Simply Solving Cyber - Beth St.Clair

All right.

Thanks for tuning in to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Teddy Guzik.

And we are here with today with Beth St. Clair. She is the owner and principal of ACT UP Consulting. She does leadership development coaching, is an improv— improv—

improviser.

Improviser.

We'll improvise that word, Aaron.

Yeah, that wasn't very improv.

I was going to say, let's start over, but let's just leave that in. That's just part of life. And that's good. Awesome. And you might say this is a little bit unique for a guest. And Beth was like, what am I going to add to this show? And I think with cyber burnout and leadership and finding your way in cyber is so important. We get so many requests in some of the topics we do to talk about burnout just because it's such an endemic in the industry. So I am happy to introduce Beth St. Clair. We're going to get into a conversation and talk about burnout. We're going to talk about how she's used improv and other skills and leadership to work through that, and we'll go from there.

Sounds great. Thank you so much for having me, Aaron, Teddy. It's a thrill. And when I sat down, I just wanted to clarify with them that I don't know much about cybersecurity, but my area is around leadership development coaching. I'm an improviser and have, I'd say, a key theme with my one-on-one coaching clients the last year really has been burnout. So I think it's a topic that every industry is facing. And I know for me, I have had the experience of burnout. Aaron, I know you have as well. So would love to just share that experience and perhaps some of the little tricks and tips that have worked for me over time.

Yeah, let's start there. And then Teddy and I can tell you a little bit more about burnout in cyber, and maybe you can help us and our listeners learn a little bit more about how to apply some of your learnings and skills to their experience wherever they are.

Yeah, I would love that. I would love to brainstorm with you too. So yeah, I had a career in a top consulting firm and I absolutely loved it. I graduated from an MBA program at IU and I was like, put me in, coach, whatever you need. Started at, at this company and really felt like I was willing to put in whatever it took, work on the weekends, work late, because a couple things. I loved the work. I felt like my talents were being utilized probably every day that I showed up. And I had a really strong community. So I had people that I trusted that were looking out for me. They had my back and vice versa. So that went on for a number of years, sort of, if you think of employee engagement, I was probably the poster girl for that, like the highest level of engagement you could have. But fast forward some years later, that company merged with a larger company and my world completely completely shifted. I found myself on this large-scale technology project, which if you know me at all, and I know this is funny for your listeners, you would say, that is not a good fit for Beth. My talents were no longer being utilized. I kind of became a bit of a number because I was on a project that had multiple contractors and I no longer felt connected to a community. So some of those elements that were there for me initially sort of just stopped. And I went from this top performer to someone who is feeling pretty disengaged. And so for any of your listeners who have felt that way, I just want to tell you, I get it. Like, it can be a very difficult spot emotionally, especially if you're used to performing really well. You're kind of asking yourself, what went wrong? What did I do?

What were the trigger points when you started to see it? Maybe early on, or maybe if you didn't see it, but in hindsight you were able to see it better.

Yeah, it's so much better looking back. I think you have the perspective and clarity. For me, I started to have— Aaron— these like physical manifestations. And I don't think for your listeners there's one sort of checklist. I think depending on who you are and what you're experiencing, there could be many different triggers. For me, I started to have back issues, which as a young person was a little bit of a clue of what's going on, to the point where I had a back spasm at work in my office, which was not ideal. It kind of forced me to slow down a little bit, which I think was good. Another thing is I had these, like, you know, the Sunday blues that people talk about. Oh, it's Sunday.

Scaries. Yeah, those scaries. Sunday scaries.

I had that times 10 and I had not experienced that before. If anything, I was excited to go back on Monday. And so that was new, this feeling of dread. That I didn't want to go in. And then lack of self-care. I think even the busiest times that I had in the beginning at that company, I was still finding time to see friends, to work out. All of that started to go away. And there's this feeling of, where's the joy? Like, isn't that— where's the love? Where's the joy? Yeah. So yeah, those were some of mine. And so Yeah, so, so kind of found myself in a little bit of a funk. Um, and so I was telling Aaron and Teddy, for your listeners, that there's lots of different ways to tackle when you're in that situation. But just by luck, at that time, a friend of mine said, Beth, why don't you take improv comedy? You're not doing much in the way of fun or something interesting outside of work. And that's really counter to me. I'm much more of a planner. So it was scary and I was a little hesitant, but I did take that class, fell in love, took all of the classes and even started an improv troupe and started performing.

Were you into comedy prior or was this just like a leap to get out of the funk?

It was a leap to get out of the funk, Aaron. So yeah, some people ask me like, oh, you probably did theater in high school. No, no, no. None of it. Not until my early 30s did I. Try this thing. But what I found is, um, I found the joy, I found the love. Um, what was happening in those improv classes was something that was so, um, delightful and in some cases felt magical. And so I started thinking about, well, what's so good about this? Like, why is it so good? And what I realized is there's these kind of principles or skills that I was being taught that then I started showing up in that way at work, which made work all the more inspiring. So things like make your partner look good, give control and share control freely. Yes, and accepting offers and building on 'em. So I would say at least temporarily that became a bit of my saving grace at the time, 'cause it started to trickle into my day-to-day at work.

Right, awesome.

Yeah.

So then it helped you. And then I think as your story evolved, you got the idea to maybe compress some things together. Tell me about how that unfolded.

Yeah. And so I think for your listeners, there is not— I don't want to say there's one path. My path ended up being a shift out of the company and to start my own thing, if you will. Right. I think any time you're in a place of burnout, it's an opportunity, number one, to rest. To find a way to pull back and rest, but also secondly, to reflect what's not working. What is it that I really want? And it's a little bit of like some soul searching there.

Did you find before you made that leap, it was tough to find rest if your mind was worried or concerned or in burnout mode? Sometimes it's like, I just can't get any rest even if I try.

Yeah, it's kind of that notion of it takes a week on vacation to just get into vacation mode. And so people say take 2 weeks if you can. Yeah, we're, we're in a vicious cycle in some ways. And so how do you get off of that? I think it's a, it's a challenge. I know at my company I was looking into a sabbatical. If your listeners have that opportunity, that's a great way to really step away and get that soul searching in or have that reflection. Because I don't think a few days does it if you're really in the depths or the grips. Um, so I wanted to just give a couple practical things to think about because not everyone has that opportunity to step away for a period of time. So, um, in my work I have discovered what I think is a cheat sheet, and I don't know sometimes why more people aren't talking about this, but Gallup is an organization that does a ton of research around employee engagement. And when we talk about burnout, it's connected to our level of engagement. So they have 12 factors that they've identified. If you Google it, you can find it, that if you do a little assessment on these 12 factors, I think that's gonna give you some aha. So let me give you an example of that. Um, one of them is I have a best friend at work. There's a reason why they call it a best friend based on their research. It might sound a little, a little crazy, but the idea there is that you have someone you really trust at work. And if you're in a situation where you're like, well, I really, I don't have that. Well, that might be contributing. So how do you cultivate something like that? Another big one is my talents and my strengths are being utilized every day on the job. So if you take a step back and say, okay, I'm feeling burnout and I notice that what I'm really good at, which is big picture thinking. I'm not doing that every day. I'm not thinking strategically. I'm just in the weeds. Great, great opportunity to talk to your leader about, I'm noticing about my level of engagement, are there other opportunities that I can get that really connect to my talents? So I'm going to give you one, one last example of the factor here, which doesn't occur, unfortunately, in a lot of the companies that I see, which is, I receive positive feedback on a weekly basis from my leader. Whoa, how many of us get that? But that's an aspect of recognition and acknowledgement of our work. And if we're not getting it, it leads to disengagement and potential burnout. So if you're a leader listening, you might think, oh, how can I step that up? Like pointing out your team and what's going well. If you're an employee, you might think about having that conversation with your leader, How can we give each other feedback on a more regular basis? So that's a place for your listeners to look, at least as a starting point.

Yeah, as leaders, sometimes we're in problem-solving mode so often, and it's— you got to take a step back and say, okay, you know, I've corrected some things, I fixed some things, okay, I've done a great job there, but how do you give that acknowledgement or the, the attaboy, attaboy to really help keep them going and say, what am I doing right? What do I want to replicate next week that I did well this week?

Well, Aaron, and if your listeners are anything like me, it's like MBA risk analysis, analysis, trying to find what's wrong with the situation. So the muscle that we have around looking at what's right sometimes is a bit atrophied. It's not natural for us to go there.

How do you— have you gotten into the book now, Discover Your Strengths? I think that, yeah, the theory of that is, um, you can focus on weaknesses but make marginal improvements. For people's like true weaknesses, you can always mitigate them, but the strengths is like how can you prop up the things that they do really well versus kind of continuously focusing on what's wrong or not happening well.

I'm such a big fan of that because if more people are doing strength-based kind of leadership, then your team is going to be doing all the things that fill them up, make them feel happy, make them feel engaged.

Yep. That makes sense.

I'm with you on that.

Awesome. So how do you help companies? So how have you applied your leadership skills and improv skills and kind of your own experience? How do you help companies through, you know, what, what types of challenges do you typically walk into that is like your bread and butter, the, the ones you, the projects you want to keep doing?

Yeah. Yeah. Great question. Do you want to talk about the burnout component or more generally?

Maybe a little bit of both.

Yeah. Yeah. I think the burnout comes out with one-on-one coaching clients that I have. So it would look like a coaching arrangement, potentially a couple of coaching sessions a month. Where we set goals and then in each session talk through real life experience, what's happening, what can we learn from it, move towards kind of meeting those goals. Definitely burnout has been a key theme. And one of the things that has come up around how to deal with that in these coaching sessions is just clear expectations and boundaries. I feel like boundaries are being thrown around, like that word is being thrown around and talked about quite a bit.

Overused, would you say?

Yeah, might be overused, but what does it really mean? It means I know how to work with you, Tenney, because you've clearly explained to me that you need to stop at 5 because of X, Y, and Z reason, but you're going to be back on for an hour checking your email, 8 to 9 PM, right? So if I know that, oh my gosh, don't you think that makes my life a lot, a lot easier? So I'm not expecting you to respond to something when you've already told me you're not going to be available. And I think if anything, COVID world has opened up more of that discussion because we're all balancing so much more in our lives, or sort of our personal or professional lives have mixed and smushed into this soup. And so it's a real deal that sometimes people in the middle of the day have to go take care of something that they wouldn't have had to have before. Um, so I think that's healthy. Um, I think it can be scary, guys, to set boundaries, and it, and it It comes down to, do we trust the people we work with that they're going to be open to that? And if they're not, I think it's worth asking, am I in the right culture? Assuming those requests are reasonable and you are doing a great job in your role.

All right. So, Teddy, let's dive in and get Beth's help on the cyber burnout situation. So, we were talking before we started the recording of what is the systemic problem So, maybe you and I can kind of share some of our thoughts and get Beth's thoughts on how to help our audience navigate or whether it's them that are in burnout or their peers or anybody that they may be interfacing with in the industry. So, from my perspective, I would say cybersecurity is a high-paced, high-volume job. Companies are catching up. A lot of companies are investing. A lot of boards have, you know, woken up to the fact that It's not an IT-only thing that their CIO can go solve and they don't have to worry about it, executive committee involvement. So the companies that are going all in, that adds a lot of pressure and stress and timelines are now 10 times the importance. Teddy, what are your thoughts on some of the root causes?

Yeah. So I think one of the main things has to do with it kind of being a thankless task, right? So what we're doing Right, so working in industry, right, if you're trying to protect a company, you— if you don't get breached that day or that week, right, it's just kind of expected part of your job. It's not, you know, it's not like you're enabling some business process or something along those lines to improve. It's really just, well, yeah, we didn't get hacked today, good. That's it. So I think from an industry perspective, that's definitely a lot going on. Um, from a consulting perspective, it's— I think it has a lot to do with, um, bill more hours, make more money type of thing. And that's kind of where your performance metrics lie, is in order to stand out in these organizations where you're, like you mentioned before, you're kind of a number, you've really got to stand out because there's a lot of achievers working in those types of fields. So you're, you're working a lot of hours trying to impress people, and I think that has a lot to do with it as well. Not enough pat on the— pats on the back and that kind of stuff.

So, sure. Beth, thoughts? Is this consistent with other industries? Is there any uniqueness that you feel, or is this just maybe an exacerbated focal point of, of the cyber journey that is a lot of the same things that everyone is facing in all careers?

Yeah, I think the, the unique aspect that stands out to me is this idea that if you don't get hacked, good, good job. And then if you do, bad job. So it's like you want— you're aiming for, um, status quo essentially, a little bit. And, and so the question that comes up to me then is, how do you set up structures where you're still able to give positive feedback acknowledgement of milestones, even if they're somewhat manufactured, and I mean that in a very genuine, real way. Can leaders think about, well, how do I set up some metric that when we reach that metric, we have kind of a celebration of sorts so that there's a sense that we are doing a good job based on the last 6 months, we haven't been breached, and maybe even taking it back further, like set it, set some of those up so that you can on a more regular basis. And you guys tell me if this is crazy and what that could look like if leaders thought that through. But so it's not one metric, which is breached or not, or breached, I guess.

Yeah, I think a little bit of perspective from my side, I think companies that are early maturity that don't have goals and they've not measured their maturity and they're figuring out, hey, we need to go from point A to B to C, I think a lot of times the IT programs that IT just owns it and they're very operational focused and it's like, hey, we got to keep doing more stuff to avoid breaches. To Teddy's point, that's typically when it's the thankless, hey, let's not get breached. And if we do, we're in trouble. If we don't, maybe we get recognized, maybe we don't. I think I like your comment of manufacturing milestones because at the end of the day, while cybersecurity is a protective function. We can also enable the business and help build things that make, you know, the company secure and also help them, um, you know, get things done productively. So it's almost like, how do you not be in a defensive-only posture and convert that to what are we trying to accomplish here and what does winning and losing look like? But, but I think the points that you raised, Teddy, is there's probably a lot of companies that don't have that structure they don't know where they're at and where they're going. And it's just a few people that are doing cyber and trying to prevent bad things from happening. Is that a fair representation? Yeah.

You're just basically expected to— I think it's also a lack of transparency, right? People not understanding how cyber risk really works and they think it's just a ones and zeros type of thing. And there's a lot more to it than that. So I think the awareness is coming and it's gotten better over the years. At least I've noticed that, but it's still definitely not even close to being there. Where we need to be.

I mean, I think another area that comes to mind is sometimes, you know, we're promoted to a manager or leadership role because we do really great technical work, and then we're expected all of a sudden to be responsible for this team and manage culture and manage individual performance, and we may or may not have the toolkit for that. It's like a real retooling moment. Actually, and I think it's okay for leaders to say, oh, I don't, I don't think I have— like, at a moment where I, where I was managing a team at that consulting firm, thinking, I don't think I have the skills for this, which is why I went through my coaching program. Like, I thought if I could get the coaching skills, I think I would be a better leader, a better manager, which I think ended up being true. But really, as leaders, thinking about what do I need that I don't have, and being okay going to get that particular skill, because leadership is a whole separate animal with lots of responsibility. So that's one thought. My other thought is just, I've seen a lot of leaders in the last year put burnout on the top of their list, put mental health and well-being at the top of their list. So when they're having their one-on-ones, they're checking in on that and offering support, asking how they can help. And really keeping a pulse, whereas I think before the pandemic, that wasn't as much on the top of the priority list for leaders. But I heard a leader recently say that individual well-being is greater than organizational well-being, which might seem very radical, but if your people are burning out and eventually leaving or exiting the organization, that's going to be a real problem, bottom line.

Right, or even Worse, they don't leave the organization and they create collateral damage.

Yeah, toxic environment that they're creating. Yeah. So I think if your listeners are managing a team and they're not yet having that well-being conversation top of the list, I would encourage them to do that because the closer that they are to that, the more they're going to be able to prevent a really bad situation from occurring. You just gave an example and also just prevent. So yeah.

Yep. So talk to me a little bit more about improv specifically, cuz that is, you know, one, a very cool, but a unique, um, tool to help, uh, people. And I know, uh, you have a passion for it given it helped you, but tell, tell me how that works in the business world.

Yeah. So, um, maybe the best way to do it is to give you an example.

Yep.

So we've all been kind of guilty of this. Someone throws out an idea in a meeting and we say, "Yeah, but..." And we kind of take the conversation a different direction. And what happens to that original idea is it kind of disappears. So that's called blocking. And it's something that in improv we can't do because if we do that, the scene literally dies and we can't go anywhere with the scene itself. So improvisers do what's called yes and. So that's kind of the mentality, the yes and mentality. And it's not enough to say yes, because Aaron, if you say, oh, we're going on a cruise together in a scene, and I simply say yes, it puts the pressure on you to come up with the next thing.

Yeah.

So the premise is we're co-creating. The premise is what we create together is gonna be so much better than what I create by myself. And if we believe that, then we have to let control a little bit on the outcome, 'cause I can't control what you're gonna say, Aaron, or you, Teddy. I gotta yes and it. So yes and is accepting that offer of the cruise and building on it. Yeah, and we can try water skiing. We've been talking about that for a long time. Yes and I'm not sure I wanna go 'cause I think I want a divorce. We can take it many different ways. All right. So yes and in thinking about a business setting, And also about burnout, right? It gives me affirmation, but I think most importantly, we're going to have a better result if we can yes and. And it's not to say that leaders can't block. I just think we've overused that muscle and we do it by default. So we say no a lot just because we're used to saying it, but really to stop and be conscious about, is this the time I really want to block? Because yes anding is going to get you further faster. Generally speaking.

Yes. And what else might you use to use improv in the business community? See what I did there? Not well, but I tried.

You yes-anded me. Do you want to hear about another principle or another idea? Yeah, sure. Yeah. So one is, and I'm kind of thinking through right now how this relates to the cyber world because I understand Teddy's saying zeros and ones, it's a little black and white, but view mistakes as offers. So still in many cultures, in many companies today, we're really scared of mistakes and, uh, we don't wanna make them, especially if you're struggling a little bit with perfectionism. That's like the worst thing you could do is make a mistake. In improv, we don't even have the word mistake. Mm-hmm. It's just offer. Teddy makes an offer and maybe he called me the wrong character name. I get to do something with it. It's is simply another word for offer. What if we had that view in businesses? Like, I took a calculated risk, I made a mistake. How can we stand that? Well, we can talk about what do we learn from that, you know, what do we gain, how can we iterate on that. And so turning it— not like turning it in a positive per se, but seeing where we can take it. What's the next move? So that's another— okay, another idea.

How do you— I'm really interested in that one. How do you draw that out of people to kind of take that seeming mistake, which there are no mistakes, but, and then vamp on that or iterate on how do you— yeah, maybe give me an example.

Yeah, yeah. I mean, some companies do, um, like mistake showcases, like a product that really flopped but turned into something amazing. So I don't have one specific that's coming into mind.

The 3M, the sticky notes.

Oh, that is one. Yeah, yeah, that was a mistake. The Post-it, they were after a different product.

They're trying to make the strongest adhesive, right? Or something along those lines. And got this reusable adhesive that, yeah, no, I've heard that one.

That's right. So what, what can this be if it didn't end up being what we thought? What purpose could it serve? Is there, is some, is there some value or utility? So asking that type of question, that's a good example. And yeah, the lessons learned. So a simple one is just someone makes a mistake, they apologize, we're kind of annoyed and we just kind of move on. No, that's like a huge opportunity. Take a moment and stop from the fast-paced life. Let's meet for an hour and talk about the postmortem.

Right.

Right. We made a mistake. What contributed to that? Okay, let's make sure we fix that next time. What did we learn? Can we still do something with this? So asking, getting curious, asking those questions.

Great. Awesome. So I guess lastly, how do people get in touch with you or how do you engage with companies, whether it be individual coaching or to do workshops? How do people reach you?

You know, it's just those— the webs, the interwebs. Um, I am @actupbeth on Instagram, and actupconsulting.com is my website, and there's a place on there if people want to get in touch with me. I love just talking with people, seeing if there's something that we can build together, so feel free to reach out.

Awesome.

And I hope this is helpful.

This is very helpful. I guess last question, um, what advice do you have for the cyber security community, whether they're in burnout, whether they fear getting to burnout, what is the key takeaway that you want them to kind of reflect on?

Yeah. What can you yes and about the situation? Yes and your burnout, and there's something there that you can learn from and likely take action to move forward.

Yep. No, that's good. It's almost a little bit, how do you make lemons or lemonade from lemons?

And— Yeah, there's usually a change.

—stuck in your moment. Yeah. Awesome.

And one more thing I want to add too, um, is I've heard of this, uh, notion of improv being a beneficial thing for business. Do you have any— so I'd say, let's say for the— in the Indianapolis area specifically, is there any good courses that you would recommend or any online courses or anything like that that people could take if they're interested in getting into this type of thing?

Yeah, that's a great question, and I've had people ask that. So, um, yeah, there's a couple avenues here in Indianapolis. I also want to mention, since COVID the world has opened up with online courses, even with improv comedy, stand-up comedy, things like that. So, um, Second City has a whole catalog now, which you used to just have to go, right? If you're in a different place, you have to travel up there from Indy to Chicago. Now you can access them and be a part. And I have taken one of those courses recently, and I was, I was wondering how it was going to play out in that virtual world, and I got a lot of value out of it. Nice. So even places like the Groundlings in LA, that's also a place online you can check out.

How about locally for those in Indy?

Is there anything? Yeah, there— can we put it in your show notes? I have a couple ideas. Yeah, absolutely. Yeah, we'll do that. Yeah, and I'll send it to you.

Awesome.

There are a couple resources for this area too.

Thanks so much, Beth. I like that this was unique. I like that this was different, and I like that you're helping people now in cyber, but even beyond that. It's such an important thing, and we really appreciate you coming to share your learnings. Oh my gosh, thank you.

My pleasure, guys.