Advice for Aspiring CIOs and CISOs with David Gee - Simply Solving Cyber (Full Episode)

Thanks for tuning back in to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And today we're here with David Gee, who I was honored to work with a number of times back in the day. I think I first met David when I was working at a large pharmaceutical company, Eli Lilly. And if I remember right, David, I was on an audit in Lilly Japan. If I remember right, and we met there and then got a chance to work with you years later when we were both in the US affiliate. So nice to see you again. I know we've kept in touch, but nice to see you and more importantly, have you on the show and get some others, give some others a chance to hear a little bit about your, your journey and your background.

Thanks, Aaron. If I recall, that was probably a SOX audit, if I recall rightly. And then SOX was a big thing.

I tried to avoid the Sarbanes-Oxley. I was the privacy guy.

Oh, okay.

Yeah, yeah, yeah. Awesome. Well, David, we always like to start out with the backstory and obviously the high points because you've had a long, illustrious career. But tell us about a little bit about you and then we'll want to make sure to touch on the new book. You've recently retired and wrote a new book that I have on my desk back here called The Aspiring CIO and CISO. And I know it's done really well with a lot of interested people in kind of advancing their career in this space.

Thanks, Aaron. Look, I've retired about 100 days ago. And so I think the book's been on sale this week. So I'll plug it for a minute, for 100 days. And as you can see, it's all about, you know, people who aspire to be a CIO and CISO. And for me, it was part of my, a lot of my journey and some of my battle scars are actually things I put in the book. And so I think one of the things I've alluded to is there is sort of, I had this sort of transformation career where I've been sort of a transformation you know, CISO and transforming myself in terms of working in different industries. And so I'm a bit unusual, I guess, in that regard because I look back at, you know, I've worked in 5 countries, in the US and China, in Hong Kong and Japan a couple of times each, even in 3 cities in Australia and across the MetLife and insurance, Lilly, you know, CEO in the US, Japan, China, Australia, etc. But I've also worked in HSBC as a CISO and building products and media, print media, television. So I've done all kinds of different things. And to me, it was always part of my, you know, career design principles was not to be stuck in any one place and have to pivot and move and keep learning. You know, continuous learning is really important because I think we can make ourselves redundant if we don't actually keep focusing on sharpening our sword. So, it's sort of now enabled me to move from place to place.

Yeah, I don't want to disappoint any listeners in any country, but if you had to pick out of those 5 countries, like where did you most thrive? What did you enjoy the most, you know, the best, both personally and professionally?

Wow, that's a really hard question. I've done so many fun jobs and hard jobs, right? I think honestly, the CISO roles, I've done 20 years as a CIO. And then 3 years as the CISO with HSBC. And the last 3 and a half years, I've been heading up cyber risk and tech risk for Australia's largest investment company, Macquarie. Each of those has different sort of challenges, I guess, Aaron. I think, I mean, lifestyle-wise, living in Japan's the best because the food's amazing, the place is amazing. Work is the hardest, people just don't go home. So, yeah, it's a combination of work-life balance. You don't have any work-life balance in Japan, but really amazing lifestyle, just hard work. But I think I've had some fun in the places I've worked in.

That's awesome. So, David, I want to ask you a couple of questions about your book and the one thing, and I love a good Venn diagram, but the SKEB or Skill Experience Knowledge Behavior assessment. Can you tell our listeners about that? And reason why I'm interested in this today is I'm, as Cody knows, I'm listening to an audiobook called You Can't Send a Duck to Eagle School. And it's about motivational fit and skill set and people, you know, having the right people skills for the jobs and customer success and all those things. But I really like this diagram. Can you talk about how, what it is and how individuals can use it to help understand where they are at in a role or a specific job.

