Taxonomy of Cybersecurity Roles & Responsibilities with Deidre Diamond

Welcome to Cybersecurity Vault. I'm your host, Matthew Rosenquist, cybersecurity strategist and CISO. Today we're gonna be talking about the chaos and challenges when it comes to the inconsistent and often changing, confusing taxonomy of cybersecurity roles and responsibilities. And this impacts everybody in the industry in one way, shape, or form. People coming in, people that are trying to change roles, as well as the organizations looking to fill roles with quality people. And there's tons of problems: inconsistent titles, misaligned responsibilities and roles. We've seen job positions open for architects when the company is really looking for a CISO, or posting something as an analyst, and yet really they're looking for an engineer, or a risk specialist, but it's really a network person that they're looking for. This causes all sorts of problems, again, for people trying to get in the industry and trying to figure out where they want to land, as well as all those companies out there trying to get people in the door. And there is several million open positions right now that need to be filled. So this creates a, well, it's a terrible barrier, right? And there is really no maturity around there. We're going to get into that. And today we'll be talking with Dedri Diamond. She is the founder and CEO of CyberSN, which specializes in matching cybersecurity professionals to, well, the needed positions. Dedri is also very well known for her leadership in opening and promoting the field to women. So she's been a very important player in that role. So I'm hoping to talk a little bit about that as well today. Now, today's podcast is created by Eclipse, who is a provider, really an elegant solution, elegant capability to secure data in transit across insecure networks between untrusted endpoints and cloud instances. So welcome, Deidre. Thank you for coming and talking with us.

Oh, it's great to be here. Anytime I can be in the conversation of chaos, which is a great word you used, it is so what's going on. I have to show up and help because I have good data for you all today.

You could be the queen of chaos. I've known you long enough that I'm comfortable in saying that and saying that it's a good thing.

Yeah. Yeah. You know, it's funny. My whole life, people have described what I'm able to do is manage chaos. And turn it into goodness. So, I like that. That's an operational mind, right? Organizing things. Yes. It is.

It is. And speaking of your history here, before we dive into the topic, you know, I find a lot of people in our industry, we go into it, it's not an easy industry, but there was a moment in time, there was a spark or something that motivated them to get into cybersecurity and not abandon ship quickly. What was that moment for you? Why are you here in this industry?

Yeah, I'm here because I worked for two serial entrepreneurial men who hired me out of college as a criminal justice major and a sociology major, double major. And they put me into tech sales right out of college, which was staffing, by the way. Staffing is sales. You have to sell opportunities. Sell people on getting out of their own way of having challenges with each other. That being said, I did 13 years of that and then those founders owned Rapid7 and they were selling the opportunity as the first Vice President of Sales. And I thought, "Cyber?" It really intrigued me, right? This is 2007, so a long time ago. And I said, "You know what? I'm in. I'll bring the inside staffing sales model to software and go go take this leap into cyber. And I just fell in love with the community. I mean, I'm a social servant. I thought I was going to be a criminal attorney, really got turned off in the process of doing so and landed with these two men that I worked for for 21 years, thankfully. And when I found the cyber community, I thought, oh, this is my community. And so here we are.

Well, we are better off in having you. So thank you for diving in and sticking with it. I've known you for quite a while and you're all over the place and helping in so many different needed places. And one of those places obviously is this challenge with the roles and responsibility, that whole taxonomy or lack thereof. From your perspective, what are those challenges around that space and the detriment that this ambiguity is having?

Yeah, yeah, yes. Luckily for me, everything I'm doing all ties together that and, and, and really matching to jobs, whether it's entry level or the C-suite or anything in between, right, in cybersecurity. And so when I founded CyberSN almost 7 years ago, the founders had retired and it was time for me to keep the, the, the story going. And there was many of us that wanted to still create. And I thought, well, nobody's paying attention to the cyber space in terms of talent. Every time I go somewhere to a show, people are telling me they need people and this and that. And I thought, let's go do that, everybody. Well, the big smack in the face leaving talent for 10 years and going into software was coming back into particularly cyber, the complexity of matching. I mean, Matt, I went from a 5-day sales cycle of matching IT and software professionals to jobs, literally in 5 days we'd place them. They walk into our office, we'd have them in 5 interviews in 5 days and you're placing them, right? To 90-something days when I founded Cyber Asset, I was like, oh my gosh, this cost of sale, I cannot, I can't build my army on this type of cost of sale, you know? So that's where it happened. That's where the taxonomy solution started for me, which was I can't make the kind of money that needs to be made to employ the people I employ if I don't figure out this cost of sale of matching.

