S5E58🎙️ Live with 🛡️ Alyssa Miller (Multi Tracks Audio)

Hi, I'm John Maxwell. When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation I'm proud to say is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend Bob Fabien Zinga.

Welcome to the Leadership and Success Podcast with your host, Coach BZ, where we help you lead with purpose and succeed with impact. If you're ready to grow into the kind of leader others want to follow, this podcast is for you. If you're determined to elevate your success and leave a lasting legacy, this podcast is for you. As my mentor, Dr. John C. Maxwell, reminds us, everything rises and falls on leadership. Our goal is simple: to inspire you, challenge you, and equip you with insights that can transform the trajectory of your leadership journey. Welcome aboard to another episode of the Leadership and Success The Security Podcast with Coach BZ.

I'm a hacker. It's true. Have been all my life. Since my youngest days when I took apart my toys to figure out how they worked, to my preteens when I bought my first computer and hacked a dial-up community service, to the last 15 years of my career, which I've spent helping organizations secure their computer systems. My— like many of us in technology though, my path through security has been more a result of a series of serendipitous events than any carefully laid out career plan. In fact, my ability to go from a pre-med major with dreams of being a surgeon to a software programmer was really more the result of a hiring manager who saw how the skills that I had developed in other industries would be valuable assets to developing banking software. So I find myself wondering quite often, do— how many hiring managers have this same wisdom? How many of them could take a barista from a local coffee shop, for instance, and see how their skills relate to a job in security? Now, if you follow technology news, and in particular around security, you've no doubt seen the headlines talking about the supposed skills gap or talent shortage. Cybersecurity, this industry that's focused on ensuring that the digital systems that run our very lives are protected from attackers who would seek to destroy them or to manipulate them, struggles to find the talent that we need to fill those jobs. In fact, some estimates say there will be as many as 4 million.

All right. Thank you for watching another episode of the Leadership and Success Podcast. I have a very special guest with me today, and I am so excited about today's episode. But before I introduce her, Let's start with our moment of gratitude as is our custom here on the show. So, we like to start to think about one thing every single day that we are grateful for. And part of the reason why we do this is because in the military, it's about 21, 22 service members and veterans who commit suicide every single day. And I believe it's not possible to be suicidal and be grateful. At the same time. So if you would maybe close your eyes, if you are comfortable, put yourself in your happy place, maybe take a deep breath, calm down your nervous system, and think about one thing you are grateful for right now. And for me, I think I am grateful for all of the women who have had a huge, huge impact on my life, starting with my mother. I really didn't believe anybody could love me more than my mother, Pauline Koutakane Zinga. It's just incredible what women have done for our society. Without women, there is no society, there is no culture, there is no future. So, this Women's History Month, I really want to give a shout-out to all of the females throughout my entire life who have supported me, loved me, and really helped me get on the way and the paths that brought me to where I am today.

Alright.

So, let us know in the comment one thing you are grateful for today. And also, let us know where you are joining us from, what city and which state. And if outside of the US, since we are global now, which country. And also, if you do have a question for my guest, go ahead and type it in the comments and we're going to be answering live. All right. Let me see if I can properly introduce our guest today. Today, I am really overjoyed. We've been trying to make this happen for quite a while, but I'm really excited to welcome Alyssa Miller, Chief Information Security Officer at Epic Global. Internationally recognized cybersecurity leader, ethical hacker, researcher, and author of Cybersecurity Career Guide. Uh, with more than two decades of experience across programming, pentesting, consulting, and executive leadership, Alisa has built a reputation for bridging the gap between technical cybersecurity teams and executive leadership. She's also a global advocate for strengthening the cybersecurity workforce, uh, mentoring the next generation of cyber defenders, and helping organizations build trust and resilience in the digital age. So from teaching herself programming as a young technologist to leading global cybersecurity programs, Alyssa's journey is a powerful example of curiosity, resilience, and leadership. So without any further ado, please help me welcome to the Leadership and Success Podcast, the one and only Alyssa Miller. All right. Good afternoon, Alyssa. How are you doing today?

Hey, good afternoon, Bob. I'm doing well. How are you?

Fantastic. We are so, so glad you are here. So maybe to get started, what is one thing you are grateful for today?

Um, honestly, today I'm thankful for this, uh, house that I'm in because it's, it is, uh, about 35 degrees outside, 50 mile per hour winds, rain and snow. It's just been an awful day. So it's nice to have a warm house and a warm office, nice office to be in. So yeah, I'm more thankful than maybe normal to just have warm, nice space to be in.

That's crazy, we are in the same country, but here in California, I have a bay area, it's like 76 degrees. Can you believe that?

Incredible. That bodes well because I'm going to be out there next week and hoping for that same weather. That'd be great. Yeah, that's something.

Yeah, that, although in, in the city proper it gets a little bit chilly at times, but it's not as bad as it is where you are, for, for sure. Is, is there, uh, when people meet you for the first time, is there something about you that makes they may not know.

I mean, there's— if someone's meeting me for the first time, or all they know about is what they just saw now, I mean, it's probably this, this stuff up here.

Yes.

Um, you know, uh, it's kind of mandatory if you're a pilot, you have to tell people you're a pilot. There's the joke is, you know, how do you know there's a pilot at your party? Wait, they'll tell you.

Yeah.

So yeah, uh, I'm a private airplane pilot and a commercial helicopter pilot.

So that is crazy. Wow, that's gonna be a story to that.

Oh, there's a whole story that goes with that. I mean, it's, it's one of those things I just wanted to do since youth and then finally was able to, uh, make a reality later in life.

So, man, congratulations, that is just fantastic. So let's start with your origin story. Sure. Describe yourself as a lifelong hacker. Actually, the video I showed That was your very first sentence. I am a hacker and you are. So what first sparked your curiosity about technology and how did that curiosity turn into this wonderful cybersecurity career you've had?

Yeah, I mean, it's hard to put my finger on one thing, but I was that little kid, you know, very, very young who liked to take my toys apart and figure out how they worked. And then that kind of progressed into like my parents' electronics. I remember very distinctly taking apart a VCR at one point and having a pair of very unhappy parents. Um, you know, I was 4 years old, my dad brought a computer home from work. He was going to do some work over the holiday season at home, and he had video games on it that he let me play. So that kind of got the, the juices flowing with, with computers. And then when I was in elementary school, I was fortunate enough to be in an elementary school— and this is the '80s, okay, so this was not common— uh, we had computers in our elementary school. We started off with— we had these old RadioShack TS-80s, and then I think I was like 4th or 5th grade, maybe, maybe 6th, when they, they did this Box Tops for Education thing with Apple and they were able to end up outfitting this entire lab of Apple computers.

Wow.

So, you know, so that sparked a lot of it. And yeah, I mean, you know, from there it was because I was a geeky little kid, A lot of the younger people out there may not even know this reference, but I got a paper route when I was 12 years old.

Wow.

So, you know, going around the neighborhood once a day delivering newspapers to people's doorsteps. And so at 12 years old, that was my first job, and I saved up a little over $1,000. And again, we're talking 1989 now, okay? People did not have computers in their home.

Yes.

As ubiquitously as we do now.

Let me guess what you did. You bought a computer.

I went and bought a computer. Wow. Spent $1,100. Imagine a 12-year-old, $1,100, who their choice of things to go out and do is buy a computer. Back then that was crazy. Nowadays maybe not so much because I could see a kid doing that and like going and buying an iPhone or something, which is basically—

yeah, but with the, uh, inflation of that today's dollars, that was a lot of money.

That was a lot of money. Yeah, I mean, yeah, if you did the inflation, yeah, it's got to be about 5 grand or more.

Yeah, I would think so.

