Fireside Chat w/Brian Lozada, CISO @ HBO Max

Hello and welcome to our fireside chat. This is the replay and you got here right on time. So thanks for joining and thanks for being a member of our community. We hope you enjoy the rest of the show. Good evening. Thanks for joining us. So look, we have a few quick ground rules before we get started. Rule number one is pretty simple. Let's have a great time. Let's have a good conversation. Let's have fun. This is the middle of the week. It's meant to be a little lighthearted. It's meant to be a little bit more engaging on a personal level versus a professional level. Although there are questions that might pop up around individual sort of professional life and the sort of blurring of the two. Because, you know, if you're at home, I've got a little sign in my house where it says home is where the work is. If you've been working from home for a long time, you know, that sort of will resonate. But yeah, look, let's have a really good, lighthearted conversation. If you do pop up on stage to ask a question, we ask that you please, please, please don't sell us on your product, your service, your offering or anything of that sort. Use that sort of sales pitch that you might want to have at a different point in time. You know, I know myself and I'm sure Brian and others, we get pitched all the time from different vendors. Let's save that for a different conversation. Today, let's learn about more about Brian and his journey. So I'll ask that you all respect that. And then if you're not following on Fireside Chat, there's a little green house, little green Monopoly house on the top left of your screen where it says Fireside Chat. You can click that and you can join the Fireside Chat Club. What it gives you, it gives you more access to see the calendar as to who our next few guests are. So we've got a lot of great guests lined up over the next few months. So if you want to see who's coming up next, feel free to join the club and you can sort of scroll through that. Everything else is free, right? We do this to give back to the community. Lisa Beth, did I hit all the rules? Lisa Beth has been standing there for me. So I appreciate her taking the helm and others. Did I hit all the rules? I think I did. You did. Just make sure we all have fun. Oh, you know what? I did miss one. I did miss one. One important one, at least for me. My comments and opinions and most of our comments and opinions are our own and do not represent our current or prior employer. So please understand that and respect that. So without further ado, I'm just going to go around the room. Brian, we'll leave you for last because it is 8.01 p.m. Eastern time. I'm Tomas Maldonado. I'm the CISO for the National Football League. Octavia, over to you. Hi, I'm Octavia Howell. I am the CISO for Aquifax Canada. And as Tomas said, my opinions are mine and mine alone. I would add, do not also represent my future employers as well. Russell, over to you. Thank you, Octavia. Great to be here. And I'm enjoying this last couple of years of not having to worry about speaking for anybody because I'm speaking for myself and my company. Russell Eubanks here, former CISO for the Atlanta Fed. Last two years, I've been running my own CISO practice as well. And just so incredible. And I always encourage everyone to put this on your calendar as a recurring reminder. There's always fantastic conversations and I always enjoy it so much. But Lisa Beth, over to you. Hello, hello, everyone. My name is Lisa Beth Lentini-Walker. I'm the CEO of Lumen Worldwide Endeavors, which is a compliance ethics and corporate governance consulting firm. And I like to teach. I teach law school in the United States and Europe. And I also am a huge fan of mentoring. And then I think I should just turn it over to Katie. Hi, everybody. Good evening. I'm Katie Hanahan. I'm a VP of Cybersecurity Strategy for a boutique SI out of Chicago. I'm also a VCSO and run our VCSO program. With that, I'll turn it back over to Tomas and Brian. Thank you, moderators. Thanks for introducing us. So, Brian, we've got a great group of moderators on stage ready and waiting to ask you questions. So I will give you an opportunity to introduce yourself. And for those listening in the audience, if you want to ask a question while we're sort of going through this first part of the conversation, there's an option where you can click, I think, on here. You can click insights. I think that's the option. And you can sort of ask your question and post that. And we'll read that and try to answer those before we get to you if you want to pop up on stage and do it live. So without further ado, Brian, why don't you take a moment and introduce yourself? Awesome. Thank you. Thank you for having me, Tomas. I really, really appreciate it. My name is Brian Lozada. I'm the CISO over at HBO Max. I've been there for a little over two years, been in the cyberspace for over 15 years now. And, yeah, really excited to be here and have a good conversation tonight. Now, we're happy to have you, Brian. And I really appreciate you taking the time out of your busy day to sort of engage us, engage with us on this conversation. You know, I usually like to ask our guests this one question around their origin story. And why don't you, you know, you, so I don't want to steal your thunder, but I do want you to share with us, you know, you. How did you become who you are today? What has been sort of the challenges and obstacles that you've, you know, gone through and overcome throughout your life? And those opportunities that have been presented to you as you started to sort of build your career and shape and mold who you are today. Why don't you tell us a little bit more about yourself? No, thank you. Thank you so much. Security is, you know, I sincerely believe that security is a calling. I tell my folks all the time that security is, it's a state of mind. It's not a piece of paper. It's not something that you could refer to. It's something that you live, something that you breathe. I started in my career early on and I came out of the military. I did not do cyber in the military. I was in the Marine Corps. I was a radio operator. So I humped a radio on my back. And when I got out of the Marine Corps, and this is early 2000s, I just wanted to get a, you know, a comp side degree. And I was really attracted to technology. And that's what I really wanted to do. And when I was graduating, I was approached at my university by Accenture. They were starting pretty hardcore in like 2003, 2004 to build out their cyber practice. And they were really focusing on just government and being a former Marine and still having an active clearance. I think that kind of like paved the way for them to make me an offer. And that's when I really got my first kind of like civilian job and really got my foot in the door when I came into cyber. Unique space being in consulting and being with Accenture. You know, being in the Marine Corps, you learn a lot of discipline skills. You learn a lot of structure. But your soft skills aren't really there. So I thought it was a great opportunity when I did go to Accenture that helped me, you know, sharpen my soft skills and really work with communication, which I have carried throughout my entire career. I think, you know, one of the biggest tools that a cyber practitioner or security practitioner can have is the ability to communicate and translate risk into either, you know, business risk or to a manner that your partner or your client is going to understand that they need to focus on it. And Accenture really gave me that opportunity to sharpen that skill and develop that skill. So that was the first kind of like, you know, security job that I had in the private sector. And then shortly after that, I went to go work for my first startup. And I've always been kind of like attracted to startups since then. And that was Vonage. I don't know if you get, do you guys remember Vonage, like the Voight company? Yep, I remember it well. The cool commercials. So I went to go work for Vonage very early on. And it was like 2005, it was, you know, took them public. But it was the first time that I was trying to work security into a fast-paced, moving environment. And like, how do you get security to matter to developers and to engineers when they're just trying to execute and, you know, deliver and ship products? So kind of framed the way that I look at security today. It really framed my approach of partnership first and really looking at leading with empathy and understanding that workflow that your business partners are trying to go through and how to, you know, weave security into it. I was there for about three years. It was a lot of fun to take a company public. And a big thing came out when I was there, which was PCI. Oh, man, that was, at the time, Vonage was like, they were taking over two million credit cards. That's how they collected their payments. They were taking over like two million credit cards a month. And like PCI became the thing. And I was like, you know, from one day to the next, you're like, uh-oh, we got to be level one PCI compliant. And the whole shift of the program, you know, went over to how do we make this organization PCI compliant without slowing them down because it is such a core component to the business, right? That's how they were collecting because like 98% of the revenue at the time or something like that. So a lot of fun. Spent close to four years there, a little over three years there. And then I, you know, decided to try media and entertainment. And that's where I've kind of like made, I think, most of my mark in my career, where I've stayed most of my time in my career. And I went to go work for Sony Music. And that was a very interesting journey for me. Trying to bring security to the creative workforce. That was like fun, but a very big eye-opener, right? Working with creative mindsets is unique. And I went to Sony Music when it was a big digital transformation because this was like 2009. Like who's buying CDs? Nobody was buying CDs. It was at the time that Sony was like really going through that digital transformation and saying, how do we convert our product from being something that is very retail heavy to direct-to-consumer and digital distribution, right? And I was like, we got to work with, you know, engineers that are taking creative products and creative, you know, material and put that out into the public internet, which was, again, at the time was pretty new. So that was fun. And it was the first time that I really got introduced to the cloud and the power of AWS. And we were using AWS at the time, but just to see the power of using a technology like that to scale the business and really reach out to a direct-to-consumer market. And it was an interesting time, too, because it was like right when Michael Jackson died and was part of the Sony Music family. And just seeing that whole dynamic, watching us rapidly put MichaelJackson.com and scaling it up pretty high so that when we announced it to the public that he had, you know, passed, that there was enough, you know, the site wouldn't go down. So it's just interesting things like that and seeing where security played a role there. And then after that, I went to go work for