The Security Collective Podcast

In the age of modern technology when we are all available all of the time, burn out is becoming more common. Cybersecurity, a notoriously 'on-call' industry, is a prime example where working long hours can take its toll on our mental and physical health. But what can we do to address it, before it gets out of hand? My guest this week is Graeme Cowan. As a mental health and resilience author and speaker, and Board Director of R U OK?, Graeme spends his professional life helping people understand just that. Graeme uses his first-hand experience after coming through an experience of extreme burn out to help others appreciate and understand the importance of looking out for themselves, as well as looking out for the people around them. In this episode, Graeme talks us through his personal experience of burnout, and his evolution out of that period of his life. Crossing paths with Gavin Larkin resulted in the launch of R U OK? Day in 2009, and Graeme shares how its simplicity helped it to grow. We cover a whole range of topics on how to consider and address issues that can lead to burnout, an issue that we know is prevalent in the cybersecurity industry. My goal for my discussion with Graeme was to give you the knowledge to build safe, resilient, and healthy security teams and leaders, but this episode goes so much further than that. It is PACKED full of information, resources and simple, actionable ideas that you can use today immediately to check in not only with your team, but also with yourself. Enjoy!

Links:

• Graeme's Website
• LinkedIn
• Twitter
• Back From The Brink
• R U OK?
• TED Talk on the Harvard Study of Adult Development
• Self-Care Snapshot Checklist
• Project Aristotle results
• Debunking Maslow's Hierarchy of Needs
• Peter Gollwitzer

Time Stamps:

• 00:30 - Graeme's introduction and background
• 01:46 - Graeme's story
• 03.10 - The origin of RuOK
• 06:12 - The impact of stress and long working hours
• 07:01 - "I don't really believe so much in the concept of work-life balance, because that assumes that work is bad, life is good. And if you believe in your work, work can be very good for you. Lots of evidence around shows that work is essential to our wellbeing. But having said that, we also have to make sure there is time in our day, in our week, for the things that really help us." - Graeme Cowan
• 07:38 - Three areas that we need to regularly top-up
• 08:02 - Harvard Study of Adult Development
• 09:04 - How to wind down and disconnect when working in an on-call role
• 14:36 - The role of mindset on burnout, and the benefits of self-care
• 20:28 - Creating a safe space to empower your staff to call out when their resilience is being tested
• 21:13 - "From a leader's perspective, I really recommend that if they want to have a high performing team, they need to be continually asking themselves these three questions; Are we connected? Do we feel safe? and Do we have a shared future?" – Graeme Cowan
• 26:14 - Key advice for building safe, resilient, and healthy security teams and leaders

Welcome to Season 4 of The Secure CIO Podcast!

Over the past three seasons of the podcast, there has been a strong focus on interviewing security leaders, which has resulted in some really interesting and informative discussions. This season I'm doing things a little bit differently.

In Season 4 you are going to hear from a few people outside technology as we look at leadership and the role HR and people/culture leaders play in the recruitment process and the building of teams.

Topics include working remotely, STEM leaders on boards, and burnout in the security industry. Some of the themes that run throughout this season include trust, reflection, and leadership.

To kick off this season, the guest on episode one is...me!

Join me for my first solo episode, as I run through some of the lessons I have learned through a number of years consulting, as well as a career in security, and share the 7 mistakes that CIO's are making when hiring a cybersecurity leader.

Links

• LinkedIn
• The Secure CIO
• Free Excerpt from 'The Secure CIO'
• Buy your copy of 'The Secure CIO'

