Fireside Chat w/Jeremy Embalabala CISO @ Hub International

[00:00:00] okay hello hello [00:00:12] started in a few minutes thanks for joining guys we will get started in a few minutes five minutes [00:00:24] so let's get this room set up real quick hope everybody's doing okay hopefully you're all having [00:00:32] a good week so far let's get this set up that was weird [00:00:44] here we go we'll get started in about three or four actually four minutes or so what's up anil [00:00:51] how are you sir i'm doing all right man i'm doing all right it's that uh pre-black hat [00:00:59] trying to not drink any adult beverages because it's gonna be a busy week next week [00:01:06] that ain't happening [00:01:09] well i'm saying i'm trying not to do it this week so that way that way i could [00:01:13] i could save my spare my liver for at least a week um let me get this room set up real quick [00:01:25] let's do this jeremy [00:01:31] i realized that i initially had mistyped jeremy's name on the invite but i corrected it so that should [00:01:39] it that should work out well let's see [00:01:50] all right let me turn me over here [00:01:56] this is our guest this evening [00:02:03] jeremy and bala bala [00:02:09] let's see what are we talking about this evening what do you think we'll do some networking [00:02:21] um [00:02:23] maybe some thought leadership is that one of the options [00:02:27] well maybe it's just leadership let's see yep just leadership yeah i guess we've got some [00:02:35] trying some coaching out of uh [00:02:39] about jeremy how's that [00:02:43] check check can you guys hear me okay loud and clear [00:02:47] uh there we go hello hey jeremy how's it going man pretty good how are you doing okay [00:02:54] doing okay thanks for joining us we'll get started in a few minutes here [00:02:59] um we'll get started in a few minutes let me just i thought i set up the room oh there we go all right [00:03:09] katie microphone check for you hello hello [00:03:15] come on katie we need some more energy than that katie hey hey hey how's that there you go is that better [00:03:24] that's more like katie that that's the katie that we know i love there it is [00:03:30] yeah wednesdays wednesdays are funny because it's like i i love this room for the reason that it's that [00:03:37] middle of the week like my energy level is totally like hit or miss though you're not wrong [00:03:43] sometimes i'm exhausted and sometimes i'm like yeah halfway done so much left to do [00:03:48] does it really ever end though that's the real question yeah not really you're right [00:03:55] i was just telling anil before you guys joined that i am trying to uh minimize my adult beverage intake this week [00:04:04] because next week black hat is going to be a interesting long week so gotta [00:04:11] gotta keep the uh the stamina i guess you know it is going to be a long week at black hat defcon back to back [00:04:17] first time in three years at least for me yeah it would be uh first time in like 10 or 15 years for [00:04:26] me so wow it's been a while it's been a while it's been a while um hopefully uh we all stay healthy and [00:04:36] it's safe next week all right look it's uh it's 8 p.m why don't we uh why don't we get started jeremy i'm [00:04:42] just gonna mute you real quick do a quick little logistics get the room sort of warmed up and uh [00:04:48] and then we'll do introductions and kind of get started uh so just give me one second let me uh [00:04:56] there we go all right so if it's the first time you just joined us is our weekly fireside chat we do [00:05:03] this every single wednesday between 8 p.m eastern time to about 9 30 or so p.m eastern time so an hour and [00:05:10] a half uh this is this is really meant to be a fun conversation uh middle of the week let your hair [00:05:16] loose let your hair down if you don't have hair well if you're losing hair like i am you know just [00:05:22] enjoy whatever you have whatever strands you have left uh but this is the middle of the week [00:05:27] conversation really an opportunity for us to get to know our our guests our guest this evening who is [00:05:32] jeremy on a different level i'll say on a uh uh a less i don't say a less professional level but a [00:05:40] more personal level right you know what makes our our guests tick so it's really good opportunity for [00:05:45] us to to have that sort of a conversation so guard rails if you will for the conversation today if you [00:05:51] are a vendor in the audience for the majority of you who know this already uh please don't come up and [00:05:56] solicit solicit us on your latest and greatest product product or project or initiative now is [00:06:03] not the time uh this is this is really meant for thought leadership along the lines of mentorship [00:06:08] networking and really getting to know our guests and their journey uh so save those conversations [00:06:13] on your solutions for another time another place um i feel like i haven't done this in a while katie and i [00:06:22] noticed somebody in the audience is probably going to be like tomas i sent you a script why don't you [00:06:27] keep to the script it's a little hard to keep this trip because i i like to have fun during these [00:06:32] conversations but i i do need to stay a little bit organized uh so i will say one last comment our [00:06:38] comments and opinions at least for the for some of us on the on the panel this evening are really our [00:06:43] own and not representative of our current or prior employers so please keep that in mind this is being [00:06:48] recorded uh but we ask that you do please keep that in mind don't hold things against us and [00:06:53] hold it as if we were speaking for our companies uh because the majority of us are not in that [00:06:58] capacity doing so this evening uh so without further ado i'll go around the room uh and start [00:07:05] off in introductions and jeremy i will leave you for last so i'm tomas maldonado i'm the ciso at the nfl [00:07:11] anil over to you thanks tomas anil barguese serving as a virtual ciso also co-author of the ciso mentor [00:07:19] jeremy welcome aboard looking forward to the conversation on to you katie hi good evening [00:07:25] everybody i'm katie hannahan i'm the vice president of cyber security strategy for a boutique si in [00:07:30] chicago um also uh run their vc so program um that's how i know jeremy actually a part of the ciso [00:07:37] community in chicago so so really glad to have uh chicago represented tonight in the fireside chat [00:07:43] welcome jeremy thank you i'm jeremy and bala bala i'm a ciso at hub international i'm glad to be [00:07:49] here with you tonight and thank you for having me jeremy thanks for thanks for joining us and [00:07:55] chicago is very well represented this evening katie and jeremy so i'm sure it's going to be a really [00:08:00] great conversation jeremy we usually like to start off the conversation by asking our guests about [00:08:07] their origin stories so i know you just did an introduction it was a very brief one so i think [00:08:14] now you have a great opportunity to take as much time as you want and really introduce yourself and [00:08:19] tell us you know who you are along the lines of as a person if you will in this in this world that we [00:08:26] live in uh and tell us a little bit more about you and your particular origin story okay all right yeah [00:08:33] so i'll go i'll go back to the roots if you will uh to tell that story um so it really it really goes [00:08:39] back to my upbringing um you know i'm a son of uh of an immigrant my dad's from kenya uh met my he met [00:08:46] my mother at central michigan university when they were in grad school my mom is is one of those uh [00:08:51] uh you know second generation you know michigan central michigan dutch uh immigrants and uh you know [00:08:59] my dad's a professor my mom was a high school teacher and uh oldest of seven kids and you know [00:09:05] when i when i was born my my parents decided that uh they didn't want us to go to school um my my mom [00:09:11] wasn't a huge fan of public school system having worked in the school system and so she decided that [00:09:16] she wanted to homeschool us uh and so she convinced my dad uh to let her try it for a year and um [00:09:26] worked out so she ended up homeschooling me and and my six other siblings uh our entire entire career [00:09:33] school and so my first day of school was the first day of college freshman year calc one class 8 30 in [00:09:38] the morning so a little bit a little bit different of a journey um but the reason the reason i kind of [00:09:44] tell that story was it actually afforded me some opportunities to uh you know spread my wings a little [00:09:50] bit and you know do some things that uh you know maybe i wouldn't have had the opportunity to do [00:09:56] you know had i been in a traditional school system and so um well i had you know kind of the the same [00:10:01] normal subjects that you know anybody would have in normal school i was really kind of in middle school [00:10:06] and high school where i was able to kind of branch out a little bit and explore areas that um you know [00:10:13] that i really found interesting and you know in the during that time i really got interested in [00:10:18] technology um i mentioned my dad was a professor and i'm dating myself a little bit i won't say my age [00:10:23] but uh my dad would bring home kind of at the end of the semester this macintosh se if anybody remembers [00:10:30] those the the you know the all-in-one nine and a half inch monochrome screen the three and a half inch [00:10:37] floppy uh you know with a handle on the top and he would bring that home and he would do all of his [00:10:43] grades for the entire semester in excel and i think i was like nine ten at the time and you know i [00:10:49] figured out how to do macros and automate you know the formulas and everything he was doing by hand [00:10:54] prior to that and so it's you know really kind of my first exposure into technology and from that point [00:11:02] on i really couldn't couldn't get enough of it and you know every time i would go to a friend's house [00:11:06] and you know they had computers or i would go to the library and they had computers you couldn't get me [00:11:10] off of the damn computer am i allowed to swear on this thing by the way i should ask before i before [00:11:15] i before i uh kind of you know dip into my personality you you could you could speak as freely as you want [00:11:22] okay go for it okay all right all right i just had to check just had to check so um so yeah so you [00:11:29] know kind of kind of you know started developing an affinity for technology and it was really really [00:11:33] anything from you know anything electronic you know vcrs i was fixing vcrs again dating myself a little [00:11:39] bit um you know got a soldering iron and you know was taking apart tvs and you know really literally [00:11:46] anything that i could do and then uh in high school i started uh by kind of by happenstance again i was [00:11:54] homeschooled during high school i was mowing lawns for one of the neighbors uh and this guy was uh would [00:12:01] go to this is like central illinois right this the springfield illinois is the seat of government for [00:12:06] illinois it's actually the capital this guy was not actually the capital well it's kind of studio [00:12:08] capital now but springfield is the official capital uh and this guy was was going to the state surplus [00:12:16] auctions and buying computers uh you know by by the pallet by the rows of pallets and he had a bad back [00:12:23] and so you know it's a guy that was mowing the lawns for him and so he's like hey can you come out [00:12:27] and kind of help us out and you know load the trucks and everything and so i went to that and you [00:12:32] know i started i saw an opportunity and i started buying you know all kinds of of gear uh you know [00:12:39] pallets and rows of pallets of computers you know cisco switches uh you know literally anything fixing [00:12:45] that stuff up this is when ebay was coming out and then i would sell that stuff on ebay as a teenager [00:12:50] refurb uh and you know you know kind of you really just kind of got into the whole troubleshooting and [00:12:56] you know more and more and more in technology at that point and you know at that point you know i was [00:13:01] still like you know had this voracious appetite for technology i was literally doing anything i [00:13:05] could get my hands on um couldn't drive yet or anything like that so uh you know again being [00:13:10] homeless we have some different opportunities other than you know being in a school all day [00:13:14] my mom would would drop me off at the library i would go to the library and i would spend all [00:13:18] day there you know reading about you know programming languages whether it was java or c or [00:13:23] you know delphi whatever it was uh you know reading about circuits computer engineering books and i would [00:13:29] just read all day and then i would check out stacks of books take them home and just just consume those [00:13:34] um and you know just kind of continue to you know grow and develop this love for technology [00:13:40] and then you know at some point during high school yeah there was actually a guy that i went to church [00:13:44] with uh that was an attorney and he had started diversifying his investments and he started buying [00:13:50] subway restaurants and he bought i think it was like six restaurants when he started and he knew that [00:13:55] you know just kind of reputation that i had for fixing stuff here and there that i had this [00:13:59] appetite for technology and kind of gave me an opportunity to help him out they had some some [00:14:02] some big issues and from there that kind of spiraled into this uh this whole consulting thing and i started [00:14:10] consulting for uh subway franchisees all over the midwest uh iowa indiana illinois um and you know really [00:14:18] focus on their retail point of sale systems but this is also when pci was becoming a big