another media company, Convain S, which was like Vogue, Vogue, JQ, Allure, Vanity Fair, those big publications. Same kind of, you know, approach, which was who was buying magazines. This is like 2014. Like nobody was buying magazines. Everything was digital distribution. So it was like, how do we help that creative workforce think about getting their product to get into? The big thing was apps, making like a specific act per brand, like a Vogue app or a, you know, New Yorker app, and then moving them 100% to AWS. So, again, a big portion of my career was in media and entertainment and just really working with that creative workforce has framed, again, my approach on how I look at security and really leading with empathy and trying to understand your business partners, because they all have different missions that they're trying to accomplish. And sometimes when security goes in and you're saying something's wrong, it feels like you're being abrasive or you're being a little standoffish. And, you know, working with creative folks has helped me take a different approach to partner and try to get security to be part of the solution. And then after Convey, I went to another startup, ZocDoc. I don't know if you guys are familiar with ZocDoc, but, you know, very mission-driven company. I was really excited to work for ZocDoc. Healthcare is broken in this country, and ZocDoc was doing a really good approach to pair doctors with patients. So ZocDoc is like the open table for doctors. Over 10 million patients a month use ZocDoc to find and book doctor's appointments on demand. So it was fun. I was there for a CISO and, you know, had a lot of fun there. I was there almost, you know, over three years. And then, you know, media and entertainment called me back. And I've been at HBO Max for the last, or Warner Media with HBO Max for the last two years. And HBO Max has been a unique experience because it's, I call it a startup within a big, huge organization, right? Because it is part of Warner Media, which is CNN and TNT and TBS and WB and WB Games and all of these massive media, you know, brands. But HBO Max is the premier direct-to-consumer product for Warner Media. So it is really a startup within a large conglomerate. And just a lot of fun over the last two years seeing this product kind of, like, take off. And, you know, we just hit 75 million customers in over 18 months. So we're in 56 countries. And we launch on March 8th in the second part of Europe. So I haven't slept in a few weeks preparing for that. So just having fun with it. So that's my career journey and how I kind of, like, came to where I am today. And all of those experiences between the startups and media and entertainment have really framed how I approach security, again, with that partnership-centric approach and really leading with empathy. No, that's awesome, Brian. And, like, it's shown some great progression and great growth throughout your sort of career journey. And I wanted to ask you, before I sort of pass it over to Octavia, and welcome, Anil. Thanks for joining us. And we'll let you introduce yourself in a second. I wanted to ask you, before you got into the Marine Corps, like, what was that decision process? Like, what sort of pushed you or motivated you to join the Marines? Like, what was going on in that time of your life? Great question. I always had that feeling that, I don't know if it was a giving back feeling or something that I wanted to do. Something that was beyond myself, that wasn't really about, you know, I felt that, you know, being something, being part of something that was bigger than me or that was an impact. I always had that calling. So I was very drawn to it. I come from a Marine Corps family. You know, my older brother was a Marine. My father was a Marine. So it kind of, like, was embedded in me, I think. But I was really attracted to just the mission and just being part of something that, again, was larger than yourself and that opportunity to give back. And that is something that I think most Marines will, you know, tell you about, that it is a rewarding feeling to be part of that, you know, that brotherhood or that sisterhood. Great, great. Awesome. Octavia, over to you. Hey. Hey. Yeah. Thanks, Tomas. Hey, Brian. I think you're the only Marine that I've ever heard that talks about another Marine in the past. Yeah. We are once a Marine, always a Marine. We always, that's our saying. Absolutely. My husband is a Marine. So he actually got out in 2004. So it's possible that you guys crossed paths. But he was in telecom as well in field operations. But, you know, you have a very interesting story. And, you know, during the time of, like, the early 2000s, around, like, you know, late 2000s, when we were kind of going from voiceover IP, from, what is it, analog to digital and going up in a voiceover IP. It seemed like that's around the time that you really started in the journey of information security. And, like, what was that like to actually see that transformation and really see people shift? Because now you have people who are infrastructure security, network security, cyber ops, information security. And we're all just one conglomerate of cybersecurity with these eight different domains. And during that early time, it was very much segmented. So how was that in your partnership? And how did you make sure that everyone was collaborating? You know, that's a great question because you're absolutely right. This is, like, 2004, 2005, 2006. Like, this whole timeframe, security was, hey, that's the individual that looks at the virus on your laptop, right? Or that's somebody that's configuring a firewall. It really was not part of the business. It's absolutely not. I say this all the time, like, security was a third-string player on a second-place team back then. Like, it was really a 1,000% afterthought. But once you see all of these businesses start going through that digital transformation and really embracing technology and really embracing that they need technology to succeed and really convert their products into that digital delivery or software-integrated world where we are today, security started taking shape in those business conversations. And so it really started taking shape into how do we help, you know, the business execute on their mission? And that security is part of that resilience or part of that ability to respond if something negative were to happen. So, but, I mean, I'd say between 2005 to, like, 2010, 2011, I think it was a struggle. I think we were always trying to compete for budget. We were always trying to get attention from, you know, those business leaders to really show where the value was for security to be part of those conversations. And it was exactly that, like, going from an analog to a digital format. Again, that digital transformation that these businesses were going through, it's like they didn't think about that, the risk that converting over to a digital world that that comes with and how security practitioners can help alleviate that risk and really push the business forward. Now, I think it's completely different. I think security, at least in my experience, security has been, it absolutely has a seat at the table. I think it is more so now than ever before because we are a software integrated world and every product, every company in the world is a technology company, whether they want to accept it or not. Like, they're not going to reach their customer, retain their customer or, you know, be able to harness some of the customer data if they're not a technical company. So, I think businesses realize that now and they know that the investment in security is absolutely necessary. Yeah, no, I agree. I agree. And it's interesting because, you know, if you don't, if you're not looking at the risk, and I don't, I would actually venture to say, like you said, the companies didn't know the risks back then in, like, the early 2000s. I would say even security practitioners didn't really understand the full level of risk and the reach that we would be getting because we didn't really maybe understand, you know, how culture played a role in it either. But we can have this conversation all day long. Go ahead, Brian. I agree with you. I totally agree. Because even back then, like, not being part of those business conversations, how do you apply that security lens if you don't understand where the mission of the company is going or what the vision of the company was? So, I 1,000% agree with you. I think we were blindly to the blind back then. I think we're in a better spot now. Still a lot of room to grow. But I think we're definitely in a better spot now as an industry. Absolutely. Thank you, Brian. Russell, over to you. Thank you, Octavia. And, Brian, you know, we said it already. You know, thank you for your service to our country and all the cool things that you've done there. A question I have for you, you talked about a partnership approach. What does that look like, the tension between partnering, say, with your boss, partnering with the business and the mission, like you just now said, versus, you know, wanting to be hands-on, working with, leading people that lead people that do, you know, the cool cyber thing? How do you manage that tension between, you know, wanting to do both things but sometimes having to make a choice of where to spend your valuable time? It's tough choices and trade-offs. You're always going to have that, right? When it comes to partnership, I like to look at the business and understand, at any industry that I go to or any kind of, like, business that I'm working with is, let's understand the critical paths of the business. What is it what makes this business tick? What is it that is making this business a business? Once you understand those critical paths and you understand the players that are supporting that critical path, and I'll take HBO Max as an example, right, where we want to make sure that all of our customers can enjoy the experience so that they can log in, they can click on some content, and that content gets delivered. That's two critical paths right there. Log in and registration, making sure that those customers have that ability to do it, and then making sure that content gets out there. So I really started looking at those partners that manage and build those two parts of the critical path and seeing where is there risk that we can help them either identify or remove from their plate. These are folks that are at the ground level. They're there solving customer problems, and they need to ideate. They need to innovate. They need to think differently to really push the product forward. So how as security practitioners can we help them do that, help them solve that problem, but make sure that security is part of that solution? So, again, partnering with those folks and then positioning the resources within the security team to help those service teams. And, you know, at HBO Max, we have, you know, engineers that are dedicated specifically to application security. We have, and those application security engineers, they're not there giving out, hey, this is an AppSec report that says that there's a vulnerability. That's not it. Look, that's valuable. Don't get me wrong. It is 1,000% valuable. But what I like more is that