Episode 22 · · 37 min
Izzy Random and Unplanned: From Annuities to ISO!
Information Security Management Systems (ISMS) Manager and founder of VixCyber
Episode summary
Ismaelle Vixsama (aka Izzy) has a knack for finding strategic flaws and speaking up about them. Doing so helped her get her first full-time job as well as have repercussions for defensive egos. Her whole career is a war story.
BIO:
Izzy is an ISMS manager with 7 years of experience. She has worked in FinTech, Government, and Security R&D. Her work has allowed her to work on several mainstream products and services with some of the most well-recognized brands.
Notes:
Creates a security program around a company's information systems
Played the CISO role initially, very CISO like role
First role in security was in Risk
Izzy comes from a very traditional Haitian back
Izzy came up with benefits at her job for an opportunity to learn something new and be in a non-toxic environment
First heard/learned about hacking at 15 from an AOL chat with a "hacker"
At 23, she decided to speak up in a meeting to provide feedback, which led to her being hired full-time
Quotes:
"[By] the time I was 22 years old, the pay wasn't that great but for me. It was amazing because I was doing something I hated. I had benefits at my previous job, but this company was giving me an opportunity to learn something new. To me, that was so exciting."
"He looked at my resume and he said, 'I realize you have no cybersecurity experience.' By starting the conversation like that, it took some pressure off of my shoulders." [10:00]
"I was so nervous that he was going to drill into me about all these topics I had no clue about."
"I didn't even [know] I had sisters."
"Everyone just kinda wrote me off." [16:20]
"Who is the audience, what do we want to say here?" [21:13]
Worst comment ever: "We have to really train you on your critical thinking skills." [22:45]
"A good idea is a good idea, regardless of who it came from."
"My whole career is a war story." [32:05]
Before infosec: Finance graduate working at a retirement services company
Chapters
- 0:00
Cold open and guest intro
Ayman previews Izzy's unplanned path, how speaking up got her hired, and the comment about her critical thinking.
- 1:51
What an ISMS manager does
Izzy explains building a security program around a company's information systems and a CISO-like role.
- 4:27
First role as a risk analyst
She started as a risk analyst in 2012 reading vulnerability scan reports and learning the OWASP Top 10.
- 5:21
A Haitian family, finance and hearing about cybersecurity
Her family steered her away from computer science, and a recruiter first introduced her to cybersecurity.
- 8:10
Interviewing with a CISO
The CISO admitted she had no cybersecurity experience and focused on her audit background and learning style.
- 10:14
Childhood computers and an AOL hacker chat
Her love of computers started in elementary school and a chat with a self-described hacker at 15.
- 14:24
Speaking up on a scorecard gets her hired
An email with suggestions on a risk scorecard led to a job in internal controls.
- 18:18
Asking questions and the critical thinking comment
She describes pushback to her questions, including a CISO telling her she needed critical thinking training.
- 23:16
Dealing with ego and bias at work
Practical tactics for responding to defensive colleagues and stereotypes, including pausing before emailing.
- 28:47
Getting into GRC without experience
Izzy recommends policy writing, risk management, NIST, privacy laws and reaching out to practitioners.
- 31:48
Working with executives
Clear communication, confidence and framing risk in dollars are what executives respond to.
- 34:11
Starting VixCyber and closing
Izzy outlines her consultancy for small and mid-sized companies; Ayman closes with a plug for his community.
Key takeaways
- Speak up with a clear, well-reasoned suggestion; an email with constructive feedback got her hired into her second role.
- Ask questions without apology, and focus on the intent behind them rather than how others perceive them.
- When someone reacts defensively, pause before replying, draft the response and walk away, and consider raising the idea in an open forum.
- To get into GRC, learn how policy writing works, read free frameworks such as NIST, study laws like GDPR, and ask people in the field for guidance.
- Translate risk into business terms, for example dollars lost per incident, so executives understand why budget is needed.
- Be a quick learner who can explain technology in business language; GRC people are generalists who know a little about everything.
Notable quotes
A good idea is a good idea regardless of who it came from.
I think my whole career is a war story in itself
there's nothing wrong with asking a question.
Questions answered in this episode
- How did Izzy get into cybersecurity without a technical background?
- She had a finance degree and some internal audit experience. A recruiter placed her as a risk analyst at Citigroup in 2012, and the CISO hired her because she understood the audit process and he believed the rest could be taught.
