Unspoken Security Ep 19: How Do I Get into Cybersecurity?

When you're too humble, when you're too, when you're saying, I'll take a step back, I'm not there, I need to learn, people do want to hear that. But also you need to give people confidence that you can come in and do the job. So the ones that are going, hey, I'm going to come in and I want to be a director and I can do that, the right person will buy that. And as long as you can back it up and you'll do the work, I'm sure we all know some people who are in jobs they shouldn't be in because they knew the right person or they did the right thing at the right time. Maybe they're not the best person, but the best person doesn't get the job. It's not a total meritocracy. Sometimes it's the person that pushed a little harder.

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Legends are made. Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent about 19 years in the intelligence community, mostly at NSA, been building and maturing intelligence programs in the private sector for about 8 years now. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! And I continue to be deeply committed to servant leadership. Now, this podcast brings all of these elements together with some incredible guests who have authentic, unfiltered conversations on a wide variety of challenging topics. It's not your typical polished podcast. My dog makes occasional appearances. Riley is in the room today, so there's a good chance she'll show up. People argue and debate or even swear here. I certainly do. And that's all okay. I want you to think of this podcast as the kind of conversation you'd hear or overhear, frankly, at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. So today I'm joined by Carla Riffold. She's Chief Product Officer at SureFire Cyber. Uh, it's a company that's redefining the incident response model by delivering a swifter, stronger response to cyber incidents such as ransomware, email compromise, malware, data theft, and other threats. Carla's also a friend of mine and I appreciate her taking time to be here, uh, with me today. I have friends that are all way better than I am. So she has a remarkable background in recruiting, leadership, personnel, and security that I'm really excited to dig into. Normally I do more in the intro, but this is a big part of today's discussion, so I'm holding back. But she also has a bachelor's degree in ancient history and an MBA, so she knows a lot about a lot, basically. Carla, is there anything I left out that you want to add to that?

I don't think so. A lot about a lot is— maybe a little about a lot is more accurate, but yeah.

She's also incredibly humble. You do know a lot about a lot. Listen, I'd love to talk more about ancient history sometime. It won't come up today, but I'd be interested to know more about that, frankly. I mean, ancient history to an MBA is— that's a lot about a lot. That's just how it works.

You don't want to talk to me about ancient history. I make— I ruin Rome for people. I ruin ancient Greece. Like, I'm very boring.

Oh well, I've been to neither, so, you know, we'll see if someday maybe I can get to one and you can ruin it for me. But today, so the topic of today I think is really interesting. I think it's fabulous to have you here because of exactly the path we just talked a bit about here. Today we're gonna talk, you know, the topic is a question I hear a lot. I know you do too. And the question is, how do I get into cybersecurity? Like, I've been hearing about this, I don't know, as long as I've been out here now, you know, how do I get in cybersecurity? How do I get into intelligence? Is another one, obviously as an intel guy that I run into a lot. And to be honest with you, it's a tough question to answer for a lot of people. For me specifically, when people ask, I'm like, well, I'm, I came through the military and I did defense contracting. I'm not necessarily the right person to ask. Because I don't really know how most people break into this. But then I got a friend like Carla who does. So that's what I really want to focus on is let's dig into your background first, right? So, you know, I mentioned in the open, you got a background in recruiting and you've done leadership and you've done, you know, security and all these different things. But let's dig into that a little bit. Like, how did you, where'd you start? You know, to get, you know, you didn't show up one day and become Chief Product Officer at Surefire. So, You know, where did you start? Like, how, how was your path?

I started doing like sales-based roles, recruiting, real estate, and I was in a recruiting role, recruiting for corporate governance. So my background was risk, business continuity, disaster recovery, and I have a view on cyber should really fit under those, those topics. But I knew I wanted to have my own business, and setting up a recruitment business It felt like I was young, it felt like a very easy thing to do. I probably wouldn't say that now, but it just seemed really easy. So, so that's what I did. And very early on, this, this guy said to me, you know what, you should really look into this cyber thing. I think it's going to be big. And so that's what I did. And that kind of, you know, a little bit of understanding what it was. I already knew a lot about information security, but cyber was becoming this buzzword. And so then we just doubled down and all we did was cyber and we kind of dropped the other things and we hit the timing right, you know, we hit the timing when cyber was the buzzword and teams were growing. And, you know, actually, I didn't realize it at the time, but we became the biggest cyber specialist recruitment company in the UK and then expanded into the US. So, like, a very different background from a very different role from where I'm at now.

Yeah, but really interesting, right? So, I mean, first of all, you I love the youthful, ah, this will be easy. I'll just set something up.

Yeah.

It's, I wish I still had that, frankly. Everything seems so much more difficult when you see all the obstacles when you're young and, and smart and don't see the obstacles. It, it probably does seem easy, right? But you went in there, right? And so you're gonna do recruitment and whoever it was, I don't know if you wanna call 'em up by name, but that steered you to this, to the concept of cyber. Yeah, they were right. It looks like cyber's probably gonna stick around. Seems like it's got a, got legs as a, as an industry at this point. So that was nice. But I think it's interesting that, so you go down that path, you decide to go into recruiting specifically focused on cyber, and then you make, uh, obviously successful company out of this. As you said, you're the, the largest, you know, cyber-focused, uh, recruiting organization in, in the UK, which is really impressive. And so when you're going through that, right, in that process and, and you're recruiting and you're bringing in a lot of people and, and I don't know if you want to talk at what level was it, everybody, was it somebody with hands on keyboard all the way up to C-levels, you know, but you had to come across a lot of interesting people. You know, and I'm going to guess, I don't want to put words in your mouth when I ask, but what did you learn, you know, through all of that? You know, did you steal bits and pieces? Did you learn about cyber? Did they give you, you know, tips and advice on things to study? Did you just have to learn a bunch because you have to understand the requirements in order to fill them? Were you forced to become smarter on the industry and the security as a whole? Is that how it all came about?

Yeah, I think you do. Like, you just naturally learn when you're, you know, you're interviewing people to assess, are you the right fit for this company? I think it's one of the things people misunderstand about recruitment as well, is your employer is the company. You're finding the right people for them, not the other way around, not finding jobs for people. So, you naturally learn a lot about what they do, how they fit. It was a time when teams were small and they were growing, so just knowing cyber was enough. I think if you do it now, you have to niche down even further. You have to be, I recruit for cyber vendors, or I recruit for CISOs. I was like, you know, we didn't have to niche that. Cyber was the niche. So yes, you do, you learn a huge amount. You learn about how different businesses think about risk as well. I think that was my big takeaway is, and maybe where I feel quite strong these days, is I understand risk assessment maybe even more than I understand technical security requirements. And you get to see all these different organizations and how they approach it and how they have to think about it. You know, what challenge does a drinks manufacturer have over a bank? What different regulations? And so, you know a lot about a whole load of different things. And it wasn't until I came out of that, I realized how valuable that was and how few people actually get that breadth of understanding. So, it's a great place to start and to learn.