the engineers are working with those developers that are in the experience and helping them get to that next step. And really even delivering sometimes 50% of that package or that library that they need to use that's either going to solve their problem or, you know, reduce that vulnerability. So really engineering with them. Same thing with the cloud engineers. They're not delivering a report. They're not doing anything like that. They're delivering Terraform templates. They're delivering half of that solution there that a developer or, you know, infrastructure engineer can just take it and go. I say this in the team all the time. I want the solutions that we provide to be two clicks away from a fix. You know, think of the modern workforce. The modern workforce grew up Googling something, searching for something, and using that data to make a decision for downstream solving a problem. We as security practitioners need to do the same thing. We need to make our services available, that they're available for engineers to search for them and literally just consume them and be kind of like a customer service, kind of like solution. So I really drive the engineers to, you know, provide solutions to the engineering organization. That was great. Go ahead. I really liked your answer, Brian. And as the others have mentioned, thank you so much for your service. I am a Marine Corps wife. My husband did 20 years. Awesome. Awesome. Always, always a Marine Corps wife. Always a Marine. So thank you. Let me ask you a little bit of a different question. When you think about your every day today, what's your why? What's your reason for getting up in the morning? What's the most important thing to you right now? That's a great question. I think the most important thing for me right now in this point of my career is the team. I love seeing how the team is developing, how they're growing. I love it when the team is trying. When they come to me with problems that they identified and that they want to throw engineering hours at, I love it because I see their growth. Right. And it's going hand in hand with the growth of the product or where the company is going. So that is my why right now is, you know, the motto across the HBO Max security team is let's secure the customer experience. And the customer for us is the 75 million on the external side, but also our internal customers, which are developers. So when they come and they say, hey, I have a, you know, a problem that I've identified that I want to throw engineering hours towards. And it's going to solve this customer problem where it's going to solve this developer problem. It's going to help facilitate the customer experience. That excites me. I really like seeing that the team is constantly looking for positive disruption and trying to ideate on things. And it's again, it's not boring. So they, you know, I encourage the team to constantly look for for ways to be disruptive. So that's my why right now. I think the other why that I have is just the cool innovation part that we're in in cyber. I think we have a really huge opportunity in the industry right now to push the envelope on how we think about security. And we're at the ground level with engineers helping, you know, developers put out the product. We could really change the way that we look at security as far as pitching it to the business and ideating on how do we help developers do things quicker? How do we help? And I say this in the org all the time and folks take a step back. I actually want to help the business take risk. As a security practitioner, we're always like, we got to protect. We got to defend. We got that's one on one. That's what we got into the game. Thousand percent. But when you look at it from an ideation perspective and you're saying we're coming up with solutions so that the business can take risk. Right. We're in the business of innovating so that we can acquire customers. You're not going to have any ideation without risk. So help the business take that risk. So what are you doing from a security perspective to help those developers feel comfortable to ideate? Right. So that's that's the other why that I have. I love it. I love the risk mindset and contextualizing everything. Thanks so much. I have a million other questions, but I know that I need to turn it over to Katie. Thank you, Lisa Beth. Hi, Brian. So many things that are really interesting about your background. I mean, at some point, I think it would be interesting to to dig into some of the personal whys and why it is. So you're obviously very passionate about wanting to change the way us as an industry is looking at security. I find that really I identify with that as well. But a couple of things that stood out to me. You went to several companies where you were bringing security to the creative workforce. I'd love to get a little bit of an idea. Is that something that you in your life, do you have creative outlets and that kind of thing? And then the second question I had, too, is I noticed that a lot of these things are, you know, direct to consumer. And the balance when you're doing something like that with 75 million customers, which, by the way, I thought I was special until I heard I'm one of 75 million. So thanks for that. You are special. But, you know, in terms of you talk about your login, your registration and your consumer experience, I mean, you're balancing a lot there with working with the creative workforce, working with the engineers who are creating this customer experience, and then also dealing with, you know, the average person who's just wanting to log in and also have an understanding that their credentials are safe or what have you. So if you could kind of walk us through, you know, that aspect of what you're doing at HBO Max. And then I just I noticed, you know, you had mentioned several times the creative workforce piece and the, you know, the direct consumer piece and how all those things kind of fit together in your strategy every day. No, that's a great question. I think that the on the creative workforce piece, I when you look at technologists, you look at engineers, like we're all technologists, we're all engineers, we're all, you know, in that technology space. If you think about it, we're creative as well. And you don't get into tech to keep the lights on. That's for sure. You get into tech to be disruptive. So I think I've always been attracted to that creative workforce because they look at problems differently. And they're looking at, you know, how to how to on delivering the product. They're looking at how's the most creative way to deliver the product, which I always find it interesting and fun to see that that aspect. But also like the creative workforce, they put a different thought process on on just an outlook on everything. Right. They're thinking of it from a lens of creativity. And I think as security practitioners, we have a lot of great standards and a lot of things that we can follow. But sometimes when we go just by that, we miss the mark on how we're really helping the business. And I think if we start looking at things from a lens of that creative ability to use our resources and thinking out of the box to solve the problems, it helps us get closer to the business, at least in this world that I'm in for media and entertainment and startups as well. It's like you definitely have to think out of the box. You've got to think differently in the creative workforce. Definitely gets you into that mindset and helps you frame some of that. When it comes to direct to consumer, I mean, that's the game right now. Like every company in the world is trying to figure out how do I get closer to the consumer? How do I how do I know more about the consumer? Like it's all about wanting to know more about you, not just for, you know, the ad tech portion of it, but also to personalize that experience. Like you are special to us in HBO Max. We want to get it to the point that when you log in, like we can recommend those things to Katie because we know Katie. We have that personal connection. Right. And you're not going to get that unless you go through a direct to consumer experience. You know, going through partners or going through third party, you're just not going to have that ability to stay that close to the customer. So I think as as the business world starts figuring out more that direct to consumer is definitely the way to pitch products and stay closer to the consumer. We as security practitioners need to adapt as well and say, how do we help and really understand where's that boundary of pushing that direct to consumer approach? Making sure that we're helping the business manage that consumer data as it comes through responsibly, how we're helping the business use that data responsibly to improve that experience and improve that product for the customer. All of that's a journey. And I think we're scratching the surface right now on what the direct to consumer world is going to look like in the next 20 years. And I think security is going to play such a core component to how businesses can use this direct to consumer arm to shape their business. Sounds like family and friends discounts coming my way. I'm all for it. I'm all for it, Brian. Feel free. Hey, look, just a quick room reset. If you just joined us, we've been chatting with Brian Lozada, who's the CISO at HBO Max. This is our weekly fireside chat. We do this every Wednesday between 8 p.m. Eastern time and 9.30 p.m. Eastern time. We're going to open up for questions in about maybe about five or so minutes. Give Brian a little bit of time to drink some water, catch his breath. And Brian, one of the things that we talk about sometimes on our weekly chats is we talk about mental health. And, you know, with all of the sort of work side of what we do and all the stresses that we have at work as very senior leadership positions, you know, thinking about how do you sort of stay focused on you as a person, as an individual? Like, what are some of your personal motivations, if you will, or things that you like to do aside from, you know, be a cybersecurity professional every single day? Like, how do you de-stress? How do you work through mental health issues? What are some of the things that keeps you, you know, grounded, right, in the world as a human? No, that's a great question because I think all of us as security practitioners, we have that welcome stress of being in the field or being in the industry. Things that keep me, my anchor is, you know, being a former Marine, getting up at five in the morning every day and hitting the gym. That's one of my anchors. It kind of, like, sets the tone for the day for me. It really helps me plan out my day when I'm there. I think that's one of the things that I've kept since getting out of the Marine Corps is just that regiment of, you know, using that, you know, the gym or exercise to really ground me. I think that's one thing that I do to kind of, like, alleviate. The other thing that I do and I love doing, this is probably my favorite job, is I'm also an adjunct professor at Monmouth University. And I teach an undergrad course and a grad course there. And I love giving back to the industry, if you will, but at that level. When we're talking in this, you know, this platform