- How do I get into GRC with no experience?
- Izzy suggests learning policy writing, GRC tools and risk management, reading free frameworks like NIST, and studying privacy laws like GDPR and the California privacy law. She also recommends reaching out to people in GRC for advice.
- What skills do you need to work with security executives?
- Clear, confident communication is the key one. Izzy says you must explain risk in business terms and be a fast learner who can translate technology into business language.
Show notes and links
Show the original episode notes
Ismaelle Vixsama (aka Izzy) has a knack for finding strategic flaws and speaking up about them. Doing so helped her get her first full-time job as well as have repercussions for defensive egos. Her whole career is a war story.
BIO:
Izzy is an ISMS manager with 7 years of experience. She has worked in FinTech, Government, and Security R&D. Her work has allowed her to work on several mainstream products and services with some of the most well-recognized brands.
Notes:
- Creates a security program around a company's information systems
- Played the CISO role initially, very CISO like role
- First role in security was in Risk
- Izzy comes from a very traditional Haitian back
- Izzy came up with benefits at her job for an opportunity to learn something new and be in a non-toxic environment
- First heard/learned about hacking at 15 from an AOL chat with a "hacker"
- At 23, she decided to speak up in a meeting to provide feedback, which led to her being hired full-time
Quotes:
- "[By] the time I was 22 years old, the pay wasn't that great but for me. It was amazing because I was doing something I hated. I had benefits at my previous job, but this company was giving me an opportunity to learn something new. To me, that was so exciting."
- "He looked at my resume and he said, 'I realize you have no cybersecurity experience.' By starting the conversation like that, it took some pressure off of my shoulders." [10:00]
- "I was so nervous that he was going to drill into me about all these topics I had no clue about."
- "I didn't even [know] I had sisters."
- "Everyone just kinda wrote me off." [16:20]
- "Who is the audience, what do we want to say here?" [21:13]
- Worst comment ever: "We have to really train you on your critical thinking skills." [22:45]
- "A good idea is a good idea, regardless of who it came from."
- "My whole career is a war story." [32:05]
Links
- Izzy on Twitter: https://twitter.com/Is_Vix
- Her story is on Twitter: https://twitter.com/Is_Vix/status/1079218656138149889
- Izzy's Business, VixCyber: https://vixcyber.co/
- NIST Cybersecurity Framework: https://www.nist.gov/cyberframework
- Intro Music: Cascadia by Trash80 - https://trash80.com/#/content/133/weeklybeats-2012-week5 (Released under Creative Commons)
- Outro Music: "Feather Duster" by Geographer: https://www.youtube.com/channel/UCcB_tnqYHwPzADwUdeppIIQ
Getting Into Infosec:
- Twitter: https://twitter.com/coffeewithayman
- YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
- Book: https://t.co/DDXxfVwpD7
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
You know, you ask a lot of questions. And I said, yeah. And then he said, sometimes I wonder if you're asking these questions because you don't know the answer or because you want to hear the response. And I said, a mix of both. And then he started laughing.
Hey everyone, I'm Ayman Elsawah and this is Getting Into Infosec. This week, my guest is Ismael Vixana, aka Izzy on Twitter. Izzy's path into infosec was 100% random and unplanned. However, her impact in the organization she enters is 100%. She shares with us how a CISO took a chance on her. And did you know what a CISO was at the time?
No, I had no idea. I literally had no information about cybersecurity at all, except for the fact that they did stuff on the computer. Many years later, I create a security program around a company's management systems or information management systems.
We talk about how she often has to speak up, which in one case led her to getting her first job.
I said, you want to make sure that you're capturing all this information so that you can make really solid risk-based decision making. I think I said that in there.
Okay.
Based on my response, he said he read the email five times because he couldn't believe that I had written that email. And so he said from there, he just knew he had to hire me.
But in other situations, sometimes it's not received so well.
And so I just asked him a very simple question of, okay, which framework do you want to base these risk assessments on? I guess that was a question that challenged him. He said to me, and this was like probably the worst comment anyone has ever said to me in my career. He said, we have to really train you on your critical thinking skills.
Wow. She reflects feelings often felt by us in infosec.
I think my whole career is a war story in itself.
All right, on to the show. Hi, Ismael. Welcome to the show.
Hi, thanks for having me.
Great. Well, I saw you online and, you know, your story is online and it's really interesting, but that's a brief story. So before we get into that story, maybe you could walk us through what you do today in information security.