thing and [00:14:24] there wasn't an encryption yet and um you know that was just kind of a a big issue for for for you [00:14:31] know retail uh presence uh you know remote access was becoming a thing there wasn't really a whole [00:14:37] lot of vpn in those type situations and so it was an opportunity for me to really you know help them [00:14:43] point in time with some of their issues but also explore what what existing and emerging technologies [00:14:47] were out there to to help uh these small and mid-sized business owners really optimize and [00:14:53] streamlines their operations having not having any kind of technology expertise so i did that and [00:15:00] uh you know starting an llc and um you know did pretty well with that and then uh ended up uh doing [00:15:07] some 501c3 work uh you know pro bono for um some some ngos overseas and medical medical space and um [00:15:18] through that i actually met uh met some other folks it's kind of crazy how this stuff always [00:15:22] snowballs it's like you start one thing and you meet somebody and they know somebody and they know [00:15:26] somebody and they know somebody and it kind of turns into something um got into this uh this uh [00:15:32] partnered with this consulting firm that was doing law enforcement software they were writing [00:15:36] arson investigation software building code enforcement software uh across the u.s [00:15:41] uh selling it to police departments and you know fire marshal offices across the united states and so [00:15:46] they had this is when the whole cloud was coming out and you know had some expertise there and you [00:15:52] know really just kind of you know continue to consult and hone my skills from from anywhere from kind [00:15:56] of the software development side on the dot net all the way through uh you know cloud implementation and [00:16:01] you know database skills and of course law enforcement and uh you know public sector is very concerned [00:16:06] about security and really really started kind of honing my skills there got out of high school and uh [00:16:12] you know i wasn't sure that i was gonna go into technology um but you know it was something that [00:16:18] obviously i spent a lot of time with and gravitated toward um ended up going to school at uh [00:16:24] university of illinois springfield for computer science and again a bachelor's and i consulted actually [00:16:29] all through all through college um you know paid paid most of my way through through school uh with [00:16:36] what i had made consulting but uh you know as as most of us probably here had you know had had a big [00:16:42] pile of students still alone dead as well um but you know that's really where you know if the university [00:16:48] is really where i decided to to focus in on the uh the security side of computer science and so like i said i [00:16:55] mentioned i did my bachelor's computer science but really you know had a concentration in system [00:17:00] security and information insurance um and i continued consulting and i consulted for a number of years [00:17:08] it was like see it was like another four or five years uh after after college um and enjoyed that and [00:17:15] really enjoyed the kind of the variety of experience and exposure that i got to develop my skills kind of [00:17:22] across the board but at some point right i realized that uh you know i wanted to kind of focus on [00:17:29] security and you know having my own shingle out uh for myself i kind of had to take you know whatever [00:17:35] work came my way and you know i you know i really enjoyed uh cyber security you know the most and you [00:17:42] know did a little bit of hacking as a kid as well um you know never did anything that got me in any [00:17:47] trouble uh but uh you know always had kind of an interest in that and so a few years after after [00:17:54] i got out of college uh you know i decided to and i had gotten married and had kids and he decided that [00:18:00] hey consulting was probably probably not the life for me at the the stage in life that i was in [00:18:06] i applied for a job uh at uh horseman educators which is a insurance carrier publicly traded uh out of [00:18:13] springfield illinois um not not a huge marketplace in springfield but uh um was a good opportunity and [00:18:19] i ended up getting the role and uh came in as a security analyst slash engineer and you know thought [00:18:26] i was you know thought i was hot stuff you know having you know 10 plus years on the bench consulting and [00:18:32] lots of experience and um you know computer science degree under my belt and you know quickly realized that [00:18:39] uh you know there there's a whole lot more to um you know uh cyber security and enterprise level than [00:18:46] you can get from you know small to mid-sized consulting and and what they teach at the universities so [00:18:52] really really spent spent about two and a half years there really you know in the trenches um you know [00:18:58] doing everything from security operations you know sock sock work all the way through uh you know triage and [00:19:05] and security architecture uh and uh you know had some had some great mentors there that actually [00:19:12] challenged me and and you know provided me the opportunity to really grow and develop um it really [00:19:18] really went above and beyond and they were so there were some mentors there um there were some peers there [00:19:23] that also had been there for quite a while that that also challenged me and kind of took me under their wings [00:19:28] and it really helped me kind of blossom and grow and you know i knew that uh you know eventually that [00:19:36] that you know that would run out i kind of i kind of run out of runway there as far as my growth [00:19:40] opportunities you know both professionally but also um as you know as a practitioner and uh you know [00:19:48] decided to to make the jump uh make the jump out of there and uh uh ended up coming over to hub and uh [00:19:55] uh moved to chicago uh for for that opportunity came in uh but actually when i found hub i applied for [00:20:02] the job on on linkedin and it was uh a security architect role and i was like okay you know you [00:20:10] know i'm a security engineer and um you know kind of trending toward that that senior side of the [00:20:16] spectrum you know with the the responsibilities that i had been entrusted with and i said uh you know i'm [00:20:22] gonna i'm gonna apply for this this uh architect role and got a call back and uh you know did that [00:20:31] kind of initial hr screening interview and i was like okay well you know we'll see how that went um [00:20:36] got a second call back and uh it was the second call was an interview with the cso at the time which [00:20:43] you know katie uh you you know you probably know i'm seth mcallister uh one of the one of the renowned [00:20:48] chicago cso's and uh you know talked to him for a little while and he was like hey jeremy you know [00:20:56] um you know what would you think about if you know if we made this a director role you know would [00:20:59] you still be interested and uh yeah i was a little bit shocked by that because i was like well you know [00:21:03] this you know now we're talking about like two jumps up um but you know long long story short ended [00:21:10] up taking the taking the role moving up to chicago um you know at the time your hub was uh you know was [00:21:17] still privately held but it had 10 000 employees um about 1.6 billion in revenue at the time and uh [00:21:25] over 450 offices operating in the us and canada and they didn't really have a security program and so [00:21:33] uh you know we basically had um open dns um security policies that had basically been uh absconded from [00:21:40] the internet someplace and uh you know defender av out of the box that was pretty much what they had [00:21:47] and so basically you know when i when i came on uh the kind of the catalyst for that was uh the board [00:21:54] had recognized that hey cyber is something that you know we need to take seriously we need to invest in [00:21:59] and so they had brought seth in uh as the cso to build out a program uh from scratch and uh so my [00:22:07] position was uh the first position that was hired for that and so when i came in he had just started he [00:22:13] just finished a strategy and started to ink deals with different vendors uh in the space to build [00:22:20] out a stack and build out a program so when i landed um it was you know uh what's what's build this out [00:22:29] and hub was in the middle of or actually just beginning on the journey of a cloud migration so [00:22:34] moving away from you know on-premise database or excuse me data centers uh in the chicagoland [00:22:38] uh in the chicagoland area to to aws and to to azure um and so it was you know essentially we [00:22:46] we've got a we've got to grind quickly uh we've got to build out a full program in a very very short [00:22:51] amount of time and you know kudos to the leaders at hub they recognize that you know it's going to take [00:22:56] some significant investment to make that happen so really in that first year and a half um [00:23:02] um you know we you know we moved to aws we put in a cloud-based web proxy we put in you know uh you [00:23:09] know cutting edge edr solution we implemented a 24 7 uh security operation center with an mssp [00:23:17] you know we put in a sim we put in a full volume management program you know threat intelligence [00:23:22] platforms integrated into our bone management program and into our sim and you know as well as our [00:23:27] our security operation center you know email security the kind of the perimeter gateway stuff [00:23:32] um you know ripped out the old asas and put in next-gen firewalls you know layer seven [00:23:38] data classification and auditing platform you know and then all the you know all the the non-sexy [00:23:44] stuff right the policies and standards and um you know all that stuff that you know everybody everybody [00:23:49] loves right and on top of that right hub is highly acquisitive so at the time hub was doing about [00:23:57] between 50 and 60 acquisitions a year um last year i think we did 74 so we've been doing between 50 and [00:24:04] 70 acquisitions a year uh for the last uh five or six years at least the last last five and a half years [00:24:09] that i've been there so we also put in a robust due diligence program around m&a to ensure that you [00:24:17] know we're not acquiring you know baskets of liability and then you know after we acquire these agencies [00:24:22] you know what is the what is the plan for integration and what residual risks would the organization [00:24:28] uh you know realize post-integration or post-acquisition so you know we kind of put all that stuff in in a [00:24:34] year and a half which is a lot in a very very short amount of time and i look back at that even today [00:24:40] and it's like you know how do we how do we do that and i look back to my experiences consulting and my [00:24:44] experiences at horace man and you know really around having to be scrappy not having a lot of resources [00:24:51] uh or having constrained resources uh and and you know just kind of having to to lean in roll up our [00:24:58] sleeves and and get it done um as a practitioner and really as a as a technical practitioner and you [00:25:05] know that's really kind of what allowed allowed us to do that and be successful [00:25:08] so that was that was kind of the the first year and a half this is this is so i started there uh i [00:25:15] would say february february no march beginning of march 2017 so this is all through i would say [00:25:23] mid 2018 at this point and then at that point you know we kind of we kind of had a functioning [00:25:29] you know program as far as a security stack and tooling and we had we had some people um and at that [00:25:37] you know but we didn't have anything around you know grc so there was no risk management there was [00:25:42] no security governance or it governance for that matter no centralized compliance function so we [00:25:49] started building out our grc team and uh um you know really started with our needs for our needs [00:25:57] around customer information requests so you know hub is an insurance broker and our customers care about [00:26:04] their data and they want to ensure that their data is safe and secure before they do business with us [00:26:09] or while they do business with us and so you know as cyber became more of a concern for our customers [00:26:15] right we started getting requests from existing customers or as part of rfps uh to place their [00:26:21] insurance they wanted to assure you know us to ensure that their day will be protected if they do [00:26:26] business with us and so we built out a a team to be able to to answer those requests and really [00:26:32] attest to the investments that we had made uh in cyber security and the controls we had put in place [00:26:39] to and to ensure help assure our customers prospective customers that they'd be in good hands with us [00:26:46] part of that we also put on a third-party risk management program um that wasn't there in place and [00:26:51] you know internal and external audit facilitation and you know then also keeping an eye on regulatory [00:26:57] compliance right obviously insurance you're dealing with uh pii and and phi and some pci and so you [00:27:05] know across multiple geographies obviously there's no national law around those things outside of hipaa [00:27:11] in the united states and we also operate in canada so there's different provincial laws there different [00:27:15] states in the u.s have different uh different regulations um so um you know really having a whole [00:27:22] capability around how do we stay on top of what we're required to do uh across all those different [00:27:27] jurisdictions how do we stay on top of that um so so we built our grc program as part of that [00:27:33] and uh so that's this that takes us up kind of up to 2019 beginning 2019 and then there was a big [00:27:40] um a big shuffle if you will of