The New CISO

Latest Episodes:

The Power of Automation: Which Tools Can Help Your Security Team? Jun 01, 2023

Show notes

In this episode of The New CISO, Steve is joined by guest Peter Frochtenicht, National Manager for Security and Compliance and CISO at NEC Australia.

A technician by nature, Peter has decades of experience across multiple countries. Today, he joins the podcast to discuss the complexities of AI and the benefits of time-saving tools. Tune into today’s episode to learn more about Peter’s technical journey, the most common security threats, and his advice for new CISOs.

Listen to Steve and Peter discuss why automation is a critical component of security tools and how the threat landscape has changed globally:

Meet Peter (1:36)

Host Steve Moore introduces our guest today, Peter Frochtenicht, who has worked at NEC for nine years.

Before NEC, Peter started his career as a systems engineer twenty years ago. Peter has worked in Africa and Australia and has worked his way up through different organizations.

Catching Up (5:21)

Ten years ago, the CISO role in Australia would be rare. Steve presses Peter as to why.

Since the Australian population is smaller than the states with fewer big-name organizations, it took Australia longer to catch up in the security industry.

Australia’s Biggest Threats (9:37)

From a defense perspective, Australia is doing much business with the states, especially with submarines. From a threat perspective, they border China and some of the eastern countries, which makes a security threat from those countries more imminent.

Increased Attacks (13:17)

The most typical security attack that Peter witnesses is phishing, which affects organizations and citizens. According to Peter, it is human nature to be curious about and click on an email link. For outside threats, financial benefits and access to information are to be gained.

AI has also advanced quickly, which can contribute to increased threats since you can mimic someone's voice. Organizations should be prepared to use AI for good but also be prepared for when there are more insidious reasons for using this new technology.

The Benefits of AI (18:05)

Steve presses Peter on what defense benefits he predicts will come from AI.

Peter shares the automation tools his team uses that help reduce his analysts' headcount and save time. Chat GPT may help you personally, but Peter believes in partnering with known vendors that can help limit human error.

What To Look For (21:11)

Peter shares what CISOs should or should not look for when choosing AI tools. Analytic tools are standard and can save much time and effort. As a result, organizations can save money and trust that there will be an increase in accuracy.

If tools can help CISOs detect abnormalities with less effort, that would be of service. Of course, abnormal actions may not be malicious but could be a mistake by a well-meaning person.

Investing In Employees (28:32)

Peter believes in training his people to bring the best out of them. People don’t always have the right skills at the right time, but you build a strong team when you invest in your employees and their relationship with your vendors.

Adding Skillsets (31:05)

Steve asks Peter what skillsets he had to add, besides technical abilities, to perform his role. Peter discusses his career journey, including his transition into leadership.

Peter had to gain a governance mindset and consider policies and when to update said policies. It’s challenging to ask for money to pursue your endeavors, but if you have a budget, you must spend it.

Sound Advice (38:56)

Looking up back at his career, Peter wouldn’t change much. But Peter recommends getting training and certifications to keep yourself up to date. You don’t need to wait for your company to suggest it to take on a new challenge.

The New CISO (42:41)

To Peter, being a new CISO means supporting the business and business structure. The biggest challenge for a CISO is adapting fast to new security changes while asking for money as needed.

Links mentioned:

Taking Extreme Ownership: How 3 Common Excuses Hurt Security Leaders May 18, 2023

Show notes

In this episode of The New CISO, Steve is joined by guest Michael Meis, Associate CISO of the University of Kansas Health System.

Beginning his career in the U.S. Army Signal Corp, Michael eventually transitioned into government consulting and the private sector. Today, he shares his philosophies on leadership and ownership in the cybersecurity field. Listen to the episode to learn more about his extensive technology background, the importance of inter-department friendships, and how he helps fellow service members make their professional transitions.

Listen to Steve and Adam discuss how to navigate bureaucracy and adapt to corporate environments:

Meet Michael (1:41)

Host Steve Moore introduces our guest today, Michael Meis. Michael has been in IT and security for fifteen years and healthcare for two years. Michael met Steve a year ago during a security conference, leading to their connecting around the industry and their philosophies on leadership.

Michael also reflects on his role in the military, which began with him working with radios and evolved into performing general technology support.