right here, we've all been in the industry. We're all there. We're all facing it. But when you have students that are, you know, they haven't even graduated yet. And they're eyes wide open right now. And they see the news. Like, when we were in school, you know, the industry wasn't as big as it is now. It's not in the news as much as it is now. So they're seeing this with the eyes wide open. It's helping give them kind of like a perspective on what's really going to, what they really should expect coming there. And just seeing that curiosity that comes from the students and giving them that opportunity to bounce things off of somebody like myself that's in the industry. I usually host a career panel. I post it on LinkedIn all the time of, you know, I have a few folks across the industry. Just come talk to the students and tell them what they should expect or what kind of skills they should come out of school looking for to get into the space. And that's a really good outlet for me because, again, it is about cyber, but it's not about stress, right? It's about how are we giving back? How are we preparing that next generation of practitioners to come into our industry? Definitely let me know when you do that. I'd be more than happy to sort of join and chat with your students and let them know. Thank you. Thank you. I'll take you up on that for sure. Absolutely. Who's your favorite team? Do you like football? Who's your favorite football team? So it's the Jets. I am a suffering Jets fan, but I'm always optimistic. Well, I won't comment on that because I like all 32 teams equally. But Octavio, Katie, or Lisa, or actually Russell, anyone of you have another question? And before we get to that, if you do have a question and you're in the audience and you want to ask a question, raise your hand. We'll bring you up on stage and you can ask your question. If you don't want to ask your question live and you want to sort of ask it, I guess, you know, in written format on the bottom left hand side of your screen where it says sort of you click that little icon, whatever that looks like, two arrows. You can do share on Clubhouse and type in your question there and interact with us that way as well. So, Octavia, you want to ask a question, Lisa Beth? Yeah, I had one. I had one. You know, I think earlier on in the conversation you said that you guys are about to expand into Europe. And, you know, if for those who follow us, you all recently know that I moved to Canada from the U.S. And, like, there's a cultural difference when you go to a different country when it comes to, like, work-life balance and what the expectation is. So, as you guys are going into the U.S. Sorry, I'm lost. Am I back? Yeah, you're back. You're back. I thought you got lost in Canada. I was like, uh-oh, he's talking about Canada. That's it. They cut off. They cut me off, man. They cut me off. That was the doggone ministry of foreign everything. No, I was going to say, you know, I recently relocated from Atlanta, Georgia to Toronto, Canada, right? And one of the things that I've noticed in relocating, especially when it comes to, like, dealing with cybersecurity, dealing with work. And, like, I was a workaholic. Like, I'm always working. And my son actually told me he didn't know what to get me for my birthday because he couldn't get me, you know, he couldn't buy me work for my birthday, right? Because he thought that's the only thing I like doing, right? Which made me feel great, obviously. But what I noticed is when you come to a different country and you're thinking about moving into the European market, like, there's some cultural differences that you have to take into consideration, especially when it comes to cyber and it comes to dealing and working with those other teams. What things do you think are going to be challenges or opportunities, right, for your team and opportunities to improve the culture? No, that's a great question. So this is our second round going into EMEA right now. We launched the first round in October. So this is the second round. I think it's another 15 countries, another 11 different languages. So we are staffing up in that area to support the customer experience out there. We do have some cyber engineers out there. I did one of my latest hires. Her name is Rosa. She's based out of Madrid. So really excited that she was able to join the team. But it's interesting you bring that up because that is something that we have to take into consideration, right? There are different ways on how the workforce across regions is managed on the internal side, right? We're all about securing the customer experience, but we want to have that nice work-life balance and ensure that we're giving the right opportunities to our engineers so that they can, one, develop while they're with us, but also be satisfied within their work. I do have to say I have to give a lot of kudos to WarnerMedia, our parent company. They give a lot of support. I mean, they have a lot of teams that help us in managing that work-life balance for our engineers, understanding the norms that are out in those regions so that we don't overstep or we're not putting too much pressure on our engineers. So that helps. I think a morale thing is also important when you think about different regions, right? We're a global team now. I got folks in Europe. I got folks on the East Coast, West Coast, Midwest. We're going to start hiring in AsiaPAC soon. It's like, what do you do as a leader or what do you do as a team to make sure that even though we're in different regions of the world, that we feel as one team, one cohesive team? So we're starting to come up with programs now on how do we all get out in all hands, even though we're all 24 by 7 in different regions? How do we make sure that we're passing on kind of like that follow the sun approach with monitoring and kind of like the reporting? So we're starting to develop that now that helps with that cohesion of the team, but it also helps with we're making sure that we're not putting too much pressure on those folks in those regions when it's off hours. So it is a balance. I think it's a fun balance to kind of like manage, but it's something as a global leader. It's just something we're going to have to deal with. I think the remote workforce, COVID has made us all a remote workforce. I think the remote workforce angle over the last two years has really changed the way that we think of this too, because it does put like you just said, you're always working. You're always working because you're always at home. You know what I mean? Like you're 12 hours behind that machine. I think that's something that we need to break as the industry is, you know, even though we are all working remote, we need to give ourselves some time away from work. And I think we haven't figured that piece out yet. Yeah. I think that when you go into Europe, they're going to help you figure it out. Like my team is helping me figure it out now. Thank you, Lisa and Brian. I encourage the team to be very open and honest, right? One thing that I tell the team all the time is that we're not a nine to five shop. Like I care that you do your job, right? I don't care when you log in, when you log out. I care that the job and the mission is accomplished. And that's part of that on the leadership side, not putting too much pressure that, you know, that we're expecting too much or that we're putting too much on those individuals in those regions. I think we also need to be empathetic. Like we have to understand those regions and understand what that culture is there. Absolutely. I don't know if anyone had anything else. I know Ryan jumped on stage. Katie or Lisa? Well, hang on. Yeah, just before we get to, there was a question that was sent to me. Yeah, if you guys will, let me read this one. Brian, the question is, you brought a great point. You bring a great point about how you're enabling risk in your business. How are you pitching that to your business partners? Are you correlating that risk reward? If so, what specific top level metrics are you leveraging? So, yeah, that's a good point. How do you correlate it to numbers or data? It's looking at the vision of where the company's going, right? The vision that the company has of, again, enhancing those direct-to-consumer experiences with the opportunities to personalize and opportunities to do things with the experience that keep customers engaged with our products. Not just HBO Max, but across the WarnerMedia family. It's saying, we're helping, right? We're helping you get there quicker, right? This isn't something that, you know, synthesizing data and helping that personalization takes time. And when you're able to say, we've helped these engineers get there in half of the time that it would have taken because we've provided, you know, an event-driven architecture that helps them do things that, if there is a misconfiguration, we're going to fix it, right? They could take risk quicker, but they could operate quicker to get to solving that problem. Those are the type of things that we kind of like escalate up to management and show, you know, how we're adding value at that level. Sounds good. Thanks for that. Ryan, thanks for popping up on stage. You want to ask Brian? Thank you. Yeah, I'm just jumping at the bit with this one. And I'll start off with Brian. Nice to meet you. My name's Ryan. Anytime I meet a Marine, I have to kind of jokingly ask, if you take the letters of Marine, what do you get? I'll just jump into my pipeline. It's Airman. I was in the Air Force, so just to go. I hope that would make you laugh. Yes, I've heard that many times. I'm glad you enjoyed that. A lot of people don't realize that. Anyway, really love the conversation. I had my question like 20 minutes ago, and you've only since added to it. So really looking forward to see where you take this, right? So you mentioned a lot of different places, and you mentioned culture. And I was thinking about, well, you know, between a startup culture or culture of a really established company, you know, a tech media culture, health culture, culture growth, or how will the culture be, right? Change with growth into me and AsiaPak, right? Where I am with 10 years under my belt in cybersecurity is, I mean, at this point, I think most people are pretty smart. Most people who are in security are pretty talented and have, you know, some experience and education under their belt. But, you know, do you see culture change by sector or like company size? Or like how have you seen culture differ, right? I mean, you have some military, you have corporate. I don't know if you did government or if you said corporate with Accenture, right? So just curious about how you see that and then how you see the best way also for, you know, how's the business culture towards cybersecurity versus a cybersecurity team maybe? Like the culture, like you said, about taking risk or, you know, wanting to come to work every day. I know that's like a big question. You take that if you want, but that's kind of where I've been kind of sitting as I listen to you. No, that's a great, great question. In my experience, culture is different by industry and it's different, you know, by sector, a thousand percent. I think when I was with Accenture in