Yeah, just a bit of background, Aaron. I think the Lily Japan, I was CEO there and Chief Privacy Officer at the time, and we were suffering from trying to develop talent in the organization, both within IT and also more broadly in the organization. And we were very sort of male-centric. We didn't actually hire anybody that wasn't Japanese men. So we could have said, actually, how do we grow that talent? So actually, the CEO at the time, my boss, said, "Look, let's go and actually have all of us become the trainers, not some funny consultant." So some guy came and trained. And so the SCABE process—skills, knowledge, experience, behavior—is something we actually taught to our team. So we said, "Okay, we want you to be really good at your development plan and you own that, not us, but we want to make sure that you understand what's required." And so if you think about this being circles and skills, knowledge, experience, and behavior, sort of the whole thing, right? And all of us focus on skills and knowledge when we're young in our career, want to be really good at, you know, Java programming or large language model prompt engineering, etc., and then have knowledge about large language models. But then we actually understand that actually as you get more advanced in your career, what matters more is actually the other side, the E and the B, which is experience and behaviors. And so what we talk about is how do you try to design yourself, your own career and saying, I'm thinking 2 jobs ahead. So if I'm talking to you, Cody, I'm saying 2 jobs ahead of where you are now, what is that person above me, he or she, doing in terms of experience behaviors that I'm not doing and trying to map that out. So in some cases, you might say, okay, that person's the CIO and that person's doing a, you know, global IT strategy, right? How can I volunteer to do a stretch assignment? How can I volunteer to be involved in that? Maybe I can't do it by myself, but I can get involved in that by volunteering, by telling them I'm interested in learning about strategy and helping the process. So, you're trying to find ways to start to role model those experiences and then also see the behaviors because what really matters is your, you know, that behaviors. And I'll give you a great example. I'm doing recruiting now as one of my advisory roles and we're trying to find a CISO and cyber managers, executive managers in a few banks. And so, you know, we put forward a shortlist and they never come back and say, "Oh, David, you got the wrong skills and knowledge." They come back and say, "Actually, we're not sure about that person's experience or behaviors." And so what's really important is you go, the higher you go, is to have those right experience and behaviors and try to build that out. So trying to find, you know, one, one skills, one knowledge, one experience and behavior that you need to actually identify for yourself. And then you can, you know, and I think in detail, I put some in my book, I put some, you know, my embarrassing gaps. I worked on my own gaps for the last, you know, 20 years to overcome that and make it no longer understood as being a gap. People think it's a strength now. So that's awesome.

That's, that's really cool, David. I think too, you know, in looking at like modern CIOs and CISOs, and I think that's a great kind of homage because it's always the knowledge is there and the skill set, but it's like, it's not just what you believe and what you know, it's like, how do I influence others in different departments and other leadership? To get on board with this idea because you're spending a lot of money, there's process changes and things. So talk about some of the challenges you've seen, you know, as people overcome that. So I think that is a gap that you kind of see. But how does one overcome that if there's technical aptitude there, but then the challenge may be leadership and influencing others?

Yeah, and that's a really good point, Cody. You know, having that executive presence and poise is clearly around communication skills and be able to go to boardroom or go to a management committee and say no. And say, not say yes, but say no. Saying yes is easy, right? Because we, but the fact is, is that, you know, in cyber or as a CIO, you never had enough resources, you never had enough budget to do what you need to do. And so, there's always going to be a rationing and there's always going to be someone who say, "I'm sorry, I can't do that." Or actually, "That's going to be my number 10, not number 1." Okay, so for me, That's the part of things that I talk about in my book a lot about soft skills. And so, so many people in technology are really good at the skills and knowledge, but they don't practice their soft skills, you know, which is sort of the strategic thinking, ability to influence, as you mentioned, right? How do you then negotiate? How do you then manage stakeholders so they don't feel that it's a lose-lose? It's a, you know, maybe a win-win and my win is delayed. So there's sort of soft skills that are really, really important. And I think there's, all of us can't be, you know, I think I talk about in my book, 10 top soft skills, right? We can't be good at all 10 things. Some of those 10 will be sort of weak at and we need to make sure we can try to develop other ones to overcome, hide that weakness if we can.