Getting His Start (6:09)

Michael was always interested in computers but initially never saw it as a career. He decided to join the military instead. However, his military recruiter encouraged him to take a tech-related job, and his security journey began.

This first army signal corps job was less computer-heavy than expected, but Michael still learned a lot.

Dealing With Corporate Politics (9:07)

For ten years, Michael worked as a government consultant. This experience taught Michael to navigate complex bureaucratic dynamics to get past red tape.

Michael highlights the importance of having solid relationships in different departments to get things done. You can determine which workplace rules to bend when you understand how things are and how your organization operates.

Finding a Path (14:01)

Michael expands on the importance of relationships in a corporate setting. You can leverage those relationships when needed to promote your department’s agendas.

The more you understand your organization’s rules and politics, the less friction you will face, and the more you can build a trusted security culture.

Government Challenges (22:44)

Steve presses Michael on his quote, “Governance is important, but alone won’t solve all of your problems.”

Anyone who has worked in government understands that there are always challenges within its IT environments. Since the government has total control over its IT, Michael learned early on that more than governance is needed to perfect these systems. Collaboration is needed between parties.

Excuses, Excuses (28:13)

Michael shares the security community’s common excuses that tend to irk him.

Budget professionals can be challenging to work with from a leadership perspective. He also gets frustrated when people use a lack of training as a reason not to try something. Michael values training, but he understands that sometimes you have to take action before that formal training comes.

Behavioral Norms (33:50)

Michael explores the behavioral norms that came out of his military service.

Learning how to function in a corporate environment is essential for people to know when leaving the military. The benefits of this experience were the rigor and structure, which can provide direction in life. On the flip side, it can be challenging to transition from that structure because you can grow dependent on it.

Helping Others (39:07)

As a leader, Michael tries to help other service members remove their need for a manual when making corporate transitions. That way, they can learn to embrace their creativity, benefiting their long-term careers.

Ultimately, Michael aims to empower his teams and shift their professional mindsets.

The New CISO (47:27)

To Michael, being a new CISO means recognizing that they are not just security practitioners but business executives. The more security evolves as an industry, the more CISOs can adapt to these modern changes.

Links mentioned:

How To Build Trust Within Your Team, Your Business, and Yourself May 04, 2023

Show notes

In this episode of The New CISO, Steve is joined by guest Adam Currie, CSO at HCL Software.

Adam started his career 27 years ago, working the night shift as a main frame operator before working his way up in the security world. Today, he shares how he builds trust within his team, company, and himself. Listen to the episode to learn more about his expansive career journey, when to encourage your team, and dealing with imposter syndrome.

Listen to Steve and Adam discuss the right time to challenge yourself and when leaders should foster an environment where it is safe to fail:

Meet Adam (1:38)

Host Steve Moore introduces our guest today, Adam Currie.

Adam was first the head of security operations and architecture at HCL before transitioning into the CSO role. When Adam joined HCL, he brought his breadth of technical knowledge and understanding of how their user base consumed their tools. In this business, it's essential to understand how these programs are used while ensuring they are secure, a mentality that helped Adam move into the CSO position.

The Main Framer (4:41)

Steve asks Adam about his experience on the main frame.

When Adam was a student, he worked as a tape librarian. This after-school job led to him taking classes and learning about mainframe operations and basic coding language.

Desktop Support (8:26)

Adam believes that having a desktop support background benefits security professionals because it provides an understanding of how end users operate. Communicating with this community with empathy adds significant value to any security team.

Unexpected Steps: CISO to Soc to CISO (12:38)

Adam did end-user support work at Bloomberg before moving into backend enterprise applications. Then he was asked to run Bloomberg's tier one and tier two service desks, a type of work Adam did not plan on returning to. However, this opportunity offered Adam his first management role, and he credits this position as getting him to where he is today.

Building Trust With Your Team (20:05)

Upon reflecting on his job journey at Bloomberg, Adam shares why people seek new opportunities.

When people leave positions or accept roles, it is for job growth. Most people want to consider how a job will help their families and goals before making a career transition. Adam would rather help his team explore their options than subdue it–though no one wants to lose valuable employees. He wants his team to trust him enough to be honest with him about when they want to make a change.

A Challenge (25:21)

For Adam, it is always a struggle to stay out of the weeds of the tech side of the business. He gravitates toward technology but understands that that is different from his role now.

