Breaking into Cybersecurity Leadership - Jeffrey Wheatman

Christophe Foulon: 00:00:23

Welcome to another episode of Breaking into Cybersecurity

2

: 00:00:27

Leadership, where we talk to leaders

within the cybersecurity field to

3

: 00:00:32

learn about the skills and competencies

needed to develop the next generation.

4

: 00:00:37

Today we have Jeffrey Wheatman,

who's on the show, and he'll

5

: 00:00:41

be sharing his insights.

6

: 00:00:43

On what it takes to become a great leader.

7

: 00:00:46

But before we get there, this is a

reminder to share this episode and

8

: 00:00:51

others, with anyone that's interested in

breaking into cybersecurity or breaking

9

: 00:00:57

into cybersecurity leadership so that

they could see the different skills,

10

: 00:01:00

competencies, and approaches that'll be

successful in advancing their career.

11

: 00:01:05

Jeff, before we jump in, give us a

little bit of background about yourself.

12

: 00:01:10

Jeffery Wheatman: Yeah, absolutely.

13

: 00:01:11

Hey, Christophe, how are you?

14

: 00:01:12

It's a pleasure to talk to you again.

15

: 00:01:15

So I have a little bit of an interesting

career in cyber because I actually

16

: 00:01:19

started out, believe it or not, in retail.

17

: 00:01:20

I managed a hardware store in

New York City when I was, when

18

: 00:01:24

I first got outta college.

19

: 00:01:26

You know what?

20

: 00:01:26

But I hated it.

21

: 00:01:28

I hated being in retail.

22

: 00:01:29

I hated I hated that whole thing.

23

: 00:01:31

And I, and

24

: 00:01:32

so I put myself through a training.

25

: 00:01:34

I'm dating myself.

26

: 00:01:35

I got certified in Novell

Network three point 11 to show

27

: 00:01:39

you how long I've been around.

28

: 00:01:41

And I did a bunch of technical

things and between you and me and

29

: 00:01:45

all the people listening, I was never

super great at a technical person.

30

: 00:01:48

But what I.

31

: 00:01:49

To.

32

: 00:01:50

So that's really driven

a lot of what I've done.

33

: 00:01:52

When I finished my, my network

certification, I actually

34

: 00:01:55

went to go work for a company

that installed color printers.

35

: 00:01:59

I ran a team that installed these

raster image processors that were

36

: 00:02:02

built on the old Silicon Graphics

pizza boxes, if you remember those.

37

: 00:02:05

Flat blue things.

38

: 00:02:06

I sorta, I moved around quite a bit.

39

: 00:02:09

I ended up in consulting where I ran a lot

of teams and I built consulting practices.

40

: 00:02:14

I ran security and network

operations for Martha Stewart in

41

: 00:02:17

New York City for a number of years.

42

: 00:02:20

And before anyone asked, yes, I was

there during the investigation, I was.

43

: 00:02:24

The thing that was super interesting

about that is back then the lawyers

44

: 00:02:28

didn't have paralegals that knew

anything about cybersecurity or tech.

45

: 00:02:31

The FBI didn't really know a lot about it.

46

: 00:02:34

They didn't know about things like

MD five checks, sums on files.

47

: 00:02:38

I sent them files and I sent them all

the MD fives and they said, what's that?

48

: 00:02:42

And the response would.

49

: 00:02:44

I went, oh, okay, I'm gonna,

I'm gonna keep this here.

50

: 00:02:46

And I did that for a while.

51

: 00:02:48

And then I went and I built another

I built a consulting practice.

52

: 00:02:51

I had my own company for a little

while, and then I, stumbled into

53

: 00:02:55

the job at Gartner where I had

the opportunity to work with.

54

: 00:03:00

Tons of Fortune 1000 CISOs and Chief

Risk Officers and CFOs, and I learned

55

: 00:03:08

more about leadership and managing

people and working with people from

56

: 00:03:12

watching other people do it and seeing

what worked and what didn't work.

57

: 00:03:15

And I did that for 15

years and I love that job.

58

: 00:03:18

I love the.

59

: 00:03:19

At Black, I.

60

: 00:03:21

And now I'm closer to the problem.

61

: 00:03:23

So we work in the third party

risk intelligence space.

62

: 00:03:27

And I work with a lot of CISOs.

63

: 00:03:29

I work with a lot of people in sourcing,

procurement and vendor management.

64

: 00:03:32

And one of the things that I do

a lot of with them these days is.

