Episode 76: Jessica Gulick: An accomplished cybersecurity practitioner turned CEO on future focused leadership

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda.

Loop.Com hello, I'm Bob Gourley, the Chief Technology Officer of OODA llc. And today on the oodacast, Jessica Gulick. Hello, Jessica. How you doing?

Hi, Bob. How's it going?

It's going great. And I'm so excited to finally get a time to record with you because I know you have so many lessons and I think you're a very inspirational leader and, and I want to tap into some of what makes you think and share it with our audience.

I appreciate the opportunity to be here. You know, I'm a huge fan of yours, Bob, and Oodaloo.

Well, thanks. Thanks. And you have an interesting career. And one thing, I think a lot of people see you as a successful CEO and know that you run a Cat's Eye and have this great marketing engine. But I don't think people realize that you have a career as a practitioner with deep experience in leadership and cybersecurity in a wide variety of cybersecurity related fields. So can you walk us through the beginning? How did you get into this?

Oh, goodness. I got started in cybersecurity in Ramstein Air Force Base in Germany and I was just out of high school at the time, starting my college. I was probably midway through college and, and started working for SAIC then. And I had the opportunity to talk with the security office on base, the IT security office, and integrate with them and what was called Systems Integration Management Office back then, cmo, and learn about what they were doing in terms of system security plans. And that was really inspiring for me. So when we migrated back, if you will, to Colorado and, and got out of the Air Force and I was looking for my job, I went back to SAIC to see if I could find a position and that started with State Department. Now if you recall, Bob, this was when Gizra was in place and FISMA was just around the corner and the State Department was really kind of setting up within IRM their security program. So one of the first mentors that I met There was Lynn McNulty and the father, if you will, of Cyber Program Management. I remember him holding up a security plan from 1978 and he's saying cybersecurity has been around forever. Jessica, there's no reason why you can't be an expert. He goes, you need to get your cissp. I need to really dig into cybersecurity. And so I did. And it was a lot of fun. We did a lot of great stuff at State Department and then moved on to saic where I was doing a lot of different federal work managing various programs and to a point where I had a team at one point of like 34 security professionals doing everything. Penetration testing to forensics to policy, to strategy documents, to even co authoring some NIST special publications. So it was. It was a lot of fun.

All right, so. And when you were at the State Department, what year was that?

Oh, my goodness. So it was right after I started the October after 9, 11. Okay.

So very busy time. The whole world was trying to raise their security posture and.

Absolutely. And it was a lot of fun. I got to my first job there, was working on one of the very first vulnerability assessment databases. And we used. We used Microsoft Access, but it worked. And we were working with all the embassies and consulates around the world and talking to them about their disaster recovery plans or IT contingency plans and, you know, making sure that they had what they needed. So it was a lot of fun. And then that kind of migrated into security metrics where I had the opportunity to be part of the team that really set the best practices. What that ended up being the FSMA scorecard. Do you remember those days?

Yeah.

And how to, you know best the scorecard. So what we were doing at State Department was really the foundation that was then rolled out to the rest of the federal community, which was a lot of fun.

That's cool. And you also, I mean, besides the CISSP, I think I saw on your LinkedIn profile PMP.

I did. I got my PMP back in. It's either 2004 or 2007, but that was a big milestone for me.

I guess we should back up. For those that don't understand what a PMP is, would you tell us what is that?

It is a project management professional certification. And I chose to get out of my career because I was actually seven months pregnant when I got my pmd. And I knew it was going to take some time for families. So I wanted to really do a milestone, a big milestone that would help ensure that when I returned to the workforce, I would still not lose any ground. Right. And at that time, there wasn't a lot of project management professionals out there. I think it was still under 1000 at that time, I want to say. So it was a great move and it really has helped me in my career to be able to have the tools that I need to run a project. Right. And understand the cost and understand the planning and the sequencing. But I Would say it was also probably foundational to when I started my own business. It gave me some of the planning knowledge that I needed to be successful.