uh you know folks in executive chairs uh there's a you know there's a new [00:27:49] new coo that came in and uh a new cio um and a cto position was created so at hub uh security doesn't [00:27:58] report into it so the this the chief operating officer is responsible for it which is split between [00:28:05] a cio and a cto um and then security also reports up to that coo adjacent to it and so 2019 that's kind [00:28:14] of when that configuration uh breakout happened where which you know where it was split security [00:28:20] was always off to the side but uh there was a split and seth mccallister who i had mentioned [00:28:25] who was the cso that had hired me uh vacated the cso role and moved over to assume the new cto role [00:28:31] on the it side so the cso role was open and uh um they put it out to to market and i applied for it as [00:28:41] an internal candidate and uh after you know kind of much back and forth and ado uh long story short [00:28:48] i ended up in the role and i'm still in the i'm still in the role today so uh you know it's been it's [00:28:55] been a fun journey uh thus far uh i hope to be there for for quite some time um you know i would say that uh [00:29:04] you know the the biggest challenge you know in the journey that i've described so far for me [00:29:10] you know isn't really the the hurdles that we jumped or you know the the the bodies of work [00:29:19] that were in front of us that we accomplished to me it was really making that transition from [00:29:23] a technical practitioner to be to being a an executive uh you know that's something that that [00:29:30] was was tough and you know they don't again they don't teach that uh you know at school right and [00:29:37] i'm getting my master's degree in computer science they don't teach that at universities uh they [00:29:42] don't you know you're not going to learn that consulting you're not going to learn that in [00:29:45] kind of some of the smaller shops as a practitioner you really focus on your skills but those are really [00:29:50] things you kind of got to learn trial by fire um and uh so yeah that's that's kind of that's kind [00:29:57] of the journey that uh that i had to for me from from the beginning to to where i am today [00:30:01] that's that's uh that's an interesting story and and i was just thinking back to uh one of the first [00:30:09] things that you said around being homeschooled you know how how forward thinking of your mom right [00:30:14] think about the pandemic and all the parents that had to shift into doing homeschooling and you were [00:30:20] yeah you know your parent was doing that very early on in your in your life uh so that [00:30:25] that um is an interesting skill set to develop or to have had uh develop and and go through i'm [00:30:34] curious uh curious if she could have been like a consultant for for other parents you know thinking [00:30:39] about uh the past two years or so um but just real quick if uh if it's the first time you joined us [00:30:47] there's a little greenhouse on the top left of your screen right next to where it says fireside chat you [00:30:52] click that little greenhouse and join our fireside chat club we do this every single wednesday [00:30:56] we're going to ask our guests this evening jeremy a few more questions and then we'll open up for the [00:31:01] audience to uh raise your hand and you can jump up our stage and you can ask a question so far [00:31:06] further ado anil i'll pass it over to you thanks tomas uh jeremy great insights thanks for sharing [00:31:14] your journey you know one of the things you touched upon you know you know was tom's talked about [00:31:18] uh homeschooling being you know coming from a family of educators you know it was another thing [00:31:24] you you highlight as being drawn to these other opportunities what caused you to pick and open [00:31:30] yourselves up uh it's one thing to have them presented another one to take the leap forward [00:31:35] and being quote-unquote fearless to some degree and taking those on whether subway or consulting [00:31:39] or even into your current role what was that drive behind that that allowed you to step into those roles [00:31:47] yeah that's that's a good question i mean for me i i would really boil it down to just hunger [00:31:53] right i was i was hungry for more i was hungry for knowledge i was hungry for experience so i was hungry to [00:32:00] to get out there and really you know find my place and you know make make an impact and make a contribution [00:32:07] and to me that that was the underlying you know drive that provided me with the uh the momentum and um [00:32:17] you know kind of kind of propelled me forward and you know you just kind of you kind of marry that up with the fact that [00:32:23] i really love technology and you know i i you know i was messing around with security as a kid and um [00:32:30] um you know just really really loved that and felt drawn to that so you you you just pair that up with [00:32:35] the fact that i wanted you know i i had i wanted what's what's my way what am i going to do i was [00:32:40] always thinking about what am i going to do in the future and you know just wanted to take advantage [00:32:44] of every opportunity in front of me to the fullest didn't want to leave anything on the table even at a [00:32:48] young age and so um that was really kind of the mindset that i had and i think that's that's kind of [00:32:54] what motivated me and propelled me um you know to to kind of take some of those challenges and risks [00:33:01] at a young age and and bring me to where i am today all right appreciate that background you know and [00:33:08] along those same lines which one of the roles do you feel prepared you most for the season or were you [00:33:13] able to grain gain or pull knowledge from a leverage uh day-to-day these days no that's a good question [00:33:21] too so i i've thought about that actually uh because i've been asked that question before and i i honestly [00:33:26] can't say there's any one role that really uh i i i gleaned the most or i get i benefited the most from [00:33:35] from an experience perspective right going back to consulting uh you know through you know being an [00:33:42] engineer slash analyst at a publicly traded uh insurance carrier right to building out a program as a [00:33:49] director slash architect uh you know so those are kind of the the three main i guess foundational roles [00:33:56] they all provided something to me right consulting it was really around you know problem solving in the [00:34:02] moment people had major issues and you know i come in and consult what do we have to do we have limited [00:34:08] resources we have limited time there's business disruption being able to kind of operate in the [00:34:13] heat of the moment during a firefight to to solve a problem um for for folks that you know didn't [00:34:20] really have a great grasp or understanding of technology as small to mid-sized business owners [00:34:26] so that's really why i really honed my consulting skills and my ability to communicate with uh you know [00:34:32] lay people so to speak and then you move into you know uh you know the the role when i was at horace mann as [00:34:40] an analyst or you know engineer and you know that's really where i kind of learned how to fit into [00:34:46] corporate culture uh on a larger scale and you know how an enterprise works and you know that's how [00:34:52] i you know where i learned about you know security operations and security architecture and business [00:34:57] process and you know you know all of the uh all of the all of the kind of methodologies and ways that [00:35:03] corporations work you know a lot of that was new for me as a consultant didn't really have to deal with a [00:35:07] lot of that it was really come in problem hey prescribe uh prescribe the you know the remedy for [00:35:14] the symptom and you know let's move on let's get paid uh you know in a public company it wasn't like [00:35:20] that and you had to be a part of the machine and and and find a way to kind of slot in and you know know [00:35:25] your role uh to be able to succeed and so i i learned that there and then you know when i came to hub [00:35:32] uh you know was really kind of bringing those two skill sets together from the consulting side and [00:35:37] then you know the skills i picked up at horace mann uh to build that program but still was a [00:35:43] practitioner again um and so brought those two things together and that's what we were able to be [00:35:48] successful in a short amount of time but then taking over the role of cso uh it was again a pretty [00:35:54] big uh you know a pretty big transition or shock for me even even though it was a move within the [00:36:00] organization i'd already been in it's a very different way of thinking about the world [00:36:04] thinking about the organization and its problems um and and that was something that was a bit of a [00:36:11] transition for me and you know as katie mentioned um chicago's got a great community of of cso's that [00:36:20] support each other and help each other and uh the you know actually before i had transitioned even into [00:36:27] the cso role i had when i had the opportunity to meet uh meet that cso group and really get involved [00:36:32] that's actually when i met katie uh back this is like what four and a half years ago almost five [00:36:36] years ago something like that uh and there was a there was a number of folks uh in that group that were [00:36:41] able to you know kind of help me understand and you know kind of you know understood the path that i was [00:36:46] on and um you know kind of where i was trying to go and really kind of helped me develop that [00:36:51] that executive kind of corporate enterprise thinking and and really you know understand what [00:36:56] it meant to be a cso um you know versus just being a uh an academic you know security practitioner so [00:37:03] there wasn't really any one experience again to kind of sum it up and just you know they all kind [00:37:07] of snowballed and fed into each other that's great jeremy thanks for sharing because again i think [00:37:14] you which has you conveyed you've been able to be in those points and position yourselves you know as [00:37:19] those firms are going through pivotal changes or see changes as an organization as industry with [00:37:24] pci with subway or others that you were able to leverage and snowball into your future opportunities [00:37:30] it's great to hear that on to you katie yeah thank you anil um hi jeremy so fun to have you on the [00:37:38] program tonight yeah i mean so you said a lot of things to tonight that have uh got me thinking um one [00:37:44] of the things that you said was um you know trial by fire um you said that you know it kind of [00:37:49] around the challenges in transitioning from you know technical practitioner to executive um there [00:37:56] are a number of people you know me included um a number of people in the audience um that have had [00:38:01] those moments where you know we're making um you know transitions whether they're as drastic as um [00:38:07] you know becoming a cso for the first time which you know i know you can appreciate because yeah [00:38:11] when we met four and a half years ago i was not a cso and now and now i am and you know a [00:38:15] a vc so role and um it's uh to your point it's it's a shock to the system um and a lot of it you [00:38:21] know in in this industry um you know there is a lot of trial by fire and um what i'd be curious about [00:38:28] is and you can go to any one of your experiences and i love that anil even did the call back to subway [00:38:32] because i think all of these things do piece together in terms of how we solve problems how we [00:38:37] approach problems how we um you know transition um curious about what that trial by fire looked like [00:38:44] what are some of the things that you really felt like you were in the fire maybe a started out as [00:38:49] a failure maybe it was a total failure and and then it became a success uh something like that you know [00:38:55] just i i feel like um knowing you you must uh have gone through some really interesting moments um to get [00:39:03] to get to this point so just can you expand a little bit on on that trial by fire statement [00:39:09] yeah so without without getting into like a lot of the specifics because you know when you know when [00:39:14] you ask the question katie you know some of the some of the things that come to mind you know things [00:39:18] that probably can't share either from uh current company or prior but they all kind of center around [00:39:25] um you know large issues whether they are security incidents or or outages and you know as a [00:39:33] as a technical practitioner that you know you always you know especially on the security side [00:39:40] you know usually security is kind of the the the the last line of defense right the last level of [00:39:46] escalation for that stuff and so you know you're always pretty comfortable about your craft and oh we [00:39:51] have this problem let's go to the logs look at these tools you know let's figure out who's doing what [00:39:56] and what's kind of quarterback situation and what's what's roll through it and so that's that's always [00:40:02] you know kind of the the go-to and you know in a vacuum it's pretty easy right you just kind of fall [00:40:08] back on your trade craft and let's get it done let's handle it and that was kind of a you know [00:40:13] a common theme of uh teams uh past and present just handle it right let's just roll up our sleeves [00:40:19] let's get it done we do this we practice we train for this stuff we you know this is this is what we do [00:40:23] so in a vacuum that's that's pretty easy but when you're talking about you know in an enterprise [00:40:29] environment um i talked about hub being 10 000 employees when i started where we're 17 000 [00:40:34] employees now um so you know larger so the needs of the organization have kind of snowballed and grown [00:40:41] um you know maybe maybe you