65

: 00:03:37

I help them engage with their non-IT

non-technical partners where people

66

: 00:03:42

tend to struggle when this gonna a,

67

: 00:03:45

and they had two breaches,

very significant breaches.

68

: 00:03:48

The CISO got fired.

69

: 00:03:50

The CEO got a raise and became

the chairman of the board.

70

: 00:03:52

They put out their annual report.

71

: 00:03:54

They didn't talk about cybersecurity risk.

72

: 00:03:56

Yes, they railroaded the ciso,

but at the end of the day.

73

: 00:03:58

Did the CISO do a good job

of communicating the business

74

: 00:04:01

impact of those cyber risks?

75

: 00:04:02

And they probably did not.

76

: 00:04:05

So that's kinda kind of my story.

77

: 00:04:08

I love to talk to people about coaching.

78

: 00:04:10

I love to mentor people.

79

: 00:04:12

And I'm a big fan of helping

people become people, become

80

: 00:04:15

leaders as opposed to manager.

81

: 00:04:17

Christophe Foulon: Yeah, absolutely.

82

: 00:04:18

I think helping new leaders switch

from a tactical hands-on approach to a

83

: 00:04:25

more strategic holistic approach when

working with the business is critical.

84

: 00:04:30

I.

85

: 00:04:30

As they move up, but

let's take a step back.

86

: 00:04:34

In your career, you pivoted from, at

some point, from being an individual

87

: 00:04:40

contributor to starting to lead teams.

88

: 00:04:43

whAt in you decided that you really

wanted to lead teams versus just

89

: 00:04:49

controlling your own workload?

90

: 00:04:50

Track 1: That's a great question

and I think it's I'm gonna

91

: 00:04:54

paraphrase a famous quote, right?

92

: 00:04:56

Some some people seek out

leadership, some people have

93

: 00:04:59

leadership thrust upon them.

94

: 00:05:00

And what happened was people

started coming to me and asking

95

: 00:05:04

me, Hey, how do I do this?

96

: 00:05:06

Or struggling with this?

97

: 00:05:08

There I have conflict with someone on my

team and I just really started doing a

98

: 00:05:13

lot of the things that leadership does.

99

: 00:05:17

And when when the leadership role opened

up it, I just stepped into it without even

100

: 00:05:22

really thinking about it, and they did

gimme more money so that, that was good.

101

: 00:05:27

But what I realized was I enjoyed

mentoring and leading and working

102

: 00:05:33

with teams and building teams, and.

103

: 00:05:36

As much, if not more as doing

pen testing and doing incident

104

: 00:05:41

response, because those are a couple

of things that, that I was doing.

105

: 00:05:44

I got more satisfaction outta it

and it, that just propelled my

106

: 00:05:48

career and I'm proud to say I've

had a number of people that have

107

: 00:05:50

worked for me in more than one role.

108

: 00:05:52

And a very good friend of mine told me,

and I almost cried when she told me this.

109

: 00:05:57

And she's a partner at one of the

big big four consulting firms.

110

: 00:06:01

She said, everything I learned

about managing and leading

111

: 00:06:03

people, I learned working for you.

112

: 00:06:06

And she worked for me 20 years ago

and she told me this last month.

113

: 00:06:12

I love that

114

: 00:06:12

something.

115

: 00:06:13

Christophe Foulon: You

already started to answer.

116

: 00:06:15

The next question is, what are some of

the critical skills and competencies

117

: 00:06:20

needed for a cybersecurity leader today?

118

: 00:06:24

I.

119

: 00:06:24

Jeffery Wheatman: All so that, there's

a lot, but we only have limited time.

120

: 00:06:27

So I would say three or four

of the key ones, I think is we

121

: 00:06:31

need to be better listeners.

122

: 00:06:33

We have a tendency, especially those of

us that come from a technical background

123

: 00:06:37

to get in front of a business audience.

124

: 00:06:39

We have limited time, limited

opportunities, so we tend to

125

: 00:06:43

go, here's everything I know.

126

: 00:06:45

And they're overwhelmed and they

don't have the background, they don't

127

: 00:06:47

have the context, and they don't

necessarily what to do with what.

128

: 00:06:51

So I think being a better listener

and being able to understand the

129

: 00:06:56

perspective and the role and what

is it that's important to you.

130

: 00:07:00

So I make sure that I'm.

131

: 00:07:02

So I think being a lister is another

I think another one and here to

132

: 00:07:05

me is the major difference between

being a leader and a manager.

133

: 00:07:09

Leaders lead from the front.