Time Stamps

• 00:26 - Introduction to Season 4
• 00:52 - Introduction to this episode
• 00:52 - "What I have noticed about security hiring and retention is that there are many CIO's out there who are making decisions early in the hiring process that could be preventing making the right decisions at the end of the hiring process, or even preventing them from finding the right candidate to begin with." Claire Pales
• 02:00 - The role of the CIO
• 02:45 - Mistake #1; The reason for hiring doesn't set the CIO up for success
• 04:17 - Mistake #2; You use the same job description you used last time
• 05:42 - Mistake #3; The job description is written as a wish list of actions
• 05:50 - "If the job description is laid out as a wish list of actions, this can mean that after the CISO delivers these items, it's unknown what their remit should be." Claire Pales
• 06:17 - Mistake #4; Looking for someone that can do it all
• 07:40 - "Seeking a security leader who can do it all will delay your hiring and possibly leave your security seat empty which only leads to increased risk." Claire Pales
• 07:49 - Mistake #5; Viewing internal promotion as a 'quick win'
• 08:39 - Mistake #6; Leader not nurtured or developed adequately
• 09:33 - Mistake #7; Viewing hiring a leader through a 'set and forget' lens

Join host Claire Pales, as she shares some exciting details about the upcoming Season 4 of The Secure CIO Podcast, with the first episode due for release on Thursday 18th June!

www.thesecurecio.com

Fred Thiele is an information security and technology executive with a diverse, global background in large corporate environments, mid-sized consulting businesses, and small startups. Fred discovered the field of cybersecurity in 1998 while repairing Wyse Terminals and maintaining Linux servers at his university library. Currently, he is the Group CISO at Transport for NSW.

In this episode, Fred will share strategies for building and growing strong cybersecurity teams across the USA and Australia. Find out the barriers to cybersecurity success and how to overcome them.

Links:

• LinkedIn
• The Johari Window

Time Stamps:

• 00:27 - Fred Thiele's background and introduction
• 07:13 - The best reporting structure for the CISO or head of security
• 07:27 - "Just because you report to the CEO doesn't necessarily mean you have a seat at the table." - Fred Thiele
• 08:38 - Building teams & hiring cybersecurity professionals across the USA vs. Australia
• 11:40 - Choosing graduates to join your team
• 14:37 - Principle to follow when building your new security team
• 18:10 - Overcoming hurdles in all organisations
• 21:01 - Best advice aspiring security team leaders
• 23:23 - "In a leadership position you're much more influential than you think you are. You're setting culture by just walking around the office." - Fred Thiele

Niamh Fitzpatrick is the co-founder of Puffling, a platform that provides tangible solutions for a more productive, engaged, and inclusive workforce.

Niamh has over 20 years experience in product and technology across a range of industries. In 2016 Niamh joined Facebook in an Asia Pacific role, leading a team of senior managers responsible for driving business opportunities and growth with technology and creative partners across the region. She has been a long-standing advocate for increasing the number of women in senior leadership roles and those choosing to work flexibly for a variety of life stage decisions or personal circumstances.

In this episode, Niamh shares how companies can successfully adopt flexible working practices. Hear about the benefits of embracing progressive and flexible work solutions. Learn why it is more important than ever for organisations to adapt their work practices. Discover how to attract and retain senior talent by offering flexible working options within your organisation.

Links:

• Facebook - Puffling
• LinkedIn - Puffling
• Puffling Website
• Puffling Tech Website

Time Stamps:

• 00:32 - Niamh Fitzpatrick's background and introduction
• 03:37 - Differentiating Puffling and Puffling Tech
• 05:18 - Embracing flexible working roles
• 06:58 - "Flexibility has become increasingly important and a real driver when it comes to moving roles." - Niamh Fitzpatrick
• 07:27 - Top factors that cause job-sharing arrangements to the unsuccessful
• 09:17 - Communicating a job share arrangements for success
• 10:25 - Roles that are better suited for job share arrangement
• 11:18 - What motivates people to change jobs?
• 14:25 - How to attract flexible candidates to your team
• 15:29 - "What works for someone in terms of flex might be quite different for someone else. It's not a one size fits all is really important for the business." - Niamh Fitzpatrick
• 16:03 - Learning more about Puffling and Puffling Tech

Angela Coble is an executive leader, board member, and internationally published author, with experience in healthcare, utilities, finance, and agriculture.

Angela has more than 20 years of leadership experience including executive positions within the Healthcare industry in Security and Technology and Electricity Supply industry, including Group Manager Business Planning Infrastructure Operations for NSW. In 2019 Ange was announced as #18 in Australia's Top 50 CIO's – the second time she has made this illustrious list.