know maybe as fast or faster than you know my ability to grow and develop [00:40:46] um but when you're when you're in that in that fire at the moment [00:40:52] you know what you got to deal with everybody else you've got to deal with it you've got to deal with [00:40:57] uh you know the sales organization out in the field on the business side you've got to deal with other [00:41:02] executives uh you've got to man you've got to manage up and across cross-functionally with other [00:41:08] stakeholders inside and outside of the organization and those those those operate those experiences that [00:41:14] kind of those issues whether they were incidents or outages whatever they were [00:41:18] were the ones that really challenged me because again falling back on in a silo right falling back [00:41:23] on my trade crap super easy know what to do you know it's kind of a standard way to go about these [00:41:28] things and handle them and um you know to process those things but when you're dealing with [00:41:34] stakeholders and different corporate culture uh people have different levels of understanding [00:41:38] different expectations uh it can become pretty tricky to navigate and so to me those are the [00:41:44] experiences where i gained the most um you know probably had the had the struggled the most but [00:41:50] also benefited the most from a growth standpoint um you know outside of you know my security practitioner [00:41:58] uh you know lens you know dealing up and across the organization um with folks that you know maybe [00:42:07] you know first of all didn't really understand what we were doing um but all you know uh you know [00:42:12] being able to kind of manage communications and expectations that that was kind of a tough thing [00:42:16] and probably the the number one area that i think about the most that i gained from a development [00:42:20] standpoint yeah i can appreciate that and that's exactly actually what i was asking i i absolutely did [00:42:27] not want you to go into specifics about your specific uh whatever within your company so yeah i think that [00:42:35] that that's the challenge too is um you know that the ability to to tell a story um you mentioned one [00:42:42] uh you know one really great mentor uh i i look up to seth as well um is there other people that um [00:42:49] have come along anywhere in your life um uh that uh have the qualities that you uh you know you are now [00:42:57] trying to give back to the the next generation who are those people who have impacted you the most [00:43:01] um in your life in your career yeah that's a great question so seth has obviously been a been [00:43:07] a great uh a great person for me um you know really kind of helped me with that transition from [00:43:13] the technical side into an enterprise leader so um you know forever grateful to him uh for for that [00:43:20] uh that mentorship and coaching and the opportunities he gave me um the the one person that comes to [00:43:26] mind that's been a constant uh throughout the last couple of companies has been a gentleman by the [00:43:33] name of ed wilson um who you know is is is infamous in the circles that know him um but he he was actually [00:43:42] the the security architect uh at horace man when i was there and um you know i i i remember interviewing [00:43:51] with him when i interviewed at horace man and being asked like the toughest questions that i could have [00:43:58] could have been asked i remember like you know going through the interview and answering questions [00:44:03] and getting progressively harder and as i got progressively harder i remember getting frustrated [00:44:07] because the kinds of questions that you were asking were uh you know were maybe a bit obscure or [00:44:15] uh you know he kind of figured out the depths of my knowledge and went beyond that and you know the [00:44:20] whole thing he was trying to do was understand like what your care what my character was and was i going [00:44:24] to bullshit or was i going to um you know say hey i don't know and you know i'll look it up and get back [00:44:31] to you that's what he was looking to understand and so you know kind of fast forward i got the job at [00:44:36] horse man i joined the team and they had a actually a five and a half month training plan where you didn't [00:44:43] do any work for five and a half months you had to get through this training plan that he had created [00:44:48] on all the tools the stack the operations the policies everything before you did anything so [00:44:54] i did that in like three months three and a half months whatever it was um and you know was given [00:45:00] some assignments and i i remember uh you know when i was finishing up training i remember just being like [00:45:07] i want to get i want to get to work like i want to get through this i want to get done and i remember [00:45:10] it was like the holidays i want to say it was like december and he was on vacation and i remember this [00:45:17] is back like in the skype days right the the microsoft skype days before teams came out [00:45:22] and i remember i remember calling him and saying like hey i need to check out on this like i have [00:45:28] questions on i think it was like the sofos stack so you know you know going back to like the on-prem [00:45:32] sofos gear and i remember him like on vacation taking time to call me back you know over skype and spent [00:45:40] multiple hours with me coaching me kind of walking through this stuff to make sure that i got even [00:45:45] though he was on vacation and you know kind of fast forward you know he came back and he was [00:45:50] always there uh he came back from vacation and i asked him like what are you doing here man like [00:45:54] why why why are you why are you in springfield illinois a horse man um you know he come from [00:45:59] the west coast worked for you know a lot of a lot of big firms right and uh you know i remember him [00:46:05] telling me it was all about he's like you know i've of of you know i've run the race right i've been [00:46:11] around you know all all over the world uh consulting or working for large firms and he said you know i'm [00:46:17] just i'm just tired of kind of the you know the kind of the corporate game i just want to i just [00:46:22] want to pass on my craft and knowledge to to folks that are hungry to learn and you know and that's and [00:46:28] that's that kind of sunk in with me because it was well this you know why is this guy taking the [00:46:32] time out of his day like every day at the office to kind of help me self help me learn even though he [00:46:36] had responsibilities or even on vacation and so you know i you know that that that kind of persisted [00:46:43] over the the almost three years like two and a half two and three quarter years something like that [00:46:46] that i was there um and then uh fast forward i left there i came to hub and uh i was there for about [00:46:55] a year and an opportunity came up at hub and uh on the it side not on the security side and he [00:47:03] ended up coming to hub and he's still at hub today and so i still actually rely on him as a mentor [00:47:08] to kind of bounce ideas off of and kind of check me and and uh um you know continue to kind of you [00:47:14] know rely on his experience and his knowledge to kind of help uh you know grow me and um develop so you [00:47:22] know to me he's one of the the core foundational people that was there in the past and is still there [00:47:26] today uh fortunate enough to have him at hub today um that i've been able to lean on for you know the last [00:47:32] you know almost eight years [00:47:38] yeah man i really appreciate that and you know what's really interesting too is just [00:47:41] the fact that you were so authentic you know and and that was what was appreciated and that he was [00:47:47] able to say then um i'm going to invest in you because you were willing to say i don't know i need [00:47:52] to know and that's the thing in this industry as we're pulling up this next generation of cyber [00:47:56] security leaders um i think that's just such an important thing to hear someone who is an [00:48:02] executive physician to say it is okay to say i don't know uh sometimes for example i can say i [00:48:08] don't know how to fly a plane which i just had to throw this out you mentioned springfield in a number [00:48:13] of times today so jeremy today when i called him he called me back and he goes yeah sorry um i was uh i was [00:48:19] flying you know flying out of springfield i had to drop some some people off in springfield and i thought to [00:48:24] myself um that is the coolest flex uh that i have ever heard on a reason that you couldn't pick up [00:48:29] the phone um so i am not afraid to say that i do not know how to fly a plane i thought that was pretty [00:48:34] impressive we always wonder what people do in their spare time now we know one of your hobbies but um [00:48:39] i'm going to reset the room real quick we're already at 7 44 really enjoying this conversation with [00:48:44] jeremy and balabala see so at hub international um really uh you know loved hearing your origin story and [00:48:49] um we have a number of people in the audience jennifer sanders has already come up to the stage [00:48:54] um so we want to open up now um to uh to the room with questions um and again anyone in the audience [00:49:00] feel free to raise your hand um we'll bring you up on stage just have something in your profile so that [00:49:05] we know you are who you say you are um we'll bring you up and ask any kind of questions that you have [00:49:11] and then um please follow the fireside chat so in the upper left hand corner just click on that [00:49:17] a little green house and you'll be able to know not only when the rooms are and be alerted to those [00:49:23] but also be able to listen to any playbacks in case you ever miss an evening so with that i'll [00:49:28] turn it over to jennifer hey katie thanks thanks everybody great to see you um hey jeremy thanks so [00:49:35] much for this um super insightful uh overview and and discussion of challenges and things that you cover [00:49:42] um i'm an attorney and my hair just about like lit on fire when you talked about doing due [00:49:46] diligence on hundreds of acquisitions uh both um in the the security and your how you handle data [00:49:53] and the channels and etc and i caught you uh when you said you you don't ensure you help insure so [00:50:00] clearly your legal and marketing team have coached you on qualifying your statements but um wanted to [00:50:06] ask you how you what teams you work with on that and how you handle that that seems like it's a [00:50:10] that goes back to the cross-functional um coordination that you were talking about [00:50:17] yeah that's a great question so um you know i obviously m and m a is very very complex especially [00:50:23] when you're doing it at scale so um you know we've got a dedicated mergers and acquisitions deal team [00:50:30] that is really out there sourcing deals and you know working on the financial aspects the commercial [00:50:35] terms of the deals uh so we work we work closely with them we also have a dedicated uh mna integration [00:50:41] team that is responsible for all things integration related especially on the technology side um that [00:50:47] lives within i.t so we work closely with them um we also you mentioned legal we work very very very [00:50:54] closely with legal um and you know going back to i talked a little bit about kind of the you know my [00:50:59] dream my origin story a little bit about uh the beginning of the program how we've been able to be [00:51:03] successful one of the keys to our success has been our very close partnership with legal all the way [00:51:09] up to our chief legal officer um i've heard from a lot of uh you know a lot of folks partners in that [00:51:16] externally that i work with that that's kind of a rare thing but you know in our organization i can't [00:51:21] imagine success in m a or anything else without uh you know how close we work with our legal team [00:51:27] um and then you know also on the m a side we also work with a number of third parties uh that kind [00:51:32] of help us with um you know due diligence and we have expertise or where we have um you know needs [00:51:39] that they kind of fall outside of our core competencies and then depending on the acquisition [00:51:45] whether it's you know we do everything from you know a small insurance brokerage agency where maybe [00:51:51] we're buying a book of business all the way up through um we announced earlier this year it's public now [00:51:56] we bought insuring on right which is a digital agency um with you know their own proprietary [00:52:01] software stack and um you know you know uh you know e-commerce platform etc um you know obviously [00:52:08] lots of digital technology assets come along with that so you know they run kind of runs the full [00:52:13] gamut of complexity um and so you know in those cases where the more complex m a's you know there's [00:52:19] the our software development and engineering teams and um our it teams as well on the side of the kind of [00:52:24] the dedicated uh m a integration team that we work with so it's really really kind of across the [00:52:28] board m a really can't be successful without those deep uh partnerships with stakeholders across the [00:52:34] organization yeah thanks for thanks for that that's um good to hear and yeah and i also across the [00:52:41] organization as well as your outside as you said when you don't have the expertise or need it um [00:52:45] leveraging outside expertise i've been in a lot of companies including oracle which is a well-oiled [00:52:49] machine on the m a side so you know seeing good and bad so thanks a lot for that [00:52:59] yeah thank you jennifer um gabby over to you yeah um jeremy thanks for the talk so far um i really [00:53:07] loved that you called out being scrappy and i definitely identify with that i was wondering if [00:53:12] you've had any pivotal moments where you've said hey being scrappy