134

: 00:07:11

They're in the front line

when there's a catastrophe.

135

: 00:07:15

They're not home sitting in bed.

136

: 00:07:16

They're in the data center, they're

in the office, they're working with

137

: 00:07:19

the team through the whole thing.

138

: 00:07:22

They're there, act.

139

: 00:07:24

It wasn't even a breach, it was just,

it was an availability issue and all

140

: 00:07:28

the executives were banging on the door.

141

: 00:07:30

My job during that was

make sure my engineers.

142

: 00:07:32

Shield and to be at the front

and not the back orders.

143

: 00:07:37

I think you need people

see the big picture.

144

: 00:07:40

I'm big fan of the parable about

the blind person, the blind

145

: 00:07:43

people in the elephant, which.

146

: 00:07:45

I always use to articulate the fact

that when we're really close to a

147

: 00:07:47

problem, we don't see the bigger

picture, and we tend to make decisions

148

: 00:07:51

based on what we see in front of us.

149

: 00:07:52

And then we step back and it

turns out, oh wow, everyone's done

150

: 00:07:56

that and we now have 10 parallel

solutions that are not necessarily.

151

: 00:08:01

I think that one of the this

is there's discussion on

152

: 00:08:05

frequently, showing that

you don't know something.

153

: 00:08:08

Being open and honest, I think makes

you much more valued as a manager,

154

: 00:08:14

as a leader, as an executive.

155

: 00:08:15

There was Harvard Business Review probably

10 or 12 years ago, did a study and

156

: 00:08:20

they found that being liked was much

more important, quality and an executive

157

: 00:08:24

than being found to be competent.

158

: 00:08:27

Right, and the only way that you can

do that is by not demeaning people, not

159

: 00:08:33

insulting people listening to everybody.

160

: 00:08:35

And here's the key thing, for those of

you out there, just because you listen

161

: 00:08:37

doesn't mean you need to do what they

tell you, but they at least need to

162

: 00:08:41

believe that they are listened to, that

they have been heard, and that you're.

163

: 00:08:45

Mentoring thing.

164

: 00:08:47

I'm a big believer that my job as

a leader, my replacement, right?

165

: 00:08:52

Too many executive see that as a threat.

166

: 00:08:55

I've seen people lose jobs because they.

167

: 00:08:57

Showed up their manager, but

that's not what they did.

168

: 00:09:00

What they did was they brought something

to light that needed to be discussed and

169

: 00:09:03

talked about, and their boss didn't like

the fact that they got caught flatfooted.

170

: 00:09:08

Now, if you get caught

flatfooted, that's on you.

171

: 00:09:10

That's not on that.

172

: 00:09:11

So I think those are a lot of

the things that I think are

173

: 00:09:14

really important for leaders to.

174

: 00:09:16

Christophe Foulon: Yeah we'll

dive into a couple others too.

175

: 00:09:18

Let's dive into delegation.

176

: 00:09:21

How would you define delegation and

your comfort level of delegation

177

: 00:09:25

on a scale of one to five and why?

178

: 00:09:29

I.

179

: 00:09:30

Jeffery Wheatman: Yeah, so I

would've had a different answer to

180

: 00:09:32

this 10 years ago than I do now.

181

: 00:09:34

I think that leaders, especially

in larger organizations, have no

182

: 00:09:38

choice but to delegate otherwise

you will quickly burn yourself out.

183

: 00:09:42

I always joke that when I started

cybersecurity 30 years ago,

184

: 00:09:44

it wasn't even, there's way.

185

: 00:09:47

So I think you do need

able to trust there.

186

: 00:09:50

I think that, letting people do

their jobs I think is very valuable.

187

: 00:09:54

I do think you need to build

touch points in there, especially

188

: 00:09:56

for high profile things.

189

: 00:09:57

You don't wanna be in a position where

you get to the end of a six month

190

: 00:10:01

project that you delegated and it turns

out they did not do what you wanted.

191

: 00:10:05

As far as my comfort with delegation,

I have gotten significantly.

192

: 00:10:10

I, my, the first thing outta my mouth was,

that's fine, but did you try it this way?

193

: 00:10:14

And I was always trying to get people

to do things the way I want, right?

194

: 00:10:18

And I think that is not a great way to go.

195

: 00:10:21

So I would say I probably

used to be a two.

196

: 00:10:23

I'm probably closer to a four now.

197

: 00:10:25

Not sure if I'm ever gonna get to a five.

198

: 00:10:27

I tend to have some.