For leaders, it is more important to nurture an environment where employees are safe to fail because that is how people learn and grow. You shouldn't be reckless, but being inactive is more risky.

Owning Failure (29:02)

Steve presses Adam on how far he will go to own his team's failures. Adam thinks it is his job to communicate with senior management and shield his team from scrutiny.

No matter what, we must be honest about what we can do to improve and have productive, unemotional conversations.

Building a Brand (36:13)

Building a brand comes with trial and error but is critical to success. Often this comes with changing the perception that security is a necessary evil. Demonstrating that security is a value-add partnership that leaders actively want to engage in is essential.

Putting Yourself Out There (47:54)

Though Adam is not a fan of public speaking, he believes in pushing himself past his comfort zone. Although he has experienced imposter syndrome about his experience, he is putting himself out there as a podcast guest today to share his career journey.

The New CISO (54:23)

To Adam, a new CISO establishes a strong team and establishes trust within the business and with your peers. Trust is necessary to claim success.

Links mentioned:

Bio:

A proprietor of service excellence and incubator of change, operating at the intersection of people, processes, and technology with 26 years' experience successfully partnering with business leaders to build strategies aligning to corporate and client needs, resulting in realization of value-add with a holistic approach to business, technology, and security.

Be Comfortable Being Uncomfortable: Managing New Roles and Next Steps Apr 20, 2023

Show notes

In this episode of The New CISO, Steve is joined by guest Mike Kelley, CISO of the E.W. Scripps Company.

Mike worked as an auditor before eventually jumping into cyber security. Reflecting on his past, Mike shares how balancing ambition with transparency is critical to success. Listen to the episode to learn more about Mike’s auditing experience, falling into cyber security, and his advice for CISOs when interviewing.

Listen to Steve and Mike discuss how leaders should assist their team with career development and why “fake it until you make it” makes for bad career advice:

Meet Mike (1:44)

Host Steve Moore introduces our guest today, Mike Kelley.

Mike shares his role in the enterprise and consumer-based security field and how his duties differ from those in an internal security environment. Although he would say that consumer-based security is not clearly defined, his goal is to keep all things related to the consumer secure, in addition to the typical CISO goals.

His Start (3:36)

Before working at E.W. Scripps, Mike worked at KPMG, one of the big four firms. There, Mike performed external audits but also did some compliance consulting as well.

Although no one wanted an auditor there, especially to answer his questions, Mike had to work on building a rapport with people in difficult situations. Through this role, Mike was exposed to numerous companies, allowing him to learn constantly. He may not have wanted to start in audits if he could do it all again, but this experience prepared him for his cyber security career.

Adapting With Transparency (9:02)

Mike has become comfortable with being uncomfortable and transparent when he doesn’t know something. When he got his CISO job, he told HR that this position was new to him and that he had a lot to learn.

Being confident enough to say “I don’t know” is Mike’s mental motto because he knows he can adapt to new challenges. Ultimately anything is learnable as long as you push yourself, a mentality he encourages in his team.

The Burn the Boats Method (17:42)

After reflecting on his career decisions, including telling a company to fire him if he didn’t succeed as a director, Steve presses Mike on how he would react to someone sharing this approach.

If one of Mike’s employees wanted to try a position out and see what happens, Mike would like to ease them into that role. He would let them transition through responsibilities first before changing that person’s title. Ultimately, trying and failing is okay, but Mike wants his team to fail soft versus hard.

Falling Into Cyber Security (21:42)

After looking for cyber security jobs for three years, Mike eased into this field through a position in compliance. Working side-by-side with security professionals, Mike was able to dip his toes.

After lunch with his manager, he was offered the CISO role, and Mike immediately said yes. Mike admitted he didn’t know what he was doing but was encouraged to take this job.

Rolling With It (25:01)

Steve asks Mike if he ever wishes he said no when offered the CISO job. Mike knew this was the field he wanted to pursue, and he felt comfortable being transparent about his experience.

Interview Questions (31:18)

If you are a new CISO wanting to ask good questions in an interview, Mike suggests asking the purpose of that role at that company. Another helpful question concerns the company’s approach to trying new things and handling challenges.