Well, I mean, it's a really interesting point, right? Risk, right? So, as an intel person, we talk a lot about this too, right? Risk. We talk about, you know, threats and vulnerabilities, right? Opportunities. And that's, you know, sort of your risk model, sort of. I mean, there's a lot more to it. I'm sure you could go into depth on it, frankly. But I think it's important, right? You were, that was a big chunk of what you're saying was your role. As you said, you worked for the company, your job was to find people to fill the roles. So you had to take the time to learn and understand. So while you, to my knowledge, at least you can correct me if I'm wrong, it's not like you ran off and decided, I'm gonna go get a CISSP or I'm gonna go get a bunch of, you know, risk certifications or all these things. But in order to be successful at your job, you had to understand this because it was the fundamental thing. And I think it still is the fundamental thing companies are trying to solve for, right? I mean, all of security really comes down to risk assessments. You know, what do we have to do to lower our risk to a, what we consider to be an acceptable level? And then of course, nobody actually really accepts risk. You know, everybody thinks it's acceptable level until something bad happens, and then they're very upset because we didn't want this to happen. And, and apparently nothing is truly acceptable, but. But I think it's really interesting, right, that you, so you were able to glean that because that's what people kept talking about, right? And then you were forced to do it. So I'm, I'm gonna guess that still involved a lot of self-study, right? I mean, I assume you probably did a lot of reading on the materials that go into certifications and training. You just didn't need the formal work, but you had to understand risk, right? I mean, somebody had to either teach it to you or you had to go learn it on yourself. I, I assume there was a lot of, a lot of self-taught, you know, requirements in order to be able to to speak the language and to put people in the right positions to be successful. Is that right?

To an extent, like, I do. I read a lot. Like, uh, you know, I probably read 100 books a year, something like that. So, like, I read a lot. That's the way I like to learn. But, like, I've never read a book on how to pass the CISSP, or like any of that kind of stuff. But you also go to a lot of conferences, you know, you need to be there to network and meet people, and then You sit, you wanna hear what that person says, you could talk to them about it afterwards. And you suddenly, that's a great way to learn, 'cause you're being taught by the best people in the industry. So, I think, like, one of the things, you know, there's maybe a gap between, like, how do you do the work, and then, like, knowing the outcome. But also, after a period of time, you've really seen that evolve, like, how scenario planning for tabletop exercises went from being about, specific scenarios to general themes. Like, what happens if my website goes down is a theme, rather than what happens if this group takes out my website with a DDoS attack. Like, you know, it's an evolution of the industry that I guess I got a front row seat to, and that's where the learning came from, really, is the people around me. Like, and I truly believe, like, your network is the number one thing you can do for your career.

Yeah, I mean, I agree. Obviously I'm accidentally a networker, you know, I didn't realize it. And at one point I woke up and just kind of figured out I talk to a lot of people, but I also listen. I don't know if everybody knows that, but I also listen to people occasionally. And it's amazing how much that matters. You know, just, it's a people industry. People think, I think some people think this is a technical industry, it's a machines industry, it's a technology industry. It's still a people industry. Like ultimately it's somebody someplace has a problem to solve or a fear or a concern or a, whatever it might be. And machines can't make people feel better about those things. Like, they can be part of the solution, but it's people, right? People have to talk to people and people have to help people. And I'll tell you what, if you build a bad reputation, as you know, I mean, I'm sure, especially in recruiting, I can't imagine, I'm sure you've run into people who are just poisonous to either recruit for or to try to get placed someplace. It's amazing how small the industry becomes once you have a bad reputation. All of a sudden nobody likes you.

Oh yeah. There's a couple of people and people talk, particularly women in cyber. There's a network. Where, you know, we talk, the really bad people, we know.

Good.

You reveal yourself anyway. But yeah, we, yeah.

Well, and that's good. I mean, that's how it has to be, right? So, you know, people take care of people and it's definitely a people industry. So I'm gonna ask, it wasn't one of the questions, but you said you read 100 books a year. So I'm gonna put you on the spot and I'm sure you got a couple at least, but can you name a couple that you think are really important, like fundamental? Like, hey, if somebody today said, I don't wanna learn about risk, I wanna learn about cyber, I wanna learn about. Pick one of the core areas, right? Do you have books that immediately come up? You're like, these are the 3 books I recommend you read right away. These are foundational, fundamental books. Do you have any go-tos that you recommend to folks?

I read such a variety of stuff. I would say the one thing that is, you know, maybe a competitor in a way, but the Recorded Future Intelligence Handbook, like, that's a really good summary. They did a really good job with that. Like, that unlocked a lot for me. So that's a really good one.

Oh, good shout out to them. I, I know the folks who wrote it and yeah, it is a good, listen, it's a good, it's a good resource. No doubt about it. You know, I often talk to people about, you know, intelligence community directives are also good too. ICD-203, 206, 208, which are unclassified, readily available. It's like 15 pages. You wanna learn how the government does intelligence, like, you know, it's amazing how fast you can learn in just like those 15 pages. But the more in-depth piece, I think that's a good, that's a good resource. You know, the Recorded Future piece is really solid. You know, they put good work in it and they're smart people. So, and I think that's readily available too, folks. I'm sure you can go to their website and download it. You're welcome, RF.

Yeah, I think it's free. This Is How They Tell Me the World Ends, that's another really good one for like background in cyber.

Yeah, that's, yeah, that's a really good book. I read that on a plane a while back. This Is How They Tell Me the World Ends, read it years after it came out. Of course, I'm way behind the scenes.

Same, me too. But it's very well written.

Yeah, I thought it was a really good one. I don't— there's a couple others that come to mind. I'm curious if you know of How to Measure Everything, I believe is out there, and, and then there There was a follow-on that was like how to measure cybersecurity risk specifically, which I'm not going to lie for anybody who's ever read this book, I still haven't finished it. It's, I, it's just hard. I'm not good enough at the math apparently. So I read it in chunks. I find it to be good, but too good for me. So I don't know if you've come across those, but How to Measure Everything I thought was pretty easy comparatively. Yeah. So I was curious if you had, I'm sure you have others that'll come up and we can, you know, find some others. If you're reading 100 books a year, I don't know how you'd remember every one of them.

Right. That's, I don't know if I've read 100. Some of them stick out. Yeah, I read such a variety of stuff. Like, I'm reading a lot on quantum physics right now, which is not very cyber. Quantum physics is basically philosophy, is what I'm realizing. So, yeah, that's phenomenal.

Yeah, it sounds like some light reading, just, you know, a little quantum physics before dinner. Yeah, that's not really what I'm up to. Like I said, for anybody who's just joining late, I have people— friends are much, much smarter than I am, clearly. I, I don't read quantum physics. I have Stephen Hawking's book on a shelf someplace, but it's just because it makes me look smart. I've never opened it. Someone gave it to me as a gift.

That's sleeping.

Yeah, that's sleeping.

Somebody gave it to me as a gift. It's not the book I read generally. So, you know, jumping back into the conversation a bit more, and I know you touched on some of this, but I wanna dig a little deeper into, you know, the things you, you learned from all the years working in recruiting, you know, the specific things you did pick up that might be good things that we could teach folks if you wanted to pass on to others, you know, trying to get that foothold in cybersecurity. All these conversations you said, you know, you went to these conferences and you listened and you learned from all these folks. I think, you know, measuring risk certainly is one that we've talked about, but are there other things that you took away from that and said, this is something, maybe it's a perception of how people see their problems or their solutions, or maybe it's a specific technology or a specific, you know, risk or threat. Like, what are some of the things you learned in those conversations in placing folks and trying to help fill roles that might be beneficial to somebody saying, I'm trying to break into the industry?