199

: 00:10:28

I, I do sometimes suffer

from I'm Jeffrey Wheatman.

200

: 00:10:31

Do you know who I'm, and that's sometimes

cha challenging and problematic.

201

: 00:10:36

But I think it's a skill that

can be learned and I think it's

202

: 00:10:40

a skill that can be coached.

203

: 00:10:42

And I think that for leaders that don't

feel they're good at it, go to your

204

: 00:10:45

colleagues and learn how they do it.

205

: 00:10:47

And I think we can learn

from, that's discipline.

206

: 00:10:50

Christophe Foulon: And the

next one I would ask would be

207

: 00:10:53

in regards to collaboration.

208

: 00:10:55

So very similar to delegation, but n now

we have to be actively .Working with them,

209

: 00:11:01

how would you define collaboration and

your comfort level at one to five and why?

210

: 00:11:08

Jeffery Wheatman: So collaboration to

me is an example of the whole is greater

211

: 00:11:13

than the sum of the parts, right?

212

: 00:11:15

If you take five really smart people

and you bring them together, you'll

213

: 00:11:18

get more than five times the value.

214

: 00:11:20

You may not necessarily get five

times the work product, but you'll

215

: 00:11:22

get more than five times the value.

216

: 00:11:24

When I worked in consulting, I learned a

lot about that need to be collaborative

217

: 00:11:29

because the tendency was for the team lead

to go their thing and bring it together.

218

: 00:11:35

You'd end up spending twice as

much time, three times as much time

219

: 00:11:38

bringing all the things together as

opposed to getting everyone in a room.

220

: 00:11:41

I think collaboration has

been significantly hampered

221

: 00:11:45

as a result of covid.

222

: 00:11:47

I Think especially for younger people.

223

: 00:11:49

I think it's much, much more

difficult to collaborate remotely

224

: 00:11:52

than it's to do it in person.

225

: 00:11:54

You and I can have a great interactive

conversation with the two of us.

226

: 00:11:58

Add a third party in on, on.

227

: 00:11:59

It gets more than twice as hard.

228

: 00:12:01

Fourth party, it gets even harder still.

229

: 00:12:04

And moderation of panels noticed you

people becomes harder to moderate

230

: 00:12:11

panel other than a collaborative

environment for people to share.

231

: 00:12:14

To share ideas.

232

: 00:12:16

And I actually, earlier today I had a call

with one of my former colleagues at at

233

: 00:12:19

the, that research firm I used to work at

and we were talking about the fact that

234

: 00:12:23

one of their strengths is they're big, and

one of their weaknesses is they're big.

235

: 00:12:27

Everybody's so narrow, they don't do a

great job on collaboration sometimes.

236

: 00:12:30

I would say that I am

actually very collaborative.

237

: 00:12:33

So I would say on give myself a

wouldn't really on bringing in ideas.

238

: 00:12:39

And one of the things I

always suggest people do.

239

: 00:12:42

When you have a bunch of people from

disparate backgrounds and you're trying

240

: 00:12:44

to come to a, a conclusion, so a workshop

or a tabletop exercise, I always tell

241

: 00:12:49

people, give everyone a different job.

242

: 00:12:51

So for the exercise, the

CEO can act as the CIO.

243

: 00:12:54

The CIO should be the CO.

244

: 00:12:56

The CFO should be the CTO.

245

: 00:12:57

And if you give everyone different jobs,

you don't always get what you want, but.

246

: 00:13:02

A, I never thought about

it that way before.

247

: 00:13:05

And to me that is one of the best

outcomes of co, of collaboration is

248

: 00:13:08

getting people to think differently,

to be able to bring ideas together,

249

: 00:13:13

to create synergies of ideas.

250

: 00:13:16

And here's the thing.

251

: 00:13:17

I think collaboration

is also not just people.

252

: 00:13:19

I think collaboration is tools.

253

: 00:13:22

I think collaboration is data.

254

: 00:13:24

Chatt.

255

: 00:13:24

I have started to use ChatGPT

as part of my team, right?

256

: 00:13:28

Because ChatGPT has

different perspectives.

257

: 00:13:31

I wouldn't go so far to say have thought,

but they have different perspectives.

258

: 00:13:34

And I think collaboration

is about bringing that in.

259

: 00:13:37

And if you're collaborating by

having six of the same people in

260

: 00:13:39

the room, that is not collaboration.

261

: 00:13:41

So you gotta bring in di disparate

backgrounds and perspective.