that very corporate type of environment, the culture of there wasn't a culture of security. It was the fear of security. It was securities coming in here to tell you that something's wrong. Right. And I think there's still a lot of that across the industry. I think when you get into kind of like the creative workforce and some of the startup workforces, again, they're trying to solve problems, operate quickly, and they're trying to ideate to do that. And when security comes into the room, it's like, uh-oh, like who let these guys in here? Like who let these folks in here? They're going to come tell us that something's wrong or that something's – that we can't do something, that we're the office of no. Right. So I think to create a security culture that is welcoming, I think leading with empathy, in my experience, is always the best. When I go into a room and let's say we're doing a threat model or we're trying to understand that architecture, I just want the developer to kind of like tell me what they're trying – what problem are they trying to solve? What is – what pressure do you have from the business? What pressure do you have from product engineering that are telling you to do this? All right, now that I understand that, this is how we're going to help you. Creating that culture that we're going in there to help instead of to go in there and say this is wrong or this is what you can't do, I think sets the tone on how you can further put that partnership throughout the organization. Right. I think, again, when I first came out of the Marine Corps and I went into Accenture and, yes, had all these government contracts, I was the office of no. And I would go into these places and be like, yeah, this is totally wrong. You're not going to do this. And I guess the point I'm trying to make is you catch more bees with honey than you do with vinegar. Right. You have to have an open approach. You've got to understand your business problems, your business partner's problems in order to help them. And that creates that culture that you could really leverage to push the security program to be that enabler and be that pillar that says we're helping you take risks. We're helping you innovate. We're helping you push the business forward. Instead of saying, we don't want you to do that because there's a risk or there's something wrong. I think that's one thing that helps create good, positive culture and security is understanding that business part. And the second thing is, and a lot of security practitioners do this, man. They go into meetings and it's like, I'm going to bring you a vulnerability report and tell you everything that's wrong. This is a piece of paper right here. And there's no context there. There's nothing in those vulnerability reports that are really going to matter to a developer at the ground level that is trying to solve a problem. I think you don't go into a meeting with that compliance head or don't go into that meeting with that report from a tool that doesn't understand your environment that's saying that something's wrong. Understand it, fully understand it and add value there. And that'll create that culture again of that partnership. And you want folks to reach out to you. So I think that's a good way to start it. Hopefully that answers your question, Brian. Thanks for popping up on stage and asking you a question. I was just going to say, Brian, that I guess I got to throw out my next slide deck and maybe go back to the drawing board. No, I'm just playing. Great advice. I completely agree with you. You need to contextualize it, make people understand. Completely agree. There is a question. So if you are in the audience and you want to ask Brian a question, feel free to raise your hand. We'll bring you up on stage and you can ask Brian a question. If you just joined us, there's our weekly fireside chat. We do this every Wednesday between 8 p.m. Eastern time. We're going to go to about 9.30 p.m. Eastern time today. So just a little while longer. But feel free to raise your hand, pop up on stage and ask your question. You can, if you don't want to ask it live because you've got other stuff going on, feel free to send a direct message to myself. And I'll read the question off to Brian. So, Brian, I did get another question that popped in. So this one is, as a developer getting into cybersecurity, what are some great books that introduce you to cybersecurity for developers? This person works with Python. So that is an interesting question. What do you say to that? That's awesome. I would say, I won't make any recommendation on books, but just the fact that you're learning Python. Yes, definitely continue to learn Python. It helps with problem solving. I would say, if you really want to see where, and this is going to be such a cop-out kind of like answer, like YouTube. Like seriously, like go to YouTube, follow as many of the like AWS's, this is my architecture. Or go to find out all of these practitioners that are out there with these YouTube channels. They really do give good advice on how to introduce security into a development lifecycle or get into that CICD. So definitely continue on with Python, but books are great. But my recommendation is get practical and go to YouTube. Like really start researching in YouTube some of these folks that you can follow. Great answer. But you missed an opportunity there, Brian, to say HBO Max should be developing a cybersecurity training. Sounds like an opportunity for you, my friend. I'm happy to be on that show. Silicon Valley, right? You can watch our show Silicon Valley, maybe. There you go. There you go. Lisa, go ahead. Hey there. So I've been really enjoying the conversation this evening. And you touched upon one of the things that you're really passionate about, which is really developing your team. One of my questions for you is, you know, the role of mentoring and guiding people as they continue throughout their career is so important. What are some of the things that you do? And what are some of the techniques that you've learned over the years that you deploy with your team or that you found helpful? Great question. Great question. I think one of the things that I did with the team is each one, I kind of picked their brain on what they want to do with their career when they started working with us. And it's like, what is it? Where do you see yourself in one, three, and five years, right? And then let's start looking at the roadmap for the organization and saying, what are the things that are within this roadmap that are going to help you in your career development? So that was one area that was good because then the team members get excited and say, I want to go work on that problem or I want to go work there. I think that's one thing that keeps that enticement with your team and keeps them eager to develop themselves, really, and seek that opportunity to work on those problems. That was one. The second thing that I do is I put a stretch goal for every single person on the team is that they need to open source something within a year, right? I want something that they get open source. Why? Why? It's because when they open source it, not only are they solving a problem from a technical perspective, they then need to go talk about it, right? And they actually need to go publicly speak about it, whether it be in a blog, a conference, something like that. And again, those soft skills matter. They absolutely matter in career development. You could be as technical as you want, but if you can't translate that from a communication perspective into business speak or business risk, you're not going to really go far in your career, unfortunately. So I put these stretch goals with the team so that they do that. Then another thing that we do is we do monthly office hours, and we open it up to the entire organization. And then I rotate it across the team. So this month will be somebody. They have to pick a topic. They got to talk about what problem they were solving and then how it's going to be available to the organization. Again, it shows off their problem-solving skills. It shows off the opportunity of how they're going to speak and how they're going to communicate with the organization. But it also opens up that partnership with the organization as well. Like there's somebody that they could reach out to. So those are the type of things that I kind of like instituted across the team that have helped with that career development and just seeing them grow. And when I get team members that are arguing and fighting because they both want to be doing the same kind of office hours, I love it. I'm like, one of you is going to have to wait. You know what I mean? I'm like, I'm so glad that you're spending the time on your team. having a great manager who really takes an interest and tries to cultivate people is worth its weight in gold. So thank you. Yeah. You're only as good as the team you have period. My stretch goal is to wake up without back pain in the morning. Katie, over to you. We were going to go a whole, nevermind. I'm not doing it. Bye. Yeah. We, yeah, I have a lot of stretch goals too. I really appreciate what you said. And actually my question, Lisa best question was the perfect question to be right before this followup question I had, because you've mentioned several times that, you know, your leadership style, you've sprinkled in the word empathy several times. I, I'm imagining you've picked up some things along the way from some pretty great leaders to have the type of leadership skills that you have today. I'm curious if you have kind of any stories of, you know, kind of coming up, whether it's the Marines or in, um, in, you know, any of the companies that you work for in your career, is there a single person as an amalgamate of every single manager you've ever had, or where did you pick up all these things along the way? Oh man, that is a great, great question. Um, so I think it is a combination of, of leaders that I've had and mentors that I, I still have that have kind of like trained, uh, you know, the way I, I, I, I approach, uh, approach things, uh, in the civilian world, in the private sector, I think one of the, he's still a mentor to me and I still reach out to him for, for advice. He's currently the, the CIO over at Sophia Marine. His name is Bob Pick. Um, and I had the opportunity to work for him when I was at Conde Nast. And he is just one of the best mentors I've ever had in my entire career. He had such an ability to one, be empathetic, uh, and, and understanding you and your problem. That was one. He showed so much passion in helping you solve that problem that it really inspired me to one, continue to work for him and continue to just really follow his lead. And then the third one was, he was just a fantastic communicator. He could go into any room and really make it so that every person in that room felt like they were being, like he was speaking to them and that's a talent. And that is, uh, you know, it wasn't just salesmanship. Like he absolutely had that ability to do it and, and, and make that person feel valued so that they would partner with them and get, get to the root of the problem. So, uh, yeah, Bob Pick was just, again, he's, he's still a mentor to me today. Uh, he's the CIO again of Tokyo