andrew, being a new CISO means seeing cyber security as a business enabler. This mindset can include expanding your network and learning what different people in the field do.

LinkedIn

Quote: Well, I'm a strong believer that if we're not constantly learning and growing and progressing, that we will become obsolete. The skills you were using five years ago are not the ones you're using. And the same thing goes for five years from now. [00:50:30] They also talk about the jobs that our kids are gonna have don't exist today. So whenever I have people reporting to me, I dedicate 10% of their time to learning and training, and growing so that they will develop the new skills and be able to take on those n

In this episode of The New CISO, Steve is joined by guest Suid Adeyanju, CEO and Co-Founder of RiverSafe Ltd.

Although his parents dreamed of Suid becoming a lawyer or a doctor, Suid had a passion for technology. Although his path was challenging, Suid shares how he successfully transitioned from a security engineer to an entrepreneur. Tune into this week’s episode to learn more about Suid’s early career journey, the mindset differences between engineering and business leadership, and the catalyst for starting his business.

Listen to Steve and Suid discuss navigating the corporate ladder and how security professionals can become business leaders:

Meet Suid (1:39)

Host Steve Moore introduces our guest today, Suid Adeyanju, a security professional and entrepreneur. At RiverSafe Ltd., Suid’s team specializes in cyber security, data operations, and demo. 

Since childhood, Suid wanted to work in technology. Recently, he found his old yearbook from Nigeria and saw that he wanted to be a computer engineer even then. Even though that goal was unusual then, it demonstrates that Suid always wanted to be in technology.

At University (6:24)

While at university, Suid initially went for computer science and mathematics. After studying accounting for two years, his professor steered him toward business information systems. 

As much as Suid loves computers, understanding how organizations deliver their services was a better fit. 

Think About Impact (10:26)

Steve and Suid discuss how security leaders need to consider how their security work impacts the business. 

If leaders focus on making the business secure, they need to work with the business and understand the risks associated with the work.

The Transition (13:40)

Suid reflects on his transition from engineer to entrepreneur. 

As an engineer, Suid saw things in black and white. To run his business, he needed a different mindset because there is a difference between working with people versus computers.

Workplace Challenges (20:03)

Steve presses Suid on his time at Reuters. 

After two years of contracting, Suid saw that he was stuck in his role while his teammates gained more responsibility. Initially, Suid believed he needed to work harder and gain his master's in information security. Now, he understands that this mindset is common with ethnic minorities and reflects on the challenges he’s faced. 

Valuing Yourself (28:55)

Suid realized that this particular work environment did not value the additional education he had gained or the extra work he put in. Without another job lined up, Suid decided to quit.

Suid could take this risk because he had made good financial decisions, which gave him enough savings to rely on. Suid also had the proper professional skill set, preparing him to take a chance. 

Starting A Business (34:24)

Suid reveals that this time led him to start his own business. Although it’s challenging to transition from engineer to entrepreneur, Suid knew his team was talented and could show value to their customers.

The Big Break (38:14)

Suid’s company got their big break when a senior manager at a major corruption chose to work with them. This manager took a chance on them with a significant project, which set Suid up for future momentum.

Sound Advice (43:43)

For the listeners who feel that the corporate world is not for them, Suid shares his advice.

 First, take a course that teaches how to set up a business. Secondly, find a mentor who can share with you valuable insight.

The New Security Leader (47:21)

To Suid, a new leader focuses on people. One must have empathy and the mentality that leaders are meant to serve.

Links mentioned:

LinkedIn

In this episode of The New CISO, Steve is joined by guest Jeff Schilling, Global CISO for Teleperformance.

Jeff returns to discuss a pressing issue for CISOs: Insider threats. With credentialed attacks on the rise, Jeff shares his take on the “flattening” of this evolving threat. Tune into today’s episode to learn more about the ABCs of bad actors, how Covid has contributed to the problem and complex recruiting scams.

Listen to Steve and Jeff discuss which strategies are being employed to comprise employees’ credentials:

The Return Of Jeff (1:42)

Host Steve Moore introduces our returning guest today, Jeff Schilling of Teleperformance.

Steve reveals this is Jeff's third time on the podcast. Unlike other episodes, where guests discuss their career journeys, Jeff is here to share necessary research regarding insider threats.

The Problem (4:24)

Jeff explores the fundamental issue of insider threats. He reveals the different levels of the skill pyramid that threat actors can be evaluated at. 