262

: 00:13:44

Christophe Foulon: And on the

next scale, communication, how do

263

: 00:13:48

you define communication and your

comfort level with communication

264

: 00:13:52

on a scale of one to five and why?

265

: 00:13:54

Jeffery Wheatman: Yeah.

266

: 00:13:54

So on a scale of one to five, I

give myself a 10 on communication

267

: 00:13:57

to pat myself on the back.

268

: 00:13:58

It's a key for what I do, right?

269

: 00:14:00

My job now is, as an evangelist,

is about communicating.

270

: 00:14:04

My job as a Gartner analyst was about

communicating, and about 80% of what I

271

: 00:14:08

did when I worked at Gartner was helping

people be more effective communicators.

272

: 00:14:12

But coming back to the actual

question, communication is about

273

: 00:14:17

bidirectional interaction, right?

274

: 00:14:19

Communication is not

me telling you a story.

275

: 00:14:22

Communication is me telling you

a story, and then as I'm telling

276

: 00:14:25

the story, I'm watching your

face, I'm watching your hands.

277

: 00:14:27

Are you leaning back?

278

: 00:14:28

Are you leaning forward?

279

: 00:14:29

Are you looking at.

280

: 00:14:30

And make it much more interactive.

281

: 00:14:32

I always tell people, and I

tell, I'll tell your audiences.

282

: 00:14:35

Now, when you're talking to someone, don't

ever say, does that make sense to you?

283

: 00:14:38

Because that's super insulting and

very pedantic, but what can you say?

284

: 00:14:43

Is this helpful?

285

: 00:14:44

Will this help you make better

and more informed decisions?

286

: 00:14:47

If your management comes and ask you

this question, do you feel comfortable

287

: 00:14:51

answering it based on, we talked

about, those are all different ways.

288

: 00:14:54

Saying does.

289

: 00:14:55

Not offensive, and you don't wanna

be viewed as pedantic or mansplain

290

: 00:15:00

to, to use a different term.

291

: 00:15:03

But I we had a management meeting a couple

weeks ago and I delivered a 30 minute

292

: 00:15:07

session and then one of my head sales

guys came up to me and he goes, thank you.

293

: 00:15:10

He's thank you for dumbing that down.

294

: 00:15:12

And I said, I didn't dumb down.

295

: 00:15:13

I.

296

: 00:15:14

You.

297

: 00:15:14

Why?

298

: 00:15:15

Why would I make you learn

what I know, when I can take

299

: 00:15:18

what I know and contextualize

it so that it matters to you?

300

: 00:15:21

You're in sales, you don't care about

all of the technical detail, so I

301

: 00:15:25

think communication is very much about

meeting people where they are, and

302

: 00:15:29

sometimes you meet them there and then

you pull them closer to where you're.

303

: 00:15:32

But I feel like it it's, yeah,

I think it's an underused skill.

304

: 00:15:36

I'm a huge proponent of storytelling.

305

: 00:15:39

I do presentations on storytelling

all over the world, and I'll let

306

: 00:15:42

everyone in a little bit of a secret.

307

: 00:15:44

I was at an event and they were

about 400 people in the audience, and

308

: 00:15:47

they were more on the junior side.

309

: 00:15:49

And I'm talking about

storytelling, and I'm looking and.

310

: 00:15:51

I'm an introvert.

311

: 00:15:52

You wouldn't know it from listening

to me, but my, if I had my druthers,

312

: 00:15:56

I would be sitting at home on

the couch with my beautiful wife

313

: 00:16:00

watching TV and never going out.

314

: 00:16:02

But that's not a functional lifestyle,

plus no one would pay me to do that.

315

: 00:16:06

So I have adopted a character and that

character is the cyber risk evangelist,

316

: 00:16:12

and that character is funny, entertaining.

317

: 00:16:15

Create your own character.

318

: 00:16:17

And I think when we communicate,

I think creating your character

319

: 00:16:19

is super, super important.

320

: 00:16:21

And I actually was talking with someone

at an event a few weeks ago and they

321

: 00:16:25

said, so tell me who your character is.

322

: 00:16:27

And they didn't really know.

323

: 00:16:28

And we worked through it and we said,

all your character has these qualities.

324

: 00:16:32

Your character has these weaknesses.

325

: 00:16:34

Let's be that character.

326

: 00:16:35

And when we finished the conversation,

she said that was like, that may

327

: 00:16:38

be the most helpful 15 minutes

anyone's ever given me in my career.

328

: 00:16:41

Because it never occurred

to me that I could do that.