So, this one is, it's not a cyber-specific thing. And I'll tell you, I'll tell you a story of two people. They're both called Mark. The first Mark came to me and he said, "I wanna go from a manager role to a C-level role. I wanna double my salary. I want a bigger organization." And I sat there like, "This is not gonna happen. That is not the move you make. There's a couple of moves in between there. Like, no." Sure enough, I see him 6 months later and he's done it. And he continues to do that a couple of times, you know, big moves, doubling salary each time. And he's amazing and incredibly knowledgeable. And Mark has wanted to move for 10 years and he still hasn't moved and he doesn't really know what he wants. He knows he wants to move. He knows what he doesn't want, but he doesn't know what he wants. And that is like the difference there is you just, one, Mark knows what he wants and he went and got it. And when I joined, before I joined Surefire and I was thinking about moving on, I wrote down, I didn't really know what I want. So I wrote down half a dozen things that I knew I wanted. I want to be in a company that's growing. I want to be in a company with purpose. I want to be challenged. I want to I'd be learning. And that wasn't a job title. But when I kind of joined Surefire and I look back, I was like, I got all those things because those were the things I knew I wanted. I didn't realize, you know, some of the challenges, like, there were days I've regretted wanting a big challenge. But, you know, challenge is there. So, I think the big thing I really learned from, like, you know, I've placed hundreds of people in different roles, is you've got to know what you want.

I think that's, I mean, It seems simple when you say it, but it isn't simple, right? As you're saying that, I'm thinking to myself, have I done this before? And I think I've been both marks, quite frankly. I think it's different in saying, what do you want? Well, I want to be successful. Well, that's not a plan. That's not defined. I want to be rich. I want to be famous. I want to be powerful. I want to be retired, whatever it is. None of those things are planned, right? They're not defined. How do you want to get there? What do you want? I think you made an excellent point in there about, you know, making it more granular. How do you break it down? What are the things you care about? You know, do I want a big company? Do I want a small company? Do I, you know, do I want a specific industry maybe? As opposed to saying, I want to, you know, I just want a thing, right? I want a big thing, right? Or I'm just unhappy. I just don't want this anymore, which I hear a lot of people, you know, it's just, I don't know what I want. I just don't want to do this anymore, which I can relate to, but I wouldn't recommend picking up and moving on that. And I can't imagine as a recruiter, that's a really helpful bit of information to be handed. Is, what do you want? I don't want to do this. I don't imagine that helps much.

No. And, you know, I'm gonna blow my own trumpet, I think I've been very good at seeing people's potential and seeing between the lines where they could fit. Not many people can do that. People want to know, I'm an intelligence director and I want to be an intelligence director in this type of firm. That's super easy. And if you've done it before and it's a really easy fit, Even better. When you're saying, I want to jump, people get nervous. That's hard. Like, you have to— then you've got to go create those jobs for yourself. Those are not coming to you from a job board. They're not coming. No one's knocking on the door for that. So, and it is hard. It is hard to know what you want. It's sometimes starting with what you don't want. Like, I don't want a boss who annoys me. Great. This type of boss would not annoy me. Like, you know, it gives you somewhere to bounce off from. But I think you do. I think you have to define what do I want? Okay.

And so applying that to the, you know, point of this conversation today, right? About breaking into the industry, right? So somebody's in a different field altogether. They're, I, I got a story, a very small one too, years ago now. Somebody reached out to me through LinkedIn and he was a manager at a restaurant actually, and said he wanted to move into, you know, he was moving into cybersecurity and wanted some advice, which I was surprised I was the person he reached out to. I was flattered. And so we started having some conversations and he was already, he made some commitments. He had some ideas. He was in school, he was finishing a degree, but he didn't know what he wanted to do and what the world was going to be. And so my advice to him at the time was, I said, I think he's got a good chance. There's plenty of work to be done. I said, but you're a manager at a restaurant right now. You won't be a manager in your new job. Like, we want to prepare him for that. Like the ability to take a step back and say, listen, You're accomplished and experienced in business, but some of that, a lot of it may not apply to what you want to do. Are you comfortable coming in as an entry-level SOC analyst? You know, and are you going to be okay with that? And he was. And so we started having that discussion and it did sound a little bit like what you're saying. This was somebody who did know, like, I definitely want to be in security. I definitely want to be in tech. I want to, I want a place where I can grow. He had some interest in, but then we did have some of those discussions about, well, what do you want to do to start with? You know, he didn't come and say, I want to come in and be a I don't want to run a team. Like he knew better, but if he hadn't, I probably would've disabused him of the idea it was gonna happen too, because you're just not gonna come in that way.

Right.

And you don't, your experience is valuable. You may escalate and you may grow quicker cuz you have maturity and experience leading people, but you don't know any of the technologies right now. You're just coming straight outta school. Right. And so in his case, I think it was great because he was saying, I know what I want and I know what I'm willing to give, which I think is another big piece of this of, you know, what are you willing to give or give up? You know, we're talking about people trying to break into the industry. And I, I worry about that sometimes, you know, when somebody's young and new and they're outta college and, you know, they're just going, that's one thing. But people wanna switch careers, you know, people who've established someplace and say, I wanna switch careers. Do you find that they more or less understand that they're gonna have to take a step back? Or do you find a lot of people coming in saying, well, I, I, I was a director in some totally other industry and now I wanna be a director in cybersecurity. You know, do you find people that come in that are unreasonable about that? And how do you handle some of those discussions? How do we set people up for success there to say, hey, if you wanna break into the industry, you may be taking a step back and make sure that they're comfortable with that?

So, you know, I have kind of a different view because I think those unreasonable ones are the ones that make it. The ones that are like, I've been a director here, I wanna be a director in cyber, even though I've never done— they've kind of got the naivety and the tenacity I think, to go make it work. Because when you're too humble, when you're too— when you're saying, I'll take a step back, I'll, you know, I'm not there, I need to learn, people do want to hear that. But also, you need to give people confidence that you can come in and do the job. So, the ones that are going, hey, I'm going to come in and I want to be a director and I can do that, the right person will buy that. And as long as you can back it up and you'll do the work, I'm sure we all know some people who are in jobs they shouldn't be in. Oh, yeah. Because they knew the right person or they did the right thing at the right time. And maybe they're not the best person, but the best person doesn't get the job. It's not a total meritocracy. Sometimes it's the person that pushed a little harder. Ooh.

Well, now that's gonna be the sound clip I assume that we're gonna use to promote this show. The best person doesn't necessarily get the job. It's not a meritocracy. Sometimes it's the person who pushed harder. But that being said, I think that's great. I mean, you listen, you just totally contradicted me, which is good because that's why I have you here, cuz you're an expert and I'm not. And my perception clearly isn't universal reality, if not, you know, wrong entirely. But I think that's an interesting point then. So one of the things people need to know getting into this, you know, we talk about breaking in is what, what I'm hearing you say, and correct me if I'm mischaracterizing it, but you gotta have some confidence, right? That there's a line I'm gonna ask you, like, where's that line between confident and cocky, right? But it does sound like you have to have some confidence and give some people some reassurances you're capable and that you're confident you'll be able to do it. How do you do that without crossing that line though? And is it subjective? I'm sure I'm asking that question. I probably know the answer to, but depending on who you get, you know, for every person who's good with that confidence, is there somebody who's insulted by it? Hey, listen, I spent 12 years doing this. You've been doing, you've been selling tires and now you think you're gonna run, you know, a cybersecurity team. Like how do you gauge that and read your audience and, and find that level of what's confident versus what's cocky? Or is it just, you gotta read it and hope for the best?