The “A” actors become insiders to exploit specific targets, which should be considered when creating a security system.

The Flattening (12:46)

Steve presses Jeff on what he means by “flattening techniques” that have led to our current state of attacks. Jeff explains how malware software and targeted phishing scams have been used to access their mark, an issue exasperated by remote work.

Adversaries and Targets (19:54)

Jeff explains how to communicate threat issues across departments, especially when there are language barriers. The biggest challenge is making messaging as simple as possible.

Depending on the job functions of others, there are different responses and success results. This is why Jeff’s team focuses on training and additional monitoring and security control.

More Tactics (23:28)

There are many strategies that threat actors use to breach one’s security. Bad actors target companies through social media, such as Linkedin.

Threat actors also learn about their target countries and reach out to them through more region-specific platforms. Jeff then asserted that insider threats must be part of every CISO’s security plan. 

Preventative Steps (31:42)

Jeff assures us that there are things we can do to detect threats and explains those actions. Identifying the machine where phishing emails come from and implementing new technologies is key.

The Near Future (35:50)

With the evolving functions of AI, it may be easier for threat actors to be more convincing in their scams. Their messaging is getting more believable, which is why Jeff believes they are taking advantage of new technologies, despite there being safeguards.

However, Jeff is not convinced that certain aspects of AI, like voice mimicking, will get more sophisticated. 

The New CISO (39:42)

To Jeff, being a new CISO is constantly learning and having your finger on the pulse. If you think you know everything, it is likely you do not.

Links mentioned:

LinkedIn

Quote:

“I used to say multifactor authentication at the edge was a big barrier for the threat actor to get over. That's no longer, I can't say that anymore. It's more like a small fence. And now, you got to look at how do you manage your privileges and how do you conduct IT operations inside of your wire, and how would a threat do it if they were an insider? And then what controls do you have to be able to detect that activity because they're going to be using IT tools, and they're going to look like they're coming in with a legitimate account.”

In this episode of The New CISO, Steve is joined by guest Chris Nolke, multi-time CISO, and founder of Skycrane.

Chris had decades of cybersecurity experience before starting his own company. As a neurodivergent leader and life-long learner, Chris navigates the workplace with self-reflection and candor. Tune into today’s episode to learn more about Chris’ professional journey, his human approach to leadership, and his definition of happiness.

Listen to Steve and Chris discuss the values that drive career decisions and how vulnerability can serve or harm you in the workplace:

Meet Chris (1:41)

Host Steve Moore introduces our guest today, Chris Nolke, the founder of Skycrane.

Chris first started his cybersecurity journey while studying electrical engineering in college. From there, he got a job as an engineer, which eventually led him to his current path. As a life-longer learner, Chris followed the most interesting path to him: cyber security.

Defining The Interesting Path (8:36)

Chris wishes he had done a “values” exercise earlier in his career to determine his professional wants. He advises other people joining the workforce to consider a process where they discover what they believe in.

When you understand your values, you can make more straightforward choices toward your career.

Evaluating Jobs (10:59)

Chris admits that every job he’s taken has been different than he initially believed. In those circumstances, it’s essential to determine your desire to stay in that position or pivot.

Personal Characteristics (14:40)

Steve presses Chris on what three bullet points his colleagues would list for him. Chris states that vulnerability, being a conversationalist, and expertise have become his brand in the workplace, which has made him successful.

Going Further By Saying Less (25:16)

Chris shares that many people who practice impulsive communication use that as a means of connection. Reflecting on this, Chris acknowledges the difference between impact and attention.

After trial and error, Chris learned he would go further in his career if he said less.

Sound Advice  (30:31)

For leaders, Chris shares that neurodiversity is a superpower. If you can harness the pattern-recognizing skills of neurodivergent employees, you can build an incredible security team.

To understand how to use this superpower, Chris recommends leaders have mindful conversations with their employees. People need to learn what they’re good at to get ahead.

The Subject of Happiness (40:06)

As a CISO, Chris is fascinated by the construct of happiness and what comes with it. Happiness is made up of joy but also contentment. Balancing between the two is the key to understanding and taking advantage of this construct.

Chris recommends that every CISO creates a “happiness” process to avoid burnout, though burnout led Chris to start his own business.

The New CISO (49:10)

To Chris, being a new CISO is about creating a system of business relevance. You can improve your job when you understand the business's daily needs.