Yeah. Yeah. I love that you, and actually I think on one of your slides for an ISACA event, You've got top 5 skills and then the next slide is plus 5 skills to get to 10. I like that because there's so many. You are right. You can't be, you know, be the master of all of them. But I also like that you're talking about soft skills because I've seen so many, like especially on LinkedIn, echo chambers of CISOs that are arguing over like, I have a SecOps background and I've been in a SOC and I literally have heard CISOs say, If you've not worked in a SOC, you're not a credible CISO. And, you know, I know SOC technology, I've done projects in and around SOC, but I've not been a SOC operator. And I would argue I've been maybe effective in different ways, but I think any myopic technology skillset thinking is usually mired in the skillset that the person arguing it has. And most everyone, well, not everyone, many folks at the CISO level are arguing about the wrong things. I'd rather be arguing over these top 10 things and which to prioritize for a specific role or person than like which tech skills are going to make you a better CISO.

Yeah. Now, look, the modern CIO and CISO have got the same challenges, right? It's stakeholder management, it's regulatory management, it's all the above. So, being an amazing DevSecOps person or, you know, pen test. It's all great. So, that's all great foundational bits. But actually, what gets you promoted and gets you noticed, keeps you a job because, you know, getting the job is one thing, keeping the job is another thing, right? So, you want to get beyond your 2 or 3 years, which is the average, right? How do you do that is by having great at your stakeholder management, which is soft skills, which is trying to make sure they're not too disappointed when you say no. I think one of the things I've talked about in my book, Aaron, is, you know, the first 90 days. And I learned that actually, Lily, because I think, you know, at the end of the day, I was I did 5 CIO jobs in 15 years. So every 3 years I was being moved to another place and then not only did I do a strategy, I had to get then rebuild the team from scratch and then leave my successor, right? Find a successor, make the organization stronger and then leave behind a successor, which is sort of unusual, right? In this day and age, people don't do that. But I did that because that was my pattern. And so I kind of had this thinking about how do I then institutionalize this by documenting what I'm going to do across people, process, technology, committing to that so people can actually see that, right? And then, you know, showing that to my boss, my stakeholders, and my staff and say, by the way, this is my plan for the next 90 days. And then them starting to think, oh, actually David wants results, and David's actually very focused on certain things, and certain things he's not even mentioning. That's interesting, and it makes them focus as well. Yep.

I want to hit on one of your 10 that I know that, I know we've both faced in our corporate lives as probably, as well as probably consultants and advisors, but negotiation. And we've talked a lot about on this show because we've had on attorneys, you know, chief privacy officers, and a lot of those relationships sometimes are not starting in healthy spots or, you know, privacy versus cyber arguing over like, not monitoring any data from a privacy standpoint and really needing some data to understand if your data, your IP is walking right out the door. So give us your thoughts and tips on negotiating and influencing and building those relationships.

Listen, I think I can talk about without identifying where the examples are, what some cases where, you know, you've got to stick to the facts and and you take a position which is, I think we need to be here. Okay. And so I can talk about two examples. One case was, it was just a while ago, but it was HSBC. And we had a bot attack actually in America on our mobile banking system. And so, you know, we did some research and said, oh, actually that's really bad. Bot protection did not exist at HSBC in America at the time. And so we then said, actually, oh, we have the same we had the same software versions in 4 countries in my part of the world in Asia-Pac. So, you know, go back to the CEO and said, by the way, we got a bot attack here. We need to actually put in some MFA and we can put in Mickey Mouse MFA, which is, you know, the CAPTCHA stuff, which is that much code and that takes 5 minutes. I'm not asking your opinion because these are CIOs that I used to be a CIO, right? And they said, oh no, "My customer experience is so important, David. I can't do this." I said, "Sorry, I'm not asking you. I'm telling you. You can only negotiate when, not yes or no because this is actually a serious situation that your whole digital experience will break down like the US has." And so, that was quite interesting because they're my old peers, right? The CIOs who just said, "Oh no, we can't do this. Impossible." And I was like, "What do you mean?" And so this, you know, many examples like that where people have got a view of the world and you've got to just change that. I mean, another case was, you know, was just asking questions about, tell us, tell us, tell us, what was the Colonial Pipeline? Was it May 2021, I think it was, right? So I came across this, it was about 4 in the morning, I was up early with my iPad and I pinged the sock later and said, okay, this is really interesting. Can you tell me about how we, the IOCs for DarkSide, how do we capture that, right? And look, you're busy now, so just come back. Eventually after a few weeks I said, look, can you show me your playbook? Because he didn't come back to me. He sent me your playbook and I was kind of horrified how bad it was and said, look, let's go and work and rebuild that, okay? And let's go and let's test it because you haven't tested it, right? And so that role, that says I shit, I was actually a risk person. Asking the CISO and his team. And then eventually they rebuilt that ransomware playbook. And then we were then asked 6 months later by the board. The board says, hey, can you show us your playbook? Can you show us? Have you tested it? Show us your results. And we did a page turn, page by page. And I then turned to them and said, by the way, aren't you happy we did this? Because we would have been fired. Both of us would have been fired, right? And so that was— it's kind of tricky, right? Because you wanted to do the right thing. Not throw people on the bus because that's the wrong thing to do. But how do you progress the organization? And if this is the right thing to do, then actually it's not a negotiation. We're just going to say the facts speak for themselves.