The Definition of Success (34:13)

When evaluating a company during an interview, it’s essential to find out what that company’s definition of success is. Mike defines success as being aligned with the business that employs you and being seen beyond the security status.

The Important People (36:50)

If you don’t know where to start when beginning a new position, Mike suggests finding out who has influence in the organization and who delivers results.

Once you know who those people are, you can nurture those relationships and get their input about the initiatives you want to implement.

Bad Advice (42:21)

The worst advice Mike received was “fake until you make it.” Although that approach may have good intentions, it is better to be transparent about your abilities.

A quick way to imposter syndrome is to fake it. When you have humility, more people are inspired to help you toward your career goals.

The New CISO (44:04)

To Mike, a new CISO is having input in your organization’s strategic direction and getting an opportunity to take that to the next level. Having a leadership position is how he defines a successful CISO.

Links mentioned:

The Patient Safety Model: Developing a Hospital’s Security Culture Apr 06, 2023

Show notes

In this episode of The New CISO, Steve is joined by Martin Fisher, CISO at Northside Hospital.

An information security veteran, Martin has worked in the commercial aviation, finance, and healthcare industries and was an award-winning podcast host. Today, he shares how to build a unified team and his approach to managing mental health. Listen to the episode to learn more about the value of hobbies, defining company culture, and being an empowering leader.

Listen to Steve and Martin discusses the importance of shared team culture and how CISOs can balance the stress of the job:

Meet Martin (1:50)

Host Steve Moore introduces our guest today, Martin Fisher. Over his decades-long tech career, Martin has worked in several industries.

His podcast, Southern Fried Security Podcast, lasted ten years and was an incredible learning experience. While a podcast host, Martin discovered that he used too much jargon for non-security listeners, encouraging him to expand to a larger audience.

Other Hobbies (5:52)

Martin considers himself an original nerd, playing Dungeons and Dragons as a kid and an adult. A fan of role-playing tabletop games, Martin has backed many Kickstarters and has a great gaming community within his group of friends.

Mental Healthcare (8:22)

A CISO for a hospital, Martin stresses that mental healthcare is healthcare. Martin believes in what his non-profit-based workplace stands for, which is why he has chosen this role.

The Bad Day Factor (10:27)

Martin manages his mental health by setting boundaries. People need to separate their work and personal life because it’s essential to have time to decompress.

In the IT and security fields, there is a high percentage of neurodivergent employees who may need additional support in dealing with stress. Leaders must have employee assistance programs to help their staff with mental healthcare safely.

Being Authentic (16:50)

To build lasting relationships, you have to be your authentic self. When Martin looks for people to promote within his team, he looks for genuine individuals.

Growing the Team (18:33)

When Martin started his current position, he and the company culture aligned.

Starting as the original security employee, Martin has been able to grow his team. His company understands that security is an investment and helps protect its patients, which has led to its success. Martin hires employees with their personalities in mind and how they fit the company culture.

Patient Safety (22:53)

Confidentiality is paramount to uphold in the medical security field. Since they are a patient-safety-first organization, Martin ensures he hires employees who understand that mentality.

Defining Work Culture (28:25)

Northside lists its company culture on job listings to attract the right candidates, which includes kindness. Since Martin focuses on patient safety and quality care with his CISO work, he hires people who match those ideals.

When you have this approach to hiring, you can create a positive feedback loop while forming a strong team.

Culture Over Security? (33:35)

Steve presses Martin on what’s more important: culture or preventing security issues?

For Martin, security is still, of course, the focus. People are human and make mistakes, but they’ve never had a problem they couldn’t control.

Bad Advice (38:43)

The worst career advice Martin ever received was to work for a hedge fund. This environment was not a good fit for Martin, further emphasizing his point on authenticity's value.

Military Experience (39:56)

Martin explores how he has applied his military service experience to security crises. He has confidence in his CISO role because he has gone through worse. Having army training, he has a quiet confidence that has made him a better leader who empowers his team rather than micromanages them.

The New CISO (48:18)

To Martin, being a CISO at Northside is the best role he’s ever had. Protecting patients is both gratifying and terrifying, but he believes in his colleagues and the company’s mission.

Links mentioned:

@armorguy@infosec.exchange

What Would a Breach Cost You? Personal Risk vs. Reward as a CISO Mar 23, 2023

Show notes

In this episode of The New CISO, Steve is joined by guest Jeff Farinich, SVP of Technology Services and CISO at New American Funding.