Links mentioned:

LinkedIn

In this episode of The New CISO, Steve is joined by guest Peter Frochtenicht, National Manager for Security and Compliance and CISO at NEC Australia.

A technician by nature, Peter has decades of experience across multiple countries. Today, he joins the podcast to discuss the complexities of AI and the benefits of time-saving tools. Tune into today’s episode to learn more about Peter’s technical journey, the most common security threats, and his advice for new CISOs.

Listen to Steve and Peter discuss why automation is a critical component of security tools and how the threat landscape has changed globally:

Meet Peter (1:36)

Host Steve Moore introduces our guest today, Peter Frochtenicht, who has worked at NEC for nine years.

Before NEC, Peter started his career as a systems engineer twenty years ago. Peter has worked in Africa and Australia and has worked his way up through different organizations.

Catching Up (5:21)

Ten years ago, the CISO role in Australia would be rare. Steve presses Peter as to why.

Since the Australian population is smaller than the states with fewer big-name organizations, it took Australia longer to catch up in the security industry.

Australia’s Biggest Threats (9:37)

From a defense perspective, Australia is doing much business with the states, especially with submarines. From a threat perspective, they border China and some of the eastern countries, which makes a security threat from those countries more imminent.

Increased Attacks (13:17)

The most typical security attack that Peter witnesses is phishing, which affects organizations and citizens. According to Peter, it is human nature to be curious about and click on an email link. For outside threats, financial benefits and access to information are to be gained.

AI has also advanced quickly, which can contribute to increased threats since you can mimic someone's voice. Organizations should be prepared to use AI for good but also be prepared for when there are more insidious reasons for using this new technology.

The Benefits of AI (18:05)

Steve presses Peter on what defense benefits he predicts will come from AI.

Peter shares the automation tools his team uses that help reduce his analysts' headcount and save time. Chat GPT may help you personally, but Peter believes in partnering with known vendors that can help limit human error.

What To Look For  (21:11)

Peter shares what CISOs should or should not look for when choosing AI tools. Analytic tools are standard and can save much time and effort. As a result, organizations can save money and trust that there will be an increase in accuracy.

If tools can help CISOs detect abnormalities with less effort, that would be of service. Of course, abnormal actions may not be malicious but could be a mistake by a well-meaning person. 

Investing In Employees (28:32)

Peter believes in training his people to bring the best out of them. People don’t always have the right skills at the right time, but you build a strong team when you invest in your employees and their relationship with your vendors. 

Adding Skillsets (31:05)

Steve asks Peter what skillsets he had to add, besides technical abilities, to perform his role. Peter discusses his career journey, including his transition into leadership.

Peter had to gain a governance mindset and consider policies and when to update said policies. It’s challenging to ask for money to pursue your endeavors, but if you have a budget, you must spend it.

Sound Advice (38:56)

Looking up back at his career, Peter wouldn’t change much. But Peter recommends getting training and certifications to keep yourself up to date. You don’t need to wait for your company to suggest it to take on a new challenge.

The New CISO (42:41)

To Peter, being a new CISO means supporting the business and business structure. The biggest challenge for a CISO is adapting fast to new security changes while asking for money as needed.

Links mentioned:

LinkedIn

In this episode of The New CISO, Steve is joined by guest Michael Meis, Associate CISO of the University of Kansas Health System.

Beginning his career in the U.S. Army Signal Corp, Michael eventually transitioned into government consulting and the private sector. Today, he shares his philosophies on leadership and ownership in the cybersecurity field. Listen to the episode to learn more about his extensive technology background, the importance of inter-department friendships, and how he helps fellow service members make their professional transitions.

Listen to Steve and Adam discuss how to navigate bureaucracy and adapt to corporate environments:

Meet Michael (1:41)

Host Steve Moore introduces our guest today, Michael Meis. Michael has been in IT and security for fifteen years and healthcare for two years. Michael met Steve a year ago during a security conference, leading to their connecting around the industry and their philosophies on leadership.

Michael also reflects on his role in the military, which began with him working with radios and evolved into performing general technology support.

Getting His Start (6:09)

Michael was always interested in computers but initially never saw it as a career. He decided to join the military instead. However, his military recruiter encouraged him to take a tech-related job, and his security journey began. 

This first army signal corps job was less computer-heavy than expected, but Michael still learned a lot.

Dealing With Corporate Politics (9:07)

For ten years, Michael worked as a government consultant. This experience taught Michael to navigate complex bureaucratic dynamics to get past red tape.