Sure. So I get this question a lot because a lot of people really aren't familiar with what governance is. But my official title is Information Security Management Systems Manager.
Wow.
And that's a very long title to basically say that I create a security program around a company's management systems or information management systems. So anything that collects data, that processes data or connects to a network at some point is considered an information system. So I'm putting in place an overall security program to secure those systems.
Yeah, wow, that's a big job. So in the organization, are you like the pseudo CISO? Is there a CISO in your organization? Where do you go in the organization?
Sure, so when I first started, there was not a CISO. I played the CISO role and they recently promoted someone that was within my role previous to me into the CISO position. So my role is very CISO-like. I do a lot of CISO work, but I am not the official CISO by name, but I am doing CISO functions.
Great. And so now you're handling a lot of security management, compliance, all that kind of stuff. Walk us through maybe what's a typical week for your typical month or typical day.
Okay. So it's never really the same, my day.
That's exciting.
It kind of is. It can be. To be honest with you, I don't like too much routine. But on a normal day, I will just walk into work and I'll check my emails. And then from there, I get a lot of my tasks. So right now what I'm working on is my company is creating this product that basically is going to be capturing maturity models for other companies just to make sure that they understand where they stand with us. Their security practices. And so I'm being pulled into that project to provide security requirements, help understand what implications we would have if we launched in different countries. So I'm looking at things like data privacy, making sure that we understand if GDPR will come into scope because we're collecting company email addresses and names and certain countries, I guess in Europe, consider an email address as PII, or it'll be a day where there's
Absolutely nothing going on whatsoever. I don't get a single email for any requests. So I'll probably go through and look at some of the policies that I've created and just draft up some new ones or I'll start creating some project plans for some work that I know will be coming up on the horizon.
Okay. Earlier in your career, when you entered information security, what kind of role did you start off in?
So I actually started doing, the title was officially Risk Analyst. And I really didn't know what that was. Because if you actually followed me on Twitter and you saw my story, I was transitioning from finance into cybersecurity. And so what I did all day, every day was I was looking at reports from vulnerability scans. And just creating the different reporting to be sent to the application managers. So I learned a lot about vulnerabilities. I learned about the OWASP top 10 through there, but it was early on during the OWASP top 10 days when they first started. So this was back in 2012, I guess. And I also learned about what DDoS was. I had no technical knowledge at all at that point. So I was just reading reports and just figuring out basically what Archer was as well, because Archer was the system of record at the time.
So let's step back for a second. Walk us through how you actually transitioned in information security. I know your brief story is available online, but walk us through your perspective and how that transition was.
Sure. It was completely by chance. But I guess I can go a little bit deeper into how I actually learned I liked cybersecurity and then kind of transition into there. Sure. So when I was in high school, I really wanted to be a computer science major. And I'm from a very traditional, conservative Haitian background. And a lot of people who may be listening are not familiar with it, with Haitians. Education is very key in our culture. And having a specific type of education is very important. And so for my family, there's four options. You're either going to become a doctor, you're going to become a nurse, a lawyer, or you're going to be a disgrace to the family. And so... I chose to be a disgrace to the family because I didn't want to practice law.
I didn't want to be in the medical field at all because I don't like blood. I don't want to be around sick people all the time. So when I told my mom I wanted to be in computer science, she just completely shot my idea down. Wow. I know it was really disheartening, but I ended up getting into finance through some negotiations with her because it was like an issue for me to not go into medicine. And while I was doing my degree, I actually did a couple of computer science courses because those were part of the College of Business and I really enjoyed them. I graduated, I started working at this retirement company and they were so traditional. Everything was a problem that I did, what I wore, how often I would be a minute or two late.
And so I just really hated my job. So I just put my resume out on Monster and within two weeks or so, I think it was something as quick as that, which most people know two weeks now is no time at all when You're just starting your job search. And this recruiter, it was a temp agency that reached out to me and said that they were working with a client that was looking for someone who had some financial services background, who also had done some either entry-level work or internships within internal audit or in cybersecurity. And I was just like, what the heck is cybersecurity? I literally had never heard of it until my guy said so. And this is back in 2012 when cybersecurity wasn't really that big.