First starting his career as a general contractor, Jeff now prides himself on solving security problems. Today, Jeff shares how he makes career decisions and manages his organization’s risks. Listen to the episode to learn more about Jeff’s extensive career journey, his development relationship with vendors, and how CISOs take on a great deal of personal risk.

Listen to Steve and Jeff discuss the right time to leave a company and the personal and monetary cost of a breach:

Meet Jeff (1:45)

Host Steve Moore introduces our guest today, Jeff Farinich.

In his early twenties, Jeff studied accounting but realized it wasn’t for him. He then became a general contractor, but by his mid-twenties, he was still determining what he wanted to do. He soon took a course that kickstarted his IT career, putting him on the path to becoming a CISO.

Adjusting To The Job (4:20)

When Jeff started his first IT job, he was excited by the change of direction.

However, Jeff realized he always dabbled in tech because even at his first accounting job, he helped manage PCs.

Multiple Paths (6:28)

Jeff reflects on his job at a large property management company and his position as an MS manager at a small movie studio.

He soon began his path into security management and leadership. Through the movie studio, he also went to the premiere of a Jean-Claude Van Damme movie.

Advice To His Younger Self (10:45)

If Jeff could give his younger self advice, he would suggest getting as much tech experience as possible on the VAR side. He also would have stayed in Silicon Valley longer, possibly having an even more explosive career.

A MacGyver Type (15:38)

Steve presses Jeff on whether he would ever consider stepping away from the technical side of security to get on the strategy/VAR side.

Jeff is very open but also likes to fix things. He refers to himself as a MacGyver type “born with a screwdriver in hand.”

A Development Relationship (19:30)

Jeff enjoys having a development partnership with partners by trying new, untested tech at a low cost.

This type of relationship allows both parties to win and allows Jeff to be creative and drive innovation for that vendor.

Evaluating Vendors (22:13)

There are fewer IT vendors than security vendors, so there have been fewer decisions for Jeff to make. Evaluating vendors to work with is a process and can leave room for great, collaborative relationships.

A Small Step (27:35)

Before jumping into vendor development, Jeff recommends understanding the industry and being knowledgeable about the vendor space you’re interested in.

If you are someone who doesn’t always want to contact your VAR but doesn’t know where to start, it’s essential to begin by learning and choosing carefully.

Moving Up and Out (32:59)

Steve presses Jeff on clarifying his belief that “the best way to move up is to move out.”

Jeff is far from a job hopper, but if you wait to the point where you are desperate to leave your company, you probably should have left sooner. If you are not fixing the problems you want to repair, or there are a lot of risks, it’s valid to seek new opportunities.

Managing Liability (34:51)

CISOs always need to evaluate how much risk they are taking on. Whether you are an officer or director, you should realize that liability can reach you. Jeff has pushed for ways for CISOs not to be personally liable for breaches.

Individual Risk (36:20)

Jeff and Steve share the costs of a breach and how that can trickle down to the CISO, whether monetarily or mentally. CISOs have bad day factors that can outweigh other members of a company.

The New CISO (43:44)

To Jeff, a new CISO is someone who deals with ever-growing cybercrime. You may not get everything you need on day one, but being a CISO is a journey of learning.

Links mentioned:

Self-Sufficient Security: The Perks of Being a vCISO Mar 09, 2023

Show notes

In this episode of The New CISO, Steve is joined by guest Laura Louthan, Founder & vCISO at Angel Cybersecurity.

Originally from Britain, Laura moved to Los Angeles to explore new opportunities before transitioning into IT. Eventually starting her own business, Laura shares her self-sufficient approach to cyber security. Listen to the episode to learn more about Laura’s unconventional career journey, why it’s more efficient when you understand your abilities, and how she handles being a contracted CISO.

Listen to Steve and Laura discuss embracing challenges but avoiding struggle and tackling likeability when applying for jobs:

Meet Laura (1:45)

Host Steve Moore introduces our guest today, Laura Louthan.

CISO and only employee at Angel Cybersecurity, Laura, had an eclectic past before settling into the security field. She worked as a scuba instructor, can-can dancer, and temp before getting her first IT job. She feels she was fortunate to break into IT when she did.