Michael highlights the importance of having solid relationships in different departments to get things done. You can determine which workplace rules to bend when you understand how things are and how your organization operates. 

Finding a Path (14:01)

Michael expands on the importance of relationships in a corporate setting. You can leverage those relationships when needed to promote your department’s agendas.

The more you understand your organization’s rules and politics, the less friction you will face, and the more you can build a trusted security culture. 

Government Challenges (22:44)

Steve presses Michael on his quote, “Governance is important, but alone won’t solve all of your problems.”

Anyone who has worked in government understands that there are always challenges within its IT environments. Since the government has total control over its IT, Michael learned early on that more than governance is needed to perfect these systems. Collaboration is needed between parties.

Excuses, Excuses (28:13)

Michael shares the security community’s common excuses that tend to irk him. 

Budget professionals can be challenging to work with from a leadership perspective. He also gets frustrated when people use a lack of training as a reason not to try something. Michael values training, but he understands that sometimes you have to take action before that formal training comes.

Behavioral Norms (33:50)

Michael explores the behavioral norms that came out of his military service.

Learning how to function in a corporate environment is essential for people to know when leaving the military. The benefits of this experience were the rigor and structure, which can provide direction in life. On the flip side, it can be challenging to transition from that structure because you can grow dependent on it.

Helping Others (39:07)

As a leader, Michael tries to help other service members remove their need for a manual when making corporate transitions. That way, they can learn to embrace their creativity, benefiting their long-term careers.

Ultimately, Michael aims to empower his teams and shift their professional mindsets.

The New CISO (47:27)

To Michael, being a new CISO means recognizing that they are not just security practitioners but business executives. The more security evolves as an industry, the more CISOs can adapt to these modern changes.

Links mentioned:

LinkedIn

In this episode of The New CISO, Steve is joined by guest Adam Currie, CSO at HCL Software.

Adam started his career 27 years ago, working the night shift as a main frame operator before working his way up in the security world. Today, he shares how he builds trust within his team, company, and himself. Listen to the episode to learn more about his expansive career journey, when to encourage your team, and dealing with imposter syndrome.

Listen to Steve and Adam discuss the right time to challenge yourself and when leaders should foster an environment where it is safe to fail:

Meet Adam (1:38)

Host Steve Moore introduces our guest today, Adam Currie.

Adam was first the head of security operations and architecture at HCL before transitioning into the CSO role. When Adam joined HCL, he brought his breadth of technical knowledge and understanding of how their user base consumed their tools. In this business, it's essential to understand how these programs are used while ensuring they are secure, a mentality that helped Adam move into the CSO position.

The Main Framer (4:41)

Steve asks Adam about his experience on the main frame.

When Adam was a student, he worked as a tape librarian. This after-school job led to him taking classes and learning about mainframe operations and basic coding language. 

Desktop Support (8:26)

Adam believes that having a desktop support background benefits security professionals because it provides an understanding of how end users operate. Communicating with this community with empathy adds significant value to any security team.

Unexpected Steps: CISO to Soc to CISO (12:38)

Adam did end-user support work at Bloomberg before moving into backend enterprise applications. Then he was asked to run Bloomberg's tier one and tier two service desks, a type of work Adam did not plan on returning to. However, this opportunity offered Adam his first management role, and he credits this position as getting him to where he is today.

Building Trust With Your Team  (20:05)

Upon reflecting on his job journey at Bloomberg, Adam shares why people seek new opportunities.

When people leave positions or accept roles, it is for job growth. Most people want to consider how a job will help their families and goals before making a career transition. Adam would rather help his team explore their options than subdue it–though no one wants to lose valuable employees. He wants his team to trust him enough to be honest with him about when they want to make a change.

A Challenge (25:21)

For Adam, it is always a struggle to stay out of the weeds of the tech side of the business. He gravitates toward technology but understands that that is different from his role now. 

For leaders, it is more important to nurture an environment where employees are safe to fail because that is how people learn and grow. You shouldn't be reckless, but being inactive is more risky.

Owning Failure (29:02)

Steve presses Adam on how far he will go to own his team's failures. Adam thinks it is his job to communicate with senior management and shield his team from scrutiny.

No matter what, we must be honest about what we can do to improve and have productive, unemotional conversations.

Building a Brand (36:13)

Building a brand comes with trial and error but is critical to success. Often this comes with changing the perception that security is a necessary evil. Demonstrating that security is a value-add partnership that leaders actively want to engage in is essential.