has worked with us worked for us so [00:53:18] far but we really need to buckle down make us a priority and give it the support that it needs [00:53:24] yeah so you know i again if i call i kind of fall back you know on consulting you always kind of had [00:53:29] to be scrappy but in an enterprise environment back at horseman that was really kind of where i learned [00:53:33] that um you know we you know we did we was a mature program when i when i got there so it was really [00:53:40] you know kind of a ktlo was develop mature and grow the program um you know there wasn't a whole lot of [00:53:48] you know additional incremental dollars that were being provided and so we wanted to do you know cool [00:53:53] new things or we wanted to you know pivot to keep up with uh you know the the you know kind of the [00:54:00] threat landscape that was continually evolving it was always what can we do with what we have today right [00:54:05] what scripting can we do or you know what gear can we repurpose or what can we do differently with [00:54:13] this platform or that platform to be able to achieve some some information security outcome and i remember [00:54:20] you know a specific example going back to actually repurposing um and i'm gonna date myself again here [00:54:27] the old nitro sim uh which was before it got bought by uh by mcafee before it was intel i remember [00:54:36] repurposing some of that gear and actually having to modify and recompile uh the some you know nick [00:54:43] drivers in linux uh to be able to you know create a promiscuous uh uh nick card to be able to you know [00:54:50] sniff network traffic and pump that into a um uh you know an nvr threat detention [00:54:57] uh you know type of engine you know that it was you know that kind of thing it was like well we [00:55:01] don't have money for this we don't have the gear you know we we have a threat you know we can't you [00:55:06] know wait till next year's budget cycle and propose something what can we do and so it was really so i [00:55:10] guess you know to answer your question it was really kind of a reaction to you know threats that were [00:55:14] emerging and what can we do today with what we have today what can we repurpose reuse what create how [00:55:21] can we be creative to to solve this challenge because we can't wait till the next budget cycle [00:55:25] try to propose a solution awesome thank you [00:55:34] i love that i love the creativity um in a budget cycle i'm really starting to get uh the sense of [00:55:40] that and this this new role i'm in um speaking of being in the hot seat though we have another um [00:55:46] esteemed attorney on the stage uh jenny uh over to you for your question welcome good to see you hey [00:55:52] katie nice to see everybody um jeremy wonderful listening to your um career very impressive um for [00:56:02] those folks who are you know in a different role than being in in it um and they're moving up into the [00:56:12] executive kind of level which is a natural progression if you're good at whatever area you're doing [00:56:18] what is this skill that you have um learned or honed that you find to be the most valuable [00:56:28] um being in that executive role now yeah that's a good question um you know i would i would say [00:56:38] you know there's really kind of four four areas and i'll break it up into uh three three and one so the [00:56:45] first three uh are around you know knowing your role right what what role are you in today and [00:56:56] you know kind of understanding where you fit in the organization um so that's that's number one [00:57:02] number two would be communicating and listening and communicating being that you know not just [00:57:08] talking stating your position but being able to really listen that's something that people have a [00:57:12] have a hard time doing being able to really absorb and you know we think we're listening we think we [00:57:17] understand what somebody's trying to communicate and say but you know if we're if we're not really [00:57:22] open-minded or objective what we're hearing that could be kind of difficult uh and we don't really [00:57:28] you know get the message and then you got two ships passing in the night kind of thing going on so [00:57:32] that's kind of the second piece third piece being following through always making sure you're able to [00:57:36] execute close things out follow things up that's you know that's kind of a table stakes thing but [00:57:42] it's especially important uh when you're making that transition to kind of that executive [00:57:47] that executive role so those are the first three and i mentioned kind of that's i do three in one the [00:57:52] other piece to that would be you know focusing on the business whatever business that's in and this [00:57:59] is something that you know i continue to you know reinforce with my team and um you know new folks [00:58:04] to come into the organization and i have to continue to remind myself of of as well yeah [00:58:09] whatever role you're in and i'll use you know you know my my role and you know my team's role as you [00:58:15] know information security and i say you know we're not here we're not at hub we're not in this [00:58:20] organization to do information security or to provide information security that's not why we're here [00:58:27] and people look at me like jeremy what are you talking about like you you you run security you're [00:58:32] the cso and you know i tell and i tell engineers this they're like what are you talking about and [00:58:36] i'm a security engineer i'm here to design and maintain and implement controls that protect the [00:58:42] organization i said no that's not why you're here the reason why we're we're here whether it's your [00:58:47] security or some other role the reason why you're in your organization is to help that organization [00:58:51] succeed to help grow and enable that business that's why that's why you're there right as as ed once [00:58:59] told me back when i learned this lesson a long time ago was you know keep that cash register handle [00:59:04] cranking because that's what pays your salary that's why you're there you're there to grow and enable the [00:59:08] business and we do that through whatever function we're in whether it's information security or whether [00:59:14] it's legal or whether it's marketing or whatever it is but that's a you know people say okay well [00:59:19] that's kind of a you know maybe that's kind of a hokey way to look at it but if you look at it you [00:59:23] think about it that's a very important distinction to make if you apply that to information security [00:59:28] terms right we're not here to to do information security if you were just if you were to take [00:59:34] it from that lens i'm here to provide security from a purely academic view you're going to very [00:59:40] quickly become the business prevention unit right if you're an attorney and you approach legal legal [00:59:46] matters for an organization based upon an academic legal view you're going to be very quickly preventing [00:59:52] the business from growing and succeeding and and you're not going to be successful but if you take [00:59:57] it from the lens of how can i enable the business to succeed how can i enable them to win more and [01:00:02] keep more of the existing business and you you can apply your trade craft whatever field it may be [01:00:08] to that to that organization through that lens then you can be successful and that's kind of the [01:00:13] again talking going back to the transition from a a you know a a practitioner at a technical level or [01:00:21] uh you know whatever field to an executive that's something that is tough but to me that's that's [01:00:28] one of the keys to success in making that transition that's awesome i think that's a ted talk right there [01:00:34] three to one thank you so much totally okay thank katie um katie i am mic'd and you're mic'd and then you might [01:00:52] thanks i think i know it was what it was like uh hang on um uh anyways jenny thanks for uh thanks for [01:01:00] that question and jeremy thanks for the dear response um nate over to you yeah thanks so much [01:01:07] and jeremy thanks so much for for sharing your story i've really really enjoyed this this conversation [01:01:11] this evening um one of the things that that stuck out to me when you were talking about taking on your [01:01:16] your director role when you moved over to hub was that you clearly had to stand up a number of [01:01:21] different security programs and it's it's one thing to step into a role and kind of assess the situation [01:01:26] and come up with the strategic plan it's another thing entirely to execute against it any any thoughts [01:01:32] or or insights you can share for for executing against uh your vision yeah so that that that you [01:01:39] know that's that's a good question as well um you know my my first reaction to that was that that is [01:01:44] kind of a whole different ball game having you know not kind of set the strategy and you know been [01:01:50] a part of that coming in it was already kind of pre-baked okay now you got to execute against it [01:01:54] um you know that was definitely something to kind of come to grips with and grapple with [01:01:59] i i would say the the the biggest nugget of wisdom that i have there would be around you know what's [01:02:06] what's best for where we are today from maturity standpoint or what makes the most sense right what [01:02:12] is the you know i i hate i hate the whole term mvp minimum viable minimum viable product but think [01:02:19] about it in kind of in those terms because for lack of a better term what can we do to you know [01:02:24] not check the box what can we do to actually achieve something here uh and and realize an [01:02:30] appropriate amount of benefit and you know kind of move on to what's next knowing that we're not we're [01:02:36] not going to leave that the way it was but we have other low-hanging fruit we've got to pick now [01:02:41] so what's kind of handle that was kind of get an mvp and let's continue to refine and and and mature [01:02:48] those capabilities and when you're talking about executing against a strategy that maybe you know you [01:02:53] weren't involved in and you know standing up new stuff and you just got to get it done you know [01:02:58] it may not be exactly what you thought of it may be a different tool than what you would have picked [01:03:03] it may not have all the capabilities that you think are necessary but what can you do to kind of [01:03:09] establish a common denominator for what makes sense for the organization create a road map and a plan for [01:03:15] how can you how you can refine on that not get stuck on it right harvest all the other low-hanging fruit [01:03:21] and then come back and you know tweak the knobs and and dials right and and the gauges to get to where [01:03:27] you want to be over time because if you just focus on getting it perfect out of the gate you're never [01:03:32] going to get all the other things done you got to get done [01:03:37] no thank you for that it makes a lot of sense i mean take take the ground you can get move forward and [01:03:41] and keep keep progressing so thank you yep thanks nate thanks for joining conversation this evening and [01:03:49] and thanks everybody who's who's jumped up on stage and joined the conversation this evening and [01:03:53] and has kept it going look it is a we're going to go for another 30 minutes or so so if anybody in the [01:03:58] audience has a question of jeremy and you want to you want to raise that question uh live feel free to [01:04:04] raise your hand we'll bring you up if you want to post it in the chat you can post it in the chat and i [01:04:08] will read it off to uh to jeremy jeremy i don't believe we talked about this uh what are you reading [01:04:15] what am i reading right now it seems like i'm reading a lot of uh uh proposed legislation around [01:04:23] privacy and and uh cyber security uh laws but uh um not not really reading a whole lot right now um [01:04:32] really really focused on um you know the outcomes that we've got defined for uh for the for the [01:04:39] organization this year um you know so not not really doing a whole lot of kind of side reading [01:04:46] um you know maybe maybe as i get into the uh the the holiday search it sends a slow down after [01:04:51] thanksgiving maybe i'll have a little bit of time to get back into the books but right now just kind [01:04:55] of focused on the tasks at hand all right man no off all work and no fun is not fun jeremy you gotta [01:05:03] be a continuous learner uh but i'm with you man i'm with you it is it is tough and i'm sure jennifer [01:05:10] appreciates all of the privacy legislations and jenny as well all the privacy legislation [01:05:19] um how much i mean the like legal definitely reads that stuff and you would read the i can definitely [01:05:26] see the security stuff because it's directly applicable how much are you um expected to read in [01:05:30] the private privacy area and understand that stuff for your work yeah so that's that's a good question [01:05:36] i mean definitely you know that's legal's responsibility to uh you know digest that and [01:05:44] and come up with a position you know kind of officially interpret that proposed legislation or [01:05:49] legislation that is passed and say this is kind of what we have to do or we should do um so that's [01:05:55] you know not i don't have to do that um where i you know where i feel i have responsibility [01:06:00] is to take that legislation and interpret that into what does that mean for us practically so in [01:06:07] partnership with legal kind of understand their take on it as these things are developing understand [01:06:12] what pivots do we need to make in our program from a security standpoint or larger from an enterprise [01:06:19] standpoint what do we need to do differently and start to engage in those conversations and then [01:06:24] at that point start to educate stakeholders across the organization about hey these are the