London and LA (5:04)

Laura explains why London and Los Angeles didn’t suit her well. She had a job in London that she didn’t enjoy, but her brother worked in Los Angeles in the film industry.

When she got to LA, she realized that the movie business was not for her, bringing her to her Club Med job. When something didn’t sit right with her, she left and is grateful that she used her twenties to explore. She advises people looking for work to try temping because you just need to meet someone to get your foot in the door.

Learning On The Job (9:47)

While working in IT at Equifax, Laura had to teach herself how to do things. She figured out how to get answers and become self-sufficient, which is a valuable skill.

She knows how to get things done but also understands her skillset. She believes that it is more efficient to be truthful about your abilities.

Challenges, Not Struggles (14:09)

Laura admits that while she likes a challenge, she does not want to struggle. For example, she understands that privacy and security are different, although overlap exists.

If her clients asked her to fulfill their privacy needs, she believes that would be inefficient since that is not her area of expertise. She would be happy to refer that client to a privacy professional instead.

The Privacy Question (16:24)

Steve asks Laura if there is a greater need for privacy help. Laura believes this is external pressure for CISOs, and that privacy pressure comes after security.

Laura thinks privacy is exciting and intellectual but recognizes it as a different CISO mindset. She is very comfortable with her specialty in security.

Her Time At Sephora (22:48)

At Sephora, Laura was the head of Information Security. After working in the credit industry, she found the retail space to be a fascinating change.

Although Laura is not the archetypal security type, she found her personality and gender made her a good fit for this female-focused company.

The Likeability Index (27:41)

Steve and Laura discuss how “likeability” is typically higher in women, which can hurt them during negotiations because women tend to want to be liked.

Women also tend to apply for jobs they are overqualified for. Laura advises women to apply for jobs they think are reaches for themselves instead, which is what men do. We should all hope for a job that challenges us.

In The Interview (31:22)

Laura and Steve explore different questions candidates should ask or consider during the interview process.

For Laura, she asks what technology the potential client uses, their industry, and other questions that clarify if she's the right fit. Before taking a client on, you want to ensure you can help them. Ultimately, if you do good work, clients will typically recommend you.

Legally Speaking (36:20)

Since Laura is not an employee of her clients, she explains how she handles legal risk.

Laura has errors and admissions insurance and details that she is not responsible for other companies' compliance. Since Laura is not full-time, she can’t be there for every meeting, but she works hard to discuss how she can get them where they want to go.

The Challenges of Being a CISO (41:55)

Laura shares that the worst part of the cybersecurity industry can be the negative security person. She believes that what CISOs can do better is to collaborate with other departments outside of IT.

The New vCISO (43:45)

To Laura, a new vCISO is a chance to be pragmatic and enable the business. Working together is a joint decision, so building relationships with the people you work with is important.

Links mentioned:

5 Top Tips for Boosting Security Mindfulness Feb 23, 2023

Show notes

In this episode of The New CISO, Steve is joined by guest Rupa Parameswaran. At the time Rupa joined the show, she was Head of Security at Amplitude. Now, she’s transitioned to a new role as VP of Security & IT at Handshake.

Growing up, Rupa was initially given a choice: to marry or become a doctor or engineer. With the support of her family, Rupa pursued her passions as a leader in the cyber security world. Listen to the episode to learn more about Rupa’s advice to the listeners, her first product development opportunity, and why every CISO needs to understand the power of influence.

Listen to Steve and Rupa discuss the importance of having allies across the security business and how to build a culture of mindfulness in your organization:

Meet Rupa (1:40)

Host Steve Moore introduces our guest today, Rupa Parameswaran.

With decades of experience and a deep-rooted technical background, Rupa has seen how security has evolved over the years and why CISOs need to grow with these new procedural changes. As the head of security at Amplitude, Rupa ensures that the product and employees are secure in both privacy and culture.

Engineering Background (4:00)

Before starting her career in cyber security, Rupa first studied engineering. Growing up in India, she felt she had a choice between getting married or going down an engineering or medical path.

Rupa determined that becoming a doctor was not for her and became interested in computer engineering. In university, she worked on an AI project, leading her to move to the United States and the security industry.