329

: 00:16:44

Everyone thinks they need to

be and you need to be genuine.

330

: 00:16:46

You don't wanna be fake.

331

: 00:16:47

This is a character that I've

been playing for a long time.

332

: 00:16:49

So I think that, those

are super important.

333

: 00:16:52

I don't ability to be an

effective communicator.

334

: 00:16:56

I everything's as.

335

: 00:16:57

Christophe Foulon: Now

pivoting off of communication.

336

: 00:17:00

How would you describe the skill of

influence and why is it so critical for

337

: 00:17:05

cybersecurity practitioners and leaders

to use this skill within their roles?

338

: 00:17:11

I.

339

: 00:17:11

Jeffery Wheatman: That's a great

question and I don't think anyone's

340

: 00:17:14

ever asked me that specific question,

so I think that, the word influence, I

341

: 00:17:19

think has a bit of a connotation to it.

342

: 00:17:22

So we need to be careful, right?

343

: 00:17:23

You don't want people to construe

it as you're being manipulative.

344

: 00:17:28

But I think exerting influence is

about, and coming back to one of

345

: 00:17:32

the first things that said is going

to your audience and understanding.

346

: 00:17:35

So what's important to.

347

: 00:17:37

And then taking that and

wrapping that around what it is.

348

: 00:17:41

I would like you.

349

: 00:17:42

So As a simple example I could

go to my executives and I could

350

: 00:17:46

say, and they're probably money.

351

: 00:17:48

If I go to them and say, so I spoke

with all of the EVPs, the SVPs, and

352

: 00:17:52

they've told us this system here

is probably the most important.

353

: 00:17:55

When we have this system goes

down, gets breached, we're outta

354

: 00:17:58

business, or we're gonna be fine.

355

: 00:18:00

We have to protect that system.

356

: 00:18:01

We have some things we do,

and I'll be honest with you,

357

: 00:18:03

we have some gaps in those.

358

: 00:18:05

We'd like to close those gaps.

359

: 00:18:07

We need to make an investment.

360

: 00:18:08

We need X 5 million.

361

: 00:18:11

If we don't do that over the next couple

years, based on everything we know.

362

: 00:18:15

Suffer million.

363

: 00:18:16

I think is really powerful.

364

: 00:18:18

And then I will, I'll make a

suggestion to everyone out there.

365

: 00:18:21

There is a psychology professor.

366

: 00:18:23

His name is Robert Chi Aldini.

367

: 00:18:25

He works at, I don't remember, it's either

University of Arizona or Arizona State.

368

: 00:18:29

And he wrote a seminal book

probably 15 years ago called

369

: 00:18:32

Influence Science and Practice.

370

: 00:18:35

And he talks about six ways to

get people to do what you want.

371

: 00:18:40

And the book is great if you

can find the original versions.

372

: 00:18:43

He's got a lot of stories in

there, but things like reciprocity,

373

: 00:18:46

if I do something for you, you

feel obligated to do something.

374

: 00:18:48

For me, it's human nature, right?

375

: 00:18:50

If you create the perception of scarcity.

376

: 00:18:53

People will do.

377

: 00:18:55

People wanna do, people want to

interface with people they like.

378

: 00:18:58

And that's where finding

common touch points are.

379

: 00:19:01

So you people like people who look

like them, but they also like people

380

: 00:19:04

who like the same sports as they do.

381

: 00:19:06

They like the same teams, the same

movies, the same books, right?

382

: 00:19:09

The same kind of music.

383

: 00:19:11

So building those bridges and I won't

go through all six of them, but I

384

: 00:19:14

use them frequently, probably every

single day to get people to at least

385

: 00:19:20

understand why I'm pitching them on

whatever it is I'm pitching them on.

386

: 00:19:25

And I think that, the final thing about

influence, that's very important there is.

387

: 00:19:29

Where you are going to be done, you're

gonna be finished making your point.

388

: 00:19:34

You're share what you know what

is just gonna say no, and you

389

: 00:19:39

need to learn to step back.

390

: 00:19:41

You can't drag people all the way,

but what you do need to do is document

391

: 00:19:44

the conversations and document.

392

: 00:19:46

And I think we're gonna see a lot more

of this with the SEC ruling and some

393

: 00:19:50

of the other regulatory stuff that's

coming out where, CISOs cannot be held

394

: 00:19:54

accountable for decisions that are being

made by their business stakeholders.

395

: 00:19:58

So if

396

: 00:19:58

communicating what the risks are.