things that [01:06:31] we should be doing or that we may need to do in reaction to legislation a or b whether it's you know [01:06:39] a national canadian data privacy uh law or one of the united states or uh you know incident reporting [01:06:45] legislation that that i saw that uh congress is trying to pass right now so it's really around you know [01:06:51] kind of looking forward and not so much making the determination that we have to do this but being [01:06:55] able to start educating folks and planning for um what we might need to do or where we might need to [01:07:01] make investments that's a great great example and just for the room to understand that that partnership [01:07:06] that's really invaluable you don't have that in a lot of companies and so to understand and a great [01:07:09] example you just gave is incident reporting because legal is going to look at it and go oh there was a [01:07:13] breach you know a bunch of data was leaked as of x hour and and you're going to look at it and go no was [01:07:18] it encrypted was it not encrypted what states are they in you know who was affected and so it's a [01:07:22] very it's very much a partnership and it's working through the legalese as well as the pragmatic and [01:07:26] understanding it and so i was just wondering how much you were tasked with it and if you don't know [01:07:29] like when we're um off and oning the microphone like that really quickly that's clapping on clubhouse [01:07:34] because i know you're new so we're like clapping and saying yes to what you're saying and there's also [01:07:37] a um yeah see there was tom to show you so we're just clapping at that and then i'm if you swipe right [01:07:42] like people have been commenting on the talk i don't know if you you know the chat the room chat that's along the side but um [01:07:48] but yeah thanks a lot that that was great yeah and i i would say you know again i mentioned earlier [01:07:54] and you know if you're a cso or you know aspiring to be a cso or kind of move into the the executive [01:08:00] management on the security side really really invest in those relationships uh with your your legal team [01:08:08] uh and really educate yourself uh on you know that whole grc compliance risk management you know [01:08:15] governance privacy law side of the side of the house for me that was a gap area that uh was [01:08:21] actually identified for me when i took over uh the role of cso and so um you know it was something [01:08:27] that i i you know was communicated to me that hey you know we we want you to take this role on um you [01:08:32] know there's some sentiment that you maybe you're not the strongest in this area so i actually spent [01:08:36] like very a lot of time like the first year really doubling down in that area educating myself and [01:08:44] uh trying trying to kind of shore up that gap area for me again as a practitioner a technical [01:08:49] practitioner that's kind of how i came up the ranks uh i wasn't so focused on you know privacy legislation [01:08:55] and instant reporting legislation or you know canadian provincial law or um you know you know [01:09:01] know pipeta or what's going on uh you know in california or massachusetts i wasn't worried [01:09:05] about that stuff it was hey legal is always going to tell us what we needed and so i spent a lot of [01:09:08] time you know building that skill set and and educating myself and as part of that you know i realized that [01:09:15] you know you got to know what you don't know and there's folks that know that and that's kind of how [01:09:20] i started forming that partnership with legal and that's been invaluable uh for us especially as you get [01:09:25] into incidents and uh again reacting to changes in legislation that are happening quickly and the [01:09:30] threat landscape is changing and you know as you all know very very quickly um being able to educate [01:09:35] them they've also legal is able to become a very big advocate for us uh and help keep us connected to [01:09:41] the business and provide kind of a different lens of perspective outside of oh this is you know one of [01:09:46] those you know crazy ex-hacker type you know fear mongers that's telling us we got to do this when you have [01:09:51] your gc uh kind of saying the same thing from a different lens at the same time it kind of helps balance [01:09:58] around the perspective and um really kind of help us get a lot of things done so i really recommend [01:10:03] investing in that those relationships if you can couldn't agree more uh i've worked for i've worked in [01:10:10] the in that legal world for about seven and a half years uh as a cso so i couldn't agree everyone knows [01:10:16] tomas wanted to be an attorney because he was watching perry mason we've heard this story before [01:10:21] that is true jennifer that is true we gotta we gotta educate people on who perry mason was now [01:10:29] but these uh young folks in the crowd uh but yeah we have to educate them on what linear tv is first [01:10:35] and then we can go to perry mason that's true as well no i i i can't um i can tell you jeremy that [01:10:45] you know what you're what you've experienced over the past few years with uh with grc and and having [01:10:52] to build your space in that world or build your build up in that uh capacity and everything that [01:10:59] you're doing now is you know it's only going to continue right i mean people think cso's are [01:11:05] are very technical in nature and some are right but a large majority of what we do is having to interpret [01:11:11] uh interpret different uh laws whether they're privacy laws or regulations if you're in a regulated [01:11:19] industry or the like so i spend a lot of my time reading contracts which is fun fun stuff uh but anyways [01:11:27] enough about that nicholas thanks for uh jumping up on stage uh anything you want to ask jerry yeah so uh [01:11:36] hey jeremy thanks for sharing with us today that's great um i had a question so i'm definitely older [01:11:43] than you because you had a mac at sea i had a fat mac when i was growing up so i got you by a few years [01:11:49] um so no worries about that and and that gives me a little bit of a different perspective um early on [01:11:55] my uh so i've been doing my fourth company right now my second company was a company called digital [01:12:00] guardian way back when and when we started that there was no such thing as a sso um so it's kind of [01:12:05] interesting i've seen i think three years into dg the dlp term came up and the cso term came up and [01:12:10] i've sort of seen it evolve what's interesting now and i'd really like to get your thoughts about is that [01:12:15] it seems like the the cloud and specifically um basic infrastructure like m365 or g suite whatever [01:12:23] you know the basic collaboration tools and file storage and email and blah blah blah sort of and [01:12:28] especially the m365 suite that gives you a combination of all the different components in one seems to be [01:12:34] causing in terms of what i'm seeing is a lot of friction because i see sort of um many times the [01:12:41] infrastructure groups taking responsibility for some of the cloud stuff and keeping the security guys out [01:12:47] uh and not really providing a positive collaboration mechanism partially because what you said previously [01:12:52] like like too many times you know security was not about to your point helping the business security [01:12:57] was about no right they're the no department um and uh and hence now that they've the opportunity to [01:13:03] sort of block out the security folks because they're the no people and this is collaboration [01:13:07] we're going to do everything um it's it's not as collaborative and and what happens is they start [01:13:12] making mistakes they don't understand infosec they don't understand the basics they don't understand [01:13:16] how to tune these things and employ these things you know any of that stuff around it um and on the [01:13:22] other hand sort of many times the security organizations aren't necessarily up to speed and all the latest [01:13:27] you know whatever technology and it causes a lot of friction and and and i've seen in some cases [01:13:33] situations where um sisters are getting fired and replaced by info by operations people on the [01:13:39] on the on the cio side i've seen other situations where the cso's are are are taking over operations [01:13:45] and becoming like a cso operations person i've seen other uh a large fortune sort of uh [01:13:52] a hundred pharmaceutical company assist so just changed their title about six months ago he became [01:13:56] and he was a long-time citizen like 20 plus years um he became the chief digital trust officer right i [01:14:03] haven't heard that term before so there's a lot of i don't know i see a lot of change i see a lot of [01:14:08] good change a lot i see a lot of conflict sort of going on in large organizations i love to hear your [01:14:13] thought and your perspective on what what you're seeing how you're seeing evolving you know um you know [01:14:19] will the cso world be changing over the next five years to something else and evolving or adapting [01:14:23] what what are your thoughts yeah that that that's a good question um you know there there definitely is [01:14:30] a bit of conflict between you know the the security organization and you know traditional [01:14:36] infrastructure organizations if you will and you know some of that some of that is is by design and and [01:14:43] is is natural and healthy that's one of the reasons why you know it helps security doesn't report [01:14:48] into it as it does in a lot of other places but you know what you're talking about i think is is [01:14:54] is uh you know maybe a bit more than that and it's definitely something that that can present itself [01:14:59] especially you know folks are moving to cloud and you know infrastructure teams are looking at you [01:15:04] know how do we bundle licensing in how do we do this how do we do that that we want to do you know [01:15:08] without necessarily having to jump through security hoops or having to get approvals etc and so that [01:15:15] that that is that is definitely there's definitely uh there's definitely something to that that uh you [01:15:21] know needs to be solved and i would say that you know one of the things that that you know i've done [01:15:28] that our team has done is try to you know i talked about not being the business prevention unit and you know [01:15:34] being focused on the business versus being an academic when it comes to information security that's that's [01:15:41] that's really kind of where i anchor in solving some of those challenges and you know i can count on [01:15:48] one hand in the last five years how many times i've had to say no where i've had to say we're not [01:15:56] approving that because we we're trying to you know what i've tried to do is move away from security being [01:16:02] hey you got to jump through our hoop and we're going to say yes or we're going to say no move away from that [01:16:06] that that's that's not going to be helpful that's not going to to work in today's day and age now [01:16:11] obviously there's there's some you know hard red lines that that can't be crossed but the approach [01:16:17] that we that we've taken is let's have a risk management conversation about this let's enumerate [01:16:22] and illuminate the risk and let's talk about that risk let's put it on the table and let's focus on [01:16:27] process and being able to say hey there is there is an issue with proposal a and this is the risk that [01:16:35] it presents to the organization rather than saying no rather than saying we're not going to approve [01:16:40] that and getting into uh you know fisticuffs over it let's let's have a conversation about what that [01:16:47] risk means to the business you know whether you know and hopefully you're having that conversation [01:16:52] some material risk and then let's talk about what what we can do about it right are we going to mitigate [01:16:57] that risk are we going to are we going to propose an alternative solution are we going to find a [01:17:01] technical way to solve for that risk or are you know and likely if we're getting into this [01:17:06] conversation somebody's trying to accept the risk and so versus saying we're not going to approve that [01:17:12] let's have a conversation about the risk and decide and security often kind of owns this subjective [01:17:20] uh decision of who owns the risk let's talk about who owns the risk is this an enterprise risk [01:17:25] is this a risk that that doesn't affect the entire this affects one business unit or you know [01:17:30] affects you know it's ability to operate or is this a risk that that is systemic and material [01:17:35] to the entire enterprise organization because if that's the case maybe maybe you know it doesn't [01:17:40] belong in it maybe it doesn't belong in operations it probably doesn't even belong in security right [01:17:45] maybe that's a that's a that's a a conversation for for legal to sign off on or for the cfo or for [01:17:51] the ceo to sign off on or the board at some point so rather than you know getting to we well we're not [01:17:57] we're not going to approve that you can't do this but you know i i try to was convey the risk in terms [01:18:01] of back to the business what it means for the enterprise and then at that point we can talk about [01:18:05] who who is the best person to you know uh disposition that risk and again you can kind of [01:18:15] decide who's the best person at that point and by taking that approach you kind of avoid a lot of [01:18:19] those conflicts or those conflicts kind of self-resolve where we're not having to kind of play that game of [01:18:24] well we're going to say yes or no does that answer your question yeah just a follow-up so do you feel [01:18:31] when you say so you've only said no once right i assume that's a permanent no but in other times when [01:18:36] you when you were thinking yeah that's really risky right do you