A Clear Path (7:08)

Pre-Amazon, Rupa and her colleagues were trying to create a marketplace for books with AI security technology. After this incredible experience, it was clear to Rupa what her career should involve.

Having Support (9:04)

Rupa shares that India has been a typically male-dominated society, which is changing slowly. Many more parents are interested in helping their daughters pursue careers and become self-sufficient versus getting married.

Rupa’s mother fought for independence, which she wanted for her children. Grateful for the support, Rupa was able to pursue her passions.

Rupa’s Advice (13:50)

Whether someone is a woman or just someone determining what they want to do, Rupa recommends that everyone find their passion. If you discover something that excites you, seek mentors or people you can trust to discuss your interests.

You will be on a good path if you can build a support group. It may be a slow process, but it is a critical one. With mindfulness, you can build credibility with your work, and nothing can stop you.

Post University (17:09)

After university, Rupa was at a crossroads. Should she go into academia or not? As she determined this, she got an opportunity to be a software engineer with a new company.

Interested in the GDPR security product they were building, Rupa was able to be a developer on the project. Believing in the company’s vision, Rupa was excited to get immediate security industry exposure across different team initiatives.

Having Influence (25:19)

Rupa reflects on what she learned from the GDPR project. She became skilled at building ally support groups and influencing security development without having to manage people directly.

This unique opportunity gave her essential leadership skills and the ability to spread security mindfulness throughout the company.

Her Definition (28:48)

Steve presses Rupa on her definition of “security mindfulness.” To Rupa, this phrase demonstrates a willingness to include security in every initiative you pursue.

If you build out a unique group of security-minded professionals, each person can preface the importance of this topic in meetings without you. Having another person speak up on your department’s behalf shows successful security mindfulness.

Find Your Allies (32:19)

As a security leader, finding your security allies is critical. When you need resources, education, or policy changes, you need to have people in your corner to help you.

Rupa advises the listeners to find these allies early and “catch the wave when you see it.”

The Currency Of Credibility (35:17)

Rupa defines the currency of credibility as building trust amongst your colleagues.

If you can show your coworkers you have this knowledge and the data to back your proposals, it’ll be easier for others to agree with your judgment. Understanding your product allows you to be a better security leader.

Holding Executives’ Attention (40:00)

When it comes to leadership, you must build allies and know your audience. By having relationships with executives, you can better understand what piques their interest and convey to them that the company’s security is equally important to you.

The New CISO (47:38)

To Rupa, a new CISO is someone who is constantly evolving. Keeping the wheel of security turning is the primary goal of any security professional because security is a journey.

Links mentioned:

Are You Ready to be a CISO? Why Mentors Matter with Mark Weatherford Jan 26, 2023

Show notes

In this episode of The New CISO, Steve is joined by returning guest Mark Weatherford, CSO and SVP of Regulated Industries at AlertEnterprise.

In last week’s episode, Mark shared how he set the foundation for his incredible career, from his start in the Navy to his time working for Governor Arnold Schwarzenegger. Today, Mark delves into his lasting legacy in the cyber security field. Listen to part two of this episode to learn more about being the plus one at security meetings, Mark’s mentorship perspective, and putting in the work to succeed.

Listen to Steve and Mark discuss what it means to be coachable and the importance of experience:

The White House Basement (1:33)

Host Steve Moore presses his guest Mark Weatherford on a meeting he attended in the White House basement.

Mark was initially instructed to use this meeting as a learning experience to see how things worked. Unexpectedly, John, the National Security Advisor, asked Mark his thoughts on an issue, and Mark answered on the spot.

Strong Leadership (6:44)

John asking Mark a security question showed strong leadership because it allowed Mark, who was new to the team, to be included.

When you’re the CISO in charge, you should bring a team lead or a middle manager to meetings, so they can learn and provide input. This type of experience will allow them to build skills and develop confidence, which they will need as they climb the cyber security ladder.

Mentorship Advice (10:29)

Mark advises the younger leader to always look for opportunities to mentor people. Generally, Marks tries to be available to those who ask him to chat about leadership and security.

On the other side, younger people need to be willing to ask for help.

The Mentorship Exchange (16:10)

Steve asks Mark what people should expect from mentorship lunches. Is it just lunch or something more pressing?