Yeah, David, it's great. So a question I like to always ask our guests are a couple of things. You kind of already alluded to it. So I think you'll have a great answer for this. I'm cueing you up for a great answer right here. But over the years, you know, there's a lot of focus on technology and tools. But at Reveal, we have a lot of belief in like people and process and the things that enable the tools. So thinking over your career and your tenure, is there a time that sticks out when a process or people won the day versus a specific technology?

Oh, it's always that. And I mean, the tech piece, HSBC spent $1 billion on on tech transformation over 4 years. Okay, um, so we were just buying everything, um, and, and as you know, right, it's about embedding the processes and having the people understand the stuff. So, um, like a really, really good example maybe is actually that we'd, we'd bought something called Secure Code Warrior for DevSecOps, and, and that was part of the journey. And HSBC had 25,000 developers 25,000, just a lot of developers, right? Across mainly India and China, but all over the world. But the two centers had probably 20,000 developers. And so I said, I said, that's great. We've spent all this money on licenses. And so you're telling me that actually we've got, could have got great DevOps, but we've got about 20% of our code being scanned and about 20% of our staff have been trained in this stuff, even though we have licenses for 25,000. We haven't given a carrot or stick. We've given them free iPads and, you know, all this nice carrots to go and do this stuff. And I said, well, no, no, that's you've been screwing around for 2 or 3 years here. I'm going to mandate this. I'm going to say we must have everybody trained as a white belt, 25,000 people, for the next 6 or 7 months. And we have 10% of those people as yellow belts. And I'm going to start hounding every CIO that owns these developers. And so we get it done by December, right? So to me, that was actually, we got the tech, let's get people in place, let's put in some structure to say, identify sort of a yellow belt, white belt, green belt, black belt. And we sort of say, here's how we need to get to the black belt level. You need to be good at this and you need to have, you know, be mentoring people and embedded in the pods and, you know, try to put that whole mechanism. And also, by the way, we don't want 20% of scanning, 80%, 80% code is probably the best practice, right? Let's go towards that. How do we do both? The theory and also the practice to advance at the same time. So that was fun. We got there, we got to 95% in 6 months. That's excellent. But that's, yeah, it's all about data, right? And making people accountable to say, sorry, Aaron, why haven't you done it? Why is your team behind? You're not tracking towards your number and making them accountable.

That's awesome. That's really good. So kind of following that, that's you know, over the time you spent. But let's say you, you're going to get one phone call tomorrow. I got a special cell phone I get to hand you, and you get to call yourself 20, 25 years ago, early in your career. Um, what, what are one or two things you're telling yourself that you've, you've learned that you say, hey, if I could call myself 25 or 20 years ago, what are you telling yourself?