I think you do. You gotta kind of hope for the best. Like, you'll find your people, right? Like, the right people will find you. You'll find them. You know, I have that in my role now, right? I've never been a chief product officer. I've worked for an intelligence organization for 3 years before this, but I've never been a threat intelligence analyst. Like, there's a big gap between what I'm doing and what I'm building. And everyone knows that. I've been very upfront about that. I've not sat there, you know, like, you only have to look at my resume. It's not a secret, you know, but it's, well, what can I do? Well, I can build businesses. I can build relationships. I can learn quickly. I can see solutions. I can bring people together. I can bring a different point of view. So, it's, and, you know, I'm not suddenly saying that I've had the confidence in that all the time. Like, there's been days, but, you know, so there is a line. But I think more people go the other way. For every confident person, yeah, there's a cocky one, but there's 10 that don't have the confidence that they should really have in what they can do.

Hmm. Well, I think that's really interesting. And so you talk about the intel piece, like anybody who knows me personally or professionally or follows me or anything like that, I'm notorious for smashing people who are in intel positions, have intel titles, who don't have intel backgrounds. Like I'm, I'm pretty rough on it sometimes. Right. And it's because I've seen it too many times. There's too many companies where it's an intel team. And they promote somebody whose whole career is in incident response or, you know, SOC, you know, analyst, network engineering, something like that. All brilliant people doing great important things, but with no intel background. And almost universally they build failing intel programs because they don't have intel backgrounds. There's exceptions, but not a lot of them, frankly. I'm not saying you have to come outta the intelligence community in the military and, and be an intel, you know, a 10, 20-year intel pro to do it. You can go to school, you can have, you know, SANS courses and, you know, a lot of hands-on work and get there. But for those who are wondering why I don't smash Carla, it's not because we're friends, although we are. Carla's never claimed to be an intel analyst or an intel professional, right? She, her last job was an intel company. We've been friends since even before then. And she gives intel briefings and they're good ones. Listen, if you haven't seen her on LinkedIn, I recommend following her. She gives some pretty good presentations and briefings on these things, but she's never claimed to be an intel professional. And that's, there's a fine line there, right? She's been upfront. You've always been upfront and said, you know, you're, capable of reading, you're capable of understanding, you've done research and you know some of these things, but you don't claim to be an intel professional. And, you know, as a result, I think that, that, you know, that transparency and that humility comes through of this is what we understand, this is what we know. A lot of times, I know you're working with other intel people too, and you're presenting work from people who do have those intel backgrounds, which also is really helpful. But now, as you said, you're Chief Product Officer, and for anybody who reads your resume, you've never been in product before. So, I mean, here's somebody who's done intel briefings, who doesn't have intel background, who's been a Chief Operating Officer. And that's because, I mean, you've run a company, you've done a bunch of things. Chief Operating Officer seems to make a lot of sense. And now you're Chief Product Officer, having not worked in product organizations before. I don't know how much you want to reveal there about how that's gone, how that, you know, the challenges of that, the excitement of it. You said you always want these challenges and then sometimes, you know, like many of us, I think we regret, why didn't I take the easier job? But, you know, that's an interesting piece that you've been able to make that move. What, and this wasn't one of the questions we prepped, I apologize, but What made you decide to go, you know, I want to do product. I want to be a chief product officer. I want to be responsible for developing the next solutions and technologies. And maybe more importantly, tied to this conversation, how did you convince somebody else that you should be?

Maybe the bigger question, right? I've known the CEO, Billy, at Surefire for a long time. So his very background is, and strengths and weaknesses, and we were talking about, you know, what could exist for me at Surefire? What were their gaps? What are my strengths? And so this role was kind of created out of, these are the things that I want us to do that I don't have time to do. Me going, that's really interesting. I actually, like, I've got some details to figure out, but I know how I see this. I see the path. I know what we can do. And a lot of the product role here is we're building new service lines, we're building new things. I've built businesses, I've sold two, like I can build things and put that together. I know where my limits are. Maybe not always, but I think I know where my limits are. I know when I need a threat intel analyst who can run scripts and scrape stuff and has a different way of thinking. And I run my stuff past them. And sometimes, you know, like I said, I've read a lot. I've been doing, I've been around these people a long time now. You start understanding how you think. And actually, everything in business, I think, comes back to that risk piece. If you can understand, how do I assess risk, which is what you do as a business owner all the time, then you can start talking the right language. And that's what you need to build products. How do I help someone fix their risk? How does this help somebody else? Or what do I need to go do to build that? So, yeah, you know, I think I've got some of the core components. And yeah, there's nothing hidden. There's no pretending and courses and hiding it or trying. It's just being very authentic and very confident in what I do bring.

Well, and I think you bring, first of all, for anybody wondering, sitting here in my head, running back how I phrased the question, how did you convince somebody? Listen, Carla doesn't convince anybody. If you've met Carla, if you've worked with her at all, if you know her, Yeah, it's pretty easy to say, yeah, she can do anything she wants. I'm not suggesting it was hard to convince somebody to hire you to be a chief product officer. It was more about why did you want to and what were you going to bring into it? But I think you also made a couple of really interesting points that I really respect. Again, anytime somebody's stretching into a different area, right, that doesn't necessarily— they don't have an obvious path there, right? Is that, as you said, I know my limits and you leverage people with the depth, right? I mean, a C-level position, Sure, it's great if you're the CPO and you're also capable of coding and you can, you know, you can dig all the way into the, but you're not gonna have time for that anyway. Like, it's not gonna be your job, right? So, you know, being able to build a business, as you said, being able to understand strategically what needs to be accomplished, being able to, you know, reflect what the CEO thinks the company needs to, where they need to go and, and how to build something. And then being able to leverage the people who have that experience, that hands-on piece, that, and then trust them. Of course, you get good people and you trust that what they tell you is the truth. I think that's like knowing you, I think that's where you excel and it sounds like that's a big part of this, right? And having that humility too. I've worked with a lot of leaders who are not all that humble, if I'm gonna be honest. I've worked with some that are great, but I find the ones that are certain they know the answers to everything tend to be really frustrating to work with. But you just said it, like, you know, find the people that are depth of knowledge. If it's an intel question, let me talk to an intel analyst and bring some things in. If it's, I'm sure you do the same thing in product and development and, you know, whether it's UI, UX, for instance. I know brilliant people in that space. I talk to them and I just tell them, hey, this is what I want it to look and feel like. Now you tell me what that is and if it's possible, right? So I think that's a big piece that, you know, to me it seems like that's probably a big compelling piece to why somebody would say, yeah, Carlos, good for this role. You understand needs, how to fill them. You said risk. And then you leverage people and you do it with humility. But as you pointed out, also confidence, like that fine line, right? You can't come in and say, well, maybe I can do it. I don't know. We'll see. I don't. You know, nobody's gonna hire that person, I would assume. But you never come— I would say no, but you don't come across as cocky. I've known you a long time. I would say you're remarkably humble but confident. You seem to have, you seem to have solved that riddle. I guess that's the question it should have been. How do you solve that riddle? How do you find that line between confident, cocky, too humble? You know, not that I wanna speak to it, but I will just cuz this is how our industry works. I think it's harder when you're a woman in this industry as well. I think the whole industry makes it much more difficult. The whole world probably does, but I know our industry does. Confident women get labeled differently than confident men, which I think is shitty, by the way, for anybody who's listening, just to clarify my position on that one. So, but you've managed to find that spot, right? Where you're confident and not cocky. You're willing to stretch and go out there and do things beyond what might be traditionally your background, but you've leveraged the right people. So, I mean, it's impressive. Obviously things are going really well. If anybody, like I said, if you don't know Carla, if you haven't looked at her resume, I highly recommend it. And she's great to work with too.

