- One of the focus points of the Cyber Work podcast
which has, you know, changed a little bit
since you were last here.
Is cyber security career and career strategy
and so on and so forth.
So one of the findings of the report
what do the findings of the report, I should say,
have to tell someone or say to someone
who is looking to get into the cyber security field
either as an executive level, CIO or CSO,
or even at a lower level, is this surprising gap
in security leadership a sign that career climbers
should be planning their experience
and skills around filling this leadership gap
in the decades to come?
- It's basically saying if you're interested
in being in cyber then just go do it
and you're gonna find a place somewhere.
And I think that one of the things
that we focus a lot of attention on
unfortunately, as far as work force development
and cyber security is we focus on the technical side
of cyber security and the technical skills
that are necessary.
But what our report is showing is that
cyber security is really owned
at a multi-disciplinary level.
it's not the CSO who owns cyber security.
The CSO is really just the coach and the captain.
The entire leadership team owns cyber security
and has some level of ownership
in association with their area of business responsibility.
So, what this is basically saying
is for seasoned professionals, go seek those opportunities
to learn about the governance of cyber security,
security management.
There are actually a number of educational programs
here in Massachusets and New England in general
that are actually focusing attention on executives.
You know business executives learning cyber security
and how it relates to their business.
And preparing them
for more of that governance oriented role in cyber security.
So, if you're an executive, cyber security could be your
pathway to advancing to a board position, for example,
in your area.
When you're just getting into the space,
I think what newer cyber security professionals
should look at is the experiences that CSO's are reporting
as far as being a security professional
and trying to elevate from that security professional
into a business executive role.
The experience that the security executives are learning
is that they really are coalition builders.
They need to learn how to not just communicate effectively
across leadership teams, they need to learn how to
build coalitions, build partnerships.
And you know, building partnerships at a
business level perspective takes a lot of compromise,
give and take, negotiation.
Those are all skills that unfortunately, we just don't learn
as security people. - Yeah, yeah.
- And a lot of times, we're looking at CSO's who are
just crashing into the executive suite
because the board decides they need a CSO.
- Yep.
- And they're like oh well the salary's right,
I'll go ahead and be a CSO and then they find themselves
they wanna get their hands dirty.
- Yes.
- They wanna go to their comfort zone of fixing things.
- Yes.
- And what they're not attune to is
how do you fix the business?
- Yeah.
No, you have to become the ideas person
rather than the nut and bolt person.
- Yeah, hack the business processes
the way you used to hack the code.
- Right, right.
- It's taking that mentality, so,
at that professional level at that entry,
more lower level, professional, seeking those opportunities
to actually engage with people.
To actually deal with confrontation
and deal with conflict.
You know joining a Toast Masters.
Or, joining your local chapter of some business group
or something like that.
Looking for those opportunities where you can work on
translating your security understanding,
your security knowledge to the business
that you're working in will give you paid dividends
in the future as you're moving up the executive ladder.