397

: 00:20:00

That's on you.

398

: 00:20:00

Not on me anymore.

399

: 00:20:02

And I know we don't like to give up.

400

: 00:20:04

No.

401

: 00:20:04

You don't understand.

402

: 00:20:05

Lemme just tell you one more thing

and it'll definitely change your mind.

403

: 00:20:08

And that's just, that's not gonna work.

404

: 00:20:10

Use what you got and then be

prepared to step back and let

405

: 00:20:13

people do what they're gonna do.

406

: 00:20:14

People are, have their own

agency, they're gonna do.

407

: 00:20:16

Christophe Foulon: Absolutely.

408

: 00:20:17

And going from there, let's

talk about another important

409

: 00:20:20

skill the skill of networking.

410

: 00:20:22

How would you describe the skill of

networking and why is it critical

411

: 00:20:26

to cybersecurity and leadership?

412

: 00:20:28

And just to set the stage, this

is networking between computers.

413

: 00:20:33

This is networking between people.

414

: 00:20:35

Jeffery Wheatman: Yes.

415

: 00:20:35

Yes.

416

: 00:20:36

That's good 'cause I don't

know that much about networking

417

: 00:20:38

between computers anymore.

418

: 00:20:39

So I think that's a great it's

a great thing to talk about.

419

: 00:20:43

I think there are lots of different

kinds of networks out there.

420

: 00:20:46

You have your network at your

office, at your company, right?

421

: 00:20:49

You know who decision makers are, and

frequently decision makers are not who

422

: 00:20:53

you think they're, when you first walk in.

423

: 00:20:55

You need to be able to bring

disparate parties together.

424

: 00:20:58

There, there was a book a bunch of

years ago, it was a little bit more

425

: 00:21:02

technical, but it was about networking

theory with people and they identified

426

: 00:21:06

things like hubs and influencers and all

these different roles, and they actually

427

: 00:21:10

used it to analyze the hijackers for.

428

: 00:21:13

So I think you have to

have internal network.

429

: 00:21:15

I think you also have be network

people outside organization.

430

: 00:21:19

People.

431

: 00:21:20

Who are in and out of your vertical?

432

: 00:21:22

One of my roles at Gartner was

I was a leadership partner.

433

: 00:21:26

And the thing I learned, the most

valuable thing I learned from that role

434

: 00:21:29

was that there are things that higher

edge doing that can absolutely inform

435

: 00:21:35

what financial services are doing,

but they're not talking to each other.

436

: 00:21:38

Giving more than you get, giving

more than you ask for, right?

437

: 00:21:42

So I'm very active on LinkedIn.

438

: 00:21:43

I actually just hit 5,000

followers last night.

439

: 00:21:45

I was very excited about that.

440

: 00:21:47

And I, I know for you, you

have a couple more than that.

441

: 00:21:50

I'm never gonna catch up.

442

: 00:21:50

But what I try to do is for every

one thing I put out there where I.

443

: 00:21:55

What we do at Black Kit, because

ultimately that's my job, is

444

: 00:21:58

I talk about other things.

445

: 00:21:59

I talk about what's going on in the world.

446

: 00:22:01

I share parables.

447

: 00:22:02

I take pictures and use

them to build stories.

448

: 00:22:05

And then when people like what I

post, I go and connect to them and

449

: 00:22:09

I say, Hey, thanks for engaging.

450

: 00:22:11

If there's anything you need,

please do not hesitate to ask.

451

: 00:22:15

And I think that's

probably how you and I met.

452

: 00:22:18

On LinkedIn was, I like something of

yours or you like something of mine.

453

: 00:22:23

And I reach out to all those

people and I say, look, I, anything

454

: 00:22:26

you need to do, you reach out.

455

: 00:22:27

I'll be happy to help you.

456

: 00:22:28

I make connections with people all

the time on LinkedIn, outside of

457

: 00:22:32

LinkedIn, and what I have found is

other people are willing to do the.

458

: 00:22:36

I think sometimes security people

have a tendency to interact

459

: 00:22:39

with people and detriment.

460

: 00:22:42

Now, keep in mind.

461

: 00:22:43

You can only have so many close friends.

462

: 00:22:45

So networking isn't always about that.

463

: 00:22:47

And my wife has actually said to me

more than once, my wife owns our own

464

: 00:22:51

company and she does branding for people.

465

: 00:22:53

She says, frequently you get more

from the people who are a little

466

: 00:22:57

bit farther away from you than the

people that are super close to you.