In this episode, Angela will share how to build and lead a high-performing security team as a remote leader. Find out the role that diversity, inclusion, and culture play in the workplace. Learn the best advice for aspiring leaders to excel and succeed in all parts of technology, even beyond security.

Links:

• LinkedIn

Time Stamps:

• 00:31 - Angela Coble's introduction and background
• 04:17 - "Leadership is interoperable. It's more about the people that are around you." - Angela Coble
• 04:34 - How a security background shaped Angela in her tech leadership role
• 06:20 - Interacting with security teams and leading organisations to success
• 10:18 - Building security teams as a remote working leader
• 15:29 - Ways to successfully work remotely?
• 17:07 - "For people to be successful who work remotely they often have to be hyper-aware of over-communicating." - Angela Coble
• 18:40 - Defining diversity and inclusion in the workplace
• 22:59 - The best advice for aspiring CIOs

Brett King is a lover of all things technology that make our work and social lives more rewarding. He is the Managing Director of two technology businesses that share similar customer objectives of implementing solutions that increase organisational efficiency and effectiveness whilst indentifying and implementing governance and risk management.

During this episode, Brett shares the benefits of integrating security technologies into your organisation. He will explain the three main strategies that organisations with limited budget, resources and knowledge can employ to manage cyber risk. Listen as we discuss managing your risk as a consultant, change management, and the challenges facing regional organisations. Hear about the power of hiring independent contractors and the difficulties building internal teams.

Link:

• LinkedIn
• Unified Technology

Time Stamps:

• 01:00 - Brett King's introduction and background
• 06:08 - Discovering security landscape and needs of security CIO's
• 07:47 - "I see it as a very professional thing to do to understand your risks and manage those risks without addressing them." - Brett King
• 10:05 - The benefits of Integrating an element of security in the tech space
• 12:14 - Addressing customers with cyber risk and a limited budget
• 14:30 - "Organisations need to understand what assets they're trying to protect and what the value of those assets are, and what they're trying to protect those assets from." - Brett King
• 17:44 - Hiring internal employees vs independent contractors
• 18:33 - "To have the appropriately trained internal people and to be able to afford them and retain them is a significant barrier to building internal teams." - Brett King
• 20:28 - Security in regional Victoria vs. capital cities
• 22:06 - Best advice for aspiring CIO's

The Secure CIO Podcast has been downloaded over 5,000 times!

Over the first two seasons of The Secure CIO Podcast we heard from 21 industry experts, discussing a range of issues currently affecting the cybersecurity industry.

We are now over halfway through another amazing season, and I am looking forward to recording season four.

I am excited to share with you that after just 25 episodes The Secure CIO Podcast has been downloaded over 5,200 times.

To celebrate, I wanted to share this episode with you. It features conversations from the top five most downloaded episodes so far. Hear from Jonathan Werrett, Nick Ellsmore, Anna Leibel, Craig Searle, and Dan Maslin as we discuss all things cybersecurity.

Links:

• Episode 1: Security In Context with Jonathan Werrett
• Episode 3: Security Sourcing: Cracking the Code with Craig Searle
• Episode 12: The Cybersecurity 'Roles' Crisis with Nick Ellsmore
• Episode 14: From Security Architecture to Security Leadership with Dan Maslin
• Episode 21: Anna Leibel, CIO, UniSuper
• The Secure CIO Podcast LIVE! with Anna Leibel (video recording)

Time Stamps:

• 01:28 - Jonathan Werret on finding a leader that can do it all
• 02:52 - "Rather than looking for a unicorn, have an idea of what you think the biggest risks are, and what you the most important skills will be in that person and start to optimise for that." - Jonathan Werrett
• 03:10 - Nick Ellsmore on the impact of how the first leader in the organisation can shape the perception about security, and if there is an ultimate path to security leadership.
• 05:00 - "Security knowledge alone isn't often what's going to get the job done. My overall advice would be to find someone pragmatic and someone that can build relationships." - Nick Ellsmore
• 09:47 - Anna Leibel on how information security is impacting the board
• 10:42 - "Two and a half years ago we would talk about how much money do I have to spend to spend to be safe, and now we are talking about are we prepared for when we are breached." - Anna Leibel
• 14.29 - Craig Searle's tips on how they source great people to work at Hivint
• 16:40 - "One of our big beliefs is that good people attract more good people, and in fact what ended up happening was that ... people wanted to work with other team members in our team. That then attracted more people. It does get easier to recruit on that basis." - Craig Searle
• 17:35 - Dan Maslin on insourcing and outsourcing
• 22:59 - "Sometimes the organisation is not the right fit, or it is not the right time for certain people within that organisation. I would say that is ok, and that does happen, and you need to have that conversation pretty quickly." - Dan Maslin

Graham Thomson is an independent consultant specialising in cybersecurity and information risk. With many years as a leader in cybersecurity providing advice to boards, senior executives and technical and operational teams, he has a unique breadth and depth of skill and experience in the industry.

During this episode, Graham shares his evolution into becoming a security leader, including the techniques and challenges in building a security team. He reveals useful techniques and strategies on how to retain long-term employees for your organisation. This episode delivers practical advice on how to ensure you are recruiting the right candidates for long-term success within your organisation.

Link:

• Graham Thomson | LinkedIn
• Blog - Is it time to rethink your interview process?

Time Stamps:

• 01:02 – Graham Thomson's introduction and background
• 01:56 – His evolution to becoming a security leader
• 04:00 – How does consultancy fit in security teams?
• 6:35 - Building a cohesive and effective team for the Commonwealth Games
• 7.29 - "Failure was not an option. The fact that it had to be successful meant that individuals brought a willingness-to-help frame of mind." - Graham Thomson
• 10:30 – Hiring your first security team employee
• 13:16 – Challenges in building a security team
• 13:54 – An technique to use when interviewing a potential employee
• 16:30 – What encourages Graham to work long-term with an organization
• 18:00 – "Retention within a security team is very much a challenge for security leaders." - Graham Thomson
• 18:13 – Ways to inspire your team to stay long term in an organisation
• 19:19 – "Cybersecurity is a great challenging area where you could actually enjoy what you're doing" - Graham Thomson
• 19:26 – Key lessons in building your security team
• 20:54 - What advice would you give your 20-year-old self about teams and leadership?

Dr. Jodie Siganto is one of Australia's leading privacy experts, sought by government departments, international corporations, and Australian businesses to advise on privacy and data security-related matters.

Over her career, she has held in-house counsel roles for Tandem Computers, Unisys Asia and Dell. She also co-founded data security firm, Bridge Point Communications, which was sold to Telstra in 2014, and held leadership roles with industry groups including AISA. Jodie has been involved with a range of privacy and security industry groups, including as Chair of the AISA Policy Committee and AISA Education Director.

During the course of attaining her doctorate, Jodie coordinated extensive research into privacy in Australia. In this episode, Jodie will share the important links between information security and privacy, and the significance of being able to protect individuals. Expect to gain insight into a statistical analysis of the privacy skills shortage based on the results of her research. Hear the issues hindering privacy from a resourcing and recruiting perspective, and how they compare to similar issues facing the cybersecurity industry.

Links:

• Itsecuritytraining.com.au
• LinkedIn
• Privacy 108

Time Stamps:

• 00:28 - Dr. Jodie Siganto's introduction and background
• 05:58 - What draws others into the cyber security industry
• 08:30 - A statistical interpretation to the cyber security skills shortage
• 11:18 - "Some of the traditional indicators of a skills shortage weren't present when we were looking at the data." - Dr. Jodie Siganto
• 14:00 - The importance of streamlining and standardising roles against the job titles
• 17:29 - Insight into privacy from a resourcing and recruiting perspective
• 21:50 - "The absence of [information security] now at a societal level would be enormously harmful." - Dr. Jodie Siganto
• 22:00 - Is there an obvious privacy skills crisis?
• 24:43 - Upskill your staff with proper fundamentals