David Gee Shares Keys to Cybersecurity Excellence

Thanks for tuning back in to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And today we're here with David Gee, who I was honored to work with a number of times back in the day. I think I first met David when I was working at a large pharmaceutical company, Eli Lilly. And if I remember right, David, I was on an audit in Lilly Japan. If I remember right, and we met there and then got a chance to work with you years later when we were both in the US affiliate. So nice to see you again. I know we've kept in touch, but nice to see you and more importantly, have you on the show and get some others, give some others a chance to hear a little bit about your journey and your background.

Thanks, Aaron. If I recall, that was probably a SOX audit, if I recall rightly, and then SOX was a big thing.

I tried to avoid the Sarbanes-Oxley. I was the privacy guy.

Oh, okay.

Yep, yep, yep. Awesome. Well, David, we always like to start out with the backstory and obviously the high points because you've had a long, illustrious career. But tell us about a little bit about you and then we'll want to make sure to touch on the new book. You've recently retired and wrote a new book that I have on my desk back here called The Aspiring CIO and CISO. And I know it's done really well with a lot of interested people in kind of advancing their career in this space.

Thanks, Aaron. Look, I've retired about 100 days ago, and so I think the book's been on sale this week. So I'll plug it for a minute, for 100 days. And as you can see, it's all about, you know, people who aspire to be a CIO and CISO. And for me, it was part of my, well, of my journey, and some of my battle scars are actually things I put in the book. And so I think one of the things I've alluded to is there is sort of, I had this sort of transformation career where I've been sort of a transformation CIO, transformation, you know, CISO, and and transforming myself in terms of working in different industries. And so I'm a bit unusual, I guess, in that regard because I, I look back at, you know, I've worked in 5 countries in the US and China, in Hong Kong and Japan a couple of times each, even in 3 cities in Australia and across the MetLife and insurance, Lilly, you know, CEO in the US, Japan, China, Australia, et cetera. But I've also worked in HSBC as a CISO and building products and media, print media and television. So I've done all kinds of different things. And to me, it was always part of my, you know, career design principles was not to be stuck in any one place and pivot and move and keep learning. You know, continuous learning is really important because I think we can make ourselves redundant if we don't actually keep focusing on sharpening our sword. So it's sort of now enabled me to to move from place to place.

Yeah, I don't want to disappoint any listeners in any country, but if you had to pick out of those 5 countries, like, where did you most thrive? What did you enjoy the most, you know, the best, both personally and professionally?

Wow, that's a really hard question. I've done so many fun jobs and hard jobs, right? I think honestly, the CISO roles, I've done 20 years as CIO and then 3 years as the CISO with HSBC and the last 3 and a half years, I've been heading up cyber risk and tech risk for Australia's largest investment company, Macquarie. Each of those has different sort of challenges, I guess, Aaron. I think, I mean, lifestyle-wise, living in Japan's the best because the food's amazing, the place is amazing. Work is the hardest, people just don't go home. So, you know, it's a combination of work-life balance. You don't have any work-life balance in Japan, but really amazing lifestyle, just hard work. But I think I've had some fun in the place I've worked in.

That's awesome. So David, I want to ask you a couple questions about your book. And the one thing— and I love a good Venn diagram— but the SKEB, or skill, experience, knowledge, behavior assessment. Can you tell our listeners about that? And reason why I'm interested in this today is I'm, as Cody knows, I'm listening to an audiobook called You Can't Send a Duck to Eagle School, and it's about motivational fit and skill set and people, you know, having the right people skills for the jobs and customer success and all those things. But I really like this diagram. Can you talk about what it is and how individuals can use it to help understand where they are at in a role or a specific job?