So, let's, like, I just want to stick on that for a second, like that, that asking the right people and that putting yourself out there. Because in this role, I've had to do that. I've reached out to other chief product officers and said, like, "Hey, I'm new to this. Could, you know, can we chat?" And, you know, people say yes more than you realize. And I think that's a really key thing for, like, how you break into security is reach out to people. Very few people reach out to me and ask for my time. When they do, I say yes every time.

You're gonna get a lot of them now.

Well, maybe. And it brings me back to like, do you remember how we met?

I do remember how we met. Absolutely.

I love this little story. So like, I was new to the US, new to the area, and I sent a message to— I'm sorry, you weren't the only one— to a couple of dozen people saying, hey, I'm new and I'm lonely. COVID and I want to meet more people. Would you be open to having a call? And a couple of people subsequently have told me that message was really weird. Like it was mail order bride kind of vibes. I— you shouldn't send that to people. And I was like, do you know what? I met 3 or 4 people from sending that message that are now really good friends of mine. The right people found me because I was authentic. So you've just got to be okay with putting yourself out there and that some people are not going to like it.

Yeah, I, I think it's a great story. I'm glad you mentioned it. I, I think it's a great point, right? You know, I have the same experiences, right? You know, people do reach out to me occasionally. I think it's remarkable to me how surprised they are when I respond almost always very quickly too. I mean, I'm on LinkedIn more than I care to admit, so very often I'm responding moments later. Sometimes it's not. So if you do ping me and I don't respond for a week, don't take it personally. But usually it's pretty quick and I'm always surprised at how surprised people are. First of all, I'm not important, so I'm always surprised by that alone. But I think you're right. People usually say yes. It seems like more often than not, I think people want to connect. People want to help each other. Not everybody, but I think most people really genuinely want to help other people. And it's flattering if somebody says, hey, you know, I'm trying to do something, you know, do you have time? I'm like you. I make the time. There are very few times when I say I don't have time, at least for a call. In your case, when you reached out, I wouldn't call it weird. I did take a moment, but I, listen, if I'm gonna be really honest, I took a moment because of the bias that comes with this. If it were a guy, I probably wouldn't have. It sounds terrible, but I took a moment because of course I'm in a relationship. I was at the time as well. I have a woman who I don't know who is saying, hey, do you have time? And I think we went and got coffee together actually too. I drove into DC if I remember correctly. So I mean, there was a moment I paused, but then I was like, well, that's ridiculous. This is a professional, great resume. This is somebody who wants to get to know somebody. I like meeting new people and, you know, Gender's not part of the equation. It certainly shouldn't be, but there's a bias there, right? So you give it some thought. You weren't creepy. Like nothing you said was creepy. And I was flattered. I was like, yeah, let's meet. Let's talk and let's, you know, let's see what's happening. Right. And I'm thrilled, you know, best cup of coffee I've had probably in a long time. Like it was, it spawned a great relationship and a great friendship out of this. And I appreciate it. So I think you're right though. I think just saying, hey, don't be afraid. It's okay that I was one of a couple dozen people. It would probably be weirder if I was the only person.

That would probably be weirder.

Yeah. That would be a bit creepier. Yeah. If it was just me alone, a couple dozen is a good number, I think. But I think you're right. I think being able to put yourself out there and say, hey, listen, I'm just, you know, I'm just trying to meet new people. I want to learn new things. I think, you know, you mentioned that, you know, Chief Product Officer, so you're reaching out to other Chief Product Officers. That again is that humility that you don't often see and courage. Like, I should put these two together really. It's not just about being humble. It's courageous to say, hey, I'm new to this. I'm not sure of everything I'm trying to do or accomplish yet. I want to learn from people who've been here. I think a lot of folks, the fake it till you make it concept, they take it too far and then they just refuse to say, hey, I don't know the answer to this. You know, they're afraid that they'll come across as weak or incapable or something like that, as opposed to just coming across authentic and saying, hey, you've been doing this a long time and I admire your work and I think you're successful at it. Any tips you want to give? And I think people are surprised at how often the answer will be, yeah, you know, let's make time. Let's get on a call. And so yeah, I've had a lot of those same experiences. I'm always surprised by it. Like, I'm not gonna lie, every time somebody rings me up or, you know, sees me at a booth or whatever, I'm always surprised anybody even knows who I am, let alone cares what I have to say. So I will tell anybody out there with imposter syndrome, that lasts forever too, I think. And yeah, get used to it. None of us knows anything or thinks we do. So you're either an imposter syndrome or you're a narcissist, I think. I'm sure you've met a bit of both in the industry.

Maybe a bit of both.

Yeah. Yeah. They happen occasionally. I'm sure you've met some. It sounds like from what you're saying, the narcissists probably do all right finding jobs though. They don't have a problem with confidence. Yeah. Sad but true. All right, cool. So we've cannibalized some of, a fair amount actually, the third question through the rest of this. So we'll, we'll figure out what else we're gonna chat about in here cuz the third question officially, and I guess we can get into some specifics, but we cannibalized some of it. You know, what tips or advice do you have for people looking to make, you know, the move into cybersecurity from what we would call non-traditional backgrounds? So I know we talked about a bunch of things, but the, the non-traditional background piece specifically. I think we can dig into a little. So again, you started in recruitment, you ended up funding, you know, founding your own company because you didn't, you were too young to realize how hard that should be for the most people, or you're too good to not be good at it, I guess. And then for you, it seemed like, sorry about that.

Sorry.

No, you're good. I forced Carla to come on sick because I really wanted her on and I, and, and she's filling my time slot, so we'll probably cut it out or we won't.

It doesn't matter.

Yeah. But I, in doing that from the recruitment side, like obviously there were some advantages we talked about, right? You met a lot of people, you got to know a lot of people and you learned an industry as a result. But let's assume somebody doesn't have that advantage, right? And they just want to break in from nowhere. So, you know, tips or advice. I think we talked a little bit about being bold, you know, being able to reach out to people and ask them and don't be shy and don't assume people will say no. You know, what about things like on the education side, on the training side, on the, you know, what do you, how do you feel about internships for instance? How do you feel about, Like, what other tips do you have or advice you have for somebody who wants to make a career switch, like a dramatic one, to cybersecurity? I would have said, be willing to take a step back. Maybe that's a bad answer now, talking to an expert. So, what other tips or advice come to mind for you on somebody who wants to make that move?

