Importance of Soft Skills in Cybersecurity

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about the importance of soft skills in cybersecurity. And I'm going to be talking with Avinash Karam. And Avinash, and I, again, apology if I get your name wrong. I always do this. I mean, I've known him for a while. He's a cybersecurity expert and advisor. Previously, he was the VP of Cybersecurity Solutions Architecture at Herjavec Group, CISO at Cyber Beats. He's founded several cybersecurity podcasts and is the author of Architecting Success: The Art of Soft Skills in Technical Sales. Welcome, Avinash. Thank you for coming and talking with me again.

Thank you very much. Isn't this fun to have a unique name that nobody can pronounce?

It is.

But they know, they're gonna remember you.

I want that. I want people to be just a little off because they can't pronounce my name. I want that.

And your last name is not also very easy to pronounce as well. So you have a bit there.

It is, it's Swedish. It's Rosenquist, originally pronounced Rosenqvist. So yeah, can't you tell I look Swedish? You know, the blonde hair, blue eyes. Yeah, yeah.

Definitely, definitely. The height. Yes, all there.

Yeah. All right. So soft skills. And I mean, we're in an industry, cybersecurity, that has so predominantly grown up around technology and hard tech skills, right? And truthfully, I mean, that's the playing field we're on, right? We deal with that. But there are so many aspects of behaviors and people in our industry. And when we talk about soft skills, right, we're talking about the communication skills, the leadership skills, the decision-making skills, the relationship building and all of that. And yet our industry, that really isn't what we lead with. In many cases, that's not what our industry is strong at or even adequate at. I hate to say it. But so, I mean, in your mind, I mean, and through your research and your experience, what is the role of these soft skills? How do they play in the tech sector?

You know, we say in the industry, it depends. I'm not going to go there. But there's actually several different things. Let's think about that. We have amazingly smart boys and girls and many other people in our community. And these people, are, have so many different ideas, and some cases they're doing a very, very important job. And how do they explain their important job to someone that don't understand all the bytes and all the nuances? In many cases, this could be their management, this could be board of directors, this could be other people in the industry. They need to give them budget, they maybe need to approve a certain project when they need to evaluate the risk of go left and right, jump or hide right now. This is one of the important soft skills. Can I take complex idea, cyber, IT, whatever it is, AI, and explain this in the language you will understand and will resonate to you? This could be simple language, this could be business language, depends who I'm talking to, or this could be a metaphors because I know you play golf. I know you have a house or you like sailing or maybe you like to do puzzles or whatever it is. If I can do it in a way that you will understand and you will connect to it as well, something that relates to you, I am half winning the game. And I'm not talking just CISOs. I'm not talking just analysts. This could be many different things. Unfortunately, in many cases, we blame the human in cyber. Oh, this is the human, this is that. But if we're doing bad job to explaining to them security awareness, we're not going to go there, but it's such a popular topic. We need to explain why and how we show these amazing videos, how you're not supposed to be clicking on these links. But not always we relate back to, hey, you have kids, you go to a park. What do you do with the kids? Like, oh, I tell them in case we get lost, we're going to meet here. Or here's my phone number. And if you get lost, you go find a security guard or whatever it is and call me. What is this? It's like, oh, it's just the basic stuff. Great. We just describe security awareness for day by day. Oh, makes sense. Okay. And there's many, many, many different examples, but it's not as easy as we see because in hard skills, majority of the time, we expect the same outcome if we do the same particular steps. If I go to ChatGPT, that's supposed to help and solve everything. And ask, how are you doing? How are you doing? How are you doing? He will say, I'm doing well. How can I help? I'm doing well. How can I help? If I ask Matthew, how are you doing? How are you doing? How are you doing? He's gonna punch me in the face. I'm like, are you kidding? What's wrong with you?

Gently.

Gently. As a human being. Yes. But because as a human being, we are dynamic. And even if I explain something to Matthew in one way that you understand, it doesn't mean that if I grab John or Julia on the street, they understand the same way. Or maybe you woke up today and you had a bad morning for whatever reason. Everything will change.