It was just coming up, especially being used and thrown around probably a year or two that I can remember before then. So then we did a phone screen with the recruiter. I did another phone screen with the CISO. He brought me in. I did more meetings or more interviews with the team. And then I found out that same week that they wanted to bring me on. So at the time, I'm like 22, 23 years old. The pay wasn't that great. But for me, it was amazing because I was doing something that I hated. I had benefits at my previous job, but this company was giving me opportunity to learn something new. To me, that was so exciting.
Yeah, yeah. And so walk us through the interview process. You know, here you are, you don't have much formal cybersecurity experience. How was the interview like? I'm sure it was stressful from your perspective, but walk us through the questions they asked and, you know, the approach.
Sure. So I was really nervous. And I also didn't have a place to go interview. So I ran downstairs, went to the parking garage and sat in my car and did my phone screen with the CISO. At the time, I didn't know who he was. I just knew that he worked in this department. And I'll go ahead and say the company name. It was Citigroup. So man, this is like a really big organization.
And did you know what a CISO was at the time?
No, I had no idea. I literally had no information about cybersecurity at all, except for the fact that they did stuff on the computer.
So he looked at my resume and he said, OK, I realize you have no cybersecurity experience. And I think by starting the conversation off like that, it kind of took some pressure off of my shoulders because I was so nervous that he was going to just drill into me about all these topics that I had no clue about.
Right.
And so he actually focused more so on my degree, what type of internships I had done previously. And he wanted to really hone on to the IT audit experience that I had. I was doing an internship with that company. Well, actually, I did an internship that was about six months and that didn't pan out. So I ended up having to apply within the company and then got the finance job that I hated so much.
Hmm.
So we focused on the overall audit process that I had to learn and go through. And then I'm just explaining it to him, some of my work. And based on that conversation, he was just like, yeah, I think you're green, but I think you have some of the knowledge that I'm looking for. You seem to understand the audit process pretty well. And whatever you don't know, we can teach you. And that was a big sigh of relief for me because I wasn't really expecting much out of it. I didn't know what was going to happen. So- Yeah. He didn't focus more on the security questions. He wanted to know about me and like my learning styles and things like that.
Right. That's excellent. And that was your first and only interview?
Yeah, really.
Wow. That's impressive. That's great. I'd love to talk to him one day. So let's take a step back also. So you said in high school you wanted to do computer science. What was it that brought your interest? What was it that made you first interested in computer science?
Growing up, I had a very interesting childhood because I'm one of four, but up until the age of 10, I hadn't met my older sisters because we were living in different countries. As I mentioned earlier, I'm Haitian. My parents were born and raised in Haiti, and then my sisters were born and raised in Haiti, and I was born in the Bahamas. So we immigrated to the U.S., my mother and I only, and I hadn't really seen my father in about five years because I came here when I was five. And so it was a lot of changes at a very early age. I didn't even knew I had sisters until probably the year before they all immigrated to the U.S. Wow. So I did all that to say that I was pretty much a loner from the time I was five until 10.
And I was always really good at math and science. And I think I remember my very first memory of using a computer was one of those Mac, I think it was like i5 or i3s, the ones that had like the colorful panels.
Oh, yeah.
I love that thing. Oh, okay. When I tell you that was my favorite thing to do in elementary school was to go and do computer class.
What grade was that?
This was like either third or fifth grade. I can't even remember.
Okay.
But it was my favorite thing to do. And all I wanted to do was just learn how to type. I just remember thinking, I can't wait to grow up and just have an office job and just be typing on my computer.
Nice. Awesome.
Now as an adult, it's like, oh my gosh, this is not a dream job. But to me, that was amazing. And I think that's really where my love for computers and all that just kind of started.
That's amazing. That's great. And then it just continued on into middle school and high school.
Yeah. I mean, I was always really happy to use any computer, any device at all that we could find in my school. I would be in the library just playing games, looking up things. And then I also was tinkering around with the family computer. And my mom, she was so strict. She wouldn't let me do much of anything. But when I did get my computer time, I was always doing probably some things I probably shouldn't have been doing at that age. Like what?
Like what?
I would surf the net. I would get on like AOL chats. Right. For those of you who remember AOL chats. And I was just meeting up with people that enjoyed computers. Looking back at it now, it's probably super dangerous.
Right. Right.
But also I learned about what hacking was from one of the guys who was in the chat was like, yeah, I'm a hacker. I don't know if he's telling the truth or not, but it was just so impressive to me.
What did he say?