Marine. So he's, he's, he's been a really good inspiration in my life. The second one is, uh, uh, Sir Khan Kukin. Uh, so he was the CTO over at, at Zoptock, uh, when I started there and he took such a unique approach, uh, a unique approach in, in managing security. Sometimes when you report to a CTO and security, they kind of want to maybe dictate a little bit and you're under their budget. So it's, it's hard to kind of like make decisions. That wasn't the, the, the case with Sir Khan. He was, uh, all about ownership. He, he really made it so that, you know, I had complete full ownership of my decisions. He supported that and really pushed me to think out of the box. And he really pushed me even more to innovate and to, to not always go to that off the shelf tool, to not be afraid to use engineers to solve a problem, not just the tool. So again, he's still a mentor to me today. Uh, he he's the CTO over at Amwell health. Uh, so those are two in, in, in, that I've worked directly for. And then someone that is a mentor to me that I've never had the opportunity to work for, but I was, I've been a fan of him, uh, and Tomas, you know him for, for probably the last 15 years is Mike Higgins. Um, he, he used to be the CISO over at New York times and then, uh, NBC universal. He's currently the CISO for Amazon pharmacy. If you've ever had the opportunity to hear Mike speak or go to one of his conferences, he's just awesome. He, you know, he was one of the founders of kind of like cert. Um, he came out of the military as well. He was a helicopter pilot and then transitioned over to the cyber, but his leadership style, his, his ability to communicate again, was just something that always impressed me. And he's, he's a dear friend. I reached out to him again when I, uh, when I need advice or I just want to bounce something off of him. Um, so those are three people I think in my career that have really helped frame, uh, my approach and my leadership style. Yeah, it shows it definitely. I knew there had to be some really strong people that you've, uh, you've either worked for or worked with, or, uh, befriended along the way. It definitely shines through and, um, yeah, I appreciate that. It's always nice to know too, who to, um, look out for if, you know, in, in terms of there's a million, I get emails every day about the webinars that people are doing. I mean, here we are, you know, and something that, you know, we want people to come listen to and it's hard to know what, what and who, you know, in the industry are good people to listen to. So that was so helpful. I will, uh, I love a military helicopter pilot turns into a story. Yes. That's Mike. He's awesome. Thank you. Yeah. We got to get Mike on, uh, on, on the clubhouse. We gotta get him on the show. I think Mike is over at, uh, Amazon these days. Yeah. He's, uh, yeah. He's the CISO of Amazon pharmacy. Yep. Not good stuff. Uh, Russell. I'm good. Sorry. Oh, sorry. I was talking on mute. I'm sorry. I put you on the spot. Uh, Jennifer, thanks for popping up on stage. Anything you want to ask Brian? Hey Tomas. Thank you everybody. Hi. Um, Hey Brian. Great, really great talk. Um, I, uh, a couple of things hit home with that. So I just want to follow up on one of them with you, which is, um, I used to work at Viacom and it was my first time going into the creative space versus, uh, you know, enterprise software and working with creatives was definitely a whole new ball game. Uh, a lot of closed doors and a lot of different, um, spheres of, of influence. How did you, uh, break into working with them? I mean, did you find that they were very siloed in, in spheres and how did you communicate or work with them on the security? That's a great question. I, I, uh, they, there are some silos and, and, and some of the creative workforces because, uh, I'll give like examples that Sony music, it's like, there's different labels. There's Columbia, there's Jive and they operate differently. They have different artists. So they, they kind of like work in a different workflow and it's like, how do you like telling somebody this is back in like 2009, 2010, it's like, yeah, you can't send, you know, the latest album via aim, but you can't just transfer somebody's, you know, album being like, and, and to get them to, to, to, to agree to like, you know, change their workflow because it's better for, for, for, for the company and maybe not so, so much for them was, was challenging. How I did it was I wanted to, to understand what they, what, what the process, how, how's the sausage made? How do you guys actually get the, you know, from, from music to, to delivery, let's understand this. And let me just point out some areas where we can tighten up so that we could partner with you. And then I wouldn't try to recommend tools. I would, I was never trying to really recommend tools. I was always trying to recommend different approaches. So that they could see that I wasn't trying to like dictate or, you know, change the way that they do their business. It was just, I wanted them to think differently about how they did their business. Right. And help them to come up with that right, secure approach that works within their workflow. So that helped a little bit on, on, you know, in, in, in the creative side. And even today at, at, at HBO, like we, we, you know, we did a threat model called camera to consumer. Like we actually really tried to figure out how from, from the moment that, you know, the, the, the camera stops to the moment we deliver that piece of content to our 75 million public customers, you're something HBO max side, what are all the teams that, that, you know, touch and, and, and, and do that. And then really started to like, put, you know, feelers out there and all of branches. Like, how can we help them do things a little bit differently? Not dictating, not saying you must, you shall, you have to, but just saying, Hey, we understand that this, this is hard. Like we know what you're doing is hard and it's very valuable. So we just want to make sure that we can help you do it. And, and that approach has, has kind of like broken down those, the, that silo or that fear that security is going to come in here and do something, you know, or mandate something differently. Yeah. And that's awesome. I, I'm hearing that approach. I'm actually in legal. And so I'm, I'm really the black hole that, that brings all the, you know, stop work, whatever, but, but to your point, I call it different. I mean, I, it's exactly what you're described with how, how I approach things. What's the win-win or what are their real incentives? Like they're the business and how do I support them? As you said, just giving them tools or, or telling them what they have to do, doesn't work with what they're doing or what they're you know, what their end goal process drivers are. So yeah, that's great. Thank you. Thank you. Good question. Thanks for popping up on stage, Jennifer, and asking your question. Brian, you're, you see, just thinking about, you know, your, your sort of, your journey so far, your career journey, you know, you seem to be on the cutting edge of, of companies and technologies that are, you know, almost a little bit ahead of their time to a certain, to a certain degree, right? You, you were at Vonage, you were at ZocDoc, you're at, you're at HBO Max. What do you think about that trend? Is it, is it a trend? Is it a happenstance? Is it just because of the way you are and what you like in terms of opportunities? You know, any, anything you can add around that? Just curious. That's a great question. I think I seek it out. I really do look for those opportunities that is, that is out of the box or is not what you typically look at. I like disruption. I like, I think being on the innovative side of things or being with products that are, are, are, you know, coming into market. It's fast paced, man. So it keeps your mind thinking differently. And to me, I just like the edge. It's an adrenaline rush for me when we're launching in a new region, like it's an adrenaline rush when we're launching a new feature. And, and just to see, you know, how threat actors are going to look at this feature, how they're going to try to weaponize it. that's an adrenaline rush for me. So I, I like, you know, products or industries that give me the opportunity to be on the ground level, I guess, or be at, you know, boots on ground to just to see that, because again, it keeps you sharp. I think it keeps you constantly ideating even within your mind on how you're going to fix these problems. So I seek out these opportunities constantly. Uh, uh, and I, I, it's interesting because I hire, I like to bring in folks into the team that have that same mindset. Like I said, at the beginning of the call, like, security is a 1000% state of mind. Like you have to live this, you have to breathe it, you have to really immerse yourself in security and not, again, not fall back on standards or compliance, which are valuable, don't get me wrong, but really think about how security is, is, is really part of the business. Live it. Yeah. You know, it's something to be said, right. About blocking and tackling and making sure you don't have to throw Hail Mary passes at the end of the game, but you're, you're moving the ball forward. I guess I'll start with the football references. The football. I got you though. I'm just trying to get Octavia to come up from mute and tell me that I'm saying some old dad joke or something. I think you're trying to, you're trying to, you're trying to, you're trying too hard. It's not, it's too easy. I need to be able to catch something. You're giving me no alley-oops, literally. You're already, you're doing it yourself. Just making it right in. It looks like I'm not throwing any interceptions, which is, I'm not throwing enough interceptions. Brian, you said something earlier about your, your team and, and the, and, and sort of the performance review process and the objectives and goal setting and things like that. And, and you talked about sort of stretch goals, which I completely agree with. And I don't want to put you on the spot. So if I am, I'm not really trying to, but I'm curious, what are your stretch goals? What, what do you, what are you still looking to continue to grow and, and stretch yourself into a different direction, if you will, or, or in the same direction? No, that's a great question. I do have stretch goals. I think there's a few things that I, I, I, when I look at, you know, the current problem statement within HBO Max and, and, and just the streaming world is what, is there an opportunity for the HBO Max security team to kind of like come up with a way that completely changes the way that the user experience comes into, or the users come into the experience. When I look at a simple thing, like login, like we've been logging into portals and we've been logging into the, to the experiences the same way for the past 20 years and stuff still happens, right? Is there an opportunity for us to ideate or come up with something that facilitates that experience? Is it time to start bringing a passwordless approach to these type of, of, of experiences that is native, that we're not using a third party, right? So I'm always pushing the envelope on what we could do from a security