So I'll get back to 30 years ago. Ready because 30 years ago I made a decision to be a CIO and I was tossing up. I walked into a garden, it's in my book actually, walked in the garden in Kodawaji in Kyoto and it's the most famous zen garden in the world. And in this garden there are 13 or 14 rocks that are sort of positioned strategically and you sit there and look at the rocks and contemplate life. I walked in with 3 job offers, right? And 2 were to be consultants, one was to be a partner with EY and I was 35 years old and sort of, you know, I'll be a partner next month, you know, so, and they give me a signing bonus and all the nice, put me through an MBA and, you know, studied, toured the US, they're throwing, throwing at me, right? At the same time, Lilly was saying to me, hey, come be a CEO with us and we'll send you over the world, maybe send you through an MBA and then afterwards send you to China and Japan or US, which is what I did. I became CEO for China, Australia, Japan, Asia Pac, US, etc. That was the decision I made then. So to me, sitting in that garden 30 years ago, I was like, am I making the right decision here? Am I chasing a career, not money, you know, not money and status because probably more money and status now to be a partner than to be a CEO for a little Australian company, right? Not the US at that stage. But for me, it felt right. It felt like, you know, Lilly was a great company doing great things for health. I felt, I felt aligned with that and I said, okay, I want to do this. This sounds like a really interesting opportunity for me to take on. And so back to your question, Katie, it's around, you know, back yourself because, you know, if your instincts are right, you know, try to make those right decisions. Don't do it on dollars, do it across, you know, the whole gamut around your family, lifestyle, learning ability, you know, because I think, you know, what turned me off being a partner in a law firm, sorry, EWI Consulting was I thought at 35, I'd retire, mentally retire. I'd just be then protecting my turf, right? Trying to protect my income and revenue and not keep learning new things. And that scared the hell out of me. I didn't want to get to the stage of retiring at 35 mentally.

Yeah, that's great. I mentor a lot of young men and women in cyber and IT, and I feel like cyber is kind of nebulous, you know, to get in from the outside. And sometimes people think, You have to be technical, you know, to get into cyber. So I think that's really cool of kind of what you said. And I would totally agree that focus on what— on learning and growing and the value will find you. But you chase the dollar sometimes, those paths end and then it's hard to pick up again. Absolutely.

It's hard to also just kind of have a comment on that. I've seen people for the money in the wrong job and the motivational fit is clearly off and it's If you can't find your passion from what you're doing and wake up every day and get excited about it and continuously want to learn, if you're just distracting yourself and getting through the day and kind of bumping along, you're not going to probably achieve your goals. You're probably not going to be overly successful. And even if the money is there, it's probably going to plateau. So, I totally agree with everything everyone's saying. And again, I've probably at certain points in my career been in the points where it's, "Ah, this is the wrong job. This is the wrong fit." and the sooner that you can know that and kind of make that pivot to get back to something that's more getting you into a place of thriving, the better. Yeah, which is—

Aaron, I think I talk about in my book and I often sign these covers and I write, you know, keep striving to be uncomfortable. Uncomfortable means more growth and it's kind of counterintuitive but actually if you are comfortable, you're going to just sit there and float because it's easy, right? Life's easy versus actually, I don't know what I'm doing. I, I need to learn fast. You know, I've got the, um, great example I talked about, um, in the, in one of the chapters is around being a CISO at HSBC, you know, and volunteering to be a CISO after being a CIO for so many years to say, I can do the keep doing the CRO, but actually I'm bored with that. I've done it for 20 years. I want to, you know, do something different. And so to me, you know, being a CISO where I don't know everything, I need to learn fast, and I need to engage the business and get them to help transform and the team to transform is the challenge for me. That's excellent.

Yep. David, hold that book back up for a second. I do have one question. So I've got my copy. If individuals order the copy, I'm a skier and I see the gondola. Will you guarantee our listeners that they will be on a fast-track gondola to the top of their mountain? Is that the imagery you were going for?

It's a really interesting question. And I'd When I designed the COVID it was a Saturday morning and I was thinking about, okay, blue sky, you know, the further you go up the mountain, it gets kind of cold and sharp rocks and it's not very nice, which is what it's like in the C-suite. Okay. And so I got up to the publisher, sent me, you know, iStock photo access and I went onto their little search with sort of AI, not really good AI. And I'm looking for a, you know, a gondola that goes left to right, that's up, not down. And I want a blue sky background and I want this sort of snow and whatever. And I kind of had picked about 5 different pictures and showed my wife, you know, she was still sleeping, it's 6 in the morning. And then when the artist got this, he said, oh, you know, I've removed the safety line, David, because it was, it made the photo look kind of ugly. I said, no, no, it's great because there's no safety line in these jobs, right? You just fall. But I think the At the end of the day, the guide is meant for people to help them. Not everybody wants to be at the very top. Some people actually okay to be at base camp because, you know, further you go up the mountain, Everest, right? It gets— there's no oxygen, it's life-threatening. So base camp is okay for some people. And so a lot of people read the book say, I don't want to be a CEO or a CISO, but I want to be close to that role. And so the book's more about actually how do you become the best version of yourself and grow yourself beyond where you think you could be. And so if I look at my own career, have I gone further than I thought I could? Absolutely. And I think I've also coached people to the same point where they didn't believe they could be a CRO or CISO, but I've coached them to believe that by actually then them understanding, identifying what is it I'm not doing and how do I round out those rough edges that otherwise would stop me being a CRO or CISO. Love that.