467

: 00:23:00

Hey, can you intro to me to this person?

468

: 00:23:02

Christophe Foulon: I I'd echo what your

wi, I echo what your wife said because,

469

: 00:23:07

for example, in, in my recent search.

470

: 00:23:10

All the people that were close to me

already knew what I was looking for, but

471

: 00:23:15

when I posted it publicly, it's all the

people that I didn't interact with on a

472

: 00:23:21

daily basis that were doing the shares,

that were commenting, that were doing

473

: 00:23:26

And you'll find that the people that you

interact with daily, the reciprocity that

474

: 00:23:32

you have with them usually has been used.

475

: 00:23:36

Continuously.

476

: 00:23:37

So there, there isn't that that

feeling to give you more, whereas

477

: 00:23:43

the people that you've potentially

helped without knowing it, they're

478

: 00:23:47

not willing to go, oh, the advice you

gave me 10 years ago was so helpful.

479

: 00:23:52

Of course I introduced

you to that person, or

480

: 00:23:55

whatever the situation might be.

481

: 00:23:57

But

482

: 00:23:57

totally agree with you there.

483

: 00:23:58

Jeffery Wheatman: Yeah.

484

: 00:23:59

then one thing I'll just add on there

too, which I think is important, I

485

: 00:24:02

for quite a while, I always hesitated

about reaching out to people.

486

: 00:24:06

'cause I don't wanna bother you.

487

: 00:24:09

I don't wanna bother them.

488

: 00:24:10

And whenever I articulate that to people,

they go, what are you talking about?

489

: 00:24:13

It's no bother.

490

: 00:24:14

I love talking to you.

491

: 00:24:15

I love helping people.

492

: 00:24:16

So you are not bothering people as a

general rule when you reach out to them.

493

: 00:24:21

People are on LinkedIn because they

wanna be linked to other people.

494

: 00:24:26

And I think it's important you're not

bothering and you're not bothering me.

495

: 00:24:29

If you listen to this and you

connect to me, I'll respond.

496

: 00:24:32

And if you need anything, I'll

do my best to try to help you.

497

: 00:24:34

Christophe Foulon: And as, as we

wrap up the end of our podcast I know

498

: 00:24:38

you've shared a lot of advice, but

what final advice would you give to

499

: 00:24:42

cybersecurity leaders that are looking to.

500

: 00:24:46

Pivot up from a more tactical

career to a more strategic

501

: 00:24:50

career to move on up that chain.

502

: 00:24:53

Jeffery Wheatman: Yeah, it's a

tough, that's a great question.

503

: 00:24:55

It's tough.

504

: 00:24:56

I think finding yourself a mentor, in

your organization, maybe out of your

505

: 00:25:00

organization who can guide you because

it's a big step to go from being

506

: 00:25:05

a practitioner to being a leader.

507

: 00:25:07

So I think finding a mentor or what we.

508

: 00:25:09

But I think the other thing too is

you need to expand your learnings.

509

: 00:25:15

There's free classes online.

510

: 00:25:16

Learn how to read AP and l.

511

: 00:25:18

Learn how to read a general ledger.

512

: 00:25:19

Learn how to read a balance sheet.

513

: 00:25:21

Take classes in, in public speaking learn.

514

: 00:25:24

Start looking at 10 Ks looking, 10 Qs

looking at annual reports for companies,

515

: 00:25:29

figuring out what it is that is important.

516

: 00:25:32

And here's one last

thing, stop with acronyms.

517

: 00:25:35

Acronyms are great when you're talking

to people in your tribe, but when you

518

: 00:25:38

start talking to people outside of your

tribe, acronyms basically insulate you.

519

: 00:25:42

We don.

520

: 00:25:43

Don't,

521

: 00:25:44

but it's an important thing.

522

: 00:25:46

Meet people where.

523

: 00:25:47

Christophe Foulon: Absolutely.

524

: 00:25:48

Jeff, thank you so much for

sharing your advice with us.

525

: 00:25:51

Truly appreciate it.

526

: 00:25:53

For everyone.

527

: 00:25:54

As a reminder, thank you for joining

Breaking into Cybersecurity Leadership

528

: 00:25:59

where we're looking to help develop the

next generation of leaders so there's a

529

: 00:26:04

leader or a future leader in your network.

530

: 00:26:07

Feel free to share this with them

so that they can learn from the

531

: 00:26:10

skills and competencies of others,

and we can have that diverse

532

: 00:26:14

perspective within our industry.

533

: 00:26:17

Thank you all.