He was always talking about- Quote unquote he, right? I think it was he.
Okay.
He, in air quotes. Yeah. With his handle that was like hacker one or something like super generic like that. Okay.
Okay.
And I remember reaching out to him like, hey, what is a hacker? And then he was like, well, how old are you? And I told him I was probably like 15. And so we're just chatting back and forth and he's explaining to me all these things. I don't know who this person was, to be quite honest with you, but whatever he was saying to me about, you know, being able to break into networks and it sounded really illegal, but it also sounded like very appealing. And I was just like, man, I want to know a little bit more about that. And then the computer science major into my brain. And so I was like, oh man, I'm going to learn about this. And I started doing more research and I was like, that's what I want to do.
That's awesome.
Yeah.
And did your high school have any good programs, you know, computer science programs? And did you take any CS classes in college as well?
My high school did not. My high school was a international baccalaureate, but our magnet program was really for medicine. So a lot of people that went to that school ended up becoming like doctors and nurses. So we didn't have a good CS program. My college had a pretty okay one, I think. I did maybe one or two courses, your intro, you know, computer science course. I think I also took a computer information systems course that was really interesting to me. We did a little bit of coding in that one. And I kind of regret not doing my computer science degree after that course. That was actually one of my best classes that I took, honestly.
So now you've gotten this first job, you're in the cybersecurity group. How did you transition from that job to what you're doing today?
So I got my first, I guess, real full-time job with benefits about nine months after my contract job. What happened was during the time I was working in my risk analyst contract role, there was a ton of openings for the internal controls department. And the way that the company was set up is a TISO is what they call the technical information security officer. Mm-hmm. And then there was an internal controls officer that were assigned to a line of business. And so they kind of worked together. One side was more audit prep. The other side was more of like technical controls and implementation for the application side. And so the internal controls team had an opening and I knew the lady who was leaving, she was getting a promotion or something to another team.
So I applied for it and everyone just kind of wrote me off. They were like, whatever.
Hmm.
This kid, she's green. She's not going to get the job. And I did an interview. I think they had to interview me because I was not an internal hire, but they knew my work. So I was invited to attend one of their meetings, one of their discussions. And they were coming up with this, the scorecard that they had was just like really, they didn't have enough detail. At least from my perspective, I was thinking, why wouldn't you want to know these certain elements? So then everyone was discussing the scorecard and I didn't think it was that great.
Mm-hmm.
So I actually spoke up. The manager at the time, he asked specifically, does anyone have any suggestions on some things that we should add in there? He asked that question. I was too nervous to actually say my opinion on the phone. So after we hung up, I sent him an email and I said, I think the scorecard is great, which was a complete lie because I didn't think it was great. But... We started off buttering them up a little bit. So I said to him, I think what would enhance this is to make sure that you're asking the five basic questions, who, what, when, where, and why. And I said, you want to make sure that you're capturing all this information so that you can make really solid risk-based decision making.
I think I said that in there. Right. And based on my response, he said he read the email five times because he couldn't believe that I had written that email. And so he said from there, he just knew he had to hire me.
Why did he not believe that you had written that email? What does that mean?
I honestly don't know. I think because at the time, everyone on that team was well into like the 30s and 40s. And here I am like a 23-year-old kid that just graduated college doing a contract job. And he had no experience with what my work actually entailed, him specifically. But everyone else on the team knew that I was pretty good at what I did. And I was like a self-teacher, whatever that term is. So he hadn't had any one-on-one experience with my work. But so I didn't expect me to actually have like a good response
I see.
But after I sent that email, he hired me three weeks later. Yeah.
Nice. And this is all under the same CISO org, right? Or is this a different organization?
Yeah, under the same CISO org.
Okay.
And then after that, I worked there for about a year and a month. And then I was hired on to be a technical information security officer, but only on the junior level. I was assigned to a senior TISO who had been working in computer science-ish degrees for like 15 years. And he was explaining to me, you know, he's so excited about how cybersecurity is now becoming a thing because he actually was part of the discussions to coin the term cybersecurity, which at the time I didn't think that was a big deal. I was like, okay, whatever. But now I'm like, wow, that was really amazing. Yeah.
So basically speaking up is what helped propel your career a little bit, right? Yeah. Speaking up for what you think, giving your honest technical sound opinion in the interest of the company, I would say.