Yeah, I know the only analogy that you might throw in there is the gondola has one one compartment going up and one going down. And there's a joke or something in there about like, for those that get near the top and don't like it, they might either choose to ride back down or be sent back down.

So yeah, it was interesting. It's probably hard to see the details here, but there was, when the photo came back, actually the actual version going down had no one inside it. And I asked the artist to add them back in again. Because the reality is, is, you know, some people choose to go down. Right? You might say for lifestyle, for family health reasons, I want to go up and I go down. I talk about this as using the elevator analogy actually in my book, which says that sometimes you're open to the person calling you, so the door's open or the door's closed, or you actually just hate your boss, you press that panic button. There's different mechanisms, but up is not always the answer. Sometimes down is okay as well because it depends what you're looking for. In that sort of holistic viewpoint. Great points. That's excellent.

David, we have one more question for you, very, very important question here. So, for all of our listeners, I want to give them the VIP access and say, give us one fun fact of David that maybe everyone wouldn't know. So, share either a story, a fun fact, but give our listeners something special here that's not super public knowledge about you.

I married when I was 20 years old. And so for me, being married at 20, at university, doing, you know, odd jobs, you know, pizza barman, you know, whatever it was to make money. But then to me, then, you know, then saying, okay, I want to go and support my family. I want to go and buy a house and do all the right things. But inside I had this drive not to ever be stuck in my job, never to be stuck in one company. So when Banks offered me a job, I thought I can't take that because the banks will offer me a job and I'll have this half-price loan. I'll never be able to leave. So I ended up working in banks later in my career, but it's counterintuitive, right? Because the safe answer is to go to the safety, which is take the job with the 7% loan, not 15% loan. And because it's a high incentive, but I said, no, no, I'm gonna resist that. So to me, the fun fact is around know yourself, know what drives you. For me, it was actually, I know if I make myself into a comfortable position, I get lazy and floppy, right? And I needed to keep pushing myself. And so that was a sort of a fun fact, Katie, that helped me drive. And I think, you know, being a young dad also meant that I had to learn how to, you know, how to teach my son things. So my son, you know, at the age of 12 could read books, he could play the violin, he could swim because we did all this things with him. So my son, the first music he heard was Mozart and he didn't talk about dogs, he talked about this is a Wind Mariner, this is a Dachshund, you know, he saw books on Monet and this is the age of 12 months, by the way. He saw Manet, he saw Picasso. We showed him things because we said, we don't know what we're doing here. And I realized very quickly that actually all the techniques I learned to teach my son to enhance faster than schools, because you know, you don't get to school until you're 5 years old, right? At 1 year old, he could read, right? And I said, actually, you know what? All of us can actually enhance ourselves if we choose to. We've just been told, you're not that good, David, or you are that good. And I learned early in my life, actually, these guys were all wrong. They got it all wrong. You can break these molds. And that's why I've kind of done my own things in my career and written books and things that people probably thought I'd never get to do because I always challenge myself. And wanted to never be put in that little box.

That's excellent. Excellent. Well, sir, I want to thank you again. This has been a great episode and we appreciate you spending the time with us. We know you're very busy and blessed to have you here on the US side for a little while, this side of the globe. So thank you again for the time.

And lovely Vegas. Maybe he's in Paris now. He could be, you know, at the Sahara Desert. No, I think that casino went under. So Thanks so much, David. Appreciate it. Thank you.

Thanks, David. Cheers.