I mean, you might have to take a step back. I'm not saying you never should. I'm just saying, like, the ones that, you know, the ones that refuse probably, you know, get at it a little quicker. But yeah, you do, you need to demonstrate your interest. So whether that is saying, I listen to all these podcasts, I have read these books, I go to these events. Like, what? It doesn't even have to be courses or like expensive courses where everyone has an opinion on what courses you should take and what are good and what isn't and what qualifications are good and what isn't. So there's no good answer to that question apart from show your interest, show you've put some work in, show what you're doing and you teach people how to see you. Like, I do my threat videos twice a week. That means most people see me as a threat person. Like, that's— I'm teaching people what I'm doing and what I want to be known for. Anyone can do that. Like, start blogging, start writing, and teach people what you want to be because no one's going to come and give it to you. Like, particularly if you don't know what it is, just cyber in general. No one's going to come and knock on your door and give you that opportunity. You have to teach people, this is who I am. So you have to put some of that in. And like, for me, it always goes back to network. That is the number one thing.

Yeah. Oh, I think, I mean, so teaching people how to see you, I think that's a really interesting point, right? That I think a lot of people talk about it as like personal branding now. You know, I hear a lot of that, and surprisingly, I've had people ping me on that too and say, how did you build a brand? And I didn't realize I had, but so, but I think it's a really powerful point. Teach people how to see you, right? Like, so I, I watch your videos, right? And again, you know, we know each other. I know your background and I remember watching them thinking, yeah, these are pretty good. These are good. You know, this is good content. Like it's consumable. It makes sense. It's valid. You know, it's based on good materials, but yeah, for somebody who doesn't know you, doesn't know your background or anything, absolutely. I'm sure that's what they see you as. This is somebody who gives threat briefings a couple times a week. This is who this person is. They're a threat. And it's earned. I mean, you're, again, the content's really good, but I think it's a really interesting point just to tell people, like, teach people how to see you, right? Uh, you get a chance to frame yourself in people's eyes however you want to. You know, I, I got a friend who's blogging. It's a good example. You mentioned blogging, you know, and he and I talked. He's, you know, having some challenges right now. It's tough industry. And for whatever reason, he's not finding the role, which I don't know why at this point, but You know, he's been doing some work on the side. I said, just keep doing that, man. Keep blogging, keep writing, keep doing the analysis you're doing and putting it out there. It's a, it's a, it's a place, right? And it says, this is what I do. This is who I am and what I'm good at. It'd be better if somebody would pay him to do that. But, but I think it's a, it's an interesting point, you know, teach people how to do it. So if you're changing career fields, you know, I've talked to people who didn't look on paper like they were gonna be a fit, but I was like, all right, let's have this interview. Let's see. And you find out they've built a home lab and you start having this discussion. You realize. This person's a little crazy, frankly. I mean, they spend 20 hours a day working on the— they— crazy may be the wrong term. I apologize for anybody who's offended, but this person's very passionate about this. It didn't show up on their resume. Their resume says they've been doing retail work and they're in, you know, community college, but you find out at home, this is what they do. This is their passion. They live this. And you unlock that and you see all these things that you didn't see in that person, which by the way, for anybody wondering, if you're that person, get a resume writer to help you capture that because you may not get the interview. If all it says is you work at Foot Locker and you're in community college, they may not know this. So if your passions aren't showing up in your resume, I strongly encourage you to get somebody to help you write a better resume. It doesn't have to be certifications and college and experience necessarily. Those are great. But if this is what you do in your time, as you mentioned, Carla, you know, if you go to conferences, if you go, if you're reading books, if you're taking online courses, it doesn't have to be the CISSP. It could be LinkedIn courses. It could be Udemy. It could be Google has free stuff. You know, there's a lot out there, right? So, but I think it's interesting to get all those things captured and that passion is a really big thing, right? Because if you're gonna make that transition, the person who's gonna interview you, in my opinion at least, they need to know why. Why are you just doing it? 'Cause you don't like your job. You're just doing it 'cause there's more money in cyber you heard about, you know, or is it something you're really passionate about and you're, you know, whatever you do with your free time tells me a bit about what your priorities are. If you're building a lab at home, that's, you're more interested in this than I am, frankly. So, but you're certainly passionate about it. You're probably somebody who'd do all right in the SOC. And you could probably talk in detail. Like, were there other things like that you, you know, experienced when you were working with folks who were making some of these moves, Carla?

Yeah, definitely just those things. I think a lot of people go, what course can I take? What's the course that unlocks the door? There is no course that unlocks the door. The thing is doing the work. And, you know, when I say teach people how to see you, like, there are some people out there that have built careers and brands on not very much substance. Because they've built a brand, not a substance. Like, I'm not advocating that. I'm advocating—

I feel attacked now, Carla.

Well, you're the opposite of that. You know, your brand does not show the substance away.

So, like, I appreciate that. I was really going for that compliment. I appreciate that. Go ahead. Go on.

So, yeah, it's not faking it. It's not, you know, you know, there are some people out there doing that. This is show people what your substance is because there are far more people out there who are doing all this stuff, who really are interested and passionate, and they're not showcasing the stuff that they know. I think it's enough. I haven't done the job. I haven't got the course. I haven't got the CISSP. It doesn't matter. You've, you know, you're in it, you're doing it. Like I'm talking to someone right now who wants to get into threat intel, done a ton of courses, writes a lot of content, content for other people's websites. I'm like, that's doing it. You're writing threat briefings. That's part of the job. You know, like, show that. You know, this isn't— there's not some secret. You're doing it already.

Well, I think that's a good point. Maybe that goes back to the discussion earlier about some people are too humble, right? And they don't think they've got what it takes, right? They look at their resume and they look at other people's and they say, well, I don't match up. You know, people a lot of times grade themselves really harshly. You know, I know a lot of people who are brilliant and you wouldn't know it if you talk to them because they certainly won't. Tell you so. And people tend to really make it hard on themselves, I think, a lot of times, or they think this is a bigger obstacle maybe than it is. You know, it, this isn't the world's best time to have this discussion. I mean, the industry's contracted a bit right now. So, I mean, there are people with great experience who are looking for new opportunities right now because of all the layoffs and changes in the industry. So it's not the world's best time, but in general, still, it's not some insurmountable obstacle. There are still a lot of vacancies in this industry that need to be filled. And most people I talk to, they're looking for people that are passionate and want to do it, you know, and I know some organizations, we only want A players. And I'll tell you, by the way, and I'd love your opinion on this. I shouldn't say mine first, but I'm gonna, cause I'm stupid. But I think that's the dumbest thing ever. When somebody says all we want is A players, I actually think it's one of the dumbest things I've ever heard. It's like saying you're going to build a basketball team and all we want are 5 superstars. Somebody's gotta pass the ball. Like you can't build a sports team at basketball's probably, listen, Carla, as many probably heard, is British. So I'll speak in soccer terms, you know, or footy. You can't have everybody try to be the striker, right? Somebody's got to, to be a halfback. Somebody's gotta be midfield. And so if you try to build a team out of all superstars, I think you're ridiculous. But I think that means people have to understand you don't have to be a superstar necessarily either. You have to be passionate and care and wanna do it. And prove you're gonna grow and care. But I'm curious, I'm gonna ask you, like, how do you feel about the, and I'm sure you've run into them being in recruiting so long, the person who's like, I only want A players, I only want superstars. Like, how toxic of an environment does that create? It was just my thinking, am I wrong?