Yeah, just a bit of background, Aaron. I think the Lily Japan. I was CEO there and Chief Privacy Officer at the time, and, um, we were suffering from trying to develop talent in the organization, both within IT and also more broadly in the organization. And we, we were very sort of male-centric. We didn't actually hire anybody that wasn't, um, you know, Japanese men. And so we could have said, actually, how do we grow that talent? So actually, the, the CEO at the time, my boss, said, look, let's go and actually have all of us become the trainers, not some funny consultant. So if some guy came and trained and— so the SCABE process, skills, knowledge, experience, behavior, is something we actually taught to our team. So we said, OK, we want you to be really good at your development plan and you own that, not us, but we want to make sure that you understand what's required. And so if you think about this being circles and skills, knowledge, experience, and behavior, sort of the whole thing, right? And all of us, focus on skills and knowledge when we're young in our career. We want to be really good at, you know, Java programming or large language model prompt engineering, et cetera, and then have knowledge about large language models. But then we actually understand that actually as you get more advanced in your career, what matters more is actually the other side, the E and the, and the B, which is experience and behaviors. And so what, what we talk about is how do you try to design your, your own career and saying, I'm thinking 2 jobs ahead. So if I'm talking to you, Katie, I'm saying 2 jobs ahead of where you are now, what is that person above me, he or she, doing in terms of experience and behaviors that I'm not doing? And try to map that out. So in some cases, you might say, OK, that person's the CIO and that person's doing a, you know, global IT strategy, right? How can I volunteer to do a stretch assignment? How can I volunteer to be involved in that? Maybe I can't do it by myself, but I can get involved in that by volunteering, by telling them I'm interested in learning about strategy and helping the process. So you're trying to find ways to start to role model those experiences and also see the behaviors because what really matters is your, you know, that behaviors. And I'll give you a great example. I'm doing recruiting now as one of my advisory roles and we're trying to find CISOs and cyber managers, executive managers in a few banks. And so, you know, we put forward a shortlist and they never come back and say, "Oh, David, you got the wrong skills and knowledge." They come back and say, "Actually, We're not sure about that person's experience or behaviors. And so what's really important is you get the higher you go is to have those right experience behaviors and try to build it out. So trying to find, you know, one, one skills, one knowledge, one experience and behavior that you need to actually identify for yourself. And then you can, you know, and I think in detail, I put some in my book, I put some, you know, my embarrassing gaps and say, how's that worked on my own gaps for the last, you know, 20 years to overcome that and make it no longer understood as being a gap. People think it's a strength now.

So that's awesome.

That's, that's really cool, David. I think too, you know, in looking at like modern CIOs and CISOs, and I think that's a great, um, kind of, kind of homage because it's always the knowledge is there and the skill set, but it's like, it's not just what you believe in, what you know. It's like, how do I influence others in different departments and other leadership to get on board with this idea? Because you're spending a lot of money, there's process changes and things. So Talk about some of the challenges you've seen, you know, as people overcome that. So I think that is a gap that you kind of see. But how does one overcome that if there's technical aptitude there, but then the challenge may be leadership and influencing others?

Yeah, and that's a really good point, Curtie. You know, having that executive presence and poise is clearly around, you know, communication skills and being able to go to boardroom or go to a management committee and say no. And say, not say yes, but say no. Saying yes is easy, right? Because we But the fact is, is that, you know, in cyber or as a CIO, you never had enough resources, you never have enough budget to do what you need to do. And so there's always going to be rationing and there's always going to be someone who says, I'm sorry, I can't do that. Or actually, that's going to be my number 10, not number 1. Okay. So for me, that's the part of things that I talk about in my book a lot about soft skills. And so, so many people in in technology are really good at the skills and knowledge, but they don't practice their soft skills, which is sort of the strategic thinking, ability to influence, as you mentioned, right? How do you then negotiate? How do you then manage stakeholders so they don't feel that it's a lose-lose? It's maybe a win-win, and my win is delayed. So there's sort of soft skills that are really, really important. And I think all of us can't be— I talk about in my book, 10 Top Soft Skills, right? We can't be good at all 10 things. Some of those 10 will be sort of weak at, and we need to make sure we can try to develop other ones to overcome, hide those weaknesses if we can.

Yeah. Yeah. I love that you— and actually, I think on one of your slides for an ISACA event, you've got top 5 skills, and then the next slide is plus 5 skills to get to 10. I like that because there's so many. And you are right, you can't be, you know, be the master of all of them. But I also like that you're talking about soft skills because I've seen so many, like, especially on LinkedIn, echo chambers of CISOs that are arguing over like, I have a SecOps background and I've been in a SOC and I literally have heard CISOs say, if you've not worked in a SOC, you're not a credible CISO. And, you know, I've— I know SOC technology. I've done projects in and around SOC, but I've not been a SOC operator. And I would argue I've been maybe effective in different ways. But I think any myopic technology skill set thinking is usually mired in the skill set that the person arguing it has. And most everyone— well, not everyone— many folks at the CISO level are arguing about the wrong things. I'd rather be arguing over these top 10 things and which to prioritize for a specific role or person than like which tech skills are going to make you a better CISO.