Yeah, I think that definitely opened his eyes to a different perspective. And I was coming into it with very green, just, well, why wouldn't you want to know this? And it seemed very, I guess, naive to some people, but it worked for me. So I rolled with it.
And then you talk about how you transitioned, you asked a lot of questions. Walk us through some of the good and the bad parts of asking a lot of questions. I'm sure not everyone was very open to these questions, but I mean, it's really great. It seems like you had a nurturing environment, but for those out there that want to ask questions and want to learn, Share with us your experience and maybe what recommendations you would recommend when trying to do so. Yeah.
So as you mentioned, not everyone liked the whole concept of asking a lot of questions. Once I got into the internal controls role, I would ask a bunch of questions that a lot of people felt like had an obvious answer. But to me, the answer wasn't obvious. And so I started speaking up more. And it's funny. I remember one of my coworkers at the time, he pulled me to the side. He was just like, you know, you ask a lot of questions. And I said, yeah. And he said, sometimes I wonder if you're asking these questions because you don't know the answer or because you want to hear the response. And I said, a mix of both. And then he started laughing. I said, there's nothing wrong with asking a question.
I think the only issue here is your perception of the question. He kind of laughed. Well, he actually gave out like a really deep chuckle after that. And he said, you know what? You're really sharp. I said, thank you.
Yeah. I mean, it's the intention, right? So, you know, are you asking to just be facetious or are you asking to like genuinely learn?
Yeah. And a lot of my questions actually did make people think about things differently. So I think it was overall a good experience.
But walk us through a couple scenarios if you can.
Yeah. At one of my previous companies, we were doing this team exercise where we were unveiling this new scorecard. This is the same scorecard situation. So this was probably like three months later. And they put together this, I don't even know what you call it, like a prototype or a simulation of what it would look like. And so as we're going through the presentation, I remember thinking, who is the audience? What are we going to say here? And I asked that. I just said, what exactly are we trying to say here? Mm-hmm. And everyone just kind of looked at me like, why is she asking that question? So the manager, he was just like, we're targeting application managers and we want senior leadership to be able to recognize where their teams stand.
And I said, well, why don't we actually write that? Because as it is right now, it doesn't seem like that's what we're doing. And everyone just kind of got quiet and they were just like, okay. He said, that's a really good point. And I say, yeah, just make it simple. We're making it very complicated and it doesn't need to be. And I kind of carry that into my career now. I'm a, I guess what you call KISS principal. Keep it simple. So,
Yeah. I mean, it's good to sometimes recenter yourself and figure out, okay, why are we doing this? Right. So now that you're more senior and you have a lot more experience under your belt, I'm sure you're still asking questions.
I do.
Yeah. How has that experience been, you know, even today now, you know, or recently?
Well, it's still kind of perceived a little bit, I guess, negatively, because now that I have more experience, people take that as like you're challenging them. And I don't believe I have an ego, but a lot of people see my confidence and assume that it's either attack on them. And I'm just sitting here thinking, wow, if you take your ego out of this, you could actually see the point that I'm trying to make by asking this question. But I understand where you're coming from. The most recent example I have is the CISO that they promoted into this position. He wanted to basically create this risk assessment process that we were to be using. And so I just asked him a very simple question of, okay, which framework do you want to base these risk assessments on?
I guess that was a question that challenged him. He said to me, and this was like probably the worst comment anyone has ever said to me in my career. He said, we have to really train you on your critical thinking skills.
Wow.
I was like, wow, this is really inappropriate to say to someone. And my manager was on the call. And so my initial reaction was to just say something super snarky. And I guess looking back at it now, my response was on the snarky side, but it was also like a checkmate type of comment where I My response was, well, thank you for that. But me asking you what framework you want to work on is not really a question of my critical thinking skills, but it's a question of yours because you're the peso and you have to make these decisions. But if you would like for me to make a decision, I already know what framework I want to use. And we kind of got quiet because... I guess he wasn't expecting me to actually say that I know which direction I would take.
Do you? And so he kind of had to sit back because he hadn't thought about it. He just thought that saying I wanted to use a risk assessment and I want to create a new process without actually saying what that process was. I'm assuming people just never took it a step further with him. He didn't have to explain himself.
Yeah.
But I'm not that person. So if you say you want to do this, I'm going to take it a step further. And I want to know why. What's your rationale on that?
Yeah. I mean, I'm at a loss of words.