No, I think there's a story, and I think it's, I might get the company wrong, I think it's about Enron, how it was all about, we only want A players, we get rid of our bottom performers. You know, you have, and it built this culture where people had to be amazing and do amazing things, which meant they went further and further away from ethics and integrity. So, there's a chance that leads to a really toxic scenario. But yeah, like, you know, soccer terms, you have a star that you play around, you have, Inter Miami has Messi that they play around, who you pass the ball to. So, I think where you need A players is in your behaviors and in the values alignment. People who have the work ethic, you know, they want to be A-players, whether, I mean, what does an A-player even really mean?

Nothing. It's subjective, certainly. I don't know the Enron story. I will say I do know that was a big challenge at Google. I know Google's process used to be that they automatically wiped out like the top, the bottom, I don't know, 15% or whatever. It was just a known thing. Every year on annual reviews, if you were in the bottom 15, you were gone and they brought in new people and it created this— yeah, toxic environment. I think they've changed their HR processes. I don't work at Google. I just know what I've read, but I guess they changed them. They kept most of the rest of the processes, but they dumped that piece. It wasn't the automatic you're out the door. I mean, everybody's got organizations where people need to work and improve. That's the norm, right? But if it's such a high standard and it's all or nothing, you're in or out, yeah, you create this cutthroat environment. And like you said, what's an A player? It's subjective to begin with. So it just becomes whatever you think it is. I've seen organizations that go that route and people will do some very unethical things. If they can't make themselves better than somebody next to them, they'll make that person worse, you know, instead. And it's really ugly. So I think, you know, having team players matters. And that's one of the things I have told people trying to break in as well is, you know, it's not just about how good you are. It's about how good you are to work with. You know, we're going to spend a lot of time with each other. I'll take B talent, A people over A talent, B people any day or C people or D people, which we get a lot of. I just want to work with somebody who I think cares and will try and will be responsible and will be ethical and will be authentic and will be— I can trust if they made a mistake, they'll own it. Right. You know, and I think that's— I don't know how you get that in an interview. I'd be curious if you have any thoughts on how to present that well in interviewing, because I think that can make a difference too, especially somebody transitioning industries. I've got to have other reasons to want you. I got to know or have some confidence you're going to be a good teammate? You know, is that something that also comes up when you have these discussions or not so much?

I think that's the values alignment. And there are behavioral-based questions that you can ask around that, you know, like, when were you working on a team? And when were you working on an underperforming team? And what did you do? Like, there are questions you can ask. But yeah, that's the values alignment. That's where you need your A-players. You need people who are truly aligned to your values. And then the hard skills around that, As long as they've got that humility to go ask, you can, and you've got the right skills at the right level, then you can work with that. But you've got to have, when it comes to A-players and the best people, it's got to be the people that match your values and your work ethic. And that goes back to that network piece. You know, how do you, if you know somebody because you've met them at events and you've known them for a little while, you know you can work with them, that's a really easy person to bring onto your team when the opportunity arises. And that's why so many roles go through to people's network because you take away that risk factor of hiring someone that doesn't match your values and your behaviors.

Yeah, I mean, that's a great point. Like a great resume is just a resume, right? It's flat. And you know, it's most people I know don't end up getting positions at corporations because they submitted through an open rec. I mean, to be honest with you, and you know, if they did, it's because they also still have a contact who knows somebody who's going to have a discussion. It's people worry, I think, a lot. You talk about risk, right? All through this, we talk about risk. There's risk in a bad hire. And I don't think the risk in the bad hire is they're not talented enough. Talent, I mean, for the most part, that stuff can be learned, right? The risk is, are they gonna be, you know, a terrible person to work with? You know, they're gonna be a brilliant jerk. And those things are harder to deal with. It's hard to get rid of those people and they're toxic and they ruin environments. And it's hard to know from a resume who's, you know, who's that, right? Nobody puts on their resume, I'm really good at this and I can code that and I'm an asshole to work with. You know, I think I knew one person who actually put something like that on their resume, but they were so brilliant, people took them up on it anyway. And they weren't lying. They really were an asshole, but most people won't do that. Right. So I think you're right that, you know, that networking piece, getting to know people, it's amazing how much somebody changes their opinion of you if you've shared a coffee with them or a drink with them or a meal with them. And suddenly your B talent becomes A talent because, you know, they want to work with you. So, getting out and networking is another one of those things that, you know, I know you've mentioned a couple of times and yeah, I think it's invaluable, right up to and including just sending out messages to people you'd never met before to see if they want to get coffee and talk to the new Brit who's joined you in DC. It worked out pretty well.

And it's keeping it going. Like, when you say networking, you know, it's not just connecting on LinkedIn and like, you know, actually it's building a relationship. It's talking to that person a second, third, fourth, fifth time. No one's giving you a job because you talked to them for 15 minutes once. And what always amazes me is the people that do reach out, and maybe I'm just terrible to talk to, but very few of them come back to me a second time. So, like, that might say more about me, but I think it says more about actually how people view building relationships. And it can be hard. Like, I want to offer something, I want to add value, I don't just want to be noise. Like, it can be hard to have something to to say, but that's the skill. And that's what— if cyber is hard to break into these days, it's much more competitive than certainly when I started. So the skill does come in, actually. How do you keep that going?

Well, that is— I can tell you, knowing you, like, those people are— it's them, not you. You're actually really easy to talk to and a joy to—

I think so.

Yeah, you're a joy. I think there are people who— I think, and maybe that's the reflection of it, people who've heard networking and how important networking is And so they try to do it in volume, right? It's, it becomes net phishing for them and they get out there and they meet a bunch of people, meet, you know, they message them once or twice and then that's it. They, you know, okay, now they're in my network. I'm onto the next. And now they're building this network and 6, 8, 12, 14 months later they ping and say, hey, you remember this time we talked? No, I need help getting a job. And you're like, well, all right, we didn't really talk much. You just, you kind of wanted to add me to your network or you wanted to use me so you could get to other people. And, you know, I'm a sucker. I still probably help people anyway, but there's a difference between networking, just trying to collect, right? We're not Pokémon cards, you know, just trying to collect as many people and build up your numbers. I don't have 10,000 followers. I probably could. There's people I reject because I don't know them and they don't really reach out with a reason. They just want to connect, right? And it's not that, you know, it's not a statistics game. Having authentic connections. When I say networking, it's authentic. I have thousands of connections. I won't say I'm as close to everybody as I am to you, Carla, or, you know, they're not all that close, but I don't think there's anybody in my network I haven't had a conversation with, at least probably several. And that's different, right? The people who are just net fishing, they're not really networking, they're just collecting, right? And they're hopeful that'll be enough out there. And it's not the same, right? So I think it's important, like you said, to build relationships, not just to make a connection. You gotta be able to do a bit more than that. And maybe you can't do it with everybody. Like I said, I have thousands. They're not all equal, but I have certainly hundreds that I would consider to be friends that I've actually I have spent real time with, that's a true network. Those are people that we can count on each other and I've helped people out and they've helped me out. You know, the other thousands that are in there, you know, it's, I probably still would cuz I'm a sucker, but most people probably wouldn't run to help them and, and they won't be at the top of my list necessarily. All right, cool. So listen, we're coming up on time. This has been fantastic. I hope everybody listening thinks so as well. You know, the question comes up all the time, how do I break into cybersecurity? And I think your story's a really good one. Right, from a totally different industry and a totally different, you know, coming forward business-wise and that ancient history background. We didn't even talk about that, but, you know, from recruiting to getting into, you know, the cyber side of things and then the operations and now being a chief product officer. I think it's a good story. I think hopefully I've learned a few things, so I hope others have as well. And I really appreciate you coming on and sharing. You'll probably get a lot more messages now that you've welcomed them. Carl is very easy to find on LinkedIn and definitely worth chatting up. I highly recommend it. She's also, you know, SureFire Cyber is certainly a good company to take a peek at as well, because she's going to be a big part of building some very cool things that they're working on there. But as we close out the show, we always end the question, you know, the show with the same question. You don't get a free pass just because you're a friend. The name of the show is Unspoken Security. And with that in mind, I'd like to know if you can share something that, from your life that you've never told anybody, something so far that's gone unspoken.