Yeah, now look at the modern CIO and CISO have got the same challenges, right? It's stakeholder management, it's regulatory management, it's all the above. So being an amazing DevSecOps person or, you know, pen tester, it's all great. So that's all great foundational bits, but actually what gets you promoted and gets you noticed, keeps you a job, because, you know, getting the job is one thing, keeping the job is the other thing, right? So you want to get beyond your 2 or 3 years, which is the average, right? How do you do that is by having great at your stakeholder management, which is soft skills, which is trying to make sure they're not, not too disappointed when you say no. Um, I think one of the things I've, I talk about in my book, Aaron, is, you know, the first 90 days. And I, I learned that actually, Lily, because I think, you know, at the end of the day, I was, I did, um, 5 CIO jobs in 15 years. So every 3 years I was being moved to another place. And then not only did I do a strategy, I had to then build, rebuild the team. From scratch and then leave my successor, right? Find a successor, make the organization stronger, and then leave behind a successor, um, which is sort of unusual, right, in this day and age. People don't do that, but I did that because that was my, my pattern. And so, um, I, I kind of had this thinking about how do I then institutionalize this by documenting what I'm going to do across people, process, technology, committing to that so people can actually see that, right? And then showing that to my boss, my stakeholders, and my staff and say, by the way, this is my plan for the next 90 days. And then them starting to think, oh, actually, David wants results. David's actually very focused in on certain things and certain things he's not even mentioning. That's interesting. And it makes them focus as well.

Yep. I want to hit on one of your 10 that I know we've both faced in our corporate lives as well as probably consultants and advisors. But negotiation. And we've talked a lot about on this show because we've had on attorneys, you know, chief privacy officers, and a lot of those relationships sometimes are not starting in healthy spots, or, you know, privacy versus cyber arguing over like not monitoring any data from a privacy standpoint and really needing some data to understand if your data, your, your IP is walking right out the door. So give us your thoughts and, um, tips on negotiating and influencing and building those relationships?

Oh, listen, I think I can talk about, without identifying where, where, where the examples are, um, lots of cases where, you know, you've got to stick to the facts and, and you take a position which is, I think we need to be here, okay? Um, and so I can talk about two examples. One, one case was, um, which is a while ago, but it was HSBC, and we had We had a bot attack actually in America on our mobile banking system. And so, you know, we did some research and said, oh, actually that's really bad. Bot protection did not exist at HSBC in America at the time. And so we then said, actually, oh, we have the same, we had the same software versions in 4 countries in my, my part of the world in Asia-Pac. So, you know, go back to the CEO and said, by the way, We got a bot attack here. We need to actually put in some MFA and we can put in Mickey Mouse MFA, which is, you know, the CAPTCHA stuff, which is that much code and that takes 5 minutes. I'm not asking your opinion because these are CIOs that I used to be a CIO, right? And they're like, oh no, my customer experience is so important that I can't do this. I said, sorry, I'm not asking you, I'm telling you. You can only negotiate when, not yes or no. 'cause this is actually a serious situation that your whole digital experience will break down like the US has. And so, that was actually quite interesting 'cause they're my old peers, right? The CIOs who just said, oh no, we can't do this, impossible. And I was like, what do you mean? And so, this, many examples like that where people have got a view of the world and you gotta just change that. I mean, another case was just asking questions about, Tell us, tell us, tell us, what was the Colonial Pipeline? Is it May 2021? It was, right? So I came across this, I was at 4 in the morning, I was up early with my iPad and I pinged the SOC later and said, okay, this is really interesting. Can we, can you tell me about how we, the IOCs for DarkSide, how do we capture that, right? And look, you're busy now, so just come back. Eventually, after a few weeks, I said, look, can you show me your playbook? Because he didn't come back to me. He showed me the playbook and I was kind of horrified how bad it was and said, look, let's, let's go and work and rebuild that. Okay. And let's go and let's, let's test it because you haven't tested it. Right. And so that role, that says I should— I was actually a risk person asking the CISO and his team. And then eventually they rebuilt that ransomware playbook. And then we were then asked 6 months later by the board. The board says, hey, Can you show us your playbook? Can you show us? Have you tested it? Show us your results. And we did a page turn, page by page. And I then turned and said, by the way, aren't you happy we did this? Because we would have been fired. Both of us would have been fired, right? And so that was— it's kind of tricky, right? Because you want to do the right thing, not throw people under the bus because that's the wrong thing to do. But how do you progress the organization and that this is the right thing to do? Then actually it's not a negotiation. We're just going to say the facts speak for themselves.

Yeah, David, it's great. So a question I like to always ask our guests are a couple of things. You kind of, you kind of already alluded to it, so I think you'll have a great answer for this. I'm keeping you up for, for great, for a great answer right here. But over the years, you know, there's a lot of focus on technology and tools, but, um, at Reveal we have a lot of belief in like people and process and the things that enable the tools. So Thinking over your career and your tenure, is there a time that sticks out when a process or people won the day versus a specific technology?

Oh, it's always that. And I mean, the tech piece, HSBC spent $1 billion on tech transformation over 4 years. Okay. So we were just buying everything. And as you know, right, it's about embedding the processes. And having the people understand this stuff. So, um, a really, really good example maybe is actually that we'd, we'd bought something called Secure Code Warrior for DevSecOps, and, and that was part of the journey. And HSBC had 25,000 developers. 25,000, just a lot of developers, right? Across mainly India and China, but all over the world. But the two centers had probably 20,000 developers. And so, um, And I said, that's great. We've spent all this money on licenses. And so you're telling me that actually we've got a great DevOps, but we've got about 20% of our code being scanned and about 20% of our staff have been trained in this stuff, even though we have licenses for $25,000. We haven't given a carrot or stick. We're giving them free iPads and, you know, all this nice carrots to go and do this stuff. And I said, well, no, no, that's— you've been screwing around for 2 or 3 years here. I'm going to mandate this. I'm going to say we must have everybody trained as a white belt. 25,000 people for the next 6 or 7 months, and we have 10% of those people as yellow belts. And, and I'm going to start hounding every CIO that owns these developers. And so we get it done by December, right? So to me, that was actually— we got the tech, let's get people in place, let's put in some, some structure to say we identify sort of a yellow belt, white belt, green belt, black belt, and we sort of say, here's a Here's how we need to get to the black belt level. You need to be good at this and you need to have, you know, be mentoring people and embedded in the pods and, you know, try to put that whole mechanism. And also, by the way, we don't want 20% of scanning, 80%, 80% code is probably the best practice, right? Let's go towards that. How do we do both the theory and also the practice to advance at the same time? So that was fun. We got there, we got to 95% in 6 months.

Excellent.

But that's, yeah, it's all about data, right? And making people accountable to say, sorry, Aaron, why haven't you done it? Why is your team behind? You're not tracking towards your number and making them accountable.

That's awesome. That's really, really good. So kind of following that, that's the, you know, over the time you spend. But let's say you're going to get one phone call tomorrow. I got a special cell phone I get to hand you. And you get to call yourself 20, 25 years ago, early in your career, what are one or two things you're telling yourself that you've learned that you say, hey, if I could call myself 25 or 20 years ago, what are you telling yourself?

So I'll go back to 30 years ago, Cody, because 30 years ago I made a decision to be a CIO and I was tossing up. I walked into a garden. It's in my book, actually. I walked in the garden in Kodawaji in Kyoto. and it's the most famous Zen garden in the world. And in this garden, there are 13 or 14 rocks that are sort of positioned strategically, and you sit there and look at the rocks and contemplate life. I walked in with 3 job offers, right? And, and 2 was to be consultants, one was to be a partner with EY. And I was 35 years old and sort of, you know, I'll be a partner next month, you know. So, and they give me a signing bonus and, uh, all the nice— put me through an MBA and, you know, studied, toured the US, it was They're throwing, throwing at me, right? At the same time, Lilly was saying to me, hey, come be a CEO with us and we'll send you over to the world, maybe send you through an MBA and then afterwards send you to China and Japan or US, which is what I did. I became CEO for China, Australia, Japan, Asia Pac, US, et cetera. And that, that was the decision I made then. So to me, sitting in that garden 30 years ago, I was like, am I making the right decision here? Am I, am I, I'm chasing a career not money, you know, not money and status, because probably more money and status now to be a partner than to be a CEO for a little Australian company, right? Not the US at that stage. But for me, it felt right. It felt like, you know, Lilly was a great company doing great things for health. I felt aligned with that. And I said, okay, I want to do this. This sounds like a really interesting opportunity for me to take on. And so back to your question, Cody, it's around, you know, back yourself because, you know, if your instincts are right, you know, try to make those right decisions. Um, don't do it on dollars, do it across, you know, the whole gamut around your family, lifestyle, um, learning ability, you know, because I, I think, you know, that what turned me off being a partner in a law firm— sorry, EY Consulting— was I thought at 35 I'd retire, mentally retire. I'd be then protecting my turf, right, trying to protect my, my income and revenue. And not keep learning new things. And that scared the hell out of me. I didn't want to get to the stage of retiring at 35 mentally.

Yeah, that's great. I mentor a lot of young men and women in cyber and IT, and I feel like cyber is kind of nebulous, you know, to get in from the outside. And sometimes people think you have to be technical, you know, to get into cyber. So I think that's really cool of kind of what you said. And I would totally agree that focus on what on learning and growing, and the value will find you. But, uh, you chase, chase the dollar, sometimes those, those paths end, and then it's hard to pick up again.

Absolutely.

It's hard to also just kind of have a comment on that. I've seen people for the money in the wrong job, and the motivational fit is clearly off. And it's— if you can't find your passion from what you're doing and wake up every day and get excited about it and continuously want to learn, if you're If you're just distracting yourself and getting your— getting through the day and kind of bumping along, you're not going to probably achieve your goals. You're probably not going to be overly successful. And even if the money is there, it's probably going to plateau. So I totally agree with everything everyone's saying. And I've— again, I've, I've probably at certain points in my career, like, been in the points where it's, oh, this is the wrong job, this is the wrong fit. And the sooner that you can know that and kind of make that pivot to get back to something that's more getting you into a place of thriving, the better.

Yeah, which is Aaron, I think I talk about in my book and I often sign, you know, sign these covers and I write, you know, keep striving to be uncomfortable. Uncomfortable means more growth and it's kind of counterintuitive, but actually if you are comfortable, you're going to just sit there and you float because it's easy, right? Life's easy versus actually I don't know what I'm doing. I need to learn fast. You know, I've got the, Great example I talked about in one of the chapters is around being a CISO at HSBC and volunteering to be a CISO after being a CIO for so many years to say, I can do the— keep doing the CRO, but actually I'm bored with that. I've done it for 20 years. I want to do something different. And so to me, being a CISO where I don't know everything, I need to learn fast and I need to engage the business and get them to help transform and the team to transform was the challenge for me.

That's excellent.

Yep. David, hold that book back up for a second. I do have one question. So, I've got my copy. If individuals order the copy, I'm a skier and I see the gondola, will you guarantee our listeners that they will be on a fast-track gondola to the top of their mountain? Is that the imagery you were going for?

It's a really interesting question. And I designed the COVID as I said that morning and I was thinking about I get blue sky, you know, the further you go up the mountain, it gets kind of cold and sharp rocks and it's not very nice, which is what it's like in the C-suite. Okay. And so I got up to the publisher, sent me, you know, iStock Photo access and I'd went onto their little search with sort of AI, not really good AI. And I'm looking for a, you know, a gondola that goes left to right, that's up, not down. And I want a blue sky background and I want this sort of snow and whatever. And I kind of had picked about 5 different pictures and showed my wife. You know, she was still sleeping. It was 6 in the morning. And then when the artist got this, he said, "Oh, you know, I've removed the safety line, David, because it was— it made the photo look kind of ugly." I said, "No, no, it's great because there's no safety line in these jobs, right? You just fall." But I think that in the day, the guide is meant for people to help them. Not everybody wants to be at the very top. Some people are actually okay to be at base camp. 'Cause, you know, further you go up the mountain, the Everest, right? It gets— there's no oxygen, it's life-threatening. So base camp's okay for some people. And so a lot of people read the book, say, I don't wanna be a CEO or a CISO, but I wanna be close to that role. And so the book's more about actually how do you become the best version of yourself and grow yourself beyond where, where you think you could be. And so if I look at my own career, have I gone further than I thought I could? Absolutely. And, and I think I've also coached people to the same point where They didn't believe they could be a CRO or CSO, but I've coached them to believe that by actually then them understanding, identifying what is it I'm not doing and how do I round out those rough edges that otherwise would stop me being a CRO or CSO.

I love that. Yeah, I know the only analogy that you might throw in there is the gondola has one compartment going up and one going down. And there's a joke or something in there about like for those that get near the top and don't like it, they might either choose to ride back down or be sent back down.

So, yeah, it was interesting. There's probably— I haven't seen the details here, but there was, um, when the photo came back, actually, the actual version going down had no one inside it. And I asked the artist to add them back in again. Because the reality is, you know, some people choose to go down, right? You might say, for lifestyle, for family health reasons, I want to go not up, I go down. I talk about this as a using the elevator analogy actually in my book, which says that sometimes you're open to the person calling you, so the door's open or the door's closed, or you actually just hate your boss, you press that panic button. There's different mechanisms, but up is not always the answer. Sometimes down is okay as well because it depends what you're looking for in that sort of holistic viewpoint. Great points.

That's excellent. David, we have one more question for you. Very, very important question here. So, um, for all of our listeners, I want to give them the VIP access and say, give us one fun fact of, of David that maybe everyone wouldn't know. So share either a story, a fun fact, um, but, uh, give, give our listeners something special here that, that's not, that's not super knowledge, public knowledge about you.

Hmm. Uh, I married when I was 20 years old. And so for me, being married at 20, at university, doing, you know, odd jobs, you know, pizza, barman, you know, whatever it was to make money. But then to me, then, you know, then saying, okay, I want to go and for my family, I want to go and buy a house and do all the right things. But, um, but inside I had this drive not to ever be stuck in my job, never, never to be stuck in one company. So when banks offered me a job, I thought, I can't take that because the banks will offer me a job and I'll have this half-price loan, I'll never be able to leave. So I end up working in banks later in my career. But it's kind of intuitive, right? Because the safe answer is to go to the safety, which is take the job with the 7% loan, not 15% loan, and because it's, it's, it's, it's a high incentive. But I said, no, no, I'm going to resist that. So to me, the fun fact is around know yourself, know what, you know, what, what drives you. For me, it was actually, I know if I make I get lazy and floppy, right? And I needed to keep pushing myself. And so that was sort of a fun fact, Katie, that helped me drive. And I think, you know, being a young dad also meant that I had to learn how to, you know, how to teach my son things. So my son, you know, at the age of 12 could read books, he could play the violin, he could swim because we did all this. Things with him. So, my son, the first music he heard was Mozart and he didn't talk about dogs. He talked about this is a Wind Mariner, this is a Dachshund. You know, he saw books on Monet and this is the age of 12 months, by the way. He saw Manet, he saw Picasso. We showed him things because we said we don't know what we're doing here. And, I realized very quickly that actually all the techniques I learned to teach my son to enhance faster than schools because, you know, you don't get to school until you're 5 years old, right? At 1 years old, he could read, right? And, and, and I said, actually, you know what, all of us can actually enhance ourselves if we choose to. We've just been told you're not that good, David, or you are that good. And yeah, and, and I, I learned early in my life, actually, these guys were wrong. They got it all wrong. You can break these molds. And that's why I've kind of, you know, done my own things in my career and, you know, written books and things that people probably thought they'd never could do because I always challenge myself. And wanted to never be put in that little box.

That's excellent. Excellent. Well, sir, I want to thank you again. This has been a great episode and we appreciate you spending the time with us. We know you're very busy and blessed to have you here on the US side for a little while, this side of the globe. So thank you again for the time.

And lovely Vegas. Maybe he's in Paris now. He could be, you know, at the Sahara Desert. No, I think that casino went under. So Thanks so much, David. Appreciate it.

Thank you.

Thanks, David.

Cheers.