Unspoken Security Ep 2: Build Diverse Teams...or Die!

cyber never sleeps. So why not hire people where we can and see if we can set up almost a, a mini, I'll say, follow the sun. So taking advantage of the time zones and play to that. So it's okay for us to have someone in Europe and maybe Asia Pacific, for example. So I get that around the clock coverage.

Welcome to Unspoken Security by ZeroFox, the raw and gritty podcast for cybersecurity professionals who want to understand how threat actors are leveraging the internet. In each episode, your host AJ Nash engages with various industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding security. Ultimately, the lessons learned will enable security professionals to take an intel-driven, proactive approach to physical and cybersecurity that extends past the perimeter. Let's get started. Hello and welcome to another episode of Unspoken Security, brought to you by ZeroFox, the only unified external cybersecurity platform. I'm your host, AJ Nash. For those who don't know me personally or are first-time listeners just checking us out, I'm a traditional intelligence guy who spent nearly 20 years in the intelligence community, both within the US Air Force and then as a defense contractor. Most of that time was spent at Fort Meade. I've been in the private sector for about 8 years now. And I primarily, primarily build or help other people build effective intelligence-driven security practices. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I'm also deeply committed to servant leadership, which is why I completed my master's degree in organizational leadership at Gonzaga University. Go Zags! So the goal of this podcast though, is to bring all of those elements together with some incredible guests and have authentic, unfiltered conversations. Even debates about a wide range of challenging topics most of us are faced with every day. This will not be the typical polished podcast. You may hear or see my dog. She's around here somewhere. People may swear here. We may argue or debate, and that's all okay. Think of this podcast as that conversation you might overhear at a bar after a long day at one of the larger cybersecurity conferences, especially maybe if there have been a couple drinks in Vegas. These are the conversations we usually have When nobody's listening. So today our guest is Errol Weiss. He's a longtime leader in the security industry. He's an alum of both NSA and Citibank, among other places. And he's the current chief security officer for Health ISAC. Hey, Errol, let's give the audience a chance to have more of a connection with you. Can you talk a little bit more about your background and then what you're up to right now in your current role at H-ISAC?

Yeah, AJ. Hey, great to be here. Thanks so much for having me. It's wonderful to spend some more time with you here. We'll learn about each other along the way. Yeah, I guess, you know, to help provide a little bit more color, you know, you mentioned NSA. I started my career there. I had a couple of different jobs while I was there working on the SIGINT side of the house for the first part of my career. And then I changed teams and I went over to the OPSEC side of the house and hopped onto a penetration testing team where I was, you know, behind the keyboard and doing some really pretty fun things. Things and learning a lot and working with some phenomenal people and, uh, had a great time and, and, learned some terrific skills. And then I left there to go do sort of that, you know, that thing, that InfoSec thing at the time for commercial companies. And, you know, the internet was, I'd say, still just starting to be a thing. Online banking was, was just rolling out. And I found a pretty new niche to further my career.

Well, I'd say so. I mean, we've crossed paths, you know, several times off way, not at the agency as it turns out, but several times since. And yeah, I mean, I'd say you've more than carved out a niche. I mean, you're, you're, you're a well-known leader in the space. I realize you're humble and you're not going to take a lot of credit, but like you were one of the big names I learned about when I first got in. Of course I was at a bank, so it makes sense. You were leading the way at the largest and probably best intel organization within the financial sector. And I was at another bank, so I was bound to hear about you, but Yeah, it's, I'm thankful you're here today. I appreciate it. You know, it's been great working with you all this, all these different times in different places. And thanks for being on today. And we're gonna have a good conversation. I think we've got an interesting topic here and I'm looking forward to getting your thoughts and sharing them, you know, with others and maybe we'll debate on some things. We'll see how we agree.

That's great.

Yeah. Yeah. As everybody knows, it's not so, you know, we'll just see what comes out of it. But, uh, you're in Florida and I'm in Minnesota. So no matter how bad it gets, it's not like we can reach out and touch each other today. But it's not like that usually around here. So anyway, we should just jump right into the topic actually. So today's discussion, like the podcast today is titled, you know, Build Diverse Teams or Die. All right. Maybe a little dramatic, but you know, I know we're both really, you know, we think this is pretty serious stuff. So, you know, I want to make sure people got the idea like this is in my opinion, at least one of the big keys to success or failure. So maybe you won't die, but you, whether you fail or not could come down to your diversity. Right. And listen, you've been doing this a long time too. I mean, no offense, but we're both. You know, we got a couple of years on us. So, you know, with that as the foundation for today's discussion, man, what are your thoughts on the value of diversity, like specifically in intelligence teams, but you can go wider than that if you want. I mean, you're a leader in a lot of spaces, you know, give me your thoughts on this. Yeah.