Yeah, you know, I think my manager was too. She was on the call very quiet, but I think she realized I could handle myself well. She sent me an email. She's like, did you get everything you needed? I said, yep, I finally got a response. And she sent me back a smiley face. Yeah.
Yeah. Okay. So I think you've mentioned a few things and it's interesting you mentioned that story because I could really relate to that as far as my recent history. So I think what we're dealing with is folks that have been in an environment for a while or been in a position of power for a while, whatever it may be, they're a little defensive. And when you're new to the area and you're like a sponge, you're absorbing a lot of information, you're learning a lot of things that Maybe they are not aware of or at least seeing the environment from a different perspective. Right. Right. So any tips on how to deal with that with, you know, because basically you're dealing with someone else's ego because they're being defensive.
Right.
Yeah. I think honestly, it can be difficult because people react differently to, I guess, criticism or to snarky side comments very differently. Right. What I try to do is not let it bother me too much. I don't know, we're human. I can't say that every comment just rolls off my back because it doesn't.
Yeah.
You know, sometimes I have to take a step back and I have to breathe. And I think the perception is also I have to monitor the way I respond because I don't want to feed into any stereotypes that automatically come when I walk into the door. And so one of the stereotypes that I've had to always combat on a regular basis is the whole angry Black woman stereotype. And that's something that has been pinned on me regardless of what my response is. Whether it's calm, whether it's angry. And so I think taking a breather and not wanting to respond immediately is probably the best thing to do and to analyze whether or not they are actually being offensive, if they're just being ignorant or if they truly are attacking you.
And so if any of those three are truly the case, then you can actually identify how to respond. Some people just simply don't know what they said was offensive and some people are purposely coming after you. Just taking a breather definitely works in either situation.
Yeah. Bias in the workplace is, I mean, like you said, we're humans. So I think a lot of people don't realize they might have a bias.
Yeah.
But then like when dealing with someone and you're trying to, you know, think differently or whatnot, it seems like you might have to overcompensate and like kind of walk on glass when you're trying to make a suggestion. Is that right?
Yes, that definitely happens to me a lot because, you know, sometimes I do have to sit back and consider how I'm approaching certain things. Right. I do that a lot with email. And it sounds funny to say, because when someone says an email that's kind of a little bit too sharp, your initial reaction is just hit reply. And then you're just fast and angry response. Right.
Right.
What I do is I'll type out my original response, how I want to say it. And then before I hit send, I'll like lock my computer, walk away, go get some water or something. And I come back and I'm like, OK, now that I'm a little bit more calm, let me read this email. Make sure that I'm not going to get fired over what I said. And I have a saying that I say with my friends, like I can curse you out without ever saying a curse word.
Right.
And so I make sure that I'm not doing that in my emails. And I don't like to respond to things in an emotional standpoint. But if you are feeling angry, you do have to let that out in some way. And so if you have to write up first, write everything you want to say, and then go back to it, that always works for me.
Yeah, that's definitely a really good recommendation. Even getting a second opinion on it, employing some of this emotional intelligence where you don't really react too quickly, but you allow your brain to kind of digest it and calm down.
Absolutely.
Yeah. But again, when you're dealing with trying to make a suggestion to someone and you know, you know, they're not going to take it the right way. How do you deal with that?
I think there's a couple of different ways that this has happened to me and how I responded to it. So the first is to just go ahead and make the suggestion anyway, but I do it in a more open forum to where it's not just me and that person. So I'll make suggestions in meetings and then just use everyone else's feedback against that person.
Okay.
That usually works because if it's a good suggestion and it's just a good suggestion, people typically like good suggestions. And if I know, hey, this person's going to be against it simply because it came from me, I'll just put it out there in a very non-attacking, very neutral way and just have everyone just say, yeah, I really like that idea. Why don't we just go ahead and do that? And that oftentimes works when majority rules in those situations. Another way that I've done that is I just made suggestions. They completely ignored it. And then it kind of backfired on them. And so...
It's like, I told you so.
I don't like to say I told you so, but I...
Right, of course. Yeah, yeah, yeah. But that's going on in your brain, right?
Yeah, of course. So then, you know, once their, I guess, way of doing it doesn't work or it fails, then I'll come back and bring a suggestion. And sometimes that can be like the more catty thing to do, I guess. It only depends on who it is that I would go to that level. Or I'll just simply give it to someone else who I know that they will kind of see that as more of a neutral response or a neutral suggestion. And then we can go from there because... I don't always have to take credit for everything. A good idea is a good idea regardless of who it came from. And sometimes hearing it from someone who you don't have some sort of like emotional reaction to can be more productive. You can get things done that way.