So you've covered a ton of different aspects here. I want to unpack this a little bit. And you started off with being able to effectively communicate because, I mean, at the end of the day, cybersecurity is a team sport. You're not— it's not just one person, one brilliant person that's going to make everything secure. Right? It takes a group of professionals, skilled and nuanced in different aspects. And if you want them to work together as a team, well, you have to be able to communicate. And that leader has to be able to communicate goals and how you're going to work with each other and who owns what responsibility and what are the expectations. And then you kind of started talking about, well, you also have to facilitate these people working together. And you have to kind of know a little bit, you have to build a rapport with them. And that helps you understand if there's conflicts and do they really understand you?

Are they afraid of you? Let's stop for a second because you mentioned rapport. If maybe not everybody aware, what does it mean? Because it's a very known term in a way, but what it is in your mind, because maybe I understand it differently and you understand it differently.

It's a good point. And you need that communication, one, to convey, two, to validate, right? And that helps build a rapport. If you and I speak two different languages, it's really tough to communicate. And if I'm talking one way and you're not grasping it, how are we going to be an effective team? How are we going to collaborate?

May I interrupt? May I interrupt here? Yeah. May I interrupt here right now? Yes. And this is an example of me asking, can I interrupt instead of me just jumping and saying something what I want? Or so let's assume we're meeting on a business meeting or meeting about something, and we understand that I speak Hebrew and you speak Chinese and we cannot understand each other. But if we can guide each other, we just realize we don't speak the same language. I was like, oh, he doesn't understand me because we don't speak. So we now guiding each other, okay, let's find a different language to communicate. Can we draw pictures? Can we do something else? Because part of this building a rapport of communication is to understand we actually don't understand each other and we need to find a different way to communicate.

It's fair enough. And, you know, it's funny, you know, you had mentioned, okay, hey, we're meeting, we have different languages. I just instantly imagined you and I meeting in a coffee shop. And even if we don't speak very good languages together, we're going to probably look at each other in the eyes, we're going to smile, we're going to extend our hand, we're going to shake our hands. These are all even nonverbal means of soft skills that start to build that rapport. And that starts to break down some of those barriers. So we've got hard skills, and in our world, they tend to be very, very technical. And we've got these soft skills, right, that cover a lot of different things. Tell me and give me more examples in cybersecurity specifically, how they complement each other.

Let's take something very important, incident response. We know incident response is One, very expensive. Two, you need to know really what you're doing from the hard skills perspective because you need to go and there is a race. Now it's not a marathon. In some cases, it's a race because we need to understand and provide time to value to stop the bad guys, to stop the data leakage, to stop the marketing department to tell we all got screwed. Excuse my French. So This is a very technical skill to do actually incident response, but inside the incident response team, we have different people that doing different job functions. So one of them could be the controller, is somebody that actually communicating the finding, communicating what's going on right now with the upper management, with the legal team, with the marketing team, with everybody outside. So this person need to take very technical information about malware, about flows, about potential data, how much data, and transform them to legal business language. Fewer soft skills. Now, if I call and say, Matthew, this has happened, I don't know, but we— it's like, I didn't say anything, but you already know we got screwed. You know, we're already panicking. Because I couldn't control my emotion, my physical emotion. Then I put you in a panic mode, but maybe I was just running and this is why I'm talking like that. So one is how we speak. Two, how we actually speak in a way, not just the language, English, is are we panicking? Are we speaking fast? Are we speaking slow? Are we doing pauses between the sentences to make sure you understand? Do we try to understand, Matthew, what's the best way to give you the information? Do you want the good news? Do you want the bad news? So this is the different style of communication and how we convey the message and what our nonverbal body language shows to you as well in case we see each other. So here's one, one simple example. Two, we have this example when we take a CISO, when we take a leader and he needs to go to a board meeting. To explain something, and it usually involves some kind of graphs. And this graph gonna have yellow, red, green, green. Yes, yeah, look, there is that. But if I'm a board person or somebody in executive don't understand the graph or somehow see it first time, I don't know why, then I will may feel a bit awkward because I don't understand what does it mean. So now it's your job as a leader, doesn't matter who you are right now, to take this part and explain to them in metaphors, explain them in different parts, to convey them in the same time, again, keeping understanding and keeping the ways that you want to make sure you get to the point. If you need more budget, if you need to convey about the problem, if you need to explain urgency of doing something from whatever it is. And at some point, you also will need to do active listening because you did something and now you kind of selling because you want the budget, you want more people. So you need to know how to close your mouth, keep the pause. You already did your work, don't oversell. You gave them the ball. You mentioned about team sport. Give them the ball. Now wait. We have this idea in the industry in general. We need to be very empathetic. We need to show empathy to people. But wait a second. If I don't have the curiosity to care about Matthew as a human being, it means I'm not even enabling my active listening skills to listen to Matthew. So therefore, for me to get to empathy, I need— I'm a few steps before that. So now we're coming to job security, why people leaving, why people saying my boss is bad, I don't like the place, many, many different things that in a way related to skills, communication, human being, teamwork, and being in a place where you are working hard because we all working hard in our industry, but you also remembering that sometimes time to stop and have some fun as well.

So you're talking about many different skills, right? Obviously communication, and there's leadership, and there's empathy, relationship building. There's all of these different things that surround a lot of those soft skills. What would you say are the most important of those soft skills in cybersecurity specifically?

Hard to say for one person because even cybersecurity is 55 different types of work. You could be pentester, you could be somebody doing professional services, you can be a GRC consulting person, you can be a CISO, you could be trainer. So it will depend what you're doing. I think there's some fundamental in general that apply to cyber. One is curiosity. If you're not curious enough to even go and learn something, because one part we all can agree in cyber, it changes all the time. If you, you know, I don't really care that you did cabling 15 years ago. I did cabling 15 years ago. I respect this part. Not applicable anymore. In my resume, I used to say I understand RS-232. Serial and parallel communication. Great. Don't care anymore. Okay. I don't even care that you understand how to do RJ45 cables. And I, if you know that, if you don't know layer 7, like OSI 7, it's okay. You can probably put in a ChatGPT note in a second because something just changes in the last 3 years, like the entire idea of AI and LLMs and how going to change our industry as well. So we have many, many changes, but I still want to answer your question. Don't worry, don't worry about this one. So curiosity is one part that, okay, can I learn? Can I understand there's no job security? I need to continue learning and continue evolving. Second, it's probably one of the fundamentals that we are afraid and we're lacking— vulnerability. Able to show vulnerability. And it's come in different ways. One, asking for help. Guys, I'm stuck. I don't know what's happening. I'm not gonna be the cowboy. Until something really bad happening and then it's too late. I actually want to ask for help because I don't know what's happening. I'm gonna ask you to repeat yourself because I didn't understand because you were talking too fast or your accent, Russian-Israeli, is misleading and I didn't know what you're saying. This is hard. Like, dude, what are you saying? Can you please repeat yourself? Again, depends how you're saying. Hey, Evgeny, I I didn't really catch this. Can you repeat yourself? This is showing vulnerability because you kind of showing somebody else they're not doing something and you showing you that you don't understand. Customers should be able to ask vendors, this doesn't count. This is not something I understand. Your approach not working for me. Maybe working for somebody else. Vendors should ask customers if there's a better way to present to you. Are you going to actually buy whatever we sell? This variety of different things. A person should be able to come to the manager, show vulnerability, and say, guys, I actually do need to leave earlier because I need to put my kids in daycare. I will do the work later on. I'm not going to create excuses. I will figure out how it's done. And this is many different parts that are related to vulnerability that we are afraid to open up because you really don't want to get burning on fire.

Got it. You know, when I think about all the soft skills and all those, you know, all those different disciplines that have to work together and work really well together, you know, I would say, and I love yours, right? The curiosity, the constant learning. Absolutely. And, you know, the vulnerability and keeping your ego in check. You know, for me, I'm thinking it's gotta be communication because our industry is tough. It's convoluted, it's ambiguous, it's constantly changing. If you can't communicate, each person can't communicate well, things are going to get dropped, they're going to get missed. You're going to— it's going to be poor efficiency, poor effectiveness. So for me, it's always been communication is super important. And then the other one for me would really be around, can you role-play? And this goes back to empathy, right? Because I want my security people to put themselves in the shoes of the product developer. And what are we asking them to do? I want them to put themselves in the shoes of the end customer. Are we really going to ask them to have a 27-character password?

Really?

You know, I mean, and also, and this is the ugly one, put yourself in the position of the attacker. That wants to undermine our environment, that's maybe motivated by personal financial gain, that has a certain amount of resources, that, you know, wants to do this. And with that level of creativity and empathy, right, you will gain interesting insights that will be of value to everyone. And that's not something you're going to learn out of a technical textbook. That doesn't, you know, you don't learn that when you're programming ACLs on a firewall, right? These are different, different aspects that I think are paramount to long-term success.

So you mean I cannot learn how to ride a bicycle by watching videos on YouTube?

No, you gotta skin your knee. You do. You gotta get on that uncomfortable seat, try and pedal, feel the fear, right? And you're gonna fall down. I told my kid, you're gonna fall down. Just deal with it now. Deal with the fear before you even get on the bike. Everyone falls. What are you gonna do? You're gonna get back up and keep pedaling. Okay, cool. And my kid said—

You brought something interesting. You brought fear. So let's talk about fear because one part, I brought my ideas, you brought your ideas, and I agree with your ideas, but we have different views in a way and we're different people. And I think it's great. This is why we have such amazing people, because everybody provides their ideas. And then you mentioned fear, because you mentioned to ride the bicycle, you're gonna have some fear. So let's connect this to communication. When you're gonna start communicating with your peers, with the customers— no, no, we're gonna communicate with the attackers, it's a different story— when you're connecting with people there's going to be a chance that not everything goes as you want. People may not understand you. People—

if anything goes the way you want, it's a win.

Yeah. People may get confused and you will be scared. And you brought an important point. It's okay if everything— some— not everything— it's sometimes stuff doesn't go your way. And yes, your ego, you may become a bit vulnerable, you may be going to be not happy. It doesn't mean you should stop. You should continue with baby steps to understand how to communicate. And if you're still having a hard time to communicate, because you have many people behind the computer desk that are very, very smart, and they say, we hate people who like computers. You probably heard this many, many times. This is why I'm doing what I'm doing. I am a DevOps, I'm programmers because I don't like people. But at the end of the day, they have to communicate. So definitely, definitely push yourself a bit tiny out of this comfort zone because there is a lot of things that will happen that you don't know how great they are. And yes, you're going to have a scratch here, scratch there, but on the greater level, it will be great. And if you think about something small and fundamental, what's the difference between fear and excitement? With excitement, you know the outcome. With the fear, you don't know the outcome. Can you connect between two? It looks like camera is going nuts. Can you connect between two and say, oh, I'm not actually scared, it's indication of my body that something exciting may happen. So yes, there's one potential opportunity or two that the outcome will not be as I expected, but there's much more, it will be great roller coaster. You know, we all afraid and excited at the same time.

So you touch on an interesting tangent, and I kind of want to go down this rabbit hole a little bit, right? We talk about fear and our industry. It's no surprise that it is stressful. There is a high degree of ambiguity and chaos inherent to what we do, and we don't have full control, right? We have to deal with sometimes unknown attackers who are smarter than us, have more resources than us, may even know our environment better than us. And we're having to deal with those as adversaries, intelligent adversaries. That creates a lot of stress. So, you know, what kind of soft skills, right? Do soft skills play a role in managing that, in being able to adapt to that? In protecting yourself from that? Do you need soft skills to survive the stresses of cybersecurity? What do you think?

It's actually a chapter in a book about burnout. And when I was writing the book, my editor asked me, like, "Evgeny, where is burnout and soft skills?" And the way I explain is, think about that. The chapter name is "Being Present." If I'm an amazing human being, I'm very smart, I know how to communicate, detail-oriented, know how to do time management, But I wake up every day with a headache. I, after 4 or 5 hours, I cannot talk because I'm so disappointed. There is a lot of stress in my life because of whatever it is, kids, spouses, whatever. I'm not present. I cannot use my amazing skills because I'm not present, because I'm frustrated. And this is why we basically eliminating all the knowledge and all the soft skills we can use, these building blocks. And the idea here is the same that we can recognize that we can translate fear to excitement. We should able to recognize that we need to do maintenance to ourself. The same as you take the body, uh, the car to periodic maintenance. We're not waiting until everything break down and have a check engine. We can understand ourself better. This could be, okay, I don't need to work 12 hours a day, 6 hours a day. Because I'm not so productive. I may need to do breaks at least in between and go do push-ups, go for a walk. Recently I comment on post on LinkedIn that I wish CISO will take care of themselves more, they're gonna be less burned out. Can you do a walking meeting? Can you be on a call and just walk around your house from time to time? Because this meeting is just, you don't need to be on a screen. Can you go outside and go stretch? Can you eat a bit more healthy? Can you do many different things to take care of your body? Basically quality versus quantity that everything else will be enabled. So think about we have soft skills that we use. We, we have places where we use soft skills and we enable soft skills. So taking care of your body from a physical perspective, nutritional perspective, mind perspective, is enabling us to use the soft skills. And there's places where we use soft skills. So for example, being on video right now is you and me, is this soft skills? Not really, but it's a place where we can use soft skills. And because majority of our meetings happening over video, I need to adapt my soft skills for video. To like almost like levels on the Pandora box. Yeah.

So there are many technical, very, very technically oriented and minded people, and soft skills are definitely outside of their comfort zone, right? They're happiest at a keyboard, you know, at a prompt, whatever, and not necessarily around people. Talking to people. They want the minimum, most efficient communication as possible. Tell me what you need. I will deliver it. That kind of thing. For that audience, what are your top 1 or 2 selling points in how soft skills will help them succeed in their career?

It's a good question. Because if I just tell them, oh, you should go more networking, you should go do speeches there, tell me like, no, no, no, thank you. It will— it's— in this case, we need to understand their motivation and their hobbies. I will dive in to understand more about them and what they like to do besides work. Yes, they're going to be certain individuals are going to say we only like to do work, but majority of them like to play video games, majority of them like to play board games, majority of them like to do other hobbies potentially being airplanes, whatever it is. And what you can do is to dive in to understand, okay, what do you do after work? How do you like to spend your time? And play back to metaphors on this part to explore the horizon. Hey, if you do XYZ, if you talk more to people, you're able to meet people that are related to your hobbies, meet other people that are going to get you achieve your goals. And the goals could be again outside of work or even inside work. I will definitely, definitely would like to push them in a nice way to present their ideas eventually. You're doing an amazing work here with XYZ. Can you do lunch and learn? I want you to show the other people how shiny you are. And it will take time because people will be scared, but I think deep inside, majority of us want to get recognition on the work we're doing. We can say, okay, it's going to be money compensation, okay? If you do this XYZ, you're going to be able to make more money. But if we build them small baby steps to do, hey, can you present at Lunch and Learn to our small team? What do you do? And guide them, definitely not just say, no, no, no, this is not working. Guide them, explain to them to smoothly push them there. This small steps with mentoring them, they will eventually get there. I strongly believe that in majority of the cases this will work for people. Of course, use case was use case. Sometimes somebody will not want to do this, but if you find the correct hook to the person, you are able to get to them.

And I agree. In my experience, I've seen the same thing, right? In talking with those people— hey, I don't want to talk to people, I just want to Great. But, but don't you want to work on the cool projects? Aren't there? Don't you want to work on the next technology? Well, yeah, of course. I mean, I'm great. I'm great. I want to do that. And I said, well, until you can communicate your skills and your talents and showcase that in ways that people that aren't as smart as you, probably your manager, right? In ways that they understand. They're not gonna position you for the next project that you wanna be on. And the person that can communicate well their skills, even if they have less skills than you, but if they can communicate it well, they're gonna get the next cool project. They're gonna get that promotion, right? And in the relationships that they build, when they run into a problem and they know they need help, if they've built the rapport, they can pick up the phone and say, hey Sally, or hey Bob, I'm stuck, I really need help. And if they know you and they respect you and they've worked with you, they're going to, oh yeah, hey, let me drop what I'm doing, let me help you, sure. Whereas if they don't know you and you haven't built that rapport, you're just another request and they'll get to you when they get to you. So that type of soft skills in building relationships, in communicating, right, really can help your career and can help you deliver the very best you can. So I agree with everything you're saying. Everything you're saying.

Couple of ideas here, people listening to us. I remember I was managing an individual, it was about 2 years, and we kind of dive into some of the ideas, what the person does outside of the work on one-on-ones. And then I asked him to come to present to me to a customer. I was not sure how it's going to be. We did a bit of trials. He was okay, one-on-one. And we come and he's doing an amazing job presenting. And I'm like, wow, I didn't expect this. Like, this is phenomenal, like completely. So we dive in later on. I was like, hey, I didn't expect exactly this. Then I'm learning that I actually didn't know enough about this person because this person is playing D&D for the last 10 years, and he's actually one of the guides that running the games with his buddies. And then I'm understanding he's not communicating with people at work because they don't share this hobby, but the people that share his hobby, he's totally fine. And he was presenting on part at work, and he realized he need to do, but as a presenter, he did a very good job. He was very calm. There was not a lot of ums, not a lot of filler words. He was able to communicate. He was able to be passionate. Oh, okay, this is very interesting. I didn't even think about this part there because you didn't dive into this part. And some of the recommendations I want to do to people here listening to us, when you want to present and build rapport, build a connection, build impress, you can do a bit more research. And this could be by talking to people. This could be potentially to understand on LinkedIn, asking other people what are the hobbies, what are the interests, what people like to do, what type of people they are. This This way it's going to be easier to connect to them. And I'm not talking about fake connections. You do want to be curious and genuine that you want to talk to this person.

So you mentioned recommendations, and I want to dive into this from 3 different aspects. And the first aspect, from a manager's perspective, talking to the managers who are watching this, how should they be promoting the growth of soft skills within the group that they oversee? What would you recommend?

I think number one is when you do one-on-ones with people, I hope you do one-on-one with your people, is to dive into understand the communication style. Understand the idea how they learn, how they consume information. Do they like to read? Do they like to watch? Do they like to listen? Do they like to touch and play? This will give you an idea what type of people they are and how they consume information. Inquire, did they ever present their ideas to people before? Maybe it's part of school, maybe part of university, maybe it's in a different job. So kind of understanding more about who you have and how they learn. Why? Because then we bring the next step to lunch and learns and let everyone present about something. And here, depending on the maturity of the group, you can say present the work you're doing, the type of project you're doing. If you see it's too much for them, they're shy, then this is kind of the first conversation. Talk about the hobbies, talk about the stuff you like. Hey, Matthew will teach us today about how to sharpen knives and how to work with different type of knives, something Matthew would like, and will teach other people. And this has come naturally because this is what you like. So we do lunch and lunch to learn something, usually involve food. If it's remote, you can figure out how you can make it as well. Maybe order some pizza for people. So start building this part. Start understanding this part. Ask people what they want to learn. See, in some cases, definitely, definitely, if you have the options for yourself, go and explore Toastmasters. I think this is the best money for the training you can pay. I'm not affiliated with Toastmasters. It helped me a lot, but for the money you can pay, it's going to bump you to the next level. This is one part. Then we spoke about not being scared, but the part important is learn how to relax and how to get ready to present and communicate. Basically, learn how to understand your body, maybe do some breathing exercise to calm yourself down. Because when you calm yourself down, you're gonna be more relaxed and you will focus more on the presentation, on your ums and ahs, on what you're trying to say. And if somebody told you about removing ums and ahs, the filler words, I want you to suggest as recommendation Don't remove them, replace them. Replace them with pauses. Yes. And there is a small trick here. If you not relax, you're gonna pay attention that you're not relaxed. You're gonna be focusing on being stressed. If you learn how to relax, you remove this interrupt, and now you can allocate part of your CPU to watch for ums and ahs. And just do a pause. Somebody actually recommend me, before you want to say something, just take one breath.

Take a breath.

It will give you the space.

Yes. So, and, and, you know, in, as a manager, right, and I've, I've managed lots of technical teams, um, and, and tried to promote, uh, in, in all cases, the soft skills. Asking somebody who's very technical, who's an introvert, very shy, to get up and speak. I mean, that's a big step for many people that they're just not ready to take. And I've often come in and said, how about a half step? Instead of standing up and presenting to people, what I want you to work on is during that staff meeting, ask a good question. You're not presenting to the group, but formulate in your mind and work on simply getting your voice out there and asking a good question. And I found that at least gives them that half step. Oh, oh, I don't have to stand up. I don't have to present. I don't have to do— oh, I just have to ask a good question. Well, yeah, I'm always thinking of good questions, right? But I'm too shy to say it. Okay. Get over that hopeless ass, because smart people are really good at tearing apart other things, doing analysis, having opinions, asking difficult questions, and it benefits the group too. So, you know, getting people to just take that half step sometimes can get them down that path of growing their confidence and their communication skills for the benefit not only of themselves, but the entire group as well.

So continue with your idea. When you're doing your team meeting, it's okay to ask what your plans for the weekend.

Oh yes.

What your plans for the holidays.

And that's non-threatening, right? That isn't, I'm questioning your technical skills or your work product or anything else. That's, you know, that, that's a softball question, right? To, to kind of open the lanes of communication, get that relaxation that you're talking about. Allowing confidence and again, letting them hear their own voice. So many introverts don't actually hear their own voice in a crowd or in a meeting. It's foreign to them and it's uncomfortable.

Wait, wait, wait, wait, wait. You've been recording for a long time. How long it took you to not hate your voice?

It took me 8 months. I can't watch my own podcast. I can't, I cringe. I just, I can't do it. It's so, you know, and I, I don't think I'm the only one. I don't think so.

It takes time. It takes time. I do want to provide also recommendation for people who want to take it to the next level. And it's back to the team meeting. Once in a while during team meeting, this is actually from Toastmasters, do an exercise. We'll give you question and you have to talk about this question, but there's a time limit. Now we not just want you to talk, but you want to be concise and to the point. You have 1 minute to explain to me what's cloud, explain me what's IaaS. You have 1 minute to explain to me why I cannot use CD-ROMs anymore. I don't know, I'm just making stuff up right now, okay? But whatever it is, it requires you to think on your feet and you have to be concise. I only gave you 1 or 2 minutes. And it's teaching you to actually explain your ideas in a shorter form. Why it's good later on? When you later on talk to upper management or somebody ask you an elevator pitch about what you do or your company does, it help you to formulate your ideas quicker and not repeating yourself because you have a limited time.

I love that exercise, right? Because being concise is really important when it comes to communication. There are almost always some kinds of time limits, whether you're in an elevator and you have 20 seconds or if you're in front of a crowd or on a podcast. So, okay, so the next aspect, right, in practices is for people that are looking to get into cybersecurity. Maybe they're in a degree program or they're in a certification program or they're in high school just thinking, "I really want to get in there and go after hackers or whatnot." What would you recommend from a soft skills perspective for these people looking to get into cybersecurity?

Funny enough, I actually was presenting to a bunch of students a couple of weeks ago, about 90 of them, and I realized that it's very hard for them right now. We spoke about not liking our voice. Majority of the interviews are right now done over Zoom, Teams, Google Meets. So what I recommend to them, nail down your home office. Think about that. You're going to be on camera, you're going to have a background, you need to have some lighting, you need to have some camera, you need to know where to look, where is the camera located, and not to the screen. So this is number one, understand the idea of how you're going to be interviewed. Second, definitely learn how to relax because you want to focus on questions and not being scared. Third, record yourself with this amazing device that we hate sometimes and analyze your watch— oh, watch— your speech to understand what you can improve when you're communicating from Philip Ross's perspective. This is like kind of technical stuff. And I even recorded a 1-hour training for this on all the small aspects to help people to nail their first interview. But later on, when you want to move— not even later on— when you want to understand where you're going. I'm a big proponent of the idea of not just go on Facebook and ask, what should I do? And you have to learn to become a pentester. Bad idea in my mind. Understand the qualities you already have. Understand the type of person you are and what you will like. Maybe you're an amazing project manager or you know how to run projects. You can be project manager cybersecurity. You can be potentially product manager later on. Maybe you like to consult to people, not right away, but later on. So understand your skills and then find what will work for you in cybersecurity. And in many cases, the communication part will be paramount to your work as well.

I love that concept. And that kind of leads me into the third aspect. And that's for people that are currently in cybersecurity, right? What is the one thing as they, you know, walk away from this podcast, what should they do? Should They start off by doing a self-assessment, how my soft skills are. Should they focus on just one aspect and go, oh, I really need to work on my speaking skills? Or should they ask their coworkers and their peers, what should I work on? Right? What do I have difficulty with? Um, what, what should they do?

So what do we do in cybersecurity when we start something new? We do gap assessment. So we check what's happening. So yes, definitely do a gap assessment to understand about yourself. In the book, in the end, I have something something called SSDP. It's a soft skills development plan that helps you to learn soft skills 30, 60, 90 days, almost like a system. But you want to understand first about yourself. Second, you do want to ask your buddies about yourself. Do you talk at meetings? Do you interrupt people? Can you actively listen? Are you shy? Not the yes-mans, the people that actually tell you what's happening.

Your real friends, the ones that will tell you, yes, you have something on your face.

Yes. Third, See if you can find mentors. Not one, maybe few mentors. Maybe one mentor will help you with speech. Maybe one mentor will help you with presentation, with active listening, with whatever it is. It's okay to have few mentors. Definitely build some kind of a system or a progression what you want to do. Important part, this is not like a New Year resolution. You want to find somebody that will be almost as a check, as a check person that you can go tell them, hey, I did my homework, I did that, I learned that. That's somebody you can be as a validation that you're doing your homework and you're progressing. And not less important, soft skill is not something that only applicable to work, it's applicable to your life as well. And it means you can practice soft skills when you're not at work, when you're buying groceries. Try to have a conversation with a cashier. These gentlemen and ladies standing there for a long time, and if you can make them smile, if you can find the hope to talk to them, you made somebody's life better for a day, and you did your homework as well. Don't always get stuck in your phone when you're standing in line. Maybe look left and right and start a conversation. There are many opportunities to practice communication and talking to people And you will be surprised where it's going to lead you to.

Okay. So last question, final question, and I got to set this up here, right? We've talked about how soft skills is really important for cybersecurity teams. So for the board, for the CEO, for the C-suite, right? How would they What would they see in their security department if soft skills were underdeveloped? What bad things would be those telltale markers that the CISO or the director of security is not fostering good soft skills within the team?

People afraid to speak their mind. If you see people not speaking, It means the atmosphere is not there. You know, the culture is not there. People maybe don't want to express themselves. In the same case, you want to understand, ask people, hey, guide me what was not working. Or later on, I'm going to guide you. So this entire idea of I want to be guided and I'm going to guide you as well, something you want to understand. There should be a way. Now, some people want flat organization. Some people depend on the size of code. Some people want different hierarchy, but it should be a way to understand there's something happening on the bottom that doesn't lead to you as well. There is many movies in Hollywood when the CEO is trying to be the simple worker to understand what's happening. Basically, you want to understand the culture of the company, how they communicate, how they solve problems, how do they work under crisis as well. We spoke before about communication during— Yeah. Incidents, whatever it is. So this will give you an idea what to do. You know, as I say, so do incident response tabletop exercise, understand what's happening, not just how they solve a problem, how they communicate, you know, different to the problem.

You know, it's, it's kind of funny, um, when you look at a football game, a soccer game, right? And if you look at a professional team It's a beautiful thing to watch. Everything is coordinated like a ballet and they're communicating verbal, nonverbal, and the ball's being passed and things. And it's a work of art. And yet if you look at a bunch of 4-year-olds playing that same game— Cute.

But it's cute.

There's no communication. It's just a herd that are responding to everything. And if you look at a cybersecurity team and I do assessments and I, you know, and I go in, And I just see a bunch of responses that are just a herd of disorganization that are chasing something. I know the soft skills aren't there. Whereas if I see confidence and communication and collaboration and efficiency and things are getting done, and sure, there might be delays and there might be a little chaos and you've got an opposition. But they're working together, soft skills are there. You got it. You got it.

You know how to pass the ball to each other and the other person expects that the ball will come to them as well. It's not gonna be a surprise to get it in the face.

There's a plan and there's communication and there's leadership on all these things come together to make something beautiful and effective. And if you want a world-class cybersecurity team, you can't just have the best striker in the world, right? You have to have that communication, the soft skills, the teamwork to leverage everybody in doing what they do. So very, very important. Very, very important. Avijit, again, thank you for coming and chatting with me. You're the author of the new book, Architecting Success: The Art of Soft Skills in Technical Sales. Ed, you've published several, and you've mentioned some of them, several soft skills training podcasts. And I'm going to put those links in the description notes below. So please take a look at the book, at those training videos. It'll help you. Let us know what your comments are. And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. Thank you much.