I struggle with this because I tell everyone everything. So there were, I couldn't really think of anything, but I, you know, going back to the humble confidence. Intelligent, cocky. I rarely tell people this is I have a really high IQ. I consistently score in the 95th, 97th percentile on IQ scores. So yeah, I don't tell people that.

That is not a surprise. It's a good, I mean, listen, it's a good thing. I get the point about it being unspoken. Like it's very hard to, it's hard to tell people you're intelligent, right? People, there's, it's hard to seem humble while saying it. I've known you long enough to know I'm not shocked at all. Like, I, I would assume—

Oh, there's people that will be shocked. I promise you.

Well, that's insulting. I don't know who the hell they are. They don't pay attention. That's incredibly insulting. I find you to be remarkably intelligent. But I understand it's not something that's said much, right? So this isn't supposed to be a question about me, but oftentimes I end up responding with my own, and I've had this discussion before. Listen, I, I also happen to be somebody who scores well. Right? That's just how it works. I have been since I was a kid and I've learned how difficult it is to have that conversation. So I rarely do because, you know, from my standpoint, I'm curious if you think the same way. I've always told people, listen, it's not a brag point. It's nature. It's like being proud of having blue eyes or being 6'4". You didn't do anything to earn it. I didn't do anything to earn whatever the IQ scores say. Like, it's thanks to my parents. Thanks. You know, thanks science. Thank a little bit of luck. It's what you do with what you're given. Right? You know, it's, I'm more proud of the fact I'm not homeless or in prison. Uh, both could have been options, I suppose. You know, and that also includes a lot of luck, by the way. Uh, I'm not proud of the fact that I'm intelligent, but when you tell somebody that, it just comes across as bragging and arrogant. And, you know, people have a visceral reaction sometimes, which is probably why it goes unspoken mostly, because the thinking is just be who you are and people will know. I mean, I'm not shocked. You're very intelligent. I would've assumed as much as somebody asked me to guess your IQ, I would've picked a pretty high number. But it makes sense it doesn't get talked about because people can brag about a lot of things. But even if you're not even bragging, you just mention it. It's just a statistic, right? It's just a thing. You know, you're where you are because you're really good. You know, like you're good at what you do. You're good with people. You're, you're, you're always learning and adjusting and adapting. I'm sure some of it does tie to just being naturally intelligent, like, you know, adapting to things quickly and being able to assess things. It's ingrained into that. But yeah, it doesn't get talked about much because people just Do you have the same feeling, by the way? Do people react— I mean, I don't know if you say it much, if at all. Do people react poorly if you tell them, like, yeah, I'm kind of bright? Like, I mean, there's— I don't even— there's no nice way to say it, basically. Like, how do people react? Has it come up much?

I think there are two people that know.

There'll be at least four now that's on the show.

I got a couple people. So I don't really have an answer to how people react, but generally people, I think, underestimate me. You know, I am Maybe it's that women insecurity thing. Certainly, you know, I started a business when I was very young. People literally said, you're very young. So, you know, like, yeah, I guess I've been underestimated a lot. So it's kind of nice to be able to know, you know what, like, I know what I'm working with. I know, yeah, we can back this up.

Yeah. Provides a foundation of confidence, I'm sure. And, and I don't doubt, I don't doubt some of it is because you're a woman, unfortunately. Like, this industry is full of it. I have several brilliant friends who happen to be women. And to a woman, I've never had one tell me otherwise yet. They all have said people underestimate me consistently. I so rarely hear that with guys, frankly. Like, people overestimate us, if I'm gonna be honest. I spend a lot of time saying, I don't know why these people think I can do this. I've never done it before. Uh, I'll figure it out. I think they're overestimating my skillset. So I, yeah, I'm certain some of it unfortunately is, is tied to that. I think people still underestimate. Women in our industry as a whole. But yeah, you're pretty goddamn smart, frankly, and very good. Like, it's not just that you're smart, you're hardworking, you're good with people. Like, you're where you are because you earned it, for no, you know, no doubt about it. So it's unfortunate that still comes up, but we're getting better at it, I think, you know, slowly but surely. I know some brilliant women who've done really well, but it's— people need to stop underestimating anybody who's based on anything. Also, if they're just mild-mannered, if they're just humble, you know, there's an assumption there. The blustery, which tends to be dudes a lot of times, the blustery person who comes in and tells you all these things with great confidence seems to draw a lot of attention in a positive way. And a lot of times they're just full of it. I know, because I've been that person. So hopefully I'm not anymore. So anyway, well, this has been a great caller appreciation hour.

Can we do this again next week?

Yes, I think we should do this. Probably not on camera. I think I will have you back on the show. I don't know if people want this to turn into just the Carl and AJ show. But I mean, we certainly can have a call next week. We talk somewhat regularly and we can just keep, you know, pumping each other up and making each other feel great. No, I appreciate this. I appreciate you coming on. I really do. I know you're a little under the weather, so all the more that you were able to make time to handle this topic, which I couldn't have thought of a better person for it, frankly. So I appreciate that you were able to make time to do this. Is there anything before we wrap up? Is there any last thoughts? Anything you wanna, do you wanna plug the company? Do you wanna talk about any last tips for people? Whatever you want. You know, you got a few seconds here if you wanna throw something else in on the end before we close her out.

Well, I probably should plug Surefire, like instant response. So we're doing really great things and I'm always open to connecting on LinkedIn. And I'm really excited to have come on. I've wanted to be on this show for a little while. So thank you for having me.

Absolutely. And we'll definitely have you back on. Yeah. And everybody who's listening, definitely check out Surefire. You know, Carla's fantastic to work with. She's easy to talk to and she's really bright, obviously, and she does good things. So, you know, she's there. I'm sure what they're doing is going to be very interesting stuff. So definitely check 'em out. And with that, I'm gonna close it up today. Again, thanks. Thank you for being here today, Carla. Thank you everybody for listening or watching. Please, you know, like, subscribe, whatever you're supposed to do. I don't know. Give reviews, hopefully positive. If you have complaints, keep 'em to yourself or you can, it's okay. I'm aj@unspokensecurity.com. You can, you know, scream all you want if you'd like to. But until the next time, thanks again everybody. This is another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.