So yeah, I did that. That's where that led into, as you, those that just saw that little snippet from my TEDx talk, it's, you know, that, that led into me hacking into an online service called Prodigy. And it sort of snowballed from there. And then I came along a few years later.

Yes.

Got involved in IRC groups with other hackers. And so yeah, that's just kind of been the thing from the beginning. And eventually that ended up landing me in a cybersecurity role, still almost by accident, but You know, yeah, you said IRC chat, that's like the good old days.

Uh, I don't think my young daughters know what Windows 95 is or AOL, but this is amazing. So you began as a programmer before transitioning into security. How did that transition happen?

So yeah, I started as a programmer mostly because I didn't even know that like information security, which is what we called it at the time, I didn't know that was a job. You know, I'd been hacking for years, but I'd also been programming because part of, you know, learning to hack was, you know, learning programming. Um, and I had written a bunch of different stuff, and I, I taught myself basic programming. I was, you know, teaching myself things like C#, or well, C++ back then. Um, this was before C#. Uh, and so, you know, and I went to school. I originally— the funny story— I went to school for pre-med. Was my original plan. I had plans to be a doctor. That didn't work out so well. Um, 3 years of college level— or 3 semesters rather— of college level chemistry, I, I knew that wasn't for me. Um, but so I changed. I found this computer science major and said, okay, well, that'll work, you know, I already know computers and programming anyway, this will be easy. And this was also during the dot-com boom which some people remember, um, you know, so the internet had been now around for a little bit and everybody was trying to get online, you know, and everybody's trying to get their storefronts or e-commerce and things going. And so businesses were hiring like crazy and it was really easy as a programmer to get a job without a college degree. So while still going to school, I started as a programmer and I worked in that organization. It was a financial services org for about 6 years And during that time, of course, I interfaced with the cybersecurity teams in various respects.

Amazing.

But it was, you know, after about my 6th year, one of the managers that I had worked with from the cybersecurity team on a lot of different stuff came to me and asked if I wanted to join their security test team.

Wow.

Which I didn't know what that even meant. Okay. Right. Like, yes, it turns out it was their pentesting team., and it turns out, oh, I do know how to do this. This is what I've always done. Okay, cool. I can do this. And wow. And that kind of got the, the career in cybersecurity started.

That is amazing. That's another thing we have in common because I was on pre-med, uh, as well. Actually, I almost earned my PhD in, uh, microbiology at the University of Alabama. I guess I'm what you called ABD, right? All but the dissertation. But definitely my calling was technology for sure. So what lesson from software development still influenced your leadership today?

Oh, quite a few. I mean, first of all, just having been a developer and having a certain level of empathy for what developers are doing, I feel like as a CISO, I have a stronger kind of understanding and connection and desire to, to bridge that gap, right? I mean, I feel like there's a lot of organizations, people look at DevOps as the enemy, they look at CI/CD as this threat to cybersecurity that it's not. And, and there's even, I mean, I see the commentary about, you know, all those dumb developers or horrible things like that. Like, they're not dumb. These people got jobs because they're really actually incredibly smart. They just don't have the same motivations as you. So, you know, so I think that was a big chunk of what it's done for me as a leader. It's just given me perspective that makes it easier for me as a CISO than maybe for some others to really understand the business side of being in a software company and what this, you know, the business is after and how to connect that. And, you know, maybe not be so focused on ideals and, you know, the, the, the perfect cybersecurity posture, but rather understand how a cybersecurity program can help support what those developers are doing. So, you know, from that perspective, perspective, I think there was a lot there. You know, just other things in terms of leadership, I just think kind of some of that structure, you know, when you're in a very structured development organization, and you've, you know, nowadays, it's, it's, you know, we've even moved past sprints to other paradigms, especially if you're doing CI/CD development, this very iterative development.

Yes.

But there's still a certain structure, you've got things like backlogs and, and all the rest, right. And to that end, I mean, literally my team today, we use, you know, a, you know, a DevOps board with Kanbans and everything. And that's where we track our cybersecurity backlog.

Yes.

And it's a great way for us not only to keep track of all the things we're working on, and all the things we want to get to, but great way then to produce really good reporting for, you know, the rest of the executive team and so forth.

Wow, that is really wonderful. Yeah, there should definitely be alignment between engineering and cybersecurity, but unfortunately that doesn't always happen. And that is sad because we should be collaborating and not competing against one another. And also looking at your career, you know, in the beginning I said you are truly a unicorn and you did show me you do have a unicorn white background. Pretty, pretty cool. 'Cause you know, you've worked pretty much across the entire cybersecurity ecosystem, entire spectrum, right? From pentesting to consulting, executive leadership, board level strategy, on and on and on and on. So how does that diverse experience shape the way you lead security programs today?

Oh, again, it's just knowing those different perspectives, right? So, you know, one you didn't mention in there is I actually worked in product as well, right? I worked for a startup for a while. I worked at a reseller for a while. Amazing. It gives you that ability to— I mean, again, I'll use that word and you're probably going to hear it 40 times today— empathy. Just being able to kind of understand what somebody else's world is like and why they look at problems or why they look at challenges or why they look at opportunities in the way they do and how that shapes the way they approach things. And so from a cybersecurity perspective, then it's a lot easier for me to say, okay, I get why you're doing this. You're not doing the thing I want you to do. You're going about it in a different way. And now I can evaluate, is that all right? Or maybe I want to influence you to do things a different way. And having that understanding, that ability to look at, you know, the way you see the world and acknowledge that helps me then be able to, you know, kind of influence a little better and connect with things that are going to be meaningful for you as I try to, you know, maybe influence or behaviors a bit or whatever.

Wow, that is leadership. Incredible. Now, very significant, uh, um, people in the audience who follow me, they may be security engineer or, um, analyst, and they eventually would like to have the leadership role. So as a CISO of Epic Global, you do operate at the intersection of technology, risk, and business strategy. So what do great CISOs do differently when communicating cybersecurity risk to executive and the board?

Oh, okay. So I'm going to say something that sounds like a buzzword, but it— or, you know, sounds like a no-duh to some people, but it's the execution of it that is where I think it really happens. And that is actually connecting your cybersecurity initiatives to what they will do to enable the business. I hear a lot of talk about enable the business, but the strong CISOs know what that actually means.

Okay.

I've heard, I've, I've heard it said and then I've heard it followed up with, yeah, I enable the business by reducing risk.

Hmm.

Well, no, that, that's not really enabling the business. You know, I mean, it's necessary. Everybody in the C-suite, that's part of their job is to identify and help reduce risk. I mean, that, that's how you help corporation continue to grow for sure. But what are we doing as cybersecurity professionals to aid the adoption of new technology? What are we doing as cybersecurity professionals to encourage and actually push forward on innovation in various spaces? Yes, right. Not just, not just be there to react to it, but how do we actually help make it possible or even push for it to happen? And I think when you look, you know, it takes a unique mindset to make that happen and to make those connections because we look at it so often as cybersecurity people, it can be kind of hard because we, we tend to think of ourselves even as oftentimes just that cost center. We're a necessary cost of doing business. I mean, I've literally heard CISOs say that. And yeah, maybe that's true. You know, is cybersecurity a business imperative? Yeah, of course. I mean, I don't think there's an organization out there that doesn't understand that to one degree or another. Now, what degree do they want to invest in it and how much commitment do they make? That's where it changes.

Yes.

And that's where it's incumbent on us as cybersecurity professionals to influence that. And the way you influence that is you speak to the things that they care about. Your CEO cares about business growth. Your CFO cares about financial growth. Your business division presidents are probably looking at the next innovations, right? That's what they want. So how do you connect into that world? They're gonna say, well, we have to do this thing because it's going to keep you safe. That's true, but it doesn't resonate.

Yes.

Right. If I say, well, we're going to do this thing because it's going to speed up your CI/CD, and then by doing that, that's going to also allow us to do some things to improve the security posture of the code you're producing. Yes. That's a little bit more of a winner because fast CI/CD is a good thing for developers.

Yes.

Wow.

That is incredible. You keep going back to leadership. It's, it's really amazing because I think for some people, I guess it is changing. More now in the industry. When I first got into this field, it seems like we used to think as a security professional, you had to be technical, technical, technical. And sometimes you almost run a cybersecurity program like in a silo, completely away from all of the other business function. And we used to be known as, I'm sure you've experienced that too, right? The department of no, no, can't do it, can't do it, it's not safe enough. No, no, no, no. When we really should be finding a way to say yes, how to do it in a safe and secure way to support the business, to enable. The business. So if you could give one piece of advice to security leaders who are listening right now, who one day would like to become a CISO, what skill should they develop right now or first? Technical depth, business communication, leadership mindset, something else?

So my guess is they probably already have the technical depth, you know, because as you mentioned, as you kind of roll into more of that executive leadership role, you kind of become detached a bit from the tech, right? And you have to understand that that's going to happen. But you know, when I mentor people who will say to me that that's their goal, one of the first things I recommend every time is develop your business acumen. Okay. And I'm not saying run out and go get an MBA, Okay, that might be overkill, but hey, if that interests you, do it because, oh my God, a CISO who's got, you know, a cybersecurity pedigree and an MBA, super valuable.

Yes.

But in absence of that, and here's where I'm going to plug somebody who I don't even know, but best book I could recommend to anybody with that goal is go out and get The 10-Day MBA.

Hmm.

Is a great book. And it will give you at least the start to understanding how people outside of the technical space look at business overall. What are the motivations that are important to them? So you got to kind of read into it and to pull that out of it, right? I mean, because it talks about, you know, very businessy concepts. But as you learn those and you think about that in the terms of somebody who's not a technical person, who's trying to build and run and grow a business. Now you see a lot of these concepts there and you start to see, okay, here's how I can speak to a CFO in a way that they're going to understand and it's going to resonate. It's going to— it's something they can identify with that motivation. Here's how I talk to the CEO. Here's what they're thinking about in terms of, you know, market risks and all of the various elements of just running a business. And, you know, I just think that that's really— if your true goal is to get to be a CISO and be a good CISO, trying to come into this role with only tech skills isn't going to do it. Wow. Isn't going to happen. You've got to have the ability to speak to the business about the business.

That is really powerful. So the 10-day MBA, I'm going to add it to the Digital bookshelf of the podcast is by Stephen Silbiger, right? Step-by-Step Guide to Mastering the Skills Taught in American Top Business Schools. Powerful, powerful. Actually, in my own life, when I think back, when I came to Silicon Valley is where I was convinced I had to get the MBA. So I took 2 years to go ahead and get that because it's true, the business function, they don't care about all of your technical jargon. It doesn't mean anything to them. Unless you can actually be a partner and help them accomplish what they need to do as far as the mission of the organization, then they don't have time for you. It's incredible.

Wow.

So I guess we're going to start talking about your bestselling book, and this is such a great, great book for the industry, Cybersecurity Career Guide. Why did this book have to be written? Why did you write this?

Okay.

Whew.

So let's talk about this because it's also the reason I gave the TEDx talk.

Yes.

And that is, you know, you heard me mention in there, uh, in, in the clip that you showed of that, I talked about there's, there's this talk in the industry. It's kind of cooled at least the last couple years now. Um, but there was this talk, you know, we kept talking about this, you know, this talent gap, this, you know, hiring shortage, all this stuff. And there was a lot of fluff about it. But so I'm looking at all these people are saying, oh my gosh, we can't find people to hire. But then I'm going, I'm looking at all of these people who are graduating from cybersecurity programs in their high school or in their colleges, which when I went to college and in my, you know, probably first 10 years in this industry, 15 years in this industry, we lamented the fact that those didn't exist.

Yes.

Now we've got them, but we still have all these people who are searching for jobs and couldn't figure out how to get into their first cybersecurity job. Right. And when you look at it, you know, I originally set out to write the book and it does still address this. Ultimately, I set out to like, oh, I'm just going to tell people what they need to do to get a job. Well, then I realized more and more it's like, okay, yeah, that's what I'm going to do with this book. But it's not them that's necessarily the problem. The problem is us in the cybersecurity industry do a really terrible job of hiring.

Sure.

We don't, we don't look at our workforce as a like holistic workforce. Everybody goes out and they want to hire the most experienced person they can for a particular job. And very, very few organizations— more are starting to do it now— are willing to invest in bringing up, you know, an entry-level individual. Or if we are, we just, you know, relegate them to the SOC and that's where they land. Yes, sometimes that can be valid. But there are other places an entry-level person can go. And if they've gone through cybersecurity programs, they've learned a lot of the fundamentals that we need them to know. And we need to just get them in front of some technology that we're using in our organizations and let them learn and grow within that. So, you know, the Cybersecurity Career Guide is really about helping those job seekers sort of overcome those weaknesses in how we hire and helping them see, you know, self-inventory, but also then figure out how they take what they have today, you know, transferable skills, you know, things of that nature. How do you, how do you bring that into the cybersecurity realm when you don't have demonstrable experience on your resume?

Yes.

But yeah, I mean, it's— and so that's what the book's all about. And, you know, it is truly a guide. I mean, there are actual exercises in there that I walk people through, like, hey, here's how you take this sort of inventory just to figure out what you even want to do in cybersecurity. Because again, mentoring people formally or informally, I've had my fair share of those that will come and say, you know, I ask them, well, hey, you want to get into cybersecurity? What do you want to do in cybersecurity?

Well, I just want to learn all of it.

Hmm.

Well, good luck with that. You've got the wrong mentor because I am not going to proclaim to know all of it.

Yes.

Good luck finding someone who does because nobody does. And, you know, so breaking through just that barrier and getting people just to understand, all right, let's figure out what areas— I can always pivot later if I go into something and figure out it's not what I want. Cybersecurity is great for pivoting from one role to the other. But you know, you gotta at least steer yourself in a direction, I think, and, you know, kind of focus on a couple key areas that hold your interest the most.

Yeah, that is, that is really, uh, something even, uh, cybersecurity executive leaders really need to rethink right now. Because I, I didn't show the clip, but you know, today's talks, you were talking, no, they say it's what, 2 to 4 million? Nobody knows the number. Cap, we say we have all of these jobs that we don't have, we can't find the people to, uh, fill those jobs. But really, the, the way we think about the function itself and who could be a part? For example, the trajectory I used when I became a cybersecurity expert, there was a very, very high focus on STEM— science, technology, engineering, math. If you did anything else, we don't want you here, go away. And I think that's a big, big mistake. I think that has changed a lot. What has been your experience?

Yeah, I think it has. You know, I think we've become more open. Cybersecurity more than maybe a lot of industries has kind of at least figured out that there, there isn't a specific, you know, template for what a good cybersecurity professional looks like. I mean, you know, people look at me, I am definitely not your typical CISO. You know, the background I come from, not very typical of a CISO-level person. You know, and just even the way that I operate as a leader is very different than what I see in a lot of other, you know, executives, a lot of other CISOs. And, you know, I feel like my organization now, I feel like they're pretty smart because I do believe they see the value of, okay, she's not the, the cookie cutter. So she's got this unique, you know, If you're familiar with People Map, I've been through that process and they label me as a free spirit.

Yes.

And, you know, I think I'm thankful to work in an organization where I think they realize that, yeah, that's actually useful. That's not something to try to control. That's something to— let's leverage that and see how that, you know, spawns new and innovative ways to address the cybersecurity challenges.

So, so powerful, because one key idea I think in your book is that people can adapt existing technical and non-technical skills into the cybersecurity field. What are some of the most surprising skills that translate well into the security role?

Well, let's take the one I started to talk about in that TEDx talk again. I love that you actually played that because it's giving me lots of stuff to references. Um, my favorite example of this, and I, I talk about it in the book and I've talked about it in various presentations I've done at different conferences, is think about a barista. So let's just say, you know, your local coffee shop, you've got a barista there, and let's, let's talk about what they do every day, but let's take all of the industry terms and anything that would identify what their job is out of it. Okay. So they take multiple inputs from various sources.

Yeah.

They take those inputs and they plot a course of action based on prioritization and based on how they can efficiently execute the tasks necessary to respond to those inputs. They execute those tasks. And then they deliver a result. And they, in amongst all of that, they also have other maintenance tasks and things that they have to complete throughout their shift. So if you— now, if I described that to you, right, just in those words, you didn't know what we were talking about. There's no way you would look at that and say that's a barista, right? You wouldn't know what I was talking about. But those are the transferable skills. And now when you think about those, those skills I just described, is that not exactly the skills you want in a SOC analyst?

Yes. Yes.

You can take all that stuff in, they can prioritize it, they can translate it to tasks, they execute those tasks, deliver a result, and they do other maintenance at the same time.

Like, that is really wonderful. I, I really like the way you put that because another problem I have, I have seen actually, it was one pretty funny A couple of years ago, HR was asking for somebody, I can't remember exactly what the programming language was, but they were asking for someone who had 5-year experience in the language. And the person who actually created the language had only done so a year prior. So even himself couldn't be hired for that position. I have seen entry-level jobs where they ask for the CISSP, that's supposed to be advanced. So it's like, there is definitely a huge disconnect, right? Between what we actually do and the way sometimes we advertised jobs. Anything you want to say about that?

Yeah, I mean, I've seen them too, right? I mean, I remember years ago someone asking for 10 years of Kubernetes experience, and it was like Kubernetes had been around for about 3 years. Yeah, not happening, right? And I've definitely seen— and I, I think we are getting better, but I've definitely seen those, you know, we want someone with, you know, 1 to 3 years, but a CISSP is mandatory. 5-year requirement. SSP.

Yes.

You know, so there's no way that can even happen.

Right.

You know, and I think even now we're seeing more and more, the job postings are listing certificates and certifications as nice to haves, but not necessarily required. And I think that's important. Um, I think there was— oh, I know there was an overemphasis on certificates and getting certifications and, you know, all the alphabet soup. I mean, I, I knew college grads who went out and invested, you know, literally thousands and thousands and thousands of dollars getting every cert that they could think of. And I'm like, that's not going to help you get a job. And if it does, it's probably not a job you want to be working in because that's what they value.

Yes.

You know, one or two, yes, to prove that you're serious about it, that you have the commitment to go actually complete a cert, 100%, absolutely valuable. But I mean, at the end of the day, I hope they're hiring you for more than just that.

Yes. Wow. That is really insightful. Now, your book also includes self-analysis exercises, which you mentioned before, and career planning guidance, which is really key. Why is self-awareness so important for building a successful career in cybersecurity?

Well, I mean, to me, if you're going to build a career in anything, sooner or later you— and I say sooner or later, I'll explain that— it's like you do have to be somewhat deliberate about it, right? And the more deliberate you are, I think at the end of the day, you know, probably the more success you're going to run into. And you can't start targeting a career in something if you don't know what you want. I mean, imagine Let's go back. You and I were both pre-med, right? So I want to be a doctor. Okay. What if you said that to, like, a hiring manager or, you know, whoever hires in a hospital? I don't even know. You go and you say, I want to be, you know, chief surgeon or whatever. I just want to be a doctor. Well, what kind of doctor? I mean, do you want to be an internist? Do you want to be a surgeon? Do you— what do you want to do here? Right? Like, I mean, and it's the same thing with cybersecurity. You have to understand at least where you want to go with it. And then I think you need to understand where you are today. You have to take that stock in yourself and just understand, okay, what skills do I actually have? What skills do I don't, you know, and how do I speak to those and speak to them credibly without overexaggerating or lying?

Right?

Because that's the other problem. And that's where self-awareness really bites you in the butt if you don't have it. Because I have seen those resumes. I'm sure many who have done hiring in this space have seen those resumes where, you know, they take a little piece of something they did somewhere, they exaggerate it, but then they keep exaggerating it and they blow it up. And suddenly it's just a bald-faced lie. Like, okay, you never actually worked in Microsoft Entra. You logged into Windows once in a while. That leveraged ENTRE. You know, like, it's not the same thing. And so, you know, and I— that is literally a perfect example of things I've seen. So, you know, so you have to be self-aware and you have to be honest with yourself about what you have, what you don't, and then look at, okay, if there's things that I feel like are gaps that are going to keep me from getting the job I want, if I know what I've I can go address them.

Exactly.

I can go learn, grow, do things.

Wow. That is so, so important because I came to Silicon Valley about 12 years ago now. I think our IQ here is completely off the chart. So many smart people. But yeah, emotional intelligence awareness, that's not really something we are very good at. So we have a lot of ground to make up there. But now, many professionals reading your book or listening to you, they may struggle with imposter syndrome, not just at the entry level, but sometimes even as an executive. So especially when they start a brand new field, a brand new job, what advice would you give readers who feel they aren't quite ready enough for cybersecurity?

Ooh, okay. So a couple of things. First of all, no one knows it all. We talked about that already. And I talk about that in the book. And there's a really cool little diagram of, you know, that is adapted from some work of someone else who I credit in the book. But, you know, that concept of, oh, you know, you see all these people that are experienced professionals in the industry and you see them talking about various areas of expertise and you kind of— we all have this tendency to lump them together and see them as one big cohesive, oh, they all know all of these things, when in reality, no, they know that part that they were talking about. You know, this person over here might be talking about, you know, deep malware analysis, but they don't know jack squat about building an RBAC within an IDP. Okay. They might not even know what IDP means. Identity provider, by the way. So, you know, it's just right there, right? That, that's the thing that I think people really have to understand. The second thing is, there is nobody in this industry with any form of success who hasn't had help from somebody else in the industry.

True.

Period. Bar none. And if you know somebody who claims that they got there entirely on their own, they're like, my way, because I will prove them wrong. I will undoubtedly prove them wrong. And, you know, and those are people you probably don't want to follow anyway because it means that they've completely disregarded credited the help that they received and have just assumed that they attributed it all to themselves. Everybody gets there with some help. So with that, you know, don't be afraid to accept help when it's staring you in the face. And then finally, don't be afraid to ask.

Ask for help.

Ask questions. People are not going to think you're stupid because you asked a question. Now, there might be some trolls online. If you ask a question in, you know, some internet space somewhere, you might get a few comments. Blow them off. Who cares? Pay attention to the people who are actually there to answer you because they are there. And, you know, no question is a stupid question except the one that you don't ask. So, awful. No, I mean, you're not going to get anywhere in this industry thinking you're just going to go out and Google it all and learn it all yourself. Granted, that can be powerful. Self-study is a real thing. But sometimes you just gotta ask and say, "Hey, I don't understand how this actually plays together here. Can you explain these things to me a little bit? I see that you talk about them at conferences. Can you help me understand?" Yes.

Wow, that is powerful. Now, one more question I want to ask related to your book is what is maybe a non-technical skill you believe every cybersecurity professional should strive to master?

Here comes that E word again. Yes. Empathy. It's— and I know that that's— and I know for some people that's harder than others. And I mean, there's, there's actual clinical reasons for some people for why it might be harder for some people than others. And it's not to say that this is the only thing, but I— you are walking into a world in cybersecurity where we're trying to secure everybody. Okay, plain and simple. You've got this whole business and you've got this plethora of people from all different backgrounds with all different responsibilities, with all different priorities, and you're trying to secure all of them. Well, that— the only way to be effective in that is if you can look at their situation and piece it apart and understand why they react the way they do. Or better yet, even predict how they may react. If I send this email saying that I'm shutting down access to all AI websites, not a great idea, but we'll get it. That's a different topic. You know, how are, how are the different people going to react?

Yes.

You know, some are going to throw their hands up, get upset. Some are going to go out and find different ways around it. Right. So how does that shape my plan? Well, maybe my plan is, okay, I'm still going to block these, but I'm going to offer training that then allows people to go out and access those sites. Or maybe as part of what I deliver in that message, I can explain in more detail what we're defending against and how we're working on deploying an internal AI tool that will give you the same capabilities as ChatGPT but help protect our system. Systems, things like that, right? I mean, just, just that moment thinking about it there and realizing that, yeah, okay, if I kill everybody's access to AI sites, all these people in product development who are supposed to be innovating and trying to bring elements of, you know, the, this new frontier, if you will, into our products, they're— I'm cutting off their ability to innovate that way because I'm saying they can't use the very tools that they need to be experimenting.

Yes. Wow. That will definitely take you very, very far. In my own experience and background, I had to learn to empathize with engineering because prior to that moment, it was war, cybersecurity and engineering. We just didn't see things in the same way. But when you say, I feel what you feel, I know what you're going through, and this is how we can work together to solve this problem, it's really, really, really powerful. Now, you You mentioned different people, different backgrounds. Let's talk about culture and diversity and the future of cybersecurity, something I'm very passionate about, and I know you are too. You've been a very strong advocate for improving culture in cybersecurity and making the industry more welcoming. And I feel like we still have some work to do. But what changes have you seen over the past decade that you really like, and what do you think still needs to be improved?

So there again, I mean, I think to some degree, cybersecurity has accepted more of the value of what diversity brings. Right. And I know we live in a time right now where more than ever that word gets vilified.

Right.

But the fact of the matter is, when you're trying to solve problems, if you stick 5 people in the room who all have very similar backgrounds, they all come from the same, you know, some level of collegiate pedigree and they're all, you know, in kind of the same realm as far as their financial state and backgrounds and as far as, you know, their culture, you know, if they're all Christians and they're all white and they're all this and that and the other name, all the different demographic groups, if, if they're all so similar, you're just going to get one set of answers. You can have a bunch of nodding heads in the room. That, that's proven, right? I mean, there's been studies on this that have gone through the neuroscience reasons why that occurs. And so you need that, you know, that alternate perspective. You need people who come from a very different background, who've experienced life maybe from outside the country in countries that were more oppressive, who maybe come from backgrounds that are traditionally marginalized.

Yes.

And understand what that is. People who have experienced the lack of accessibility when we don't consider everybody in how we build things, right? All of that, that drives a thought process that, you know, me as a perfectly able white woman who's lived in the United States my entire life in the upper Midwest, you know, I may not think about the fact that, oh, hey, by doing this is really going to impact somebody who has an issue with mobility or who has, you know, someone who's experienced far greater racism or whatever is going to think about how certain words get perceived differently than I would ever even think to imagine. Right. And that's what we need in cybersecurity. Again, you're dealing with this massively diverse landscape of technology, this massively diverse landscape of people, this massively diverse landscape of business processes. Yeah, see how I did that?

People, process, technology. Yeah, yeah, yeah.

But that's the reality. Yes, that is the reality. It is all different. Even if you're stuck in a specific industry, even within one business, That stuff, man, varied and very diverse within the organization. So we need people who think about it and problem solve together that way, coming at it from different spaces.

That is really powerful. Now it is Women's History Month. I know, I think I mentioned that before. When I first started cybersecurity full-time was 2005. So, man, 21 years now. And that's— time is really running. But anyway, I have almost always been the one and only minority in the room, the only Black person, usually no women and mostly white male. And I've seen that change through time. I see more and more women now, more and more minority, which is great. But I feel like women still remain underrepresented in cybersecurity, right? Population is more women than male, but in our industry, that is not the case. What advice would you give a woman who wants to pursue leadership? Role in cybersecurity?

Um, I— this is probably played out. I mean, I hear it a lot, but it is true. Find that mentor or two, right? And here's the thing though, and this is why I'm willing to say something I've heard said a million times, because what I'm going to say, it's a little different, is don't necessarily think a mentor has to be somebody who, like, you have this formal mental relationship with, right? That might work for you, that might work for your mentor, and if it does, great. But some of the best mentors I've had have just been women in particular, and, and some men too, who I've worked with, who I could just call on, you know, on a moment's notice and say, hey, I, I've got this situation, can we talk? Can we go to lunch?

Yes.

You know, can we go get coffee? Um, I mean, my very first mentor maybe second, but the manager who gave me that opportunity into cybersecurity with her, it was walking out so she could go have a smoke. Like, literally, I wasn't a smoker. I had quit. Okay. I did smoke at one time way back when, but I've long since quit. But I would still go out with her when she went out for a smoke and we would talk and we would talk about the problems the business was facing. We'd talk about, you know, career challenges we were both dealing with. Like, I mean, yes, I was her subordinate and she was telling me about her career challenges. Right. And that can be such a powerful way because it helps build your confidence. It helps you. It gives you an ally, someone you can lean on, you can talk to. And yes, those networks do come back and help you out when you don't know they're going to do it.

Yes.

My job before this was exactly a result of that. Having networked with some people and a woman who is an absolute powerhouse CISO pulled me in and got me a BISO, helped me land in this BISO role at S&P Global. And, you know, that type of thing is so incredibly important because you're going to get in that space where, yes, you're going to be 100% surrounded by white men. I work in the legal industry that is actually very common. And yet I also work for a company that when you go look at our executive leadership page is very well balanced between men and women.

That is—

now we're missing— what we're missing, and I'll be honest about it flat out, we're missing that colorful diversity, if you know what I mean. I mean, yes, everybody knows what I mean. That's pretty obvious. Um, yes, you know, the visual diversity is missing. Still.

Yeah, but it looks like this has to be really intentional, right? It doesn't just happen by itself.

I think it does. You know, I think at this point, because— and it's not, you know, the narrative of the anti-DEI crowd is that, you know, being intentional about it is, you know, first of all, that it's a suggestion that people are intentionally only hiring white men. Well, no, it's a subconscious bias.

This was all—

if you're a white man, that's probably who you're going to be biased to look at right out of the gates. We all think, think outside demographics for a minute.

Yeah.

You look at hiring managers in cybersecurity. So many of them want to hire somebody who has the same type of background that they came through. Oh, you were a developer first and then you got into cybersecurity. Great. Or, oh, you were a network admin and now you're in cybersecurity. That's exactly what I did. Great. And so that's what we're trying to undo. But to undo that, you do have to be intentional about it. You have to— I'm not saying because you have that predilection or, you know, that particular preference subconsciously that you're like, you know, a sexist or racist or whatever.

Yeah.

But it's when you're unwilling to challenge your own biases that then I start to think maybe you're sexist, racist, or whatever, you know.

Oh, cool.

So yeah, it absolutely has to be some, you know, on the part of businesses and hiring managers, yes, it has to be deliberate.

Well, looks like we only have about 5 minutes left. Let me ask you this before I go into the very last segment. Looking ahead 5 to 10 years, you did talk about career challenges. What emerging cybersecurity challenges should leaders be preparing for today?

I could throw out AI. No, you know, I think we're going to continue to see— it's hard. I mean, I don't have a magic crystal ball. I'm not going to pretend to. Obviously, right now we're in a world where identity is— and these identity-based attacks are a thing. I think what we're going to start to see related to that is what we're only seeing, in my opinion, the very beginning of, which is a very different interaction between geopolitical issues and cybersecurity. I mean, we've seen some suggestion that maybe right now, because we're bombing them, Iran is attacking the United States through cyberattacks. In fact, I just was reading an article about someone who— that may be exactly the case today.

Yeah, it looks like that has been confirmed.

But yes, I'm trying to be soft. I'm trying to be soft. But also, I mean, you think about— and this is one that it's getting surprisingly less play than I would have thought— the threat right now of fraudulent workers, in particular stemming, you know, tied back to North Korea.

Yeah.

Right. And this is one that a lot of people I know are dealing with. And when you get people to talk about it, everybody knows it's happening. But no one wants to talk about it. And so, you know, we're starting to see more and more where, you know, those geopolitical things are, you know, kind of blurring the lines because you look at that. Right. And here right now, at least the bulk of that attack vector doesn't seem to be focused on anything we think of traditionally as cybersecurity. These people are trying to get hired into remote jobs to funnel money out of the country back to, you know, the DPRK and their nuclear weapons program.

Yes. What?

You know, I mean, think about, think about you're a small manufacturing firm or something and that's, that's the attack vector. You don't even think of that being related to cybersecurity.

Yeah.

And in fact, I've argued within my own organization very successfully, I'll add, that it's not even a cybersecurity problem. Problem. It's, it's an HR problem.

Yes.

Well, we will use technology, we will use cybersecurity tools and know-how, we will use processes and people, all of that together to solve that problem. And it's not just going to come from the cybersecurity team with some whiz-bang cool technology solution. It's got to be holistic. And so I think we're going to see a lot of that, that trend continue, at least Next 5 years, that's about what I can give you with a crystal ball. Yes, I don't have. But that's what I'm looking at is I think we traditionally think of as cyberattacks are not going to be where people are going.

I think so too.

It's changed, man.

I could be speaking to you for hours and hours. Let's at least answer one question from the live audience, but really briefly. Daniel says, how can security and engineering teams better align with business leaders So this kind of human-centered security becomes part of strategy, not just an afterthought control. Pretty cool question. Yeah.

So I think what we need to do is as cybersecurity professionals anyway, we have to understand that world and we have to understand what their motivations are. And I use DevOps as the perfect example of this. You go back to when Patrick de Broglie and Andrew Schaeffer first came up with DevOps, the concept, concept, right? And first of all, they didn't even call it that initially. The whole idea was they saw this disconnect between engineers doing the development, the dev, and the operations teams, the people who controlled like the production environments they were trying to deploy into. And they said, what if we brought all of them together and gave them the same goals and made their motivations shared? So now it's a— I'm gonna borrow a cloud term here— it's a shared responsibility where, you know, they're all responsible for the delivery, the successful, fast, and bug-free delivery of these solutions.

Yes.

And that's what DevOps was all about. Well, then security came marching along and we said, well, it should be DevSecOps, right? Or SecDevOps. That argument about security should come first, so it should be SecDevOps. Come on. No, DevSecOps was, you know, we talked about it.

Oh, SecDevOps. Yeah, we didn't.

Now you're just poking. We didn't, we didn't really connect to it credibly, right? Because we didn't accept that by saying we want to be in that mix. Now we as cybersecurity professionals are taking responsibility for code to be delivered fast. Test.

Yes.

Or, you know, production environments to be available, um, outside of just, you know, what we think of in the CIA triad.

Yes.

Um, you know, we didn't take that on. We put gates in and said, well, you have to pass this gate and, you know, do this code scan and do these things, and we're going to shift left and blah blah blah blah blah blah blah. And that's all it is because it never connected. So, you know, when I look at it, I'm like, okay, how do I connect myself and say My cybersecurity team is responsible for making sure you can code fast, that you can deliver things quickly, that you can innovate into new technologies without delay, right? Without having to do big threat models and design sessions and all the things that we don't do in a CI/CD model. And the one thing I'll say to kind of— hopefully this is answering the question, but to wrap this all in, just as an example, and this scares cybersecurity people when I say it. I want the fastest CI/CD pipeline we can possibly build because I want to be able to let you deploy to production with known vulnerabilities.

Hmm.

If your CI/CD pipeline is so mature and so fast, what do I care if you deploy with a vulnerability if I know that you can have it fixed in 2 hours?

Wow.

And that's Yes. People might be like, oh, why the 2-hour CI/CD?

Yes.

There are companies doing it and doing it a lot faster than that. So if I know, okay, the tooling is built in, you know, on your, on your commits, it's doing some code scans and other things and all this stuff, but you're, we're not pushing you backward in the pipeline. We're constantly letting it move forward like a CI/CD should. I know that anything that we found goes into the backlog, becomes a P1 issue that now has to get coded for. And I know that in your next cycle, it's going to get coded, it's going to get deployed, and that thing's going to be fixed in a matter of hours, maybe a day or two. I mean, novel vulnerabilities in software development, they're not being discovered in a day or two.

Yes.

So low risk. And maybe in the meantime, we can put some automations in that do some mitigations or around those things until you're able to deploy. But wow, that scares cybersecurity people. I say knowingly deploy vulnerabilities to production, that freaks people out. Yes, but we got to be willing to do it.

Yeah, I guess it really falls into the larger strategy and, uh, what the other compensating control or factors you might have in place to eventually, uh, ensure bug-free or secure environment as much as we can. Secure it. Wow, this has really been so fascinating. Technically, we are out of time. Let me ask you politely, can I get 5 more minutes before we end? Fantastic. One thing I want to do in the last segment is when I really try to get into your head and kind of understand the leadership principles that have brought you to becoming who you are today, right? From being an entry-level programmer to now becoming a Chief Information Security Officer. That's just Awesome. So, uh, what do you believe is, uh, one of the greatest lessons you have ever learned, whether it's in life, leadership, or in general?

Oh God, um, this is gonna sound cliché-ish. I'm gonna try to make it not, but let's start with the big cliché: carpe diem, right? Yes, seize the day. That movie, by the way, for those of you that don't recognize it, comes from a movie called Dead Poets Society. It's actually from poem. I'll not even get into all that, um, but it became prominent as a term and was used in kind of the same way within that movie. And that movie was in my youth and it shaped me. Seize the day. Go out there. I cannot even tell you the number of times an opportunity came to me, maybe not presented as an opportunity But it was something where I had a decision to make, and one side of me was nervous. One side of me is like, I don't know how to do that thing. I don't know if I can be successful in that thing. I don't know if I, you know, whatever. There's all that self-doubt. On the other hand, there was like, it sounds kind of cool, you know what? So it's literally just saying to heck with it, go grab it, because that opportunity may not come around again. And I told you the origin story, how I got that first cybersecurity job. I hemmed and hawed big time. I very much doubted whether or not I was even going to do it. And yet, you know, some of it may be out of naivety, some of it maybe just part of me works that way. But I was like, yep, let's do it.

Wow.

Let's see what happens. And I made a huge career shift, not even really realizing it was a huge career shift. But it was a let's try it out and see what happens.

Wow.

I love that mindset. So what do you think is the secret to your success? Again, you went from entry-level programmer to now, so you are also a licensed helicopter pilot, commercial pilot, bestselling author. I mean, is there anything that you cannot do?

Why? Oh, yes, there's lots that I can't do. No, I— but yeah, don't ask me to bake. Baking is not my friend.

At least you are self-aware. Okay, that's good.

Oh, I know it. I know it. I've had this conversation many times. No, I, you know, I think it's— it is a certain relentless curiosity, right? You know, going back all the way to where we started this whole thing, you know, I was 4 years old. You know, it's something I've always just sort of had, like that desire to, like, understand how things work and want to be a part of it. And it's that kind of relentless curiosity that's driven me. And I mean, you brought up like the aviation thing. Well, okay. Yeah. As a kid, I wanted to fly. I want— I wondered what it would be like, but there was no way I could ever learn how to fly planes. It didn't work. That opportunity didn't open up for me until much later.. And then at that time, I just— all I really wanted to do was, you know, fly planes recreationally, just, you know, rent a plane here and there. Well, that turned into me buying a plane, that turned into me getting an instrument rating, that turned into me now wanting to fly all the things. So now I fly helicopters too. I also, uh, started training last year in a World War II biplane trainer.

Wow.

Stearman. Like, you know, because it's like every door I open there's 4 more doors with other stuff to be explored, and I want to go and explore it. So yeah, there's a little bit of the seize the day, it's a little bit of just that relentless curiosity. And I think the way that those have met for me has really blessed me, um, with some incredible success that I'm super thankful for every day.

That is really, really fantastic. That's why I always encourage people to go after their passion, even though it might not quite align with what their job description is or whatever it is they're doing now, because eventually it all comes around, turns around, and you are going to need those skills at some point. It's fascinating. So what are you learning these days? I know leaders are learners. What are you learning now?

Oh, well, I mean, I'm still like everybody, and I hate to talk about it because we all hate talking about it because it doesn't stop getting talked about, but I am learning a ton about AI. Um, you know, I, I started messing with some of this technology around 2020-ish, and you actually splashed some of the work up there. I was doing work with deepfakes, right? So that was back in, you know, when we were—

when I think you are referring to this one, right? Yep, yep.

That was me attempting to deepfake myself into, um, Alyssa Milano.

Wow.

Um, and I made a video. It turned out pretty decent. It was Alyssa Milano talking with my voice in this spot right here.

That's exactly how the North Korean do it.

Yeah, but you know, I mean, that was literally— I went out and bought some GPUs back when you could actually buy them, um, and you know, I, I did that work, um, so, but so anyway, so yeah, I mean, I'm learning a lot about, you know, the MCP side of this now, getting into, you know, watching how I'm learning from my team as they're creating agents that are doing different things for us, um, really, really exciting massive threat intel email automations that we have now that we're able to do because LLMs and some of that, that, that agentic technology. So I'm learning a lot of that. Um, I'm still learning just how to be a better executive, you know, how to communicate better with other executives. I've got a brand new— see, well, brand new to us— COO. Um, she's got experience in the past as a CIO, and she joined us the end of last year. So I'm still learning even just how to communicate with work. We just had that conversation today, in fact. Um, you know, so you're always learning that. Um, I've had to really learn an entirely new industry, uh, and I'm still learning that, which would be the legal industry. I mean, my, my pedigree is in, you know, financial services mostly. Um, and so, so yes, to your point, a good executive is always learning.

Yes, yes. So if you could choose 3 people to have dinner with they could be alive, dead, or even fictitious characters. Who would you choose and why?

Oh my God, that is a hard question. Um, let's see. So Robin Williams.

Mm-hmm.

Absolutely. I would do anything to have met that man. And I mean, I think the whole world's collective heart broke with that. Barack Obama. Um, I've watched the amount of adversity that man put up with. And the steady, cool— even if you don't agree with any decision he made. Yes, he was so steady, rock steady, just ice cold. Um, and I would love to learn how you do that because that ain't me. Um, and then, boy, um, you know, just, just because, uh, there's a lot of press out there about it right now, I'd love to meet Alyssa Liu. You know, just the figure skater just won gold. Like, I, I watched how genuine and excited she was, and just, yeah, every, every time I see a picture or a video of her, it's just her authentic— I, I'm— it's energizing for me every time. I would love to— yeah, if I could have— if I could have those three at dinner, I'd be laughing, I'd be learning, and I'd be loving it would be perfect.

Powerful. Now, outside of your own book, Cybersecurity Career Guide, which I encourage everybody to get a copy, you already mentioned this, this book here. What should people read? The 10-Day MBA.

What else should they read?

No, why, why, why should they read? Why?

It definitely— if, if that— if business educate— if you didn't come up with a business education, 10-Day MBA is the thing that's going to give you the ability, even if you're not like looking to go into executive levels of management, it's still— it will actually— I will tell you, as someone who used to get so frustrated as a developer with all the higher-ups, you know, that whole thing.

That's you now. That's you now.

Management made that decision and the management doesn't know what they're doing. When you read that 10-Day MBA, it will alleviate so much of that frustration because now you will understand understand a lot of the times why they made the decisions they do. Sometimes they're just inexplicable.

I'm not gonna lie.

Like, I'm sure I make decisions my team looks at me with side eye or whatever because they don't understand what the heck it was. But more often than not, a lot of that frustration would be explained away if you understood their perspectives on it. And I do honestly believe that that book gives you so much of that.

Powerful. Is there maybe like a song, a book, or even a movie that would be your life's theme or anthem?

Firework, Katy Perry.

Powerful, powerful. Okay, so if you had one and only one day to live, what would you have liked your final contribution to be?

That's a really hard question. Um, I, I guess I'm going to answer it a little differently than maybe you mean. Like, I don't think I could accomplish something on the last day that would like really stand out. I guess what I want to know at the end of it, at the end of my days, is that, you know, there are people in this world for whom I have made a meaningful positive impact. Uh, you know, somehow something I did— yes, you know, writing a book, flying a plane, doing whatever it is, all the things that I did— that I've been true to you know, my roots, where I came from. And that includes that compassion and desire to just leave the world a better place than where I came into it. So I know that maybe that feels like a little cop-out, but that, that's about the best answer I can say I have. It's, it's kind of just that knowing that something I did was powerful for someone else.

That's really powerful. I think it was Maya Angelou who said, right, "I've learned that people will forget what you said, people will forget what you did, but people will never forget how you made them feel." Yeah. That is leadership. Wow. So if you had a magic wand and you could solve any problem in the world, what is the one problem you'd like to solve first thing tomorrow morning?

The loss of compassion. Yes, absolutely. I've never seen so much contempt in my entire life. I've never seen this level of contempt between even people in the same country. So yes, if I could wave my magic wand tomorrow and eliminate all that and actually bring compassion to the world, that would be number one.

Wow. And if you have the ear of every young woman in America for the next 60 seconds, I'm thinking about my two daughters, 24, 18 years old. What would you tell them to do tomorrow morning?

Do whatever it is that's going to make you smile. Seriously, you're going to be told every day you can't do this, you can't do that, you know, you're not qualified, you're not this, you're not that, you're not strong enough, you're not tall enough, you're not pretty enough, you're not whatever. Do the thing that's going to make you smile. While you're doing it, if you happen to flip them the bird and say, you know, see, I can do it anyway. Yes, I'll be there to back you up.

Powerful. Wow. Okay, all good things must come to an end. How can we add value back to you? I really could talk to you for hours and hours and hours, but we do need to land this plane soon.

Yeah, if my book sounds helpful, of course, please buy it. Um, you know, I hope it will be helpful to people.

By the way, what was the inspiration for the COVID It's kind of unusual for—

that's actually, um, that's the thing that Manning does. It's just they have all of these various characters that are historical ethnic characters.

Um, I love it.

And so it's just part of their theme. It's like, it's like the O'Reilly books with all the different animals. There's are all these, these people. Um, but yeah, so I mean, the book, obviously, if it's, if it's helpful to you or somebody that, you know, it can help please, by all means, um, you know, if you follow me on LinkedIn or on Blue Sky, I would love to have you there too because I would love to talk to you about anything. I mean, really, I love sharing knowledge. Um, you know, or I guess the last one would be if you see that I'm speaking at an event, I've got actually a fair number coming up, come on out if it's nearby or it's an event you're interested in. I'm not going to that event Okay, so don't try to come find me at ROK. Um, but, uh, yeah, I, you know, that would be the other one. I just, anytime I have the opportunity to have a good genuine conversation like you and I have had today, just, yes, you know, talking about things and sharing those ideas, I, that I have such a passion for that, and that's so exciting.

That's really, really powerful. And of course they can follow you on YouTube as well, and they can see pictures of you flying all over the place.

And there's some videos of me landing in the airplane at Chicago O'Hare and doing some other stuff. So yeah, if you're so inclined.

What a wonderful, wonderful life. Okay, uh, every good thing needs to come to an end. I guess the last question I'm going to ask you is, uh, knowing what you know now, if you could go back and give a piece of advice to your 17-year-old self standing at the edge of this incredible career you've had, becoming a Chief Information Security Officer So what would you say to that 17-year-old Alyssa?

Don't be afraid to be you. It's daunting. It's hard. You always feel like you have to hide. I mean, I felt like I had to hide being a hacker in order to get into this job that I'm in now. And the reality was, you know, I only got to this job when I was willing to embrace it and lead with it, that that's part of who I am, part of my identity.

That's right.

And that would be the biggest thing is just, God, that authenticity is such a valuable thing. It is not something to tuck away and hide.

So powerful. All right, this is it. This is the end. But I always like to end on a very high note. Although we talked about pretty positive things this entire interview. Sometimes I talk to some people, we talk about some very, very bad stuff. Q Day is the end of the world, apocalypse and all of that. No, something positive. What is something you are feeling optimistic about in 2026?

Oh, something I'm feeling optimistic about. Um, I think we're gonna, you know, I guess professionally, I think this year is going to really see some acceleration in technologies that we probably haven't even thought of yet. I think the AI hype will die down and it will actually just become an an effective tool. Um, we'll figure out, you know, what's gonna, what's gonna stick, what isn't, where is it overhyped, and where is it really driving us forward. But yeah, that's— I, I think, you know, from that perspective, professionally, I, I do expect to do some really cool things this year.

Fantastic. Before I ask you the very last question, is there anything I should have asked you that I didn't get a chance to ask?

I don't think so, actually. I knew that question was coming, and I We covered a lot.

So very good.

No, you hit great points today.

Thank you so much for giving us the little extra time. But I guess the only people I absolutely have to stick within the hour are, you know, 1, 2, 3, and 4-star Admiral in general, because those people, they don't play with time. But I really, really do appreciate you mentoring us and being our master teacher today. Very last question. What is one word that represents our shared experience on this podcast today? One word.

Authentic.

Well, thank you so much, Alyssa. This has been a long time coming and I am so, so grateful you made time to speak to my audience today. Thank you so much.

I appreciate it. Thanks for having me on.

Okay. All right, everybody. This is one for the book. Again, follow Alyssa. Let me again put her LinkedIn page right here. And also, please make make sure to get a copy of her bestselling book Cybersecurity Career Guide. If not for yourself, for somebody who wants to become a cybersecurity professional. The truth is almost every year I get at least a dozen people reaching out to me, not just from the US, but from all around the world on LinkedIn saying, hey, how do I get into the cybersecurity field? Right? Because it's kind of like what, catch-22, I think is what they call it. Some people, it's like, okay, Hey, I can't hire you because you are not a cybersecurity professional. But you cannot be a cybersecurity professional unless somebody gives you that first job. So it's really, really, really cool to have resources and books like this that can really help you out and help you get into this wonderful field. Now, as you guys know, for this year, we've decided that we're not just gonna celebrate Black History Month, we're gonna celebrate Black Black History Year. So for Black History today, quickly, you guys can go to my LinkedIn page and you will see this, but for today is March the— let me see, I think I have it here— March 13th, right? We're gonna go back 6 years ago, 2020. That was Breonna Taylor. She got killed during a nighttime no-knock raid. So we want to remember that. Breonna Taylor was her name. And then the second vignette I have about Black History Year now is African American first in the military and then in technology, right? Those are the two worlds I live in. So in the military, there is a Lieutenant Colonel Shawna Rochelle Kimball. She goes by Rochelle Kimball. She's the very, very first Black female fighter pilot in the United States Air Force. It's really great that today I am speaking to someone who's licensed to fight— no, to fly airplanes and helicopters. But yeah, the person I chose to celebrate today, Lieutenant Commander Rochelle Kimball, the very, very first Black woman fighter pilot in the US Air Force. So I'm going to play a short clip about Colonel Kimball to celebrate Black History Year on the Leadership and Success Podcast. But that's all I have for today. Before I do, I want to remind you guys, we are also studying the book of Proverbs. So next time we have a chance, we're gonna go through Proverbs chapter 19. This is not a religious podcast at all. It's all about ancient wisdom and leadership lessons, how a book written more than 2,000 years ago is still relevant. Event today and what those lessons teach us. All right, I'm gonna play a quick clip about, uh, Colonel Campbell, and I will see you again tomorrow. Thank you so much for watching. Bye for now.

As we step into Women's History Month, let's dedicate time to honor the remarkable achievements of one specific woman in aviation. Who is this woman that has defied all odds? What are the capabilities of the fighter she piloted. Join us as we embark on the fascinating and intriguing story of the glass ceiling breaker Shawna Rochelle Kimbrell and her F-16 Fighting Falcon. The formative years of the brave Shawna Rochelle Kimbrell. Lieutenant Colonel Shawna Rochelle Kimbrell is the very first African American woman to be a fighter pilot in the U.S. military. She currently serves in the U.S. Air Force with the rank of Lieutenant She flew the F-16 Fighting Falcon during Operation Northern Watch in northern Iraq. She works at Nellis Air Force Base and is part of the 78th Attack Squadron. At the base, she is a pilot for the MQ-9 and also leads missions. Before her achievement, she had a normal American childhood. Kimbrell was born in Lafayette, Indiana, and is the youngest of 4 kids. Her parents moved to the United States from Indiana for education opportunities before they started their family. Her dad, a tenacious and hardworking man, received his first degree from Howard University while caring for his family. He eventually received a doctorate from Purdue University. His hard work led the family to Parker, Colorado, which is where they raised their family. His achievements definitely set the pace for his children's accomplishments. It was obvious that education and attaining goals was a big deal for this family. So it's not far-fetched that Kimbrell and her 3 other siblings spent their school years in Parker with their different dreams and aspirations. "Education was the thing that opened doors," Kimbrell said. "If you got your education, you could do whatever you wanted to do. That was how our house was run." From a very young age, Kimbrell showed early signs of leadership.

Thank you for tuning in to the Leadership and Success Podcast with your host, Coach BZ. If today's episode added value to your leadership journey, be sure to subscribe, share, and join us again for more wisdom nuggets on how to lead better and achieve greater success. Remember, leadership is the most critical skill of our time. The world will always need leaders to inspire others, drive innovation, and execute meaningful strategy. So why not count yourself among the bold leaders shaping the 21st century? Until next time, stay inspired, stay committed, and keep leading with excellence.