perspective to facilitate that customer experience and make sure that we're still keeping the risk at that, right? So that's, that's one of the big things that I have as a stretch goal is what can we come up with it within the product? What feature can we come up with within the product that again, is going to facilitate the experience and, and, and eliminate some of that friction for, for our consumers? Good stuff. I'll tell you, I know you have another question. Go ahead. Yeah. And it kind of goes back to your team as well. You know, Brian, earlier you talked about kind of like those things that you, your team always are kind of fighting each other because they, they're the ones that want to present. And what I found, especially among, um, you know, those who are not as visible within our industry, you know, um, you know, maybe minorities, a lot of, you know, younger, um, younger people that's in the industry, it's difficult for them to speak publicly. Right. And so how do you, how do you cultivate your team and motivate them and engage them in and develop them so that they can actually articulate their views or thoughts to, to the industry, so they can be more physical? That's a great question. There's the two areas. I think I had mentioned the office hours, uh, that we do that, that, you know, each member of the team has a month that they have to talk that helps develop it. But the other thing that we've, we've been toying around with is Toastmasters, bringing Toastmasters in and those individuals that are part and Toastmasters, if you guys aren't familiar, it's like, it helps with public speaking, right. And it's signing your, your engineers up and getting them to be part of, you know, take part in kind of like a Toastmasters it helps with that communication style, helps them understand how to articulate things that they could totally do behind the keyboard. Right. But now they have to verbalize it and they have to even use their body language to get that message across. Um, and, and, you know, you're not going to do it as a leader yourself. So don't be afraid to outsource this and bring in folks like Toastmasters or, or, uh, you know, training that, that can help, but offering these types of programs to developers help and, and they appreciate it. They have that, even if you don't get them to speak at a conference or speak publicly, the fact that they're starting to gain those skills, it'll eventually happen. It'll a thousand percent eventually happen, uh, that they'll, they'll, they'll, you know, have that confidence to do it. Awesome. Thanks, Brian. Brian, I don't think you, you answered this question. And if you did, I'm sorry that I just can't remember and I'm a little hungry. Um, but thinking, thinking about the sort of advice that you've, you, you, so early on, you listed out your, your sort of three, three core, I call it core mentors of yours. Um, and just thinking about the sort of advice that they've given you throughout the years, you know, what was one of the, one of the pieces of advice that, or the best piece of advice that has sort of, that has stuck out for you or that you've received from them and has stuck out for you. And you've kept that throughout your career. What, what is that? Sir Khan, Sir Khan Kuhlun, he gave me a piece of advice and he was like, don't be afraid to fail. And, and, and think about it when, I mean, we're security practitioners. We are constantly afraid of failure because we fail in security. That means it's like something happened from a negative perspective. And he was the one that just, he said, look, we're in tech. This is, you know, we're expected to fail. How we recover from that failure, how we learn from that failure is important. Uh, so he was always one that put on, don't be afraid to fail. And then he, he upped the notch even more. And he said, if you're going to fail, fail fast. Like he wanted us to ideate quickly, get to that, you know, learning from, from, from that failure is more important than, than dwelling on that failure. Right. So, uh, that has always stuck with me. I pushed that throughout my team. Like it's, it's, it's, you know, fear is a greater threat to innovation than adversity. So don't be afraid to, to, to, to fail at all. And if you're going to fail, fail fast, learn from it. So you can continue to ideate and get to that, to that solution. Yeah. Failure sounds like a four letter word. But I agree how you, how you learn from that and how you pick yourself up and how you continue to move forward, uh, is, is important. And when you do fail, own up to it, right? Yeah. I'm going to try to hide it. Ryan, she's back up here for another question. Go ahead, Ryan. Thanks so much. Um, I just wanted to piggyback off of that. And right. Why, why do I come to these weekly fireside chats, right? I'm hoping one day to be a C. So, um, I have definitely let Tomas know that I think he has one of my dream, dream jobs. I'd love to come for the next 10 years. I'm not leaving you, Ryan. I'm not leaving you. No, I don't, I want you to keep doing what you do and I want it to do you to do it well. And you can answer this question too. Right. But like, you know, so it's the two part, um, you know, at what point did you realize you wanted to be a C. So how long after you realized you wanted to do that, did you, did you first become a C. So and then like, what's next, right? Is it CIO? Is it CEO? Is it, is it a little, I know, Brian, you mentioned you're also an adjunct professor. Um, you know, so like it, like, I don't think that's been mentioned directly. And, and I just think that right from the advice you just gave, like, that's what I'd love to learn. If you, if you want to benefit, I'm hoping that I'll help someone else in the audience as well. Um, but that's where I'm at. No, that's a, that's a great question. I, I, my first CISO gig was, was, uh, Condé Nast. Um, and this is, that was, uh, 2014. So, uh, no wait, 2011, I'm sorry. So, um, wow. It's been that long. Uh, uh, uh, what, I don't know if I knew I wanted to be a CISO. Uh, one, I think the first time you become a CISO in my experience, I think the first six months are, uh, this is a new term, but I definitely have it as imposter syndrome. Like, is this the right role for me? Am I doing the right thing? You don't, you don't know what you don't know. You don't know what you're doing. I think that, uh, it's a pretty scary, but rewarding, uh, kind of like experience. I enjoy what I do. I, a thousand percent enjoy what I do. I think, uh, uh, do I see myself being a CISO forever? No, I, I do have, I do want to, to, to get into that entrepreneur kind of like a approach. I do see myself in the next few years looking at, is there an opportunity to launch a startup or do something that, that, uh, I could bring a product to, to, to market to kind of like help. So I do see myself maybe, you know, again, in the future, transitioning to, to, uh, more than CEO and an entrepreneur state. And I mean, when I retire, I will, uh, like totally continue to, to, to, to adjunct. Uh, I, it is the most rewarding job. Take everything, uh, uh, you know, to the side, you know, I will probably be an adjunct for as long as I could physically do it. Um, because again, it is that rewarding. Ryan, I was two years old. There was keys in my hand. I decided to try to pick my, pick the lock and get out. I'm surprised. I'm surprised that wasn't a football joke as you've been saying them all night. Oh, there's the old joke. You see why, why gotta be the old guy in the room? Come on, Octavia. I would say Ryan, I want to say before you go, Tomas, hold on. Like, cause Ryan, you kind of sidestep, you know, wanting to take Tomas' job. By the time you're ready to take his job, you can kick him out. Right? For real. So I would just say, and he'll be ready to retire because his back is going to start cracking. So I think you just go ahead and just, you know, link up with Tomas, link up with Tomas and start letting him be your, uh, be his apprentice. Why not? I volunteered. He, that is, I mean, just so, you know, that's how I got here. Right. I reached out one day, not sure what came from me. Not just like on LinkedIn. Like, I gotta let you know I've been cyber stalking you on LinkedIn, not really stalking. Right. But like following with admiration and he's like, you should come on the fireside chat. So here I am. Um, and, and yeah, I would love that job one day. Uh, and you know, not to call, not to call attention to anything, but it's exciting. It's a super bowl. And that halftime show was like, I was looking just as much at the ransomware, um, with the, what the 49ers that weekend, not going to talk about that. Right. But to me, that was just as interesting. And I wish I could have known more. Right. So appreciate, appreciate all of this. Hopefully I don't get kicked out for bringing that up. Oh, we've got to move you to the audience now, Ryan. Ryan. Ryan. Ryan. Ryan. Ryan. Ryan. Ryan. Ryan. Ryan. Ryan. ! ! ! Ryan. ! Ryan. ! Ryan. ! ! ! ! ! ! ! ! ! ! ! ! to say I am so grateful for all the women on the phone today and Tomas your dedication to diversity and inclusion in the space makes my heart sing and Brian thank you for your service and it was so great to hear your story tonight and I just want to say I am so excited about this forum and I'll be back thank you for inviting me and just lots of applause for all the females in the in the audience tonight I'm just so impressed thanks for coming up on stage and I am equally impressed Annette over to you anything you want to ask Brian hi Brian hi guys really great to meet you guys and I've really really enjoyed it tonight I'm dialing in from London and I'd just be intrigued to to understand perhaps what some of the your worst breaches you've you've had to cover and face over the years what perhaps some of your recommendations would be if anybody's facing that currently at this moment in time what piece of advice you'd give what are your thoughts and what are your thoughts on when people actually pay ransom right you know businesses and whatever you know would you advise you would pay it you wouldn't pay it what are your thoughts that's that's a great question I would say so I'll talk about uh I'll generalize this uh I did have uh some incidents in some past companies uh so this is a unique one uh I don't know if anyone here has had experience working with uh our friends in in the federal government I encourage everyone to make those connections uh reach out to your local FBI and and find out who your cyber uh you know you know agents are that are in your region it's important to maintain that partnership and and really help uh you know just have that connection but I remember this was many many years ago and a few companies back I had a knock on the door and it was uh our friends at the three-letter agency and uh they gave me the network diagram for the building that I was in they were like yep we found this online they didn't tell me where it was uh what site it was on when they found it uh it was kind of like a you know this is before cloud so it was pretty alarming for us to actually see that uh so that was one of the bigger ones because again it was a three-letter agency that actually came and knocked on my door and gave us that information so that was not to say