Putting Yourself Out There (47:54)

Though Adam is not a fan of public speaking, he believes in pushing himself past his comfort zone. Although he has experienced imposter syndrome about his experience, he is putting himself out there as a  podcast guest today to share his career journey.

The New CISO (54:23)

To Adam, a new CISO establishes a strong team and establishes trust within the business and with your peers. Trust is necessary to claim success.

Links mentioned:

LinkedIn

Bio:

A proprietor of service excellence and incubator of change, operating at the intersection of people, processes, and technology with 26 years' experience successfully partnering with business leaders to build strategies aligning to corporate and client needs, resulting in realization of value-add with a holistic approach to business, technology, and security.

In this episode of The New CISO, Steve is joined by guest Mike Kelley, CISO of the E.W. Scripps Company.

Mike worked as an auditor before eventually jumping into cyber security. Reflecting on his past, Mike shares how balancing ambition with transparency is critical to success. Listen to the episode to learn more about Mike’s auditing experience, falling into cyber security, and his advice for CISOs when interviewing.

Listen to Steve and Mike discuss how leaders should assist their team with career development and why “fake it until you make it” makes for bad career advice:

Meet Mike (1:44)

Host Steve Moore introduces our guest today, Mike Kelley.

Mike shares his role in the enterprise and consumer-based security field and how his duties differ from those in an internal security environment. Although he would say that consumer-based security is not clearly defined, his goal is to keep all things related to the consumer secure, in addition to the typical CISO goals.

His Start (3:36)

Before working at E.W. Scripps, Mike worked at KPMG, one of the big four firms. There, Mike performed external audits but also did some compliance consulting as well.

Although no one wanted an auditor there, especially to answer his questions, Mike had to work on building a rapport with people in difficult situations. Through this role, Mike was exposed to numerous companies, allowing him to learn constantly. He may not have wanted to start in audits if he could do it all again, but this experience prepared him for his cyber security career.

Adapting With Transparency (9:02)

Mike has become comfortable with being uncomfortable and transparent when he doesn’t know something. When he got his CISO job, he told HR that this position was new to him and that he had a lot to learn. 

Being confident enough to say “I don’t know” is Mike’s mental motto because he knows he can adapt to new challenges. Ultimately anything is learnable as long as you push yourself, a mentality he encourages in his team.

The Burn the Boats Method (17:42)

After reflecting on his career decisions, including telling a company to fire him if he didn’t succeed as a director, Steve presses Mike on how he would react to someone sharing this approach.

If one of Mike’s employees wanted to try a position out and see what happens, Mike would like to ease them into that role. He would let them transition through responsibilities first before changing that person’s title. Ultimately, trying and failing is okay, but Mike wants his team to fail soft versus hard.

Falling Into Cyber Security (21:42)

After looking for cyber security jobs for three years, Mike eased into this field through a position in compliance. Working side-by-side with security professionals, Mike was able to dip his toes.

After lunch with his manager, he was offered the CISO role, and Mike immediately said yes. Mike admitted he didn’t know what he was doing but was encouraged to take this job.

Rolling With It (25:01)

Steve asks Mike if he ever wishes he said no when offered the CISO job. Mike knew this was the field he wanted to pursue, and he felt comfortable being transparent about his experience.

Interview Questions (31:18)

If you are a new CISO wanting to ask good questions in an interview, Mike suggests asking the purpose of that role at that company. Another helpful question concerns the company’s approach to trying new things and handling challenges.

The Definition of Success (34:13)

When evaluating a company during an interview, it’s essential to find out what that company’s definition of success is. Mike defines success as being aligned with the business that employs you and being seen beyond the security status.

The Important People (36:50)

If you don’t know where to start when beginning a new position, Mike suggests finding out who has influence in the organization and who delivers results.

Once you know who those people are, you can nurture those relationships and get their input about the initiatives you want to implement. 

Bad Advice (42:21)

The worst advice Mike received was “fake until you make it.” Although that approach may have good intentions, it is better to be transparent about your abilities. 

A quick way to imposter syndrome is to fake it. When you have humility, more people are inspired to help you toward your career goals.

The New CISO (44:04)

To Mike, a new CISO is having input in your organization’s strategic direction and getting an opportunity to take that to the next level. Having a leadership position is how he defines a successful CISO.

Links mentioned:

LinkedIn