And I'll even tell you, you know, I want to start off with sort of even before thinking about the value of it, it's even how do you even get there? And I got to tell you, you know, and again, I'll go to my career at Citibank. We, I was, I had the fortunate timing of being right place, right time. And was asked to essentially create this cyber intelligence function inside Citibank. This was, this would have been like 2007 probably, and to just go off and build that team. And then years later, looking back, literally had a conversation with our HR representative and basically, you know, a tough conversation and saying, you know, hey, Errol, look at your first line, look at the leaders who are reporting to you. And I'm like, oh my gosh, they're all white males. How did that happen? And again, you know, there, there was no rhyme or reason to it, right? I thought we were interviewing people who were right for the, and hiring people who were right for the job, had the right skills, brought the right thing to the table. And then lo and behold, I look behind me and I've got a lot of people that look just like me. So, you know, the first thing I'd say is, you know, in order to, first of, first of all, in terms of building diverse teams, you know, you've got to make some conscious efforts to do that. At least I think, I think you do. And, you know, and it starts with even thinking about like who's interviewing the candidates. So you want people interviewing the candidates who look like the people that you're trying to recruit. So if you're looking to hire more female or more minorities, I think you want the people doing those interviews that, that look like and fit those characteristics. So that, that was a big mind shift and sort of a shocking thing for me at that point in my career. And then, you know, like you said, build diverse teams or die. And I think it's not an exaggeration. I think it's true. I think, you know, when you start looking, you know, the problem with having all the white guys behind me is that we're all thinking alike and we're all talking alike. We've all got similar experiences to a large degree, and we all bring those same perspectives to the table. So when we are looking to solve problems, it suddenly becomes like, you know, the groupthink, right? The first one with the idea, everybody agrees. Okay, done. We move on. And it's just, we're not bringing any variety or new ideas to the table, new viewpoints or perspectives. And so, you know, that's the important part. And when you're hiring females, minorities, for example, you know, they're bringing the wealth of that background and the richness of their culture to the table. And it's important, especially in the intelligence world, when we're reliant on the analysis that those individuals are doing in those write-ups, you know, it's so important to be able to view and recognize those perspectives in that writing.

Yeah, man, I couldn't agree more. I mean, obviously, you know, somebody's going to listen to this, maybe if they listen, we're all right, but if they watch, they're going to go, well, great, two white guys are going to talk to me about diversity. And I gather that, right? And, you know, the truth of the matter is, I could have had this discussion with several other people and it's, it's an interesting position to be in, you know, on the one hand, I, and so this show, for instance, I'm, I'm working, I'm conscious about diversity, right? So I've got, you know, I think I've got my first 10 guests picked out. I think, you know, last time I looked, I think 6 are guys and 4 are women. It's a pretty white cast, to be honest. I'm still working on that, but it's not from a lack of effort. It's the challenge, of course, is there, there are only so many people in the industry and you're like, okay, great. Now, how do I find the right people? I only want stars. Of course, we have tons of stars. Across the board. I don't care what color or race or gender or creed or religion, or pick whatever you want. We have stars in all those categories. It isn't a white dominated field in terms of talent. It's just a white dominated field in terms of numbers. So trying to find those people, right? And then get 'em scheduled and, and scheduling's been a challenge. But I think what I also didn't want to do is say, okay, I've got this fantastic woman. Let's spend an hour talking about what it is to be a woman in cyber. How tiring must that be, frankly, for that woman? Right? And I've got friends, you know, I've got these women that are gonna be on the show. And they were, all of them, I think, kind of breathed a fresh air. I said, listen, we can talk about whatever you guys want. You know, your perspective on life will be different than mine in the industry. I just want you to know I didn't bring you on so I could spend an hour asking you the same question you probably get asked. It's not, it's insulting in some way, right? It's, I want to ask you, how is it to be a leader in this space? Not how is it to be a woman in this space, right?

So that resonates tremendously. I'll just add, you know, hey, one of the things I do at our Health ISAC summits is I host a CISO panel at the end of the summit. And I tell you, I was so proud and so thrilled that at the spring summit that we just did in Florida this year. I had 4 female CISOs up on stage with me doing that panel.

That's awesome.

And when we were, when we were doing the prep, one, one thing, one of the women raised, she said, we are not going to talk about what it's like to be a female CISO. And so I was like, okay, scratch that off my list. We're not talking about that. And it was, it was great. And somebody in the audience, you know, during the, when we opened it up to Q&A, some of the audience said, hey, kudos and round of applause for having 4 women up there. It was awesome. But, you know, exactly to your point, you know, nobody wants to talk about that. No, I think we talk about the other qualities, right?

I think it's where it fits in, right? If you're having a discussion, you know, I've told guests, listen, everybody should be who they are on this show. So obviously we're going to represent where we come from. So certainly if you're a woman, you're going to, you're going to represent a woman's opinion, or at least your opinion, which comes from a female lens, let's say, right? And that's all good. But yeah, I've left it open. I've just said, I'm not going to, I'm not going to pigeonhole someone. I'm not going to make it seem like that's the reason they were there. The people that are going to be on the show are all You know, I have amazing resumes. They're all brilliant. They're all way smarter than me. I don't know why people spend time with me, but, but yeah, it won't be about that.

Right.

So, but I think you're right. You talked about, you know, the challenges and that there has to be a focused effort because again, this industry is still pretty well dominated by middle-aged white guys. And there's bias that we don't even think about, right? We know this Intel, we'll talk a little about Intel bias, but there's bias built in. Right. And so you got to fight against that bias and you got to be conscious about it and say, I want the best candidates. I, I, I don't care where they come from or who they are really, you know, and then, and then to be able to work on that because otherwise, like you said, you wake up one day and even if you care, you can easily turn around and go, yeah, there's a whole room of people who look just like me. There's a good chance our answers are all going to seem the same because that perspective, you know, as we talk about Intel, you know, everybody's going to have the same perspective and you may not understand the differences. And there's a lot of nuance when we do Intel. I think people who don't do Intel may not realize that there's group discussions and there's bouncing ideas off each other. And if we all have the same background, we have the same economic background and social, you know, experiences, we just may not have the creativity in the room to imagine a circumstance that we've never heard of or thought about. And then somebody else who comes in and it's their life experience says, well, what about this? You go, well, that's mind-blowing. I never would've occurred to me. So I'm with you. I like to, you know, be working with a building if I'm the guy building or working with or consulting with teams that are as diverse as possible.. And it isn't just gender. It isn't just race. Experience is there. Education is there. You know, cultural difference, geo economic, you know, geopolitical differences, you know, geographical locations where people are raised, economic differences, even some, you know, interests and backgrounds. I've seen Intel teams that hire people with journalistic backgrounds, people with music backgrounds and math backgrounds. You know, obviously in our space in cyber, a lot of technical folks are tied in and that's a very different background. I mean, I'm an, I'm an arts and science guy. I don't, I don't have the technical chops of some, a lot of the folks I work with, frankly, but they don't have whatever experience I have. Right. So I'm curious about that, just specific to the Intel teams. Right. So you've assembled amazing teams, right? I mean, you're well known for this. Is it the same with you in the diversity? Are you looking at all of that picture? Are you looking at career diversity, education diversity, geographic? I realize you may not get it all, but is that, is that your thought process as you're going through it?

Yeah, I think now that's exactly the case where you do have to look at all of that. And I think, you know, you get to a point where the team is is so big and so filled out and you've achieved some of that diversity that you're looking for. Now when you start adding people on, now you start looking at, you know, where are the gaps, right? What do I need to, what do I need to fill in on that next hire? So thinking about things like, maybe I need more technical help in a certain area, or maybe I need more geopolitical coverage in some other area of the world. And so you're starting to think about like when you, when you do that next hire, okay, you're looking for someone that brings that expertise to that table.

Yeah. Well, that makes, I mean, that makes perfect sense. Right. And, and, you know, it's changed. I think I don't want to get ahead of too much because we have more questions to go through, but, you know, the, both the opportunity, I think, and I guess the opportunity maybe is the big one right now changed with, you know, with COVID with remote work. Right. So, you know, it's, I guess I should ask you, it wasn't one of our questions that we had prepped. So sorry, I'm going to throw you on the spot, but now it's part of this. So how does that, fit in for you? Has that made it easier to have a more diverse team? Is it more challenging to have a more diverse team? You know, I mean, we have a whole world to choose from. It doesn't have to be somebody who's local to the Florida office for y'all. But how has that impacted diversity and maybe in age as well as that comes into play? I don't know if there's a, if there's a, I'm going to investigate if there's a difference in ages that are more or less comfortable with remote work and, you know, working remote teams, like how have you seen that impact things?

Yeah, I think, you know, certainly in the COVID era, there's been a major shift to remote work. And so, you know, in some sense, I would say that we're actually competing now with even more than before, right? So if you were hybrid or remote pre-COVID, now guess what? You're going to be competing with a lot more organizations now because there's a lot more companies that are working remote or hybrid. You know, we're starting to see them pull back people to the office and whatnot. Now that we're at this particular stage in the end of the pandemic, fingers crossed.

Mm-hmm. Mm-hmm.

I hope so. Yeah. And right. And we've, and organizations and operations have shown that we can, we can still function with most of the workforce being remote. So why not continue that? So I think that in order to be competitive, we've got to have, we've got to be able to enable that hybrid workforce. And yes, your point, right? I can, that opens up the possibilities in terms of all of the above, right? The diversity from all of the aspects that we talked about, you know, from the human aspects of it, whether it's race, gender, and then certainly location, economic backgrounds and whatnot, educational backgrounds, geography already. And then take advantage of that too, right? I mean, one of the things that I will also strive for, as we know, right? Cyber never sleeps. So why not hire people where we can and see if we can set up almost a mini, I'll say, follow the sun. So taking advantage of the time zones and play to that. So it's okay for us to have someone in Europe and maybe Asia Pacific, for example. So I get that around the clock coverage. So yeah, that's, you know, it's a beautiful thing. We'll play to that too.

Yeah, that's a really good point. And, you know, it's, I'm curious and I realized I'm going to kind of cheat on some of the questions. Like we prepped a little bit just for everybody knows, like I said, I tell people it's unscripted and it is, but we do have at least a prep call. Errol's going to end up getting screwed on this one because I've got better ideas in my head right now than we started with. But I think you're still prepped for most of the things.

I won't put you on the spot. By the end of this, you'll figure out what my tell is when the—

That's right. I'm going to figure out the question. I'm going to play poker with you after that. But you know, you've been, you've been out of the government space for a while. You know, I've been in the private sector for a long time doing this. Right. And so what have you seen? How has this changed over the last, you know, we talked to obviously remote, I'm sure come up as part of this answer too, but what have you seen really change over the last, I don't know, say 10 years in terms of both the interest and the effort towards diversity, but also the result, you know, where, where are we going with this? Like we, you and I both just lamented there's. A lot of, you know, male, white middle-class dudes still running a lot of our organizations and a lot of this industry. So I feel like we're not getting places, but I think we also might be. So, I mean, what have you been seeing right now for change over, say, the last 10 years or so?

Well, I mean, I'm going to say really that the function of an intelligence team inside the private sector, to a large degree, I would say is pretty new. I mean, I think when we were doing this at Citi in 2007, I don't think that there were a whole lot of intelligence types in the private sector at that time doing, I say, formal intelligence operations on behalf of large commercial companies. And so it's still only 20-plus years old now, or 20-ish years old now at this point, which, you know, in the scheme of things, isn't that long, even though it seemed like a lot longer.

20 years just seemed a lot bigger when I was younger. Now you're, I'm with you now. It doesn't seem like it's very long at all.

Real quick. Then we get to say old, but you know, maybe intelligence might be like the second oldest profession out there. So it's been around a while. And, um, so from, from the science of intelligence and the methodology and all of that, it's been around. So proven, we kind of knew where, how to, how to get things going at that point. But I would say, you know, in the beginning that it was tough to find and hire people because it was, it was either we were taking smart technical people and teaching them the intelligence process, or then at some point we were able to get lucky and start getting people that were coming out of the military or the intelligence community and, and wanted to do that. And I, I remember one of the people that we hired came to, uh, Citi and, and when she got hired said that, you know, I never, when I left the military, I never thought I'd to ever do intelligence ever again. And lo and behold, here we are. So I think that, that there was a lot of growth happening in those early years and, and the struggle to set up, you know, intelligence inside commercial organizations. There was a lot of studies done. I remember with working with Carnegie Mellon and the Software Engineering Institute at the time, you know, studying intel functions inside private sector organizations with a lot of interesting findings at that point in time. So it was pretty new. All right. And then, you know, you bring up the diversity factor and then you've got, you know, old adults like me that, you know, suddenly wake up one day and say, crap, how did I end up with 5 white guys behind me helping to run this thing? How did that happen? And so, you know, again, I never planned to do that, never meant to do that, but, you know, you wake up one day and that's the reality of it. So it's it's the revelation that, man, you know, you've got to take a proactive role in this stuff. And, you know, it starts with the creation of that job rec in terms of, you know, what kind of people are you looking for? What kind of backgrounds, education? Yeah. You know, and I'll say yes or no on the education, right? Because we're all, you know, today we're starting to even eliminate the need for a college degree. Right. But anyway, you know, it starts there and it starts with that pool of candidates that you're looking at and the pool of people that are interviewing those candidates, as I mentioned before. So, yeah, we got to take an active role in it. And so, you know, that's where I'm coming from now.

Well, I mean, it's, and it's good to hear, right? I mean, it's that, it's that thoughtfulness, right? And that's, I think the thing I've seen, I've been private sector for about, I don't know, 8 years now, I suppose. And I think that's the part I've seen people lean into more is, is a thoughtful approach to this. You know, it, at first I think it was more of a discussion. I think it's been a discussion for a long time. Yeah, yeah, we really should be more diverse. You're right. And then everybody just goes back to what they were doing. And I think, you know, I've seen a lot more thoughtfulness over the last handful of years and not just because leadership tells you so, or because HR comes in and gives a briefing and says, we got to do this, right? I've seen thoughtfulness at the operator level, at the team level, at the team lead level, you know, director saying, hey, I think, I think the much like we have been working on the education of letting people know what is intel, right? What do we mean by intel? How do you build intel teams, et cetera? I think what is diversity and why do we need it is starting to sink in at a level, like what we are talking about, which is this makes us better, right? This is, this is not, and I know people want to politicize some things and there are people saying, you know, people don't like quotas, people don't like affirmative action, whatever it is, right? In terms of Intel, I don't, I listen, I'm not interested in the political discussion. I can argue with people about that some other time, but in terms of Intel, I'll, I'll, you know, plant the flag. It makes us better, period. There's, there's no debate. To my knowledge among intel professionals that you get better intel teams when you have more diverse teams. And that isn't some, for those who want, who may disagree and want to politicize, that isn't some argument saying we're going to pass up brilliant people to get unqualified people just because they fit a category. That is not what anybody is saying, or at least not what I'm saying. I know not what you're saying. But I mean, there are great people.

You will serve your customers better by hiring, you know, diverse set of analysts on your team. Absolutely.

Exactly. And they are everywhere. You know, I think it's, it's interesting. You talked about, you know, looking at the education and even is a college degree the right answer anymore? And maybe it is for some roles. It's not a guarantee. Certainly. I mean, I'm seeing a lot more. I'm curious what you are with this. I'm seeing a lot more of people who are, you know, they've got some education, maybe they'd cut some college, maybe they didn't finish. I don't know. Maybe they got college, but it doesn't relate. And they got a lot of certifications. They got hands-on training. You know, this wasn't one of our questions, but I'm curious since we talked to education, you know, how are you, how do you see like certifications versus degrees, not necessarily versus, but how do you, how do you view those? You know, does that put someone on an even playing field? Are you guys changing your job recs? Are you seeing people in the industry change job recs to say, hey, that proves you're qualified enough? Are you, are you maybe doing a proof within the interview process? Hey, let's, here's some, you know, a test of whatever it is to see if you can do these things. Has that changed at all?

Yeah, definitely. And I, I think that's another area that we're seeing, you know, especially like, yeah, between intelligence and all the cybersecurity roles that are unfilled today. I think that hiring managers are definitely looking at those requirements now and rethinking that. And I know definitely that there are people that are scratching off the college degree requirements, not looking at that any longer, and really trying to focus in on the base-level skills that that person has, what's their capability. And then, you know, things like intellectual curiosity, right? You know, do they have that drive to learn, you know, better themselves, do more, you know, the societal give back and contribution to community and all of that, you know, looking for those kinds of attributes. And, you know, the whole idea that if you've got the basic skill set, I can teach you the rest. And that's what I think people are looking for now.

Yeah, I think that's huge. You know, you talked about that, that curiosity, right? I've heard people say, you know, I want aptitude and attitude, right? You know, experience is useful and there are some places where it's mandatory. Listen, I, aptitude and attitude are great. I don't want you to tell me you're my surgeon and, you know, I got to go get her attitude. Well, great. Where's your degree from? How many times have you done this surgery? I'm much more interested in that today. I don't care if you're a jerk. So it isn't for every job, seriously. But aptitude and attitude, I've heard a lot about. But the other thing is, you know, when we talk about this, we keep hearing the stats, I know you read them, millions of jobs, or I don't know how many jobs are open in cybersecurity, right? The number goes up every year. We don't have enough. We're not making enough people to fill the jobs, et cetera. You know, does, does this change, right? Does the talent pool become wider or deeper as a result of A, you know, changing some of these requirements, maybe saying, hey, a degree is what's limiting some of us. And we're not saying we're downgrading the need to do the work well, but just saying, hey, maybe this is a limiter we shouldn't have, but also getting back to the whole remote piece. Remote and hybrid and how that works. Does that, is that, are those part of the solution for closing this gap and giving us a better talent pool, a deeper, wider talent pool to fill these jobs?

Yeah, I think it's the deeper, wider talent pool. I think that's ultimately what we're after, right? You know, I think there's definitely a gap in the number of candidates that we have today versus the jobs that are out there. Yeah, we always hear big numbers. I've heard recently there's a lot of debate about, you know, how realistic, you know, those big numbers are. It's probably not as big as we think it is.

Sure.

But I like the idea of opening up that candidate pool and again, back to the overall topic about improving diversity. You know, if we're able to eliminate that college degree, for example, then, you know, that opens up the possibilities to lots of candidates who, you know, maybe in underserved, underprivileged communities that didn't have a chance to go to college, yet they've got that drive and energy and intellectual curiosity to do the job and do it well. So, let's, let's take advantage of people like that and try to get them into some of these, you know, starter positions that at least give them some of the basic experience and training that they need to get started.

Yeah, I think that's a good point. You know, the college degree thing's really interesting. You know, I personally, I won't say I'm conflicted, I guess more disappointed in that, you know, when I grew up, it was like, you go to school, you go to college, you know, you're set for life. Basically, if you get a master's, you're special, right? And just around the time I finally got around to finishing my master's, we all woke up and went, Yeah, maybe this isn't the way it should necessarily be. You know, I think people have realized that there's some classism that goes with that. It doesn't devalue, you know, the education. I'm thrilled with what I learned and for the specifics I get to apply it to. But at the same time you go, gosh, what are we doing educationally? We've created this, you know, this requirement. Does it really apply? And there's value to education, of course. I don't think anybody disagrees, but does it apply here? Are we just eliminating the opportunity to have people who just didn't have the opportunity because they couldn't afford it? College is freaking expensive. And so I've, I've been, I've personally, I've enjoyed seeing some of this shift and I know brilliant people who don't have college degrees, you know, they got certifications, they got hands-on training, whatever it is, giving them the opportunity to show, hey, I can do the work. Is that not what you're hiring people for is to do the work? Or as you said, you know, I can learn how to do the work. I'm, I'm curious. I'm willing to come in at a low level, you know, maybe internships. I don't know. I know you guys do some work with that. I'm curious about your thoughts on, on internships too, as a way to get in the door. And what are the requirements for that? You know, does somebody have to be in school to get an internship? Can they get an internship without being in school? I don't even know if I've seen much of those change. I think most of those come off colleges still, but I know you guys do some work with that too.

Yeah. In fact, you know, we just moved our headquarters locations to Orlando and we're right on the doorstep. I know we're right on the doorstep of UCF, University of Central Florida.

Yeah.

And so we reached out to them during that move process to initiate that relationship and really start building a partnership. And we, before we even moved, we hired a graduating senior or someone that would be graduating this past May and brought her on board as part of that intern program. And now that we've moved, we actually have, we brought two more interns on as part of that program. And, you know, it's working out great. And I think, uh, You know, they've got an opportunity to learn, really develop some, some skills and, and learn about what it's like to work in an office environment, what those expectations are, right? These are very practical things that, that you don't end up learning, right, to the point while you're in college necessarily. And then I've warned everybody also on the staff that, hey, you've got an opportunity to learn from these guys too, right? Because they're, they're learning new things, they're learning new methods, and they bring again, back to the diversity, right? They bring different experiences to the table. So every single one of us on staff, including us old guys, have got an opportunity here to learn from the youngest. And so I'm really looking forward to working with them and what happens next. But I think, you know, as you mentioned, right, you have to be in a college program to snag one of these internships. And I think, you know, I would encourage anyone who's listening who's in a situation where they're not necessarily in college and they want to try to figure out how to get started in a career like this. Start figuring out who's in the area and start a letter writing campaign to try to get some attention and see if you can get hired on as an intern, part-time intern. Some, some are paying, some aren't. And, uh, at least get your foot in the door and see if you can get some of that initial experience.

Yeah, I think that's, that's an excellent point, right? It's great to hear that you guys, even before you moved, you started reaching out and saying, hey, how are we going to, how are we going to work on this internship program? Right. I think, you know, I think we're seeing some universities develop some great programs. I don't, I don't know UCF. Particularly well personally, so I can't speak to that. I'm a good university, I'm sure. But, it did remind me that some programs we've even seen where universities are developing cyber intelligence programs specifically to pull it back to the intel discussion, right? Where they're combining traditional intelligence training with traditional cybersecurity training. So you mentioned that earlier in the conversation that it was one or the other, right? You'd hire technologists that try to teach you intel or hire intel people, try to teach them tech. I've seen some of these programs now. There's one in a college in North Carolina I'm familiar with. I think James Madison, I think, has one in Virginia. There's a, I admit I'm biased. I've spoken at their comp, at their, to their students at the university. So that's a plug for James Madison, but there's, there's more of those there. And I don't know if UCF, do they have a program like that? Are you looking at other programs like that? Is that?

Yeah, they do. Yeah. Yeah, they do. It's, it's amazing. Right. I wish I would have had something like that, you know, before I started doing all this stuff.

Well, yeah, it's, yeah, it's, well, now you should be teaching it instead. So if they haven't, if UCF hasn't reached out to you, you should have a chat with them. You could totally be teaching some of these courses at the at this point. So, all right, let's kind of transition. We got one more of the stock questions for today. I've kind of gone all over the place and I moved this one. I've actually literally helped rewrite this one while you were talking, but I think it's, it's, it's still aligned with what we said. I think it just fits our discussion better now, which is, you know, I want to get in, get into this last piece. I want to kind of roll back into the discussion we started having a little bit in here. And I know we talked off cam before about specifically the, the structures we're going to have going forward, right? This talk about whether it's office, whether it's hybrid, whether it's remote work, You know, obviously we're talking about diversity and this is going to play a factor in some of this. So in your opinion, like what's the best model? I'm gonna put you on the spot. What's the best model? And then what challenges and opportunities are you seeing across all the different structures in terms of, like I said, office, hybrid, remote? What do you guys, if you're allowed to say what you're doing and you're the boss, I guess you're allowed to say whatever you want. What are you leaning towards? What do you think is the best way to go? And maybe a why there, but also the opportunities across all these different kinds of structures and the challenges.

Yeah. No, I mean, hey, in this, you know, in this Intel space, I think, you know, the idea for us will be we will be hybrid remote for the long haul. You know, I know when we were talking during the prep and all that, we, you know, I said something to the effect of like, hey, in a perfect world, we'd all be at the same location.

And I jumped all over you.

You did, man. You beat the crap out of me. And I think, you know, and I will still stand by that. So yeah, I mean, hey, if I didn't have a life.

If I didn't have a family, your definition of a perfect world and mine don't match, Errol, but I get where you're going.

Just give it a hard time. Frictionless surface vacuum, you know, all of that, right?

Oh, 100%.

Yeah. So, um, you know, we'd all be in the same room. We'd all be collaborating with each other. We'd all have instantaneous, like, you know, hall, hall talk and water cooler talk and all that kind of fun stuff. But that ain't the reality of the situation. Right. So, you know, back to all the things that we talked about earlier in terms of taking advantage of, of growing diverse teams, hiring the right talent, getting people where, you know, in time zones that we want them to be in for different reasons, locations, cultures, all of that, and taking advantage of the beautiful remote world that we live in today. So I think that's the reality for us. And I think we'll see more and more companies going that route as well. So I think that will drive competition for some of these, you know, these resources for sure. Yeah.

Yeah. I agree. Listen, and I get what you were saying. Obviously, when we're talking to PrEP, you know, Yeah. The ideal world, right? But I get what you're saying. Listen, I've, for those who've ever been in the military, for instance, you know, when you're deployed, you do great work. You know, deployments are hard for a lot of reasons. And, and I'm an intel guy when I say deployed, by the way. So if you, you know, I don't want to be compared to people who are out in combat. I'm not talking about that kind of work. That's a whole different world. I'm not, I'm not claiming that. And I don't, I can't speak to it. In intel, it's like there's stress of being deployed, but when you're deployed, we often talk about, you know, TDY someplace. At least I can just focus on this. Like, this is all I do. Like, we're together, there's camaraderie, you do the work, you know, you don't have to pay bills, you don't have to walk the dog, you don't have to worry about whatever. So there is something to be said for that. I absolutely agree. Co-location and that bonding that's with it, right? But there's a reason we aren't deployed for 10 years at a time, right? It does wear on you. So yeah, I don't disagree. I get what you were saying in terms of, you know, in, in, in that scenario, right? But yeah, I've been a strong advocate, obviously. Now listen, I work remote, you know, I'm in Minnesota, the company's in Baltimore. Ironically, I lived out east and changed companies after I moved. I used to live about a half hour from headquarters. You know, if every company said you're only, you know, going to be in the office, clearly I'm going to have to find something else to do and I don't want that. But I'm a big believer that hybrid, you know, is a good middle ground, right? Ideally, like I'm thrilled where I'm at. I'm not moving. You know, I just built a house. I can't go anyplace. But in, for me, in an ideal world, I'd be in the office, you know, 1 or 2 days a week. I think I would love the opportunity to have more of that connection. We have to make it through virtual means and we do all right with this, but I'd love to have that a couple days in there, you know, focus time, right? You're in for meetings, you're in for specifics, you get what you need, you get the connection, you can get a lot done in a day in a room together and kind of turbocharge it and then go back and do, you know, the things that we need to do and balance the life and all, all the stuff that goes with that. Right. And so I, I think I'm seeing more of that, but you know, it's, I mean, I guess Nobody knows for sure. I've seen lots of data. I'm sure you have too. Like lots of, I see a report one week that says during COVID we've proven that productivity didn't change at all. Nobody should have to go back in the office. And the next week some other company comes out or some organization says, no, no, productivity is way down. People have to get back in the office immediately. It's terrible. And, you know, I think there's so much conflicting data that may be intentionally or unintentionally biased that it's so hard to know what ground truth is. I do know the financial sector has come out and said that we're going to lose like $800 billion in corporate real estate value if people aren't in the office. So I suspect that's a motivating factor for some people.

Right.

But I think from the diversity standpoint, you know, the key piece we were talking about is, like you said, it, it offers that opportunity again to reach out, you know, the person that would make that team more diverse, somebody who knows a different area, a different background, a different culture, a different experience. The world's your oyster now. I mean, you can recruit from essentially any place, right? I am curious though, with that, are we going to see, do you think we might see some challenges in terms of I would, I don't know, kind of domestic outsourcing is kind of what I've been kicking around in my head. So for instance, why would I hire somebody in New York City anymore? Or I would hire somebody in LA or San Francisco or, you know, pick a, pick an expensive place. Why, why wouldn't I, why would I ever hire them anymore when I can hire somebody in Memphis, Tennessee or Phoenix or, you know, Billings, Montana, wherever the talent might be. Have you run into that? Not, have you guys thought about that? Is that, is that a concern that we're going to run into a situation where people actually have to leave the more expensive areas because they're going to be competing internally? At rates they can't afford to pay.

Yeah. And I think I mentioned a bit about that before too. I think I, you know, the whole notion about competitive forces driving the workforce and that hybrid remote workforce, that will continue to be a factor. I mean, much to your point, right? It could be that they would want to drive some of those functions to, let's say, lower cost locations, and then they can hire remotely from those locations as well. But again, I think that, that those companies are also in competition with others that are hiring remotely. They're going to be dealing with that as a factor too. So maybe you won't be saving as much on labor as you think you will.

That's a good point. The free market does go across everybody, right? They're all going to be shopping the same, same talent pool, which we still said isn't big enough yet. You know, I mean, we, I see a lot in this industry. We're not an exception. A lot of work that is overseas. You know, India has, has incredible tech talent at, you know, compared to Western prices, certainly less expensive, right? Just to name one, a lot of them. But there's always been some functions that I've strongly argued against pushing in those places. Intel being one, again, because there isn't the Intel background, right? There isn't, there aren't people trained in Intel in some of these other places the way we are in the West. I mean, you know, Australia, Canada, UK, us, New Zealand, I suppose, and some allies in there, but I wouldn't offshore intel, like true intel functions to some of these locations because the talent's not there.

You know, you talk about the value of the hybrid part, right? You want that time when you can get everybody together. So, you know, you, you know, it's tough to pull them when they're that far away. So, but if you pull them together from the US, right? Different points in the US to do that. And yeah, I know that's in this company, since I've been with HelpiStock, you know, that's one of the things that we're trying to do is getting, you know, all the team together. At least now we're going to, We were twice a year. Now that we're a lot more global than what we were before, we'll do at least once a year. But, you know, that's the investment that we want to make is to be able to get everybody together. And then, you know, we talked about, you know, getting your butt to headquarters on a regular basis. So I think, you know, that's a factor too, right? So back to that whole hybrid thing, you want to get yourself back there. You know, you don't necessarily need to be, you know, you don't need to wait until you get called back, but, you know, volunteer, get yourself into the office, spend some time there and get to know people there.

Yeah, that's a good point. Like, you know, I don't want to call it FaceTime just outright. I mean, I don't want to suggest that, but I mean, we all know presence is part of it, right? Just it's, that's a human thing, right? Yeah. If, if leadership knows you and knows your work, it's either better or worse for you depending on if your work's any good, I guess. If you're not good at the job, I'd say hybrid as far as I'd say remote as much as possible and keep your name out of, out of their mouths. But, you know, if, if you're decent, I think, you know, There is something to that, right? So, so maybe that's something else we should start thinking about. So as we talked about having to fight against bias, having to really, you know, think about diversity, building diverse teams and actually putting the effort into it. I wonder, and we didn't talk about this at all previously. I wonder if we want to do the same thing in terms of biasing against remote people when it comes to promotion and things of that nature. If it used to be, we were all in the office, you were sort of on an even playing field. At least if you spent more time talking to the boss, you're either You know, kissing a lot of butt, or maybe you're really good at your job or really bad again. But now you could be brilliant and never be noticed. And frankly, if you have a lousy boss, your manager could be taking credit for your work. We may have to think about mindfulness in not losing track of people who are rock stars just because they happen to be far away. We hired them far away. We wanted them to be far away.

I think that's all, you know, even if you're all in the office, I think that that's possible, right? You know, there's definitely, I remember doing the collegial reviews and somebody saying, you know, this person's a rock star. And I'm like, I've never seen or heard that person the whole time I've been here. Who is that? So, you know, there is a bit of that. You got to get out and you got to make sure your people are getting out. You've got to be the advocate for your people and you've got to make sure that you're coaching them to get in front of the right people. You know, and if they're remote, yeah, there's a little more that you have to do to do that. I know like when I was working at Citi, for example, and I was, fully remote, I was making the effort to get to New York, to get to those managers, spend time with them. And I remember somebody asking me about, you know, why I had a suitcase with me. And I said, well, I just got in from Maryland this morning. And they're like, oh, I thought you lived here. I'm like, no. So, you know, that's what you want.

Good perception.

You almost want people thinking, yeah, you belong there. And, uh, yeah.

Yeah. I thought you lived there is a great compliment. You clearly had presence. You were there. Well, I know you've, and you've grown some great leaders. So obviously you put time in there. I know some of the folks I've worked with there and where they've gone. And I won't call anybody out by name because I'd miss people and be unfair, but you've obviously grown some leaders along the way too. Because there's folks that have stayed where you've been or moved on since that have done a great thing. So clearly you found a way to bridge those gaps and to make sure people got credit for what they'd done and got mentored and grown. So, you know, it's, of course you never hired me, but I'm not going to say anything about that publicly or anything, you know, I also never applied at Citi when you were there. Anyway. So, all right. So let's, we, that's our, like, that's the bulk of what we wanted to talk about here.

Right.

But We're through the 3 questions, and in my case, 3 are turning into 7 or 8 or whatever. But with every show, you know, as we get near the end here, you know, I want to close out the show with every one of these. I've been asking every guest a bonus question. And so since the name of the podcast is Unspoken Security, you know, the question I'm asking is, tell me something you've never told anybody, you know, something that's so far been unspoken.

Yeah, I'm at least glad that I knew that this question was coming, so I had time to think about it.

Yeah, that was a gotcha at least.

It's not a gotcha, but in all seriousness, I will say that when the, my leadership, when I was at Citi, they asked me about setting up this Intel program. Overtly, I said, yeah, sure. You know, definitely would love to do it. In the back of my mind, I'm like, I've got no idea on how to do this. I've never done anything like this before. I have no idea what I'm doing. And so, um, wow, that would definitely qualify as something that I've never told anybody. Right. And. And, um, and I, so what'd you do? Well, back to what you said before, right? It's all about, it's about the networking and hiring really good people. And that's what I did. And so I worked with my mentors. I worked with people that I trusted and tried to figure out what, what did I need to do initially? And then, and then when it came to the hiring, it was, you know, I was looking for certain qualities of people culturally and all that. Of course, unfortunately, we know how the first part of the story turns out. I hired a bunch of white guys, but fixed that problem later on.

What year was that? I'm curious.

What year was it? So again, we're ramping that up. That would have been 2007 and '08. Okay. Um, when all that was, when all that was going on and really, you know, surrounded myself with some great people and, and, and provided the vision, some of the strategy on what we think we needed to do, hired some great people who had done some of these things before, and then let them go off and do their thing. Right. So it was all about, you know, providing that basic leadership and let people do that thing, provide them some autonomy and gave them the ability to make those decisions and create. And I thought, you know, when all said and done, we look back at what we created, it was pretty phenomenal.

Well, yeah, I mean, that's incredible, man. Like you listen, Citi leads the way. I'm not kissing your ass when I say this. You don't even work there anymore. But everybody knows it, like Citi leads the way, like finance, first of all, still leads the way. Healthcare's come a long way with you joining H-ISAC. I was thrilled when you went there because, you know, healthcare needed some improvements in that area. It's just, it's tough, right? I'm not trying to take a shot at healthcare. They're a whole different structure there. Like finance is in the lead because banks have been getting robbed ever since there were banks. So there's a cultural thing. They understand threats. Plus that's where all the money is basically. Healthcare has always been more about help people sharing, et cetera. It's a cultural, in my opinion, at least. And therefore getting people to internalize, you know, the threat is harder, right? But I mean, Citi's amazing. They've spent a ton of money too, but they have a fantastic program. They've got that fusion center up in New York. They've got amazing talent. Right. They do great intel. They're one of the leaders within that, you know, their ISAC.

And these are all the successors of what was initially built, right? And I tell you, I just remember in the beginning when we started things out in that early timeframe, it was, you know, everybody was saying it's impossible to make change around here. It's impossible to change the, you know, the direction this aircraft carrier is going in. And then roll ahead, you know, a few years from there, we had thousands of internal customers that we were working with. We were embedding ourselves into their process. I mean, it was phenomenal. You know, we just—

And that all started with you not even knowing, and you didn't, you took the job not knowing what you were going to do actually.

Like, thank you.

Exactly. I mean, that's exactly right. That's wild. And I'll be honest with you. So I've had a handful of these prep calls. I've recorded some of these, you know, we're getting, getting this off the ground. This is, there's a thread across our industry. They're not identical, but there's a thread across these answers so far of people who either fibbed or lied outright, depending on what it was, or just, just in your case, like just had the guts to go, I think I can accomplish this.

I can, I think I can do it.

Yep. And then figuring it out, right? I don't, somewhere between there's creativity, there's some boldness across our industry. And I think it's a message that I'm hoping people that are listening are hearing that either, you know, listen, Errol, you're one of the guys I looked up to when I got into the industry, right? As like, that, that guy knows what he's doing. And you were in that job at the time. And I was like, that guy really knows what he's doing. And find out it's like, well, yeah, you did know what you're doing. You didn't maybe realize you knew what you were doing. Right. But you go, all right, don't self-select yourself out of an opportunity because that's how people got there sometimes was taking that leap and going, hey, I can do this. I'll figure it out. Listen, I had an interview. I've mentioned this story once before already, but I had an interview where I was asked a question I did not know the answer to. It happened to be a virtual interview. And so while I was beginning to answer the question, I also was Googling the answer and I got it. I was able to get enough through. I then went and learned it. I didn't just go, ah, I'm never going to need that again. Clearly I'm going to need this for the job. And it was a relatively simple thing to learn. It wasn't like rocket science, but you know, that was the creativity. I knew I wanted the position. I was confident that I could do the work. And if there was a thing I didn't quite know, I, I can learn. That's what Intel people do all the time. Right. But I think hearing it from somebody like you and some of the other leaders that I've been talking to, you know, I think that's a message I'm hoping people are taking away, which is, you know, a lot of us leap a little bit further maybe than we think we should, or than we're, you know, on paper documented as capable of. But I mean, where would Citi otherwise be? Like, if they hadn't gotten you, like, you were the right guy, clearly. Look what's come out of this. The whole tree has been built off of that. I mean, I think that's awesome. I, and thank you for sharing that. I mean, that's, that's going to be one of those revelations.

That's a great point. I call it organizational courage sometimes. You have you have to make that, those bold leaps, but yeah, it's, it's great.

I like that organizational courage. I'm going to actually steal that one and I'm not going to give you any credit for it either, but it's recorded now. So everybody knows. All right, cool. So listen, I think, uh, we're about out of time here, Earl. So first, I really want to thank you genuinely for being here, obviously, but also just, you know, for being a friend and a mentor and, and a teammate and a partner and all the things, you know, that we've done together. I love working with you and I appreciate that as well, but obviously I appreciate you coming on here and spending some time and sharing a secret along the way, which is pretty cool. You know, we'll work together more. I'd love to get you back. We'll pick up some other topics along the way. I think, you know, there's a lot more people can learn from you if I can get out of your way and let you talk. And, uh, I'm jealous. I'm not going to Dubrovnik. So when you go there, have a great time. If anybody doesn't know, HIsac is going to be in Dubrovnik for their, one of their big meetings. And it's an awesome place that I'll try to get to next time. Yeah, I think that's it though. Thank you very much for being here today and for sharing your thoughts on, on diversity and on the importance of building diverse teams and some of these businesses being diversity more than just people normally think of it as. So we're going to wrap it up for the audience. Thanks for tuning in today. I hope this was enjoyable and informative and entertaining and helpful and all those things. If not, let me know, throw all the tomatoes you want. If you really liked it, please tell people. But otherwise, until we're back to have another one of these discussions, thanks for tuning in. Look forward to talking to you again soon. Bye.

Thanks, AJ. Thanks to you and the rest of the Xerox team too.

Yeah. Thanks, man. Appreciate it. That's a wrap for this episode of Unspoken Security, brought to you by ZeroFox, the only unified external cybersecurity platform. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.

This is how legends are made.