feel i know you don't have a liability [01:18:43] of doing this but do you feel a personal responsibility every time you you you you you want to guide somebody [01:18:48] anyway to say well i know you want to uh you know uh send the you know pii or pci to do gmail but [01:18:55] that's not really the best approach right but here's an alternative that may make a lot more sense [01:18:59] does this meet your business requirements do you feel the need to say no but here's another way to do [01:19:04] that or do you think it's the business's problem to go figure it out like no you can't do that [01:19:09] no so yeah obviously you know we want to we want to try to find a better way and that's where [01:19:13] whether it's the business that's trying to propose you know some business process that's risky whether [01:19:18] it's it let's find an alternative way like i do feel responsibility to partner with the business or [01:19:24] it to find a a way that works sense like that's that's that's a table stakes you can't just say [01:19:29] no or that's too risky go figure something else out we've got to partner with them to find out [01:19:34] how we can enable that business how we can enable that process in a safe way and then at that point [01:19:39] right it's well you know whether they want to do it or whether they don't want to do it [01:19:44] okay well you don't want to do it let's put what's what's what's document the risk let's put it in [01:19:48] writing and you know somebody's have to sign off on it and i've yet to find anybody that wants to sign [01:19:54] off on you know documented cyber security risks especially in in today's day and age where uh you [01:20:00] know executives can be civilly liable for these things so to me that's kind of a you know kind of a [01:20:05] nuclear option it helps kind of mitigate some of those some of those challenges so so that that's [01:20:10] an awesome position to be in and i've seen what i've seen over time with some of the the sisters [01:20:15] that do that a lot is the business eventually comes to them proactively rather than waiting [01:20:18] to the end of the project to go hey here's what i'm thinking of doing what do you suggest help me out [01:20:22] but i i guess do you have any suggestions to other sisters in terms of i don't know i haven't seen [01:20:27] anybody do it in a methodical fashion it's all more like typically the sister's personality and [01:20:33] approach and whatever and they just sort of you know they're just always useful and always there [01:20:37] and they they call them into it but i i haven't seen somebody be able to say okay here's a program [01:20:41] to do this in a methodical fashion rather than you know me sort of just being that guy or gal yeah you [01:20:47] know it's just always helpful and you know you get the right personality you're open about it you're [01:20:52] positive about it you know type of thing is is is there a methodical way of doing it for sort of the [01:20:57] younger sisters coming up or you just have to have that right personality no you're you're you're right [01:21:02] about that i'm not i've not found you know there's no process to solve this and you know you can try to [01:21:07] solve it with defined process and you know regimented governance but yeah that's just going to be viewed [01:21:14] in a negative manner or you know viewed as as cumbersome and you're not going to be viewed as [01:21:20] collaborative and as a problem solver so you're really hitting on something there and it's really [01:21:24] about you know again partnering with the business and again not being an academic but being first [01:21:30] an enabler of the business and that that should show through in your attitude your approach you [01:21:36] know where if you're grounded there then you know that that's gonna that's gonna remove a lot of those [01:21:42] barriers and if that's your that's your starting point that's the lens from which you would you would [01:21:47] you attack these problems um you're gonna be better equipped to to actually be that partner and be [01:21:52] successful in and finding a way to mitigate the risk and enable the business versus saying step [01:21:58] through these 50 steps of a process and then we'll see where you fall that's not going to be received [01:22:02] well well i wish you the best of luck and i hope your message goes to a lot of the young guys coming [01:22:07] up and gals coming up because uh i think there's been a bad reputation amongst business and security [01:22:13] of uh sort of being the no department and and your attitude is 100 correct and best for the [01:22:18] the business as well so congrats yeah thank you no you're 100 right it's a great question [01:22:22] that's actually a good a good sort of uh i don't call it a segue an absolute segue but but it does [01:22:31] lead me to to a question about that next level of folks coming up jeremy is there any anything that [01:22:38] you're sort of focused on with bringing and cultivating that next level of talent yeah so that's you know [01:22:45] that's kind of always the the the big question in this this industry is you know where do you get the talent from [01:22:51] because there's a you know obviously we're all competing uh for for talent out in the marketplace [01:22:57] um you know i've seen stats all over the place for the number of the hundreds of thousands of jobs i [01:23:01] think the most recent one i saw is where 700 000 jobs uh open right people that we have people short [01:23:08] we're short people to fill those positions in the industry so that it's it's it's always tough um [01:23:13] um you know as as you know as you look to you know fill roles and find folks to cultivate and [01:23:21] bring up in the organization you know it's important to really understand it and and and for for for the [01:23:27] folks that you're hiring you're working with you're trying to develop professionally to understand where [01:23:31] do they want to go and what what do they feel comfortable with and where what are their aspirations and [01:23:36] you know where um you know where did it for them to have kind of have that self-awareness of where they [01:23:41] they need to develop and grow because not everybody's going to want to be a cso or uh you know kind of [01:23:47] have the skill set or you know not even the skill set but want to tolerate a lot of the stuff that [01:23:52] comes along with that um you know you've got you know you look on the grc side and it's it's a very [01:23:57] different type of folks that are you know looking to come into grc and and uh you know specialize and [01:24:04] grow there than you know maybe on the kind of traditional uh security path so it's it's really [01:24:09] you know it's really kind of up to the individual and as as a leader of of those teams really [01:24:16] understanding you know each of those uh each of those people understand they are people understand [01:24:21] that you know they all have you know different capabilities different backgrounds different [01:24:26] experiences to pull upon i've talked about a lot of my experiences i've been able to pull upon and [01:24:30] talk about some of the gaps that i had right and the self-awareness that was required to kind of [01:24:34] develop in some of those areas the same thing is going to hold true uh for folks that you want to [01:24:38] kind of bring up and develop and cultivate and so those things kind of all have to align uh for [01:24:43] folks that are you know trying to progress in their careers and uh i mean the roads look different for [01:24:49] everybody there's no there's no blueprint for this uh if there was we wouldn't have 700 000 jobs [01:24:56] open uh with candidates that can't fill those roles uh you know this this field has not been around for [01:25:01] a long time and um you know a lot of the things i've talked about as far as you know building [01:25:06] experiences and you know kind of understanding what drives you and motivates you where you want [01:25:10] to go where do you want to invest your time there's a lot of time that gets invested into this and you [01:25:16] know for me it worked out because i really really cared about technology and security i mean i you [01:25:22] know i had home labs i would buy gear off ebay and set up you know entire environments in in my in my [01:25:28] basement and you know work on those things in my spare time because i i really enjoyed that and i i [01:25:33] cared about that and those are the things that kind of helped prepare propel me but not everybody not [01:25:37] everybody really kind of has you know maybe that type of of um you know drive or motivation for [01:25:45] cyber security right maybe they do on the legal side maybe they do on the grc side [01:25:50] um maybe you know maybe they're not going to be an engineer so those i mean you just got to think [01:25:52] about kind of what what drives people motivates people what experiences and skill sets do they have [01:25:57] where do they want to go um and then kind of help them uh kind of help them piece them together with [01:26:03] their vision and and uh then you can present opportunities for folks but it's there's no [01:26:07] there's no blueprint for this at all being a seesaw is sexy everybody wants to do it jeremy you get all [01:26:13] the all the luxuries you get to you get all the big bucks you get to sleep peacefully every night you [01:26:19] got job security what do you mean you're trying to scare off the next generation of talent this is a [01:26:25] great gig we got here i sleep like a baby every night i wake up every two to three hours hey if they're [01:26:32] you know what they're the big bucks are not in security i'll tell you that you know if i i if i [01:26:37] if i wanted the big bucks and i had to go back and do it all over again i'd sell insurance or [01:26:41] you know sell uh sell uh you know security solutions and maybe some of the folks on here [01:26:46] uh you know are are peddling um you know but uh you know i just sit around and go to meetings and [01:26:52] do powerpoints all day that's all i do you know it's not that sexy no i'm not kidding it's not that it's [01:26:56] not that's not that boring um it's exciting it's always fun there's always some new challenge [01:27:00] it's it's there's never a boring day um but you know you've gotta you've gotta have whether it's [01:27:06] a cso or whether it's a vp level it's a director whether it's an engineer whether you're a a sock one [01:27:12] junior analyst like you just gotta have a passion for it and what you're doing because it's you know [01:27:19] people people always think that especially folks that are jumping into the field that you know it's [01:27:24] going to be what you see on the movies or tv right or you're handling incidents every single day [01:27:28] and it's you know you're dealing with the north koreans and the russians and you know that's that [01:27:33] those are kind of flash in the pan experiences that pop up right now and i think we all know that [01:27:36] um you know a lot of it is you know kind of the mundane stuff it's that that maybe isn't that sexy [01:27:44] but guess what it's equally as important or maybe more important than uh some of the some of the fun [01:27:49] stuff quote unquote fun stuff that pops up so um you know as long as long as uh you know you kind of [01:27:55] understand that and you enjoy all of that and you kind of have your eye on the prize you can succeed in [01:27:59] this space absolutely absolutely and i was just i was obviously i was just joking uh but there is a [01:28:07] question in the chat uh from gabby i'll ask that question but i do see samantha on stage so samantha [01:28:11] over to you first and then gabby we'll get to uh to your question uh thanks very much um yeah let's get [01:28:18] see gabby's question and um i'll chime in after that okay sounds good so gabby you want to ask your [01:28:24] question live or you want me to read it off because you're still on stage sure i can ask it go ahead [01:28:31] so jeremy um you've talked a lot about like explaining things so that way lay people can understand um you've [01:28:40] talked about the importance of understanding the business uh so i was looking for any tips that you have [01:28:47] for communicating that business strategy down the chain to the technical staff implementing the strategy [01:28:55] i've i found myself needing to communicate up the chain about impact and value proposition for the [01:29:02] majority of my career but i'm now at a point where i have staff below me and i need to be able to [01:29:08] clearly and effectively communicate the business strategy without overwhelming them and also wanting [01:29:15] to shield them from some of the bs that comes from the top so any tips would be great yeah that's a [01:29:22] great question so i think that you know you're asking i mean you're hedging the right spot as far [01:29:27] as what you're asking because you can't probably take you know the the ceo board deck of the business [01:29:33] strategy you know all you know 40 pages of it or whatever and send that out to the team and say okay [01:29:40] here you go now you understand kind of what business is doing what's all marching that direction like [01:29:43] that's not going to work so you know it actually even even business people it takes a while to kind [01:29:49] of understand that and chew chew it on it for a while and kind of chunk it down into what does this [01:29:54] actually mean and so what i've always done is like actually tried to digest the business strategy and [01:30:00] understand it and in the context of what i've seen the organization doing and where i see the organization [01:30:07] going uh it makes sense oh i see that you know we're acquiring more and more companies every year i [01:30:13] see that we're investing in digital platforms and digital capabilities and you know i see that [01:30:19] you know we're focused on kind of stabilizing the core uh and and building up the the the capacity [01:30:25] and the capabilities the organization has and you know that's that's kind of you know