scary it was just unique that that you know we we had that level of of information that was publicly available and when I say it was a network diagram it was our entire architecture that was you know publicly available I would say preparation is the key when it comes to breaches um just like in in football tomas like you win the game in prep and you win the game in practice so I would say always be prepared uh for for for these breaches I host a lot of tablet tabletops I do a lot of tabletops basically before every single big launch um a new region or any new feature we hold tabletops and we talk about these type of scenarios because how you respond look everybody on on the call you're gonna go through an issue like don't think you're gonna go through your entire career and this is not gonna happen it is gonna happen like so how you respond to it how you prepare to it is is is is key right so constant preparation constant vigilance um keeping your engineers and keeping your practitioners uh uh trained up and and ready to respond I think is the key thing to to resolving that incident as as security practitioners our job is to prepare for response to recover from those three things you could sum it up right so it's that that recover from uh where incident response comes key and then on your last question on the ransom that's a total business decision I I think we're part of the preparation right look at like how your cyber insurance is where that covers it do you have uh ransomware brokers as part of your cyber insurance are you do you know who can invoke that do you know how to actually contact those cyber those those ransomware brokers um if you need to engage that practice that understand that and then it's a business decision I'm not going to say pay or don't pay it's it depends on your business what's the risk if you don't pay what is the risk to the impact to your brand your customers your service that that is a total business decision as a security practitioner I think it's your job to help the business make that that good decision help quantify that risk help understand what that recovery time is if not right so I think that's where security practitioners need to play a role it is really helping there again preparation and and response um so yeah I think those those I hope that answers your question that's great thanks very much and you know this is Lisa Beth I'll just chime in because I simply can't help myself I am not acting as anybody's legal representative but just be aware that the office the uh that OFAC the office of foreign asset control has put out some some guidance on payments to uh individuals that could be listed on this uh SDN list the specially designated nationals list making it uh possible that if you're paying somebody um a ransom that you could be violating other laws so just be aware that's one of the things that's kind of a new trend in this space and Brian completely agree with you it is a business decision but there's a little there are lots of factors in there thanks for popping up on stage and that and wow it's 2 a.m thank you that is uh that is some look we appreciate you uh joining us um on stage we do recognize it is 2 a.m but thanks for popping up on stage and asking your question um look it is 9 24 p.m eastern time we've got about six minutes left uh so if there's anybody in the audience that wants to jump up on stage and ask a question feel free to raise your hand it's been a quiet group to be quite honest usually we got a lot more people on the stage in the audience so especially from from some of the regulars in here uh we do i do see recognize uh some uh folks there's been some folks throughout the day or throughout the session uh with the little party hat uh on their sort of icon welcome to clubhouse that means you're relatively new to clubhouse so welcome to clubhouse um Brian i'm gonna uh actually before i get to this mods any any sort of final question before i ask uh my last question i'll take no question but brian thanks for being with us and uh i really admire what you did when you named the names of your three mentors men i don't know those folks but i really admire them and and uh it would be really cool if they were some way to be able to know the tribute you pay to them and the impact they had on you so much respect for that thank you now they'll be able to replay this back because they're going to start wondering tomorrow when they get a bunch of emails like who's emailing me and why am i freaking out for them they got they're going to come and play this back and say oh brian thanks thanks really appreciate it no no that that is that is good on you my friend um look so i usually like to ask this question uh we we we talked about books but you you kind of you kind of didn't make any book recommendations i really want to know if there was anything that you were reading that wasn't cyber related uh but i'll ask you you know if there was one piece of advice that you could give to the younger brian what would it be and why oh wow that's that's a good one the younger brian i would i i wish i would have gotten sir con's advice when i was uh first coming into the industry i was uh you know not being afraid to fail i think i overcompensated a lot early on in my career because i was afraid to tell the business bad news or be that person that that had bad news for the business and i think that that really impacted my my career i think early on so i think that's you know something that that i wish i could i could change i've definitely learned from it and and really done it and and not you ask about a book and i'm all about audible sorry uh there's one audible that i would recommend and that's extreme ownership it's and that's by jackal wilkin who was a a former navy seal and and the concept of extreme ownership is that right like not pushing the blame not saying hey i i you know i passed a ticket on to this team it's their problem now right i drive extreme ownership throughout my my teams it's like you own that problem from the floor to the door like you want to make sure that that problem is resolved don't don't say hey it's now that team's responsibility are you following up are you ensuring that that is done are you ensuring that you know we're securing the customer experience and that issue that you identified as has been resolved but that that that uh that audible it's a little long it's 26 hours but it's definitely uh i i would recommend it to anyone it's again extreme ownership by jackal walker i just added it to my audible list my friend i'm an audible guy as well i like listening to to audiobooks on my drive in the work because i've got like an hour and a half drive but anyways enough about me but i will add that to my list and you know i like to call that customer service so you know jokingly or not jokingly but early on in my life you know i was in a fast food restaurant business and it was all about customer service making sure that the customer was happy when they came in and when they left and so ensuring that you take ownership of that as of their experience if you will you know that's what i like to call it customer service but i'm going to read that or listen to that extreme ownership book because we can't say we read it right if it's audio so i'm going to listen to that book um but anyways mods any final thoughts before we kind of conclude man even the mods are quiet today wow thank you brian for your time and for your inspiration tonight it has been truly exceptional so we just appreciate you being here thanks for the opportunity i loved it this is a great uh just great fireside chat i you know i would welcome the opportunity to come back and just a lot of fun yeah thanks for it i think don't okay go ahead activate that i can't say oh i'm sorry no i think we all were trying to add the same ownership to our audible at least i was so quiet i was like i'll be back in a second uh 26 hours though wow that hurt my heart um thank you brian so much for for being here i think you know just the you have a leadership presence and you you speak about leadership um in a very clear and concise way and i would just you know i know that you are you're passionate about being an extra professor but like that leadership is needed in the industry and your your voice is definitely needed it and so i would actually you know you know consider and encourage you to continue um to speak and and to encourage more leaders in this in in cyber security so thank you thank you yeah and my my final thought and what i was going to say before is just um don't take our silences um it's anything uh negative i i was just marinating and all of the really great tips that you gave us tonight um really just amazing insight and you know anyone in in in this industry we're always building out teams we're always having to move very quickly the reminder to fail fast uh it's just such a great reminder so i just want to thank you again for your time and all of your insight tonight awesome thank you and i'm sorry maz i know you guys were doing something uh um obviously adding the audiobook i did as well uh i was just messing with you all but look brian it's been it's been really fantastic having you uh with us this evening uh thank you again for taking the time out of your day obviously thank you for your service uh ryan who came up on stage thank you for your service and if there's anyone in the audience who from the military thank you for your service uh we do sincerely appreciate uh appreciate you and all you your sacrifices um there was one thing that i wanted to say oh before we before we kind of conclude uh i just want to remind everybody again we do this every wednesday 8 pm eastern time uh till about 9 30 pm eastern time if you tune in next wednesday uh so march 2nd we have steve tran who who is the former cso at mgm and i believe is the current cso at um the dmc yep dmc yep so uh tune in i'm sure i'm sure steven i'm sure steve has a ton of interesting stories so please join us back next next week and so brian again final words for you my friend awesome thank you very much again really appreciate the opportunity to be here it's been a lot of fun uh i would say final words it's uh let's stay together as an industry it absolutely takes a village uh to do this we're stronger together we're stronger together not only in the industry but as tomas mentioned earlier like and bringing more diversity uh you know and inclusion into the industry diversity of thought is incredibly important in problem solving and bringing those practitioners in uh to bring that diversity of thought and security is is is totally important so let's let's continue to stay together as an industry and and uh let's let's you know look out for each other please find me on linkedin and twitter and you know i'm happy to connect with anyone here absolutely follow brian on uh on linkedin and twitter and obviously on clubhouse because i'm sure he'll be speaking again and brian if there's anything that we can ever do for you uh don't hesitate to reach out and uh and get in touch with us and let us know so that's the uh that's our show this evening thank you all for for attending uh we will see you all back next week 8 00 pm eastern time on wednesday cheers bye everybody bye thank you bye everybody bye