I can imagine. And I don't know what it's like today, but through most of my career I'd see that acronym and I know that this is a person that can really understand cost and schedule and performance and how to keep things on track. And especially in the government system integrator world, someone with a PMP is in extremely high demand because the government expects things to be done on schedule and on cost and to meet the requirements of the contract.

Absolutely. I would go further than that, Bob. What having project management skills like that does for an individual, it allows you to open up to scary things, big challenges. Right. Because now you know how to break big concepts or visions into little small pieces that are actionable. And you can trust the process. You can put together a plan that is very detailed to begin with, but not so detailed in the end, but trust that you know you have the tool, you understand the process so that you can take on those bigger challenges.

Yeah. It's interesting and I wanted to ask you what's the secret to your successful career? And there must be a whole bunch of things that your continued study, your hard work, your discipline. But I wonder about the role of that pmp. It sounds like if someone's asking us for advice on what they should do to further a career, considering pursuing the PMP certification might be one of the. A good recommendation.

Absolutely, absolutely. Because it really does open you up. People when they see that you have a pmp, they think, she has a good vision, but you know, if you don't have one, they're like, she's got a good vision, but could she really implement when you have the pmp, it's like, yeah, you know, hold my beer, let's go. We've got this. We can plan it out and we can make it happen and we can do it as a team.

Yeah. It gives you the mental models and the tools to really help execute.

Absolutely.

Well, while we're on that subject, then, what else. What other tips do you think have helped accelerate your career through the years?

You know, it's interesting. I try to learn from everybody I meet, I really do. And I feel like everybody has some value to learn from from their experiences, whether you like them or not, but. And regardless of if they're successful or more successful or where they are in your life, it's funny, one of the big lessons I learned was from my son who was Young at the time, if you will. I think he was in middle school or something like that, and he was playing football. He was on the practice field, and he was just taking hits after hits, right? Little guy up against big guys, all, you know, in their helmets and gear and stuff, and he was just taking the hits. And he'd fall down, get back up, fall down, get back up. And the coach just couldn't believe it. I mean, the hits were pretty darn hard. And while he's doing that, the mom of me is like, oh, my goodness. But the entrepreneur at the time, I was just starting. Cat's eye is like, oh, wow, what a difference it is between boys and girls. And I wrote a blog on this about perseverance. Boys are taught from an early age in football and sports and such that it's all about persevering through the challenge. Girls are taught about perfection. Once you let go of that ideal perfection in your head, you don't feel as much of an imposter. You take on more challenges, more risks, and you realize it's about perseverance. I'm going to fail, but I'm going to keep trying until we get it right. That's fascinating, Jessica. So my point is that you can learn from even your kids, right? So it's kind of fun. I would say that's one of them. I've learned one recently, Bob, that I'm really kind of enamored with. And I think it was in something I read from either Harvard Business Review or, you know, one of those. One of those business strategy rags that are out there. And it's all about. It's not about delegation, it's about coaching. And I think that's really important. I think one of the things I would share with anybody who's kind of going up in their career or they're thinking about starting their own business. We're taught, I think that it's about delegating, right? I'm going to give you a task and you're delegated to go do it, and da, da, da. But when you're trying to build a team and the business is yours, so all the risk is yours. It is about coaching. It is about working with your team members and putting together the process, the expectations, letting know this is how you do it and working with them and coaching them. And I found that by coaching staff, I am able to take vacations. You know what I mean? But I feel like delegation was always taught to us, and it is really one of those. Here, let me give this to you, you're on your own. And I really hope you do.

Great observation in the military kind of structure is there's a boss and then no more than three or maybe five people directly under you, because that's all you can really command. And under them, same thing, no more than three or five, and then it's that way, all the way down. But if you're coaching, you can coach a large number. It's not a command and control thing, it's you can coach a big team.

Yeah, absolutely. And I think you do see that in the military it's usually called like commander's intent. And so it's not hands on coaching, but they are trying to set the vision at the top and let everybody know this is the vision, this is what we're trying to do and understanding the mission and objectives so that people can make good decisions. I think that's part of the coaching piece. But I think as you go, when you're starting your own business or a team, I think putting that extra love into it and spending some time with the team members and understanding what you want them to do right, and how to do it, it's a hard investment, it's not easy, but it's worthwhile.

Yeah. And on your previous point about persistence too, I wanted to mention that I've met some great hackers, the people who can really get in. Matt devoe, my partner's got that great attitude and so many others. And the thing that separates them apart from me is that persistence thing. When it comes to computer security or hacking penetration testing, the greats just never get up, give up. They just attack, attack, attack, attack, attack. And I don't have that when it comes to the hackers and the hacking mentality. So I just admit that now I do apply persistence to the rest of my business, to my writing, and I see great rewards there. But I use the example, historical example of Hannibal crossing the Alps. He was told, you cannot do this. And he's bringing war elephants and war horses. And he told his generals, we will find a way or we will make a way. And so I consider him the first real hacker.

Sounds cool. I like that. I like that a lot. I think it's also the point. I remember my husband was military, so I remember we were at one of those hail and farewells that they do. We were on a boat in Germany, right? And I remember that the general got up and he said some words and he said, never judge a man by his failures. Always judge him by the challenges he chooses to accept. And that really stuck with me because I think it's true. And so I try to also practice that when I'm trying to bring on team members or work with folks.

That's cool. You have a pretty neat team now. In fact, I should ask a bit about your company, Cat's Eye. That's an interesting name because it sounds like a cat's eye, but you don't spell it that way. And the cat's eye that you also put in your logo makes me think, here's someone who's really paying attention is about to pounce like a panther. But what is Cat's Eye?

So Cat's Eye is a name it really came from I was trying to think through when starting my own firm, which is kind of another story. I started Cat's Eye kicking and screaming, by the way. And I originally thought I was going to get in and be a security firm. Right. Cybersecurity consulting. I got a call from Chris, Chris Camacho, and he's like, yeah, no, Jess, you need to go into marketing. So we did, but I was looking for a name. And Cat's Eye, as in the tiger stone. Right. Is supposed to be. The belief is that it is a powerful emblem that helps protect fortune. Right. And so it really worked for cybersecurity or for marketing. It was about protecting your growth. And it's got a nice ring to it. And we did change up the spelling. Being a marketing firm, we have that kind of right. It was originally going to be Kat Zy Zy, but then I remember I was meeting with another friend and she's like, now put the C in there for cyber, since that's always going to be your sweet spot and that's where your heart is. And I'm like, okay, so that's kind of where the name came from. And it stuck around. And, uh, it's. It's nice. I. I remember I was at. I was at RSA at one of the parties, and somebody comes around and I'm here to meet the Russian firm. And I'm like, russian firm? What's the name of the Russian firm? And they're like, kashki. And I'm like, yeah, no, so it was funny. But yeah, that's just a little bit of story behind it.

Cool. And what does Cat's Eye do?

So we help cybersecurity firms grow. We do have some IT firms, some drone firms, but we really help them grow. And we're different. We're obviously a boutique firm, woman owned, and a social impact firm. If you Will, which I know is a new term in the market space, meaning that we spend a lot of time helping nonprofits and organizations around causes that we support, which is around workforce and helping the workforce be diverse, as well as improving skills and such. But we primarily do marketing and strategy for IT cyber firms, and we do cybersecurity games. We launched that last year. And again, where we're different is that we bring some of the technical expertise. The cybersecurity market is very different than I would say, majority of the markets out there. There is a psychographic to the market that you have to understand. There's a edginess that you need to bring. But I think from the business side of things, it's really important that a marketing firm doesn't come in and try to change a company. That what we do is really try to amplify their strengths and really work at the same pace of the capacity of the growth that firm can support. And I think a lot of times marketing, other marketing firms miss that. So we have a lot of fun.

I think another one of your strengths clearly is the fact that you have the technical background where you can have a conversation not just with the CEO, but the CTO and the engineering team and really understand what these capabilities do.

That's definitely one of them. Thank you. We are able to really start to communicate in terms of business outcomes what the technical teams are doing. And I think I did learn that being a program manager at SAIC with cybersecurity, because oftentimes my role was to take what the team is doing, if the pen test team is performing a project, and really start to equate that into terms that not just the Chief Security officer would understand, but what they could put forward to their boss and up to the board.

You mentioned, did you say a social impact, your social impact firm?

Yes, yes.

Well, I know some of the social impact you've had is your personal time and energy and commitment to helping the woman's society of Cyberjitsu. And is that an example of what you meant by social impact firm?

Absolutely. So one of my volunteer hats is president of the board for Cyberjitsu and they are a 501C3 dedicated to advancing women and girls into cybersecurity technical fields. So we do a lot of work around women in cyber or diversity in cyber, and we try to help out where we can. And it's a wonderful program. And I encourage listeners to check us out@womenscyberjitsu.org and see how you can get involved. Because providing workshops and encouragement and a network to women and games, because women love to play cybersecurity games. Really helps to understand where their strengths are and where they should put their time. Baba we've kind of learned about women in the last few years is that they're very thrifty with their money when it comes to their education and their investment in themselves. Right. And their time because they have a lot of other things on their plate. So. And they're also very careful about they want to partake in things that they feel they're good at. So we have a large portion of our membership that are boomerangs, right? They're coming back to the workforce after 10, 12, sometimes 20 years of being outside the workforce. And perhaps they had some IT job back in the day. They were a programmer or web developer and now they're looking at a cybersecurity career. So they are active participants in our tribe, as we like to call it, where they come in and they can take cost effective workshops to expose them to Python penetration testing and forensics and all this different kind of capability and start to get the kind of encouragement and confidence in themselves so that they're ready to take on some of the bigger, more expensive boot camps and commitments into the career field. So that is definitely one of the programs that we're supporting. One of the things we're doing with Cyber Jitsu that's exciting. It's a blend between Cat's Eye, Cyber Jitsu and SANS is that we won a GO Virginia grant here in the Northern Virginia area. And it's really hyper focused on finding those individuals with high aptitude and IT and cyber that have been negatively impacted by the pandemic and cross training them into a cybersecurity job. And the SANS program that they have out of their cyber talent organization has gotten it down to 3G act certifications that they can train these individuals in so that they end up in a security job within six to nine months. Bob, one of the examples we use is there was a lady in one of the programs, I believe she was a single mom, she was a hairstylist or something to that degree, earning very little money on a salary basis per year. She was able to double her salary with this opportunity to cross train. And that changes lives. It changes not just her life, but her family's life. And those are the kind of programs that Katzeye really likes to contribute to.

That's great. This is very virtuous and from several standpoints, of course, it's the individuals that you're helping but then also the broader ecosystem and even those companies that now get to tap into talent that wasn't there before.

Absolutely, absolutely. And it's great for the companies that are listening to be part of the Virginia Cyber Skills Academy. Just go to virginiacyberskills.com and it doesn't cost you anything. We're just looking for a commitment and a letter of intent that you'll be a part of the program and contribute. That's it. No financial obligation.

Well, we'll put a link to that in our show notes, for sure. And the same with the Woman Cyber Jitsu organization. You guys are very welcoming to men too. So you let me join and that's nice.

We have, I would say there's a good percentage of men that are part of our program, our allies, if you will. They're welcome to the training, to the programs. It's just we let them know it's designed for women. That doesn't mean that they can't be there. We'd love to have men in the programs and we have a very diverse membership that we're growing as well. But we are dedicated to advancing the women and kind of her voice, if you will, into the cybersecurity community.

Great. And companies will also sponsor events there too. Right. And that helps give them insight into the pipeline of new talent.

Absolutely. In fact, one of our annual events is coming up, I believe Mary, the CEO, who's fabulous, by the way, and I think you've interviewed her, Bob.

Yes.

She's going to have the promotion come out on the awards program that we do every year. I believe we've kind of adopted the hidden figures theme to it because so many of the women in cybersecurity that are pen testers and hackers and coders and, and technical staff, they are kind of hidden. They come in, they do their work quietly, they get the job done well, and they leave. Right. So each year we do an awards program that tries to bring some light, shine some light on the great work that they're doing.

That's great.

That's coming up in August, I want to say August, September. So it's perfect. And we do need corporate sponsors. There are a lot of well funded women's programs out there. Our program is 100% volunteer based, so the investment of sponsorships helps keep it running.

Right. And you first introduced me to mary in the 2019 Cyber Games that you guys put on the Wicked Six.

Wicked Six, yeah.

And that was interesting.

Yes, yes. And we're hoping to do that again. So Wicked 6 was esports meets cybersecurity for a cause. So we brought out the six. Well, we brought out. We ran a college competition and brought teams together. They were all required to have at least one female, but they were co ed teams. We brought them out to Vegas and held it at the HyperX arena, which is neat. It was so much fun and we loved having you there, Bob. We had shoutcasters, we had a lot of energy and the whole point was to raise funding for cyber camps for girls and women. We're hoping to do it again late this year, a lot later than normal. It'll be a little different because it'll be virtual. But we hope to be back at Black Hat and hyperx next year.

Right now, I think that's a good segue into the US Cyber Games that you're a commissioner for. Can you describe that? What is the US Cyber Games?

It is something that hasn't been done before. This is not a normal cyber competition. I know there's a lot out there, wonderful programs like Cyberpatriot, ccdc, Cyber Force. They are all wonderful cybersecurity tournaments. What we're doing that's a little different is we're trying to put together a traveling sports team. If you will think back, if you have kids or nephews or nieces thing, where each sport in soccer you have that traveling team that crosses different states and goes off and competes and it's typically the more elite, the more advanced athletes. We're doing the same thing with US Cyber Games. We are trying to put together a sporting team that will compete globally with our first game of the season in December in Greece where we'll face off against eight other nations on a capture the flag scenario as well as a red versus blue. So we're right in the process of rolling out this program and we're learning a lot from sports and there's a reason for that, Bob. We have felt, or I feel that sports has done something brilliant and local and yet national at the same level. And because of their programs, if you look at it, they do a great job of creating a pipeline that's diverse and competitive and has multiple skills and can work as a team, demonstrates leadership. There's a lot to be learned, whichever favorite sport you have. And we're trying to do that in cybersecurity because we have an excellent opportunity here. And so we start off with the Open. We had something like 680 some applicants to participate in the first open CTF that just happened, which was exciting and now we're moving into the combine, which we're kicking off on July 9, with a virtual event. The combine. If you're familiar with football, a combine in sports is all about skills. What we want to do in the next two months, virtually with these selected few, because it's by invite only, is to really start to help them practice their various cyber skills. But we're actually getting to things like speed and accuracy and complexity and ingenuity in their approach. So we'll be exploring that and we need a lot of help to do it in a lot of different ways. And then on October 5th, we'll be able to have a draft day. I don't know if you watched the NFL draft day this year. I did. But we're hoping to do something just as exciting where we invite everybody to listen in and we make the announcement and we say, hey, Bob, would you join the US Cyber team? And we talk about your stats as a cyber athlete. So it's going to be a great opportunity to participate in something very unique and different. And I hope it grows. I mean, our intent is that, you know, Greece is just the beginning of a season of multiple games for us, perhaps throughout the world. Kind of like, can you.

I think I understand how the US Cyber Games came together. It's because of you and people like you, who you are like a force of nature and this you. But how did this global competition come together?

The credit for that really needs to go to anisa, the European equivalent of nist, where they have the European Challenge and their finals are going to be September 28th in Prague this year. This year they said, hey, why don't we just extend this after our finals a couple of months and do an international challenge. They've invited the US to participate as well as other nations. So it's going to be fabulous. And they're making sure that it's in person, that's not virtual. Because they really think that by bringing the nations together around Cyber Games, just like in the Olympics back in the day. Right. It helps us to collaborate and to talk through some cybersecurity things that we all share.

I have no doubt this is a very virtuous thing.

I should say that the US Cyber Games would not have happened if it wasn't for Rodney, the director of Nice out of. He was very much spearheaded the program and they are funding the program cost of it through a grant to Cat Sci to run the program. So we really appreciate their support and all of our sponsors support as well as Ooda Loop.

Well, it's great being involved because we get to watch you just change the world closely. So it's really enjoyable.

Well, we're really hoping this will spur some really interesting discussions in the community, and I'd love to see them on OODA Loop and other discussions and such. We talk a lot about tools that map to the Mitre ATT and CK framework. I think it's about time we start talking about how employees and cyber professionals map to the Mitre ATT and CK framework or map to the NICE framework. Let's get some metrics around what our workforce really can do and then put the games in place to help them improve. And I think it becomes really interesting when we stop saying I need to hire an incident response analyst, and we start looking about how do I create a team at our company that really protects what we value most and that kind of changes the game. Yeah.

You know, this relates to another question I wanted to get into, and that is the future of business overall. You know, the whole world changed because of the pandemic. It was changing already because of the convergence of all these technologies and just a new way of doing business. And then the pandemic hits and just dramatically changes everything. So here we are. Pandemic's not over, but it's already a new world and a new business environment. And I just wanted to ask, as a CEO, what your views are about the future and if you have any advice to other CEOs on what needs to be done to ensure success.

Absolutely. I think we're in a very interesting time. Right. We've weathered the storm, let's hope. Right. And there's a lot of excitement about returning to the office. And I think that there's going to be some really interesting discussions going on at companies in that here they've now gotten used to being the employees, gotten used to working from home, and the manager's gotten used to. To managing those that work from home and having them available at all hours of the day, if you will, or at least different hours than typical. And some have produced very well and others not so well. But the point is that we changed, and I don't think we can go back. Not fully, not the way it used to be. It's kind of like they say, you can never go home. We have a new frontier in front of us for the workforce and how we manage our teams and where we manage them from. And I think that's important to realize as we go forward. You can't expect people to show up in the office 8 to 5 and then still be available at 10pm right there. We need to reset our boundaries as employees so that we have a life balance. And as managers, we need to relook at, you know, how do we lead? You know, I've heard a lot from other CEOs and managers during the pandemic. What they learned was that they needed to have a better understanding and a better relationship with employees. Sometimes it's a lot easier to compartmentalize your relationship with your employees when you just all go into the office and then you leave the office. But when you're going through a pandemic together, there are a lot of relationships that were cultivated that really helped the team dynamics. So I think as we move forward as a world in post pandemic days, I think we should keep those lessons that we've learned over the last year or so and see how we can reapply them in a new way to our workforce so that we can find that mutual balance of virtual and home and where the boundaries need to be set between the employee and the employer, where they're still close. Right. We still have relationships. We're still working as a team and collaborating. It sounds easy. It's not going to be easy. This is something. You're changing the culture of organizations and it's very difficult, but it's worth it.

This is very insightful and I definitely agree with you on all these points about we're not going back to the old normal, we're moving forward. And there is definitely going to be some component of in person, but is it in person every day, forever? And, and then there's definitely going to be some component I just know of. Always distant and remote. There may be some team members that you never see in person. And of course it's always been that way in these huge companies. But even for smaller companies now, it's just the way things are.

Absolutely, absolutely. And you know, I would encourage people to even rethink of the 40 hour week here at Cat's Eye. I don't believe in a 40 hour week. I think some weeks have 30, some weeks have 50, you know, and you've got to be flexible. And I think flexibility across the board with workforce is going to make sense going forward.

Cool. Well, Jessica, thanks for the time today and all these insights. I really appreciate it.

No, I'm a big fan, Bob, and I really appreciate being part of this program. Thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity, technology and global risks, please visit www.oodaloop.com.