So, where's that disconnect that causes that delay, right, of a good match?

Yeah, so here's, we got a couple of things going on, right? So, first and foremost, we have that cybersecurity is super new. And cybersecurity professionals should be reactive and proactive and specialized and generalized and achievable, unachievable is going on, right? In terms of a cyber professional does everything, which is sort of how IT started. I mean, I'm old enough to say that I got into the business in January of '94. And I remember IT being very similar back then, one person doing everything, right? We're in that, and we've been in that mode for a while in security. We're just starting to see more specialization. But really it's the maturity thing that you talked about, for sure, that's a part of it, and the complexity. And you know, I think there's somebody out there who brilliantly said, we don't use electrical engineers to build bridges, and yet we expect security engineers to protect, to defend, to respond, to remediate, to know, you know. To handle privacy, right? Like, so we're in that. And then the other challenge that we have is that over the digital era of the last 15 years, content has become free to post, and therefore we've become lazy. Meaning, in my day, I would spend $5,000 in a Sunday newspaper for an ad the size of a little tiny paragraph. $5,000, that's like $15,000 now, right? And because this is the '90s and you got it one shot on Sunday and nobody saw it again after that because there's the next day's paper and the next, right? And so you made sure your job was budgeted, it was ready, you knew exactly what people, the person was looking for, like you, the content was nowhere near inexpensive. Now you can post an ad and you can leave it up for a year for a couple hundred bucks. In like every channel, right? So you put the lazy piece that content being free has given the gift of, the gift, and then the complexity, the lack of maturity. And really the third piece is sort of our recruiting, you know, how we all, you know, look at finding jobs or filling jobs as an industry of humans. It's a broken system, It's a completely broken system.

What about the challenges with people moving so often in the jobs? Does that also add a certain level of complexity? I mean, back in the day, right, you would join a company and you would stay with them for many, many years. And yet in cybersecurity, you know, your seat isn't even warm before you're already being, you know, headhunted for the next job in the next company.

Yeah.

Does that— is that a good thing in the industry or is that something that's adding to that chaos?

Yeah. So, you know, people moving jobs isn't because they're, you know, because they want more money. Right. So like if you can recruit somebody out, it's because you're not caring for their career, period. That's it. It's the only reason I can do what I do. And unfortunately, that's literally statistically, that's 89% of the population. Which is just mind-blowing. So, when I think of retention, I look at— there's no succession planning. Nobody has what I had when I walked into, you know, doing business with those two gentlemen and the thousands that have followed us. You know, that whole story is still at Rapid7. It's called One Moose. They still adopt it today, Corey Thomas and the team, because it matters. It's a culture of hang together and build together and grow careers. And And so, you know, it's really— this is past security, this issue of retention. It really happened when the dot-com era hit. And when the dot-com era hit, all of us that were out there recruiting, you know, the companies that were hiring were telling us, tell them this is how you make more money. And it was how they make more money. So originally it started that way. And then it was, well, tell them that, you know, you're more valuable if you've seen more environments, in more different environments, because everybody was staying. No, people didn't move around. You know, prior to the dot-com like they do today. So, it's all a product of the lack of, you know, career development, succession planning that it doesn't exist really for cybersecurity professionals.

And, you know, it takes a certain amount of forethought, especially for the companies trying to hire in. And when I talk with them, you know, I say, you're trying to fill this critical role, you're having problems, and you're not seeing the fact that you really have two problems. Not only do you have to fill that role with somebody qualified, You have to keep that person, right? And that's a continual care and feeding to make sure that you're doing the right thing for them and you're not overburdening them or overworking them and you're treating them with respect because they will stick around unless that golden ticket comes their way. And you can never predict that, but you've got more than one challenge, right? Get them in and retain them.

Yeah. So, a couple of things come to mind when you say that. One is I have extreme sympathy for our security leaders who, again, are those people that are supposed to do everything, and so are their teams. And yet they're budget constrained more than I've ever seen a department constrained. And yet I also get it as a CEO. And I've got an incredible cyber team. They've been with me a long time. And I trust them, and I care for them. And yet when is enough, right? We all have, as CEOs, have to figure out when is enough, where is risk end or compliance start, and how do I feel about that as an individual? And there's a lot of unknowns that you have to learn. And so I'm lucky that my leader in security and their team are super interested in me learning. And we, you know, really talk things out. And I know most people don't have that environment, right? So, you know, I have extreme sympathy for these security leaders who don't have the money for succession planning. I mean, let's talk about what succession planning is. Succession planning means 2 people per position. Basically, right? I mean, that's what it is. So, you know, where's that money in security, right? We're putting it into tools and products and not people. And then the other thing is just, okay, so let's say you do have that budget, but if you don't get to use my services, which literally is like the only game that's only cyber, then because of, you know, if somebody else wants to go spend millions to build platform, you know, I'm sure maybe they'll, maybe they will, but I had to build a taxonomy platform, right? To match professionals because recruiters cannot speak all cyber. I mean, come on, it's ridiculous. And so anyhow, so not only are they trying to get these budgets, but they're also really challenged with not having recruiting services to service them. So there are my clients, and you see them out there posting all the time. Yeah, if you want to not fill your roles, don't use CyberSN. You know, but then there's the people that still have to wait 6 months that are my clients because internal policies, they've decided they want to try and save the money. Right. And so companies on average wait 8, 9 months to go outside. And then, you know, where are they going outside? And so, you know, there's, they're also restrained by just, you have to recruit these people. We have to know the marketplace. You have to know where is somebody probably at at their career. And if you're not as specialized on that market and you're not tracking and creating your database that way, and we'll, Good luck. You know, it's like a needle in a haystack.

Well, you know, I've seen throughout the years and even this year so many job reqs that again, they title them, hey, we need an architect and you go in there and no, they're actually asking for a CISO or they're asking for a risk analyst or a SOC 1 or something. That shouldn't be that way, right? I mean, we've had it for so long and yet, Why is this still a pervasive problem and how do organizations get around it? Why is it still that way?

Yeah. So, part of it, again, unfortunately, is people being lazy. And to all you hiring managers, I love you tremendously. And you can be lazy. You can go and cut and paste other stuff and throw it over. And I mean it because at this point we've been talking about it too long. That's the only reason I'm using lazy. But really the other piece is that traditionally job descriptions are made more like a profile that I'm looking for. And so these job descriptions don't make any sense because people want to make profiles of people they think they're looking for. Well, that's not a job description. A job description, as you can see at CyberSN.com, and you can build jobs for free and export them. I can't save the planet as much as I'd like to. So I'm happy to share what I've got. Is to say that what are the tasks and what are the projects that you need completed? So that's part of it is that we're making job descriptions based on profiles we think, you know, so I want somebody with 5 years of this. I want somebody with 2 years of this and they must have this technology or that versus no, no, no. What's the job? Like if you want somebody—

What are they delivering at the end of the day?

If you want a passive job seeker to even remotely, you've got a shot at them responding to that job. Don't talk about what you think they should look like. And, you know, talk about what your job is. And so part of it is that, and that takes time. Like I said, it's very tricky. A SOC analyst to one person could be 10 different profiles. And so that's why I built what I built. That being said, the other piece on titles is, is partially, you know, just people not paying attention and not taking it seriously enough and throwing stuff over. But the other part is HR having to work within these titles that they have inside their systems that, oh my gosh, you'd think that changing them is like Somehow it's the most disruptive thing in the world. I don't know what it is, but it's taboo, you know.

We don't have that job title. We can't create a new one. Right. Yes.

You know, and so, and then, so you're trying to force these jobs into these other title categories, which have to do with salary. And that's the challenge, right? The title, they are tied to salary bands and they're trying to fit within that. And again, we can't blame them. What are they supposed to be the, you know, know this?

They're not experts.

Right, so which is why I go back to this, you know, we have a broken job searching system. Like our job sites today are, you know, any job in the world, right? Like Indeed, ZipRecruiter. So there's no speaking to, you know, sort of a profession. You know, my website today does an okay job with it. It certainly doesn't do a great job with it. What I'm gonna be launching this summer is the marketplace that I am and that we are, meaning to one profession on careers and anything and everything that has to do with your career, right? And jobs is certainly a part of it, but everything— there's a lot more of it. And so we don't have that today. And like, I can't even search in my email and find the stuff I need on, you know, easy enough. Meanwhile, people are supposed to go search these big engine job boards and find the right job and match them. So I mean, it's just ridiculous concepts. I, I, I, we're doing it and flipping it on its head already, but, uh, you know, the marketplace will make it easier.

Okay, so from a job seeker's position, we've established that JobRecs, many times what they're going to encounter, not accurate, not necessarily reflective, may not have the right title, maybe a cut and paste for skills or years that, well, aren't real. I've actually seen, you know, requests for, hey, you need to have 10 years experience in this, yet that technology has only existed for 8 or 6. Really? You know, you know, I also see where sometimes organizations will put, we want this whole list of certifications, right? That's part of that profile in my mind, when in reality it's disjointed as compared to what they actually want the person to do. And it's putting up much higher, a much higher bar that's unnecessary. So as a job seeker, That's got to be scary coming into our environment, especially, you know, somebody coming out of college or getting a degree or getting a certificate and going, wait a second, so the job rules aren't accurate, the job descriptions aren't accurate, um, the expectations for years or experience may not be on par, and oh, by the way, my job may fundamentally change because this is constantly evolving. The threats evolve, cybersecurity has to then respond to that. So, okay, maybe I don't want to be in this field is the only thing that I can think of that— how does, how does it respond? And does that contribute to this massive problem of not enough good talent coming in to the industry?

Yeah, this is the part that makes me angry at this point. You know, when I first discovered it in 2014 when I founded my organization, I thought, oh, I gotta solve this. I'm, I'm— I, I gotta save my friends. Like, oh my gosh, there's somebody that never had to deal with this crud. Like, these poor folks. And then I'm like, once I got into it and really just, you know, constantly in the emotion of it, right? Like, a professional, if they truly do want to leave their organization, then that means they're hiding behind the people that they work for and with and not sharing that information. And to see them in that state for months and months at a time trying to find the right fit, it's awful. You know, who wants to lie and hide? Nobody, certainly not security people. You know, it's just disgusting. Number 2 is that, you know, the idea that a professional should only look when they're desperate for something new is also silly because career advancement, they're not being taken care of. And so, you know, these professionals are struggling with what is it, how do you be a professional in cyber? How do you grow? How do you move? Your career, what do I do? And so, yeah, it's maddening. And so, what I say to all of them is, you know, I'm changing that game and definitely make a profile on our platform and you're covert until you want to apply to a job. And our jobs are all based on the taxonomy of cybersecurity professionals. In fact, today, Matt, we launched the 45 job category update. So, we were at 35.

We started— You were at 35. I knew you were at 35. Oh, yeah.

45 went out like minutes before you and I are meeting, which makes me happy.

I've got to go take a look at that.

It's super awesome. You know, like it's only been one year and that's how much this has, you know, grown and specialized. Like IAM is its own functional role, right? DevSecOps is its own functional role. No longer are those, you know, security engineers, if you will. So anyhow, that released today. But the idea is that there ought to be, and certainly our marketplace is, the ability to see jobs at any time that, you know, that really truly you're qualified for. Because here's the problem. A cybersecurity professional can apply to all those jobs that don't make sense. They're gonna get called. They're gonna get, people are gonna wanna talk to them. That wait, do you know how many hours get wasted every time? So I'm not gonna tell a cyber professional, oh, just respond 'cause they don't know what they're looking for. I'm like, no, the opposite. You're just gonna waste all this time for the wrong jobs. Wait till, you know, do the things you need to do. Certainly join us. But, you know, there's so much wasted time. It's sad. Like hours before somebody figures out it's the wrong job and they've been speaking to the company multiple times, you know, not even close to a fit. It makes me crazy. It literally— oh, it's a national security issue. That's what I was going to tell you. Like, are you serious? We can't match the people that are protecting us to jobs. So then they go unfulfilled at their job and they're settling and then they get depressed and burn out. Oh, that's great. And these are our protectors. I mean, it literally makes me crazy. And I work every day, you know how hard, to solve this. It will be solved. We will solve this. I mean, come on. We solved a dating app. We solved it in marriage statistics, the dating app. You know, seriously, we did. They solved the divorce rates.

Maybe that's the next app, right, for cybersecurity? Swipe right, swipe left.

Yeah, well, it's not gonna be as that like that. However, the marketplace of searching and matching for jobs, we are we have solved and now it's about making it easier for everybody to know. But the bottom line is that is what it's about. It is about having a place that speaks only to what you're there for, which is careers and only cyber, and in your taxonomy of a common language so that we can get out of this mess. And that's really all it comes down to. You know, NICE and NIST have been trying to, you know, NIST to make this happen for years. Unfortunately, it's been, you know, lots and lots of spreadsheets and not the user interface. We've solved it truly, you know, which is why we're talking to them. To help. So it was, you know, professionals need to recognize that there are great people out there to take care of them. So if you truly aren't being taken care of right now and your career isn't being looked after, well then there are places that will. It's just, you know, going to be some work to find them, you know. And the job description does matter. Don't think it doesn't. It does. Most people, most cyber professionals won't—

If it's accurate, it matters.

Yeah. I mean, just the fact that they posted it and "it's ridiculous" matters. Like, who's gonna— you don't want to spend time talking to those folks. It's just, they're not ready. They haven't figured it out yet.

And so, we've got a whole bunch of players in here, right? We've got the new people coming in and, well, actually, let's take a step back. We've got people that are simply looking at cybersecurity, right? Maybe they're in the first couple of years of college or in the latter years of high school going, "This sounds really cool." and they're trying to decipher it. I was talking with somebody who was in their second year of college and they're like, I'm really interested in cybersecurity. Can you give me a listing of just kind of the roles and responsibilities?

And I had to tell them, no, I really can't.

I mean, you can go out to NIST and NIST has got, again, tremendous amount of data that you can grind through. Cyber Seek has some, a handful. Um, you know, NICE, uh, the National Initiative for Cybersecurity Education has some, SANS has some, but the simple fact is it's constantly changing. And when I was hiring people into cybersecurity, I would sit them down and go, you know, you're coming into a highly ambiguous environment. I'm hiring you for X, Y, and Z, and you're going to have clear goals, but just understand, I guarantee you in 18 months, 18 months Right? Either your goals are going to change, the tools you use, your objectives, something fundamental in your job is going to change, and it's going to be different. And expect that. Expect it. And so having static roles is kind of counterproductive because the moment you publish them, you published them today, right? They start to become antiquated because our industry constantly has to change. So, we've got those people trying to get in. We've got the people that are ready, right? They just graduated or have their certificate or whatever. They want to get in. And again, they're having difficulties aligning with finding those open jobs. We've got, as you mentioned, people already in the industry, already doing a role, but they want to see that career path, right? Because that isn't their dream job. We never get into our dream job straight out of the gate. They want to know what are the stepping stones I need to get to? And so they need help there. We've got the businesses that are struggling, including critical infrastructure, government, everything that's protecting our way of life. They need people, qualified people, and yet they can't get their arms around them because there aren't enough to go around or, and/or they can't articulate exactly what they need. And, you know, kind of underlying all that is the academia who's trying to fill the bucket, right? Trying to prepare the next generation of cybersecurity professionals not only to meet the need but to be successful with the right skills. You've got all these groups. What's our advice here? How do we help each one of these groups? What's your advice? Let's start off with the ones who think, gee, cybersecurity, Sounds like an interesting field. I'm in my teens. What would your advice be to them? Maybe a young girl just in the last year of high school thinking this is kind of interesting. What would you tell them?

Yeah. So, this problem and it is a big problem. That's why I'm saying everything we're talking about today is a big problem and they're all tied together, right? New people coming in is tied to succession planning. Where the hell are you going to come from? And by the way, with the way education is today, to make somebody a valuable cyber professional out of most educations that aren't really hands-on is years, right? So how do you do that with succession planning, right? Like, this is complex stuff. So I've been answering this question since the beginning. When I founded Secure Diversity, it was to bring women into the industry. And then I was faced with this shit show, as I call it. And so— I can't stress enough that everything that I've been doing in our brands of CyberSN and Secure Diversity is really the entire marketplace. And so now I'm launching it all digital instead of— we do so much services for this, right? So what does that person do, that entry-level person? Well, they've got to figure out, like, OK, are they going to be attacking, defending, privacy, data? Right? Development. What, what, where, where are they going to be in cyber? And just that process of how do I pick— because no professional is going to hire that person if they don't come with passion. And right, every one of you all say that word, right, about interviewing.

Oh yes. And so the day, that and coffee.

Yeah, exactly. I mean, it's super true. And so which passion are they gonna have and Which curiosity are they gonna have and how do they even know what they all are? Which is why, again, that taxonomy of the job categories, which is now 45, is so important. And in the career center of our marketplace that we're launching, we will have every one of those jobs defined, what a typical day looks like, what your life looks like, how you progress, how you move. I mean, I've been doing this, we've been, my services, I have amazing people that work at CyberSN, as you know, We do this, you know, as a service and it's not scalable, right? It's certainly not scalable. Or even in our events, our day of security events, it's like, yeah, it's great, but we need more. We need it for men too and all genders. And so, so the marketplace and career center, you know, I'm putting it all together and investing in that solution, right? But really, that's the first step. They have to figure out which one of these job fields and categories, right? And then it's like, okay, so now I know I'm interested in this one. What do I do? And that information— how do I get the education that I need? How do I get the certifications? Which ones do I need? All of that is going to be in our marketplace because it's all around me all day long. Can you imagine how many friends I have? Their kids, never mind their friends' kids' kids, never mind all my teammates' friends' kids' kids. I mean, my God. There isn't a day. Today, I've probably had 3 in my inbox from very high-profile cyber professionals. Can you help my so-and-so? No joke. Okay. So, this is all around me. Never mind me watching my nieces graduate, which is really what sparked me to help the entry level the most because nobody pays me for entry level, of course, yet, is my own family members, right? So, really, that's the beginning and the end, which is the education and then the jobs. Where, how do you, you know, one, one place for entry-level jobs and, and, and, and using the same matching that I use, you know, as our algorithms and such. And so, so we're for the first time going to be servicing that in this career marketplace CyberSN launching. It's a mess for these folks. In the meantime, they need to go to every meetup. You know, we publish that regularly as you've seen. Seen, the meetups, the, the events. Like, you got to go out there and meet people because nobody pays to hire an entry-level person. Nobody pays for our service. We give as much as we can to help, but it's really networking and what have you. And then in terms of the education side, the good news is one of the reasons why 35 categories went to 45 categories is the massive amount of, um, advertisement that has gone on in the last 12 months for cyber professors and teachers and educators. It grew tremendously, much like privacy did, right? And so that was really cool to see. But yet, we still see cyber fall under software engineering degrees or computer science degree, right?

We can't solve that right now just yet.

If we got— unless that happens and hands up— That's another show.

That's another episode. Yeah.

Yeah, we're not gonna get very far until those things happen, you know, and we're doing, you know, actual, you know, not the theory of cloud, but like, you know, practicing in the cloud with our Sims, you know, like those two things have to happen, you know, have to happen. And it is that this is a national security issue. We are defending against a diverse group of people. So, which is why I thought, okay, You know, my content's here for all genders. I don't care. But I specifically have to go out and socialize it to the women out in the industry because they're socialized to think it's not for them. So that's why I target them. And particularly, you know, high schools is really where we're going next. So right now we're 18 and over, but we have content for high schools. We don't get to them. We're going to start getting to them and hold these events for them.

That's outstanding. I mean, because the reality is we need more competent people in this industry, especially as technology continues to rise, right? We need to be able to protect it. Otherwise, we lose that trust and innovation then will suffer greatly. And we all love our digital technical toys and services. That doesn't go away. So we need more people. Going younger, obviously the right thing. And, you know, unfortunately, the history in cybersecurity hasn't been one equality. We don't have a representative amount of women. There's, you know, a lot of minorities that are not in there, and we need all those perspectives, all that experience, because the bad guys have all that benefit. They have a diverse background and very creative and everything. So we've got to solve this. We've got to make it easier to bring people into the industry, get them train to a point to where they can add value and then get them connected up, right? Crossing that chasm between the resources and those organizations that desperately, desperately need them. And then keeping that alive, that succession and career advancement and everything else.

Yeah. My team knows I'm fond of saying, "If I shall pass this planet having solved this problem for society," I will have done, you know, what I hoped I would be passing, saying I accomplished something great for society as a sociologist. That's certainly what I think about often. And that's how massive of a problem this is to me. And so, and yet, you know what, let me just tell you something. We've already solved it. Like we've got, it's all happening. Wait till this summer, the marketplace is here. Like I've been living, eating, breathing this content for 7 years making, you know, having to run the type of operations, you know, I like to run, which are big and powerful. And, uh, you know, there's no, we've already solved it. It's just a matter of, um, making it easier to absorb and not be services and be digital, right? More digital. And that's still, you know, it's a lot, but I saw stuff today. It's like, I'm so excited. It's ridiculous at this point. So until then, everybody's gotta do a little bit of the shit show, you know, uh, deal with the challenges and so forth.

So Deidre, academia plays a big role here because they have a great funnel to bring people into the industry, to be able to give them the skills and even tie into things like internships and opportunities for experience so that they can hit the ground running. And, you know, it's, it's a tremendous capability. What would you ask of big academia? How can they help close this chasm for the benefit of their students?

Okay, so number one, those that are already teaching cybersecurity, they have to balance their concepts and hands-on learning. Too much concept, not enough hands-on learning. Like, way too much concept, right? They have to partner with the commercial space such that they're staying real-time, like real-time, about what the tasks and the projects are. They can also stay real-time with my marketplace. That being said, they should connect to the commercial space in general significantly for that hands-on, you know, staying hands-on learning. Number 3 is that, you know, we have to back it— like I was saying earlier, it can't fall under computer science. The discipline cannot be buried in anything. It's its own discipline. And it isn't just technical jobs. There are plenty of jobs that are not technical, and there are plenty of jobs that are semi-technical. We call it hands-on versus technical, you know, like I would define myself as hands-on, not technical. And yet, you know, I can sit in a room and make decisions with technologists, right? So it's, it's, it's, it's that. And then we got to start younger. They have to be committed to getting to the younger generation And making sure that we're letting everybody know about these jobs. They don't know about the jobs. Meanwhile, you know, everybody's going to be in security soon, right? Like versus tech.

So, what about the bias that still exists in, well, yeah, I'd like to say just some small corners, but, you know, the bias for men versus women, or I mean, we've got a huge amount of underrepresented minorities. What has to change there? And do you think academia plays a role in that?

Well, academia plays a role in every job that's a good role, a good job, you know, like our jobs in cyber, you're making six figures when you're three years in, right? And so there's a socioeconomic barrier to our jobs without a doubt. And there are in any job of significant value of making money. And so this is a massive problem. It's gross and it is a societal problem. And so we've gotta get to those. Schools and make sure that they have the same access to cyber training as everybody else. And they need the same access to being a doctor or a lawyer or an attorney, right? Like, this is the problem that we have today in society. It's access to the type of education that gets these jobs has economic barriers. It's the main reason why I do I spend so much time raising money for the Day of Security event. It's because I need to put that money into training certifications for these women. And I'm not just talking for them to get in, I'm talking for them to excel throughout. I mean, this, this, you know, people that are really excelling, especially in the leadership roles, have major certifications that are expensive. So until that goes away, which I can't wait till it does, and I hope somebody takes that on, but for right now, I don't have time for that to, you know, to be, to wait. I just got to get them these certs and these trainings, right? So, uh, and that's what our, the money goes towards. We have a— this is, this isn't just cyber. This is a socioeconomic, massive educational issue that we have.

So you gave some good advice in regards to especially people looking to come in the industry, um, and even some of the graduates who don't really know what they're doing, right? Find, find that, that, that path that that something is going to drive your passion. But I know, and my heart goes out to many of them, they look at this chaotic landscape and they get scared, they get intimidated, and they start questioning either their technical skills or whether they have the right social skills or communication skills. And you start seeing them shrink and take a step back. You know, it just seems like a mountain to climb, a monster to slay. What advice would you give to somebody that's in that mindset?

Yeah, well, I mean, they got to get away from whoever they're interacting with in business as fast as possible because that's just horrible. Uh, so that's one thing, because whoever they're around that's more senior is not providing a good environment for them, right? Like, it's— they need to know it's not them. They need to know that it's whoever they're around, truly. And they need to find another spot immediately because that is self-imposed upon them. It is not reality. You know, today's world in tech and in, let's call it for sure, cybersecurity, you do have to have a level of intelligence, but it is not true that you have to be extremely technical. And so I would say to people in general, is if you're finding that the roles that you've chosen are tech— too technically challenging for you, and it's not just the culture that you're in that you need to get away, well then you're probably not in the right role. You know, there are, uh, like I said, there are technical and then there's hands-on where you still are working with technology and you still are intelligent. And yet to be technical in the sense of technical is a much different mind. It is an engineering brain. I do not have that brain. And yet I can be in technology, right? And be considered, maybe by my parents, technical. So, you know what I mean? Like that, that to me is they're in the wrong role or the wrong culture or both. And they need to look at both always because there is a place where that doesn't exist, where one will feel empowered and, and, and like what they're doing and learning. And while it may be challenging, it's also exciting and rewarding.

It can be very rewarding, right? And it sounds like— and, and I absolutely believe this— if somebody has an interest or a passion in cybersecurity, there's a place for them in the industry, right? And it doesn't necessarily have to even be in a cybersecurity organization. You might be in an in a product group or you might be in legal or you might be in HR, and yet you're still going to be working on cybersecurity. And so don't, don't be afraid, right? Don't back away. If you've got an interest and passion, move forward, put forth the effort and find that role. It is out there and you can make it happen.

Yeah, well, that's why the 45 Job Categories, I mean, has sales. I mean, I came up through sales, you know, my domain is sales and yet I have I run a tech company, right? So, perfect example, yes. Marketing, product management, and then of course legal and privacy. And so all of that is in the 45 job categories, and it is super important to understand that you may find one of those roles better fitting for you. A lot of people go into sales from being on the quote tech side. So SecureDiversity.org is the not-for-profit that I founded. It's one of the founding supporters supporters of the Day of Security event along with Lookout Software, another founding organization. The idea is that we showcase the 45 job categories. It was a lot less when we started this. In fact, when we first started it, it was really just the technical roles, right, and the AppSec, and OWASP was around and helping in the early days a lot, and they're still around, don't get me wrong. But, and so, and so this event is about two things. It's about bringing women into cybersecurity by showcasing the 45 job categories in the morning, share with them about all these different jobs and what they are, how to think about them, and then they get a full day to go listen to female or women speakers that are craftsmen, craftswomen in these, in these, you know, specific fields of cyber. So they get to go see their craft and share their craft with these women, right? And so both women get to present, get more experience presenting, right? Sharing their craft, give back, sisterhood type of concept. And then of course there's sponsors. It's a great recruiting ground. Traditionally we have like about 30, 35% come from IT. Many are just younger in cybersecurity that show up. You know, another 20-25%, and then the rest are truly entry-level, really would love— college, graduated, or maybe have been home raising kids, want to come back into the workforce. And so it's great recruiting grounds. It's a great place to show off products and services. You get a booth, you can, you know, share there. So really what we do in raising this money— so first of all, it's a free event. Nobody pays for it, never have they. We used to hold it at the Federal Reserve Bank. I love you all, by the way. And COVID transformed in-person for a while, but we'll get back to doing in-person and then we'll keep digital because we can have such a long reach. So it's just exciting to see this really grow. And, you know, look, this content is gender unbiased, right? I mean, this content is needed for men too, which is why the marketplace is on its way, but it's also content I have published lots of places. And so, you know, We have to go specifically target the women because they're not being targeted. They're being targeted to not think about cyber. Otherwise, this content really needs to be heard to everybody. And so—

So it's inclusion of everybody. You're including everybody. I like to hear that.

We'll record everything so men can watch. But again, the marketplace will have everything. But please get involved. We have another issue that we have not talked about. Today, which is that women are stuck in middle management. And it is a significant problem. And there is a lot of unconscious bias going on here, meaning what, you know, what skill does it take for a woman to get into the boardroom? And as a woman that knows and was in the boardroom very young and am the only woman in the room, it's a huge amount of EQ skills, but also it's a huge amount of the men that I work for believed in me and made sure that everybody took me damn serious, never mind I made my self-made sure everybody took me damn seriously. So there's, there is a level of men have to make an effort to invest in women and put them in those seats and recognize that and have the conversation that women don't interview the same. We don't talk about, you know, so that, that, that way that everybody interviews, which is just like some feeling, you know, uh, we have to get rid of that. And so women having an experience speaking and getting their voice is something that we do monthly. It's called She Presents. And we do it regionally. And I have so many great leaders at CyberSN that make that happen. And so that's going on all the time. And so please, everybody, tell anybody in your life to tell their friends. Because that's all it takes is to share these jobs with women. We're going to change the landscape now that we can do this digitally. I mean, who would have thought, you know, another silver lining from this disastrous COVID.

Yes, yes. And I assume there's also opportunities for mentorship there and, you know, building social networks for the attendees.

Yeah, well, you know, we can't do everything, but WECIS— I'm a part of the WECIS group and they have a killer mentor program. So we'll share that while we're talking. Together and the marketplace will have that. But this event, yeah, it's the people you meet, but that's the trade-off of digital versus in-person. When it was in person, everybody left with a mentor basically, or really good sisters out in the community that they can latch on to. I mean, it was amazing to watch the beginning kickoff when I'd kick everything off and everybody's sort of apprehensive and quiet and shy and alone. And then the end of the day, it's like buzzing in there and everybody's sitting with people they knew and spent the day with. It's just like, oh man, I got to do this more, which by the way, I was really apprehensive of doing anything that excluded men considering men run everything. And it really concerned me like, how are we going to solve anything without the men? But then my team convinced me and then I experienced that and I was like, oh, we need to do both always, men and then separate, because it really is powerful, really powerful. So the mentorship will come as a part of our information. And so that's important. So yeah, people speak, sponsor, and attend is the ask.

Well, outstanding. Hey, Daedre, always a pleasure talking with you. You've put a lot of light on and recommendations for the different groups trying to tackle this problem. And, you know, the lack of a strong taxonomy, you know, within cybersecurity, it does impact everybody from the people coming in to the people already entrenched looking to, change your careers, to all the companies that need to connect with those resources. So I want to thank you very much for your insights and your participation today, and I look forward to having another chat in the future with you.

I do too. I really appreciate it as well. Thanks for making this a real spotlight.