Mark explains how in his case, he was friends with his mentor, so they mostly just enjoyed meals together. However, his mentor would ask him questions about work to see how he could help. Of course, different dynamics operate differently, but the main thing mentees should consider about themselves is, “am I coachable?”

Steering The Mentee (19:47)

Mark and Steve discuss how to guide mentees away from vanity. Nowadays, new security professionals may focus too much on the job title than becoming a leader.

Mark then further explains what it means to be coachable: a willingness to take in the tough feedback to improve.

In the Meeting (21:24)

When Mark meets with potential mentees, he’ll give them a homework lesson and ask them what their goals are. He will also ask them what efforts they’ve made to achieve their goals.

With so many CISO opportunities out there, people are getting jobs without putting in the hard work, though having experience is essential.

The New CISO (24:08)

To Mark, being a new CISO is a wide-open field. One must understand the job's responsibilities and be creative with their resources. Ultimately, being a new CISO is having the experience that validates your position in the role.

Links mentioned:

Be the One Who Gets the Call - The Keys to Landing New Opportunities Jan 12, 2023

Show notes

In this episode of The New CISO, Steve is joined by guest Mark Weatherford, CISO and Head of Regulated Industries at AlertEnterprise.

After many years in CISO roles, Mark eventually found himself in the White House. Reflecting on his incredible career journey, Marks evaluates the opportunities that led him to success. Listen to part one of this episode to learn more about Mark’s navy experience, the importance of delegating in leadership, and how to become the guy who always gets the call.

Listen to Steve and Mark discuss when to put the fear aside and embrace the possibility of failure and the willingness to take on new opportunities:

Meet Mark (1:51)

Host Steve Moore introduces our guest today, Mark Weatherford. The current Chief Security Officer at AlertEnterprise, specializing in IT and OT security.

Before starting his cyber security career, Mark wanted to build dams and roads in the navy. Instead, the navy had other ideas and picked Mark to be placed in the advanced electronics program, leading him to the CISO industry.

Measuring Your Day (7:21)

Mark measures his work day by the goals his team achieved or when a project is done. Although it’s a different set of standards than when you see a road or other construction projects completed before you, cyber security work can also be assessed.

Life After The Navy (9:08)

By the time Mark started his job at Raytheon, the Navy had a contract to complete a security project with them. Already determining when he would leave the Navy, Raytheon called him about a position that fit his skillset: building a security operations center from the ground up.

Relying On Your Team (14:14)

Steve presses Mark on what he learned from managing the start of the security operations center. Mark gathered that no one can do everything and that it’s essential to have a core group of leaders to rely on.

Good leadership comes from delegating authority to people without micro-managing, empowering them to excel at their jobs.

Working With Fear (22:07)

“That’s all part of learning. Things are going to break now and then,” Marks explains when expanding on his leadership philosophy.

Reflecting on his own experience with gaining new skills, Mark’s advice to anyone is that mistakes happen when you’re learning. We may be uncomfortable when things are unfamiliar, but as long as we’re not doing anything malicious, we can figure things out.

What Happens Next (24:14)

One day Mark received a call from his boss about a project with the Federal Government in Colorado. A year later, Mark got another call from his next job, leading him to a cabinet position.

Through his impressive work experience, Mark was considered for exciting political opportunities impacting our country.

That’s Politics (28:53)

Mark discovered pretty quickly in politics that people aren’t always truthful. Unfortunately, he understands that this is the industry's nature, and that is how things are. As a result, it’s natural to become wary and not take everything you hear at face value, although Mark still gives people the benefit of the doubt.

Working With The Legislature (31:13)

Mark’s work in government allowed him to influence policy as well. Mark learned about the trade-offs in politics during this experience and why opposition can create barriers to security policy.

Becoming The Terminator’s CISO (34:58)

After leaving Colorado, Mark was called for the opportunity to work for Governor Arnold Schwarzenegger in California.

Mark recognizes that the secret to his success derives from being prepared for new positions when they arise. Mark never directly worked with Governor Schwarzenegger, but having this role gave him a lot of respect in the security world.

Having Pride (38:06)

Mark is very proud of his time in California. With over 160 departments, agencies, and organizations operating there with different security needs, Mark worked with them all to find solutions. This level of collaboration and relation-building was an incredible experience with lasting, positive results today.

Links mentioned:

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected