Simply Solving Cyber - Jennifer West

All right.

Thanks for tuning in to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And we are here today with Jennifer West, who's the CISO at Catalent Pharma Solutions, which is a pharmaceutical contract manufacturer for a lot of the large pharmaceutical organizations that outsource or augment their, their manufacturing of pharmaceutical product. Welcome, Jen. How are you doing?

Thank you. Awesome. Thanks for having me.

Yeah, we're excited to chat with you today. So we'll get right into it. And we like to always kind of start with the storytelling about yourself and how you got into cyber and how your career has evolved, because a lot of our listeners are new people coming up in cyber or leaders that are looking to get to the next level. So give us your background.

Yeah, so I definitely did not start out my career thinking I would be in cyber. So I am one of the CISOs that got voluntold to be a CISO at some point along the way. I have been in IT for 30-ish years, so telling my age a little bit there. I landed in IT very early on. I got into online banking before that was an actual thing. We moved from PC banking, which was like a CD, to the internet. And I learned, had to learn how the entire bank worked. So I learned all the backend, how we presented on the frontend to customers, making bank, banking work virtually. And then I—

And when you, you got into online banking, I was gonna ask, did you hack your way in or not?

Well, I definitely, that, that was later years. Ethically, of course, but definitely ended up staying in IT. Even I had kind of set out to be pre-med and was going to go the doctor route and ended up loving what I was doing in IT and stayed in IT all this time. Moved around different companies and, uh, landed at ServiceMaster, which was a privately held company at the time. And, um, they decided to go public during the time that, uh, I joined and make a change in their CISO. And I got voluntold to be the CISO, and little did I know that literally changed the course for the rest of my life. I, at the time, I didn't wanna be the one leading the office of no, or, you know, all those negative people in security. I just didn't wanna do that, but I was very determined that it wasn't gonna be that kind of shop. And I really got the ability to grow and build that team and then have for 3 companies since then also been the CISO and really enjoy what I do. Cannot imagine doing anything different. So kind of didn't start out— CISOs weren't cool either back then in IT, like that. Security guys were always the ones in like the basement, never got any budget, you know, it kind of became cool after the Target breach and some of the big public breaches that brought security to the forefront. And so it's been really cool to kind of be in the middle of that during my career, you know, watch it turn into something that everyone wants to do.

Yeah, we've heard a lot of, well, actually a number of CISOs on this show that have mentioned the first role as a CISO was voluntold.

Yep.

When, when did it click for you that like, hey, I want to stay here? Like, this is what I want to focus on.

Yeah, well, I was really trial by fire. We took the company public and I was a first-time CISO. So, I really had a lot of learning to do on the job, but I would say even after the first year where I got pretty comfortable in the cyberspace and got comfortable with the employees that worked in cyber, I realized this is an endless topic. Like I was going to be able to learn. And I really am that kind of person, like to quench my soul, I really need like constant teaching, constant learning, moving, changing. I'm not really, I don't like to stand still and cyber gives me all of that. Every day it's something different. The type of people that you work with are amazing people. I have gotten to work with some wicked smart people along my journey and that just pushes me to be better as well. So I just, I realized pretty early on, I think I actually have kindred spirits with people that were in cyber, and I wish I would've known it sooner. But I am grateful for the person here who put me in that role, and it literally did change the course of my life from there.

That's excellent. So then, so coming up from the technical side, did you out of the gate, did you kind of own infrastructure? Did you work on the technical side or kind of talk about your first few roles in CISO and Yeah, so I did not own infrastructure until Catapult.

And even when I joined Catapult, I didn't have infrastructure at first. That evolved over time. But, so I've always had the security side. I've always had to work with infrastructure as a partner and figure out how to weave security into what those teams were doing. And I would say it didn't always work very well. There's a lot of us and them type mentality with cybersecurity teams and infrastructure teams and I literally was just determined I was going to break that barrier down no matter how many donuts I needed to bring or lunch I needed to bring in. We were going to break that barrier down. And I do see it getting so much better now that infrastructure has so much— you have to build cyber in just out of necessity for cost. You know, I think that the relationships are getting better and you're seeing a lot of infrastructure people turn into cyber people, which is, awesome. And I think helps, you know, kind of stand up our piece of the world a little bit stronger.

That's excellent. So talking about how your thoughts have progressed, do you think it's better for the CISO to take on CIO roles or the CIO to take on CISO roles? What's probably the more—

I think I'm at that point in my career where I kind of need to make this decision. A lot of people tell me I should be a CIO. But I, you know, my heart's just not as into that as I am the CISO role. I really love what we do, but I do think a CISO and a CIO have really got to partner. It's a, it's a little bit why I think the model should change and the way that we're seeing traditional companies set up, you know, usually the CISO falls under the CIO, or maybe they don't even have a CISO title. Maybe it's a director of information security or something like that. Yeah, I would really love to see things evolve in our, our career. And we are seeing this starting to happen where CISO has the same seat at the table the CIO does. We have the same responsibility to protect the same revenue the CIO does. But adding a CISO to the table helps someone think about things in terms of risk instead of in terms of revenue, which you need both sides of the coin to make sure that you're covering all of that. The key, I think, is to get a CISO that's willing to take some risk and be able to adjust to it, but at least present that side of the story with the other leaders at the table.

Yeah. And I think too, in our prep call, you were kind of mentioning how some of the valuable experience you gained early as a CISO sometimes or often is more experience of, you know, kind of building with a scrap budget or, you know, a little more—

Yeah.

That's just like, yeah, as a newer seat to the table, you know, you don't have the predefined budget or you're always fighting for dollars. And so, yeah, I think you have some good context around like some of those skills that you developed.

Yeah, I think, um, like I was saying, the CISO is still accountable for protecting the same revenue the CIO is responsible for delivering. So it's really important to get the same part of the budget so that you can grow and mature the program to be able to protect it as necessary. Um, but yes, definitely have been used to doing more with less and figuring out how to stretch budget for the cyber side. It's one of the reasons that I love staying in cyber. We're super creative people and we have the ability to really kind of do more with less and figure out how to still do it without budget. But I also kind of enjoy the budget arguments, to be honest. I think because it's such a different perspective for reasoning and why we need budget, I enjoy making the business case for that and really showing the value to the business.

So I don't want to, I don't want to beat a dead horse on the reporting structure, but if you were in a, let's say a pharmaceutical company with no budget constraints and Jen West got appointed to a special project to design the full org structures and make it the way that you wanted, where would, where would you report and what kind of boss would you work for?

Yeah, I definitely think I would report to the CEO, no different than any other C-level. Being the executive leadership team where I'm able to help make decisions around mergers and acquisitions, divestitures, a lot of the risk profile of the company. I think, you know, really just giving a bigger voice to the security side of the house. Now, I also have risk, so I have IT risk. We have to register all of that. I also have parts of compliance. I have parts of, Governance. So it's a bigger thing than just the cyber piece. So it's bringing kind of all those hats to the table and partnering with, uh, the CIO or whoever the other C leaders to be able to deliver the best services, but also make some really solid decisions for the company.

Well, that's great. And so you said, you know, it's, you love cyber, it's always changing. It's, it's kind of where your pull's though. And then you've also had, you know, limited budgets to work with. So that tells me you've, you've gotta be creative and you've gotta be kind of, you know, ear to the ground, what's coming up next. So I would say over the past, like, couple years, what has been your focus and kind of what topics in cyber excite you most? And, you know, what, what are you seeing right now?

Yeah, I'm gonna say AI, which is so boring. I'm sure everyone would say that, but I think it presents a new challenge for us in really making sure we don't have a data breach or information that is not accurate, that is learned through AI. I think just trying to solve that puzzle and how we're going to take care of that is— it's going to be evolving, right? We're going to see that grow and change over time. I'm super excited about the technology of AI. I think the way it will enable our business and people in general is amazing. But the cyber piece of me cringes just a little bit, and I'm super worried about privacy and data breaches and things that may not be as easy for us to protect against right now.

Yeah, we, we, we have an endless amount of questions that come through on AI. I mean, I, I think you and I probably, and Aaron, find it very interesting, but I'm sure people in general are tired of hearing it, but it's like, how do you secure something that can in turn make rules itself? So you're making rules for We also make rules.

Yeah. And you know, it, it really goes back to the thing that's the hardest for CISOs, which is hardening the human, making sure the human side, you know, really acts the right way with AI and uses it responsibly and feels as much the need to protect your company and its data as they would in their personal life. I think it is interesting to see generations coming though. They're, they don't care as much about privacy and sharing all kinds of data. They, that's just how they live their life. So watching how cyber pivots will be interesting to me. And, um, you know, so I, that's really kind of keeping me going. I, I could say DevSecOps too, and some of the different frameworks that you can look at across cyber. And then of course, I always love red team, blue team, ethical hacking, some of the things that we get to do that are on the fun side of cyber. But there's still a lot of foundational work to do in cyber as well to make sure that those primary controls are met and that you're, you're just consistently maturing.

Funny, just mentioned the thing about the, the privacy. Aaron and I, before the call, we were just talking about like, I use Chrome and he uses Safari and, or he uses the Firefox and he was like, oh, you know, the Gmail, the privacy thing. I was like, I don't care.

It's like, you know, at this point it's like, I'm so happy how many people are. No, no, my kids, my kids literally don't care. I'm always baffled by the stuff people share.

I'm like, I'm pot committed at this point. Wife has it. We have the Google Homes. I was like, ah, you know, they've got me, they got me targeted.

Yeah. I held out. I actually finally put Alexa in our home just so I could be playing with it and really understand how it shares data and, you know, kind of embrace AI a little bit and I don't love it though. I just, because you've just been taught to not share that information and to protect it. So it's, it feels like going against the grain, but I think we have to do it to evolve. And it'll be interesting to see where cyber goes.

Yeah. Jen, you mentioned the term hardening the human, and I both love and hate that analogy. Yeah. Because obviously it hearkens to hardening servers and locking things down. The counterpoint or kind of how I, I, I believe that's required and table stakes, but I think our industry as a whole is missing a, missing a whole different vector with people on empowering humans.

Yeah, for sure.

And it goes back to your initial CISO role of you didn't want to be the office of no, but I feel like user experience for, from a cyber standpoint for the workforce or outside customers, if that's the, you know, the users that you support. I think that there's a lack of focus, the OCM that goes around it, the, you know, making the compelling case to make cyber approachable. What are your thoughts on that? And unfortunately, I know sometimes that's the first thing to go in budget cuts because I've lived that both on the corporate side as well as on this side of the table. What's your thoughts on innovation or the need for the focus on this?

I think this is super critical. The way you empower people is by giving them data. If you can help them understand security from a personal perspective, you can hope that they will bring that same perspective into their corporate life and treat your company data the same way. I think it's really important to make cyber explainable and, you know, for people to really understand it and how it can affect them. But I do think that is one of the first things to go in budgets, and it's unfortunate. But I also think cyber teams have learned to pivot with this and kind of do more with less and come up with their own trainings and spend their own, you know, tabletops and lunch and learns, things like that for the topic. But I do think a robust security awareness program is really critical.

Yep. That's a good point. What have been your biggest wins as a CISO, whether that be current role, at large, across all the roles you've done? What are you most proud of? And what are your biggest wins?

I think I've won a lot of battles, so a lot of technology battles, even when it came down to maybe arguing over, you know, Cisco and Palo Alto, or it just a bunch of different things along the way for technology purposes. But I would, I think my biggest win is I've been so fortunate to work with great people and I've been able to build those similar teams at most of the places I've been. So I think my biggest win are the people. I mean, I just love working with the core group of team, the team that I have right now. They're the best of some of the 3 companies that I've been at before, you know, but building the right type of team that has a good dynamic to be able to work together. They're all very different. They bring different skill sets to the table, but I think that's That's been kind of the biggest win for me. Um, definitely, I'm sure the flip side you're gonna ask, or what are the biggest, you know, what's the biggest learning points?

I was gonna say, you know, you know, of course, like, uh, I'll, I'll probably, I'll probably get the negative side of the question. What I, I will, I will skin it in a great way. What are the, the best lessons learned? So, you know, it's not, it's not a mistake. We just learned from it. And then can you like, you know, articulate based on lessons learned, things you would do differently based on those lessons learned?

I have two really big ones. I've had a lot of lessons learned, trust me, trying to become a new CISO and take a company public at the same time. So I learned a lot of lessons the hard way, but there's two that I really kind of focus on. One is when DevSecOps came along, I think cyber was just kind of, was supposed to go along with it. And really just fully subscribed to it. I think that was a mistake on my part. I feel like we, I needed to find a healthy balance between what we could do in cyber, both financially and technically, 'cause the DevSecOps tools can be very expensive in the cyberspace. Find a little hybrid of what worked best with the company. And then I have since adopted that methodology and it's worked a lot better. You know, really kind of focusing on that. The second lesson learned, I'm learning right now. So I actually own infrastructure now. I've owned it for about 8 months and I am eating my own dog food. Patching, bit, CIS benchmarks, CIS room, like I'm actually the owner of the infrastructure side. I don't think it's the best structure. I definitely think mixing cyber and infrastructure maybe isn't the best model for every company, but it's been a good model for Catalytic. I think our cyber team has learned the infrastructure side. The infrastructure team has learned the cyber side, and we're making cyber people out of some of the infrastructure piece. I even have one of the cyber leaders leading operations for infrastructure. So I think I've learned a whole new perspective of what I've been asking my CIO partners and my infrastructure leaders to do and how that might impact the business, even though I knew I didn't fully know because I'd never led it. And had to prioritize budget again for the infrastructure side to meet what my cyber partner was asking, right? So I, I'm wearing both hats and learning the lessons as I go along. And I, I'm really grateful for the opportunity because I feel like in the future I'll be a better CISO for understanding the infrastructure side. Yeah.

I mean, put that into future terms. How will you work with the infrastructure lead in the next in an opportunity in the future where you don't own it like you do today?

Yeah, I think, you know, really trying to solution together and understand the risk of what we're asking to be done. I think that's where having a really robust risk program matters to, you know, figure out what really needs an exception. You know, what are the technology solutions you might be able to do to not impact the business, like segmentation, you know, really exploring options more than saying you have to patch by August 19th or I'm turning your stuff off. You know, I think it's a different approach that I'll take next time and really a more risk-based approach than maybe I had thought of in the past.

Wow, that's great. So a lot of our audience, as I alluded to earlier, you know, would be earlier into cyber or aspiring to be a CISO. They're already in cyber and they're growing as a leader. What recommendations for them and how they approach relationship projects, cybersecurity as a whole, would you have for that future guard?

Yeah, first I would say you're welcome. A lot of us have ate the path for you already. Becoming a CISO now is much easier and it's, you know, it's a cool thing now. Like, definitely was not always that way. I do think just really staying in touch with people, your company, really learning the business side of your company, not just the technology systems. You know, making yourself part of the fabric of that company is really, really important. And a lot of cyber teams tend to parse theirself off and it's, you know, us against them type scenario. I think never go in with that mindset. Right? You are a part of the company, you're a part of what makes it successful. And, you know, really kind of be a team player. Back when I got into even IT, I think I was telling Aaron and Cody earlier, I had to learn to play golf and drink beer because that's what all the leadership team was doing. And that's where some of the best deals were made, right? I think CISOs today don't have to do that, right? They just need to be a team player with the rest of your business partners. And figure out how to deliver cyber in a healthy, safe, and not overly expensive way. I think keeping it minimal is critical too. A lot of cyber leaders come in, they want the best next tool, they want to spend millions of dollars, and the business justification is hard. I think being really reasonable and, you know, kind of take your wins where you can get them and build on that, build the trust up with you and your team, that's really, really important.

You know, it, it's funny you say that because I see this a lot in, in my former role as a CTO, you know, we would define the business case and it would maybe be 3 bullet points or 3 punchlines, 3 success metrics, right? And then you, you get software demos and they can do 1,000 things, right? And it's like, I can do all— say, okay, well, I only need 3, now I can do 10. And the temptation is to stick to your guns and get the 3 done because sometimes the quality of the 3 goes down trying to get all 10. And then you lose, to your point, you try to do too much too soon, you lose the entire objective. But that was something that I have seen through my own growth, but also a lot of clients is like that temptation to say, well, I can do all this.

Yeah.

And it's like, but you only being great on 3 metrics. Don't try and, you know, shoot for the moon.

That's right. Don't let great get in the way of good, right? I think there is one term I cannot stand, and if a vendor says this to me, we stop conversations. And have a single pane of glass. It doesn't exist. It's not a thing. And I think with security tools, it's easy to get lost in, I can deliver those 10 things or whatever, but you need to be really good at the 3. And then build trust. The key to a CISO's position is building trust on delivering and protecting. And then you can build over time to move into some of the you know, more expensive, more kind of risky areas, but you gotta build the trust on the foundational stuff first. And every company I go to, the foundational controls are where people are struggling the most. So if you can win at that, win at like, just start with your CIS controls. If you can win at those and, you know, get into IG1, IG2 of that, you start to get some big maturity wins there. Then start doing some of the red team, blue teaming, maybe some of the really cool tools or whatever, but I would say you can't come out all jazzy, jazz hands at the beginning, right? And kind of taking on every single thing.

Yeah, I, similar analogy, like don't try to build the third floor loft patio deck to a house before you got the foundation. I mean, you can attempt it. It's just going to not be much of a house and it's not going to hold together. We're going to have Cody ask some fun questions here. Jen, I want to double back on one thing here to talk about. You mentioned that CISOs need to be more connected to the business. Landscape that they're working in. What are some tactical advice points on how to do that? You've gone, you know, medical device to software on the, on the West Coast, back into more traditional pharma contract manufacturing. Obviously business changes with each of those and knowing that context is easier said than done. One-on-ones are only going to get you so far. How have you personally invested in the business knowledge to get that acumen to differentiate?

Yeah, I would say, um, when I decide to make a change, which I had intentionally done over the last 10 years, I wanted to be in different industries because I wanted to understand different perspectives of cyber. Um, and I definitely had the opportunity to do that. So I kind of started at banking, then moved to shipping. I was in, um, services, then I moved to medical device, then software creation, and now into manufacturing. I think the way to learn the business is a whole lot of listening. So any, any of our meetings that are recorded, I take the time to go back and listen to from the business side. I try to participate in some of their strategic discussions. And I, as my CIO now would say, I get to gimba, right? I go to the site, I watch how it works. I spend time with the business leaders at the site, really trying to learn the business. And then I do a whole lot of research on the industry. So I do all the, the web searching I can do, right, to learn that, that piece of it. But I really wanna understand why decisions are made and then try to figure out what the risk in those decisions are so that my team can kind of pivot and make sure that we're covering those risks. If no one else has thought about 'em, we're really trying to think through them. And it's very eye-opening to get out into the sites where all of our work is occurring, where our patients receive products from, and also understanding some of the patient stories. I think you just got to be all in. You got to dive in and really, really learn it. I pull apart our financials. I pay attention to them. I really learn them where, you know, money speaks, right? So learning where we're investing, where we're not investing, and then And then I try to build all of that knowledge into my team, um, because it helps with like some of our user behavior models and things that we have from a cyber perspective. But I want to make sure the team understands what we do too, and never ever lose sight of the end user, right? Which for us is, is the million patients that we serve every day.

Yeah, that's, that's fun. I, I do, you know, you mentioned, which is very cool, like kind of like the swinging golf club and drinking beer, but I wanna, I wanna tap back in a little bit to some, some fun, fun chat here, a fun element here. But give me like, give us and our, our reader listeners like a fun fact or an element that people wouldn't know about you.

Yeah. So most of the time when I meet people, they think I grew up in IT or I grew up in cyber. I did not set out to be a cyber person at all. I actually have a degree in accounting, went back to school for nursing, and was gonna go down kind of a pre-med route. And then life happened. I ended up getting jobs in IT that I loved and just ended up staying in IT. But when most people meet me, they do not think that that was my path. You know, I'm very math, science, very highly analytical, and that actually ended up helping me in the cyberspace. The other thing I have, um, I have a photographic memory for things like IT diagrams, so I can really remember how all the systems connect together. It freaks people out, so I try to hide it normally, but if you write something on a whiteboard, I will remember it.

Now, whiteboard memorization, that, that has to be a nice, a nice tool to have in the corporate world.

It's good, but I don't know why I know the information. I just know it as a picture. Right? So it, it would help if I would've been able to evolve the talent into really understanding, you know, why I know it and how those things tie together. But early in my career, really understanding how systems tied together, what users needed to see, definitely gave me a, a leg up. In all my pre-med stuff, I could remember all anatomy very— yeah, I'd be like page 72 in the middle of the page. I mean, you know, I just, could remember that. So that's just one of those kind of quirky talents that I have that I normally don't tell people about.

That's very cool. Thank you for sharing that with us.

Awesome. Well, Jen, we, we really enjoyed having you on the episode here today and sharing your experiences and nuggets of value and hopeful, uh, uh, things to, for people to put into practice as they progress their careers. Thanks so much.

That sounds great. Thanks, guys. Bye. Thank you, Jen.