you know just [01:30:31] right there that's kind of like the the entire enterprise strategy for hub which is a uh you know [01:30:37] multi-billion dollar you know 17 000 person organization in just a few sentences so how do you how do you [01:30:42] you take that strategy how do you really understand it consume it and and replay that back into you know [01:30:48] layman's terms not just for your team but for yourself and once you have it down once you understand [01:30:54] and then at that point you can create a security strategy that maps to that business strategy again [01:30:59] how do you create a security strategy that enables that business strategy and if you can communicate [01:31:06] you know those together to your team and you know kind of in the business sense at a very high level [01:31:12] make it relevant for the team of how they can enable that business strategy again going back to [01:31:17] how do you position your team to be an enabler of the business build the security strategy from that [01:31:23] lens it makes it very very real for them uh you know versus you know some board deck that that you know [01:31:30] talks about you know value creation and organic growth targets and etc so that's that's kind of that's [01:31:36] you know kind of how i think about it and the approach that i've taken and um you know i've always you [01:31:42] know we kind of i've always tried to take uh you know understand kind of what what i'm hearing as far as [01:31:48] the business direction what even if it's not a formal strategy and replay that in a way that is uh you know [01:31:55] makes sense and people understand and can relate to and you know and that's something that you know nobody really [01:32:01] taught me i just kind of thought about that because i'm not an insurance guy like i'm not that's not my [01:32:06] background um and you know i was just searching for how do i how do i make how do i become relevant how [01:32:12] do i make sure what i'm doing aligns to what is going to make this this company successful because [01:32:18] that's why i'm here and so i really just got how to learn that and that's me seeking to understand [01:32:24] and learn to digest that is is kind of how i figured that out so spend some time with that when [01:32:28] whatever industry you're in and just you know as security folks practitioners we you know we may not [01:32:32] necessarily have robust experience in whatever whatever field it is that the organization we work for [01:32:39] specializes in or has core companies and but you know find the time to make yourself familiar with [01:32:42] that and be able to kind of relate that strategy back to your team and then create a security strategy [01:32:47] that that marries up to that great thank you so much yeah distilling framing and making it actionable [01:32:54] i think those are all great tips thank you yep thanks for the question thanks gabby and uh and [01:33:00] thanks for joining us gabby i had the pleasure of meeting gabby a few weeks like oh maybe a month or so [01:33:05] ago now at rsa so thanks for joining me in on the conversation samantha over to you [01:33:15] oh no thank you so much i think my question is along the lines of you know um the future in terms of [01:33:22] uh as a see so what do you see as your um i want to go two top challenges in the next six to 12 months [01:33:32] smacking and speaking the two top challenges in the next six to 12 months yeah so the number one challenge [01:33:39] is continue to uh to grow the team uh at at the pace which we need to grow the team so that's you know [01:33:48] that's that's a tough thing again we're growing very very quickly so how do we staff the roles that [01:33:53] we need for the organization um how do we you know develop talent internally and you know provide [01:33:59] professional development opportunities for people you know kind of in the the heat of what's going on [01:34:04] right which is tremendous growth and uh you know an evolution of threat landscape so that's that's kind [01:34:10] of that's kind of number one and then the second the second challenge is you know how do we [01:34:16] how do we look at what we've built over in the last five years at hub and you know we i talked about [01:34:24] the stack we built the program we built you know that can't stay static if it stays static then it's just [01:34:32] a matter of time until we have a breach um or or or you know a cyber related outage so how do we stay on [01:34:39] top of um you know the the threats how do we stay on top of the stack the tooling how do we [01:34:45] ensure that we're continually uh you know revising and updating our processes and and how we operate [01:34:53] to to be effective you know i summarize that it really comes back to efficacy how do we how do we [01:34:58] make sure that the program the investments we've made you know people process technology how do we [01:35:03] ensure that we have the efficacy of the entire program is where it needs to be given that our [01:35:09] business is changing it's growing or diversifying the business and the threat landscape is changing at the [01:35:15] same time so you have multiple variables and you've got to find a way to keep the efficacy high and if [01:35:20] you don't focus on that uh you're gonna your efficacy is going to fall down just a matter of time [01:35:25] until something happens so to me those are two biggest challenges staffing appropriately and then [01:35:31] ensuring the efficacy of the program uh you know stays high as the business changes and the threat [01:35:37] landscape changes [01:35:37] um thank you very much and i'm gonna have a one follow-up question which is around the um ensuring [01:35:46] that you stay up to date with any sort of like changes in the cyber security threat model how do you [01:35:53] and your team stay up to date with current threats or potential threats that can happen in the future [01:36:00] yeah so it's it's that that's a good question um you know obviously staying plugged into the news [01:36:06] the news what's coming out of cissa you know warnings from the fbi you know we work with a lot of [01:36:11] third-party partners i talked about on the mssp side but also a lot of the partners that we have from the [01:36:18] tooling perspective also have very robust uh support and um kind of threat intelligence research arms as [01:36:25] well so they kind of keep us looped in and so as things kind of develop and happen we usually have [01:36:31] two three four sources hitting us up uh simultaneously as we're seeing it in the news uh that's that's [01:36:39] developing i think about you know solar winds as an example um you know i think we had like four [01:36:44] different vendors at the same time as that was emerging hit us up and say hey you know this is [01:36:48] kind of what's going on we see this you know you may be exposed here you may be exposed there [01:36:52] based upon our knowledge of your environment etc so that that kind of helps and um [01:36:58] so you know there's obviously you know you gotta stay plugged in and know what's going on [01:37:02] but it also helps to have trusted partners a variety of trusted partners that understand your [01:37:07] business understand your program understand uh what your environment looks like um so that uh you know [01:37:15] they can be there to assist you um you know proactively as needed and that that's that's been [01:37:21] very very instrumental for us and being able to stand top of emerging threats [01:37:24] yes not to say thank you for that yeah because i think that um what you've highlighted in terms of [01:37:31] um your vendors coming to you and highlighting to you um what the threats are it's so important your [01:37:37] vendors or your auditors because a lot of times um companies kind of depend on their own insights [01:37:44] without realizing there's so many other third parties that you can reach out to in terms of identifying [01:37:48] your threats are yeah so thanks for having a lot um done speaking yep thanks samantha thanks for [01:37:55] jumping up our stage and contributing to the conversation this evening so folks it is 9 33 p.m eastern [01:38:00] time uh it brings us we're going to start wrapping up uh the room uh get to some of the final uh [01:38:07] quest get to the final question uh do you want to make i do want to make a quick very quick announcement [01:38:13] uh again just a reminder if it's the first time you joined us is a fireside chat we do this every [01:38:18] single wednesday uh between 8 p.m eastern time and 9 30 p.m eastern time so about an hour and a half or so [01:38:23] uh you can listen to the playback if you missed the conversation you can listen to the playback in [01:38:27] about five minutes after we close the room uh next week they'll actually i think next week next week might be [01:38:34] a bye week we might actually take uh next week off i know it's uh um i know some folks don't like when we do [01:38:41] do that but uh there will be several moderators out at uh black hat so you can probably find them [01:38:47] find them and find us i guess at black hat if you're in and around black hat next week in uh in las vegas [01:38:54] so that being said uh we if we don't come on with an impromptu sort of conversation next week we do have our [01:39:03] another guest uh joining us in about two weeks time so we ask that you do come back uh for the [01:39:11] conversation uh on august 24th with steph uh steph sheeda steph sheeda joins us and those who know [01:39:20] lisa beth lentini walker she is she and steph wrote the book um wrote a book which i oh don't tell [01:39:29] lisa beth that i can't remember the book's name right now she's gonna kill me but uh she is the co-author [01:39:35] of the book um with with uh lisa beth so it'll be a very interesting conversation that we'll have in [01:39:41] a couple of weeks time uh so with that being said uh jeremy i usually like to i usually like to ask [01:39:48] this question of our guests and and i guess it's been called the final question uh and that is if you [01:39:54] had any piece of advice for the younger you what would it be and why [01:40:07] nope am i still there i bounced out for a second no i hear you now okay what was the question if you [01:40:13] had any piece of advice or one piece of advice for the younger you what would it be and why [01:40:19] oh yeah uh one piece of advice for the younger me you know so you know going back to some of my my early [01:40:31] corporate experience it would be you know be more willing to to listen and learn and you know i talked [01:40:40] a lot about you know understanding the business enabling the business and having that business [01:40:46] focused lens though those are lessons that i learned the hard way uh earlier in my career and uh you [01:40:53] know there was you know through through different types of conflict in different scenarios different [01:40:57] places um so you know those are you know sometimes you gotta learn things the hard way that's one of [01:41:02] the things i learned the hard way so being able to to be kind of more open and and and listen and you [01:41:08] know be less prescriptive off the bat and you're really trying to to take that business focused lens [01:41:14] to versus you know hey i'm an expert security practitioner with credential a b c and d um that's [01:41:20] not gonna that's not gonna be that can be successful um if if you you stick to that so um [01:41:27] you know wish i would take an easy street on that but uh glad glad that i learned the lesson at some point [01:41:35] those lessons keep us growing so that's awesome thanks thanks for that jeremy mods any final words [01:41:40] before we kind of conclude hey jeremy thanks for carving out the time appreciate the insights [01:41:48] especially you know as we've gotten more and more in depth on the privacy and business fronts on [01:41:53] the sea the seasons have to juggle along with everything else appreciate it [01:41:59] yeah i echo that yeah thanks jeremy for spending an hour and a half with us on a wednesday night um just [01:42:04] really appreciated the chance to get to know you better i didn't realize that um you would come up [01:42:10] in such a practitioner technical way um i've i met you when you were already in leadership so um just uh [01:42:18] you know from the outside looking in it's just a really impressive story and um you know very inspiring [01:42:22] so thank you again for uh sharing your time with us tonight um and tomas just just for the room uh the [01:42:29] and and they'll put it in our chat it's the lisa best book is raise your game not your voice [01:42:34] so kind of uh thank you good good transition to it i think that jeremy uh definitely uh is that [01:42:41] type of person as well definitely showed us his game tonight um that's our our co-moderator lisa [01:42:46] beth lentini walker that's the title of her book i hope she doesn't listen to the playback because i am [01:42:51] going to get beaten up next time she sees me in person we'll edit that out we'll edit that out [01:42:57] all right look thanks jeremy thanks for you know you know i concur with the mods thanks for the [01:43:03] conversation this evening thanks for taking the time out of your busy schedule to spend with us [01:43:06] for an hour and a half and thank you everybody for for tuning in and joining us on on this wednesday [01:43:11] evening and contributing to the conversation those who came up on stage and those who uh just listened [01:43:16] hopefully you took away some good points uh this evening that'll help you with your with your career [01:43:20] or help you interact with other security professionals and and you know keep things that that are top of [01:43:25] mind for them uh i'll get a little bit more insight into what's top of mind for them so thank you [01:43:30] thank you jeremy thank you everybody and uh with that we'll see you all in a couple of weeks uh or [01:43:36] we'll chat with you on a couple of weeks have a good rest of your week everybody stay safe thanks for [01:43:40] having me thanks it was fun time thanks everybody