So I'll just say it to someone who I know that they would actually hear it from and receive it. And then we can move forward.
Okay, great suggestions. So what would you recommend for folks trying to get into the GRC space without much experience?
Honestly, learning about how policy writing works is one area. Figuring out what the GRC tools are, how they're used. Also learning about risk management. You can find a lot of information out about risk management. There's so many free frameworks that you can go read up on. Mm-hmm. NIST is one of them. You can read all 1,000 pages of every NIST framework that exists. Okay. Because there's so many pages.
Yeah.
You can also just do research. There's free materials. Cyberary is another place that does a lot of free courses or trainings. There's multiple ways that you can learn about it, but also learning about the laws. I know one way to get into GRC today is to learn about GDPR and then the California Privacy Act. I forget what it's called in its entirety, but all those are part of GRC. Right. It's not just having meetings all day, but we are actually writing policies. We are incorporating laws and regulations. If that doesn't work for you to learn about it, find someone who does what I do and just reach out to them like, hey, I want to get into the policy side. Can you help me figure out what to do?
And a lot of people reach out to me via Twitter that way as well. So I've kind of given some people some ways that they can learn about GRC. It's not really like the sexy cybersecurity, so people kind of pass up on it. Yeah.
Yeah, it's not sexy, but it's important.
It's very important. You know, a lot of people still don't do this. They don't know what I do, but they know that, hey, she does something inside. And GRC folks are generalists. We don't go too deep, but we have to know a lot about everything. That's right. Or a little bit about everything. I should say not a lot.
Yeah. And a lot of times, for better or for worse, sometimes that's where budget comes from, is trying to be compliant or trying to meet some sort of risk framework or compliance framework. Right?
Exactly. I was going to say, I have budget conversations almost every six months, it seems like.
Mm-hmm. Like your job, a lot of jobs are created just from this side of the field.
Yep, absolutely.
Right. You might have to hire an engineer because we need to become PCI compliant or ISO compliant, right?
Yep.
Yeah. So there's definitely something to be said about that. Okay, great. And any interesting war stories that we haven't discussed that maybe, I mean, I think I've heard a few war stories already.
Yeah, I think my whole career is a war story in itself, to be honest.
But to be fair, a lot of my job is dealing with C-level executives. If there's one thing I've learned is I can confidently walk into any boardroom, any executive meeting, And be able to say my piece and be heard. And I think that's why I kind of like my job a lot. And although I'm not an executive, I feel like I am because all of my work kind of comes from that. And whether you think I'm CISO material or not, it's irrelevant because my work is definitely, I guess, spread across the entire organization. So that's definitely something I'm proud of. I have to at least kind of give myself kudos for that because it's a hard job.
Yeah, absolutely. Absolutely. So what skills are necessary? What personality skills, human skills would someone need to be successful in your field, in your specific area?
Yeah, definitely have to be a clear communicator. Because when you're talking to senior executives, they don't like you to beat around the bush. They want you to be clear in what you're saying. And you also have to be confident. You have to be a strong, confident speaker.
Why is that?
Well, because if you're not clear in your message, your topics or your items will get overlooked. And now you're missing things like budget or you're not appropriately reflecting the risks that you've identified or you're just not coming across as this is important. And, you know, with security, sometimes it gets overlooked for other things because most companies see security as just a bottomless pit for their money bags.
Right.
So you kind of have to be able to explain this in a way that they're going to care about. You know, instead of just saying, yeah, we found four vulnerabilities, you have to say we found vulnerabilities to our financial transaction system, which can cost us $30,000 each time. So when you're like, oh my gosh, so that's 120,000. Oh, we don't want to lose 120,000. It's like, okay, fine. That's great. You know, let's put $5,000 towards here and then we can avoid this major catastrophic loss. Sometimes it's not that bad, but you know. It can be. So, yes.
So you're speaking their language. You're speaking their language. And also you're dealing with people in positions of power. So you have to kind of exude some sort of confidence so that they can believe in you, right?
Yeah. It's a dog-eat-dog world out in the sea levels. And, you know, these are people that are tenured. They have great pedigrees. They have great experience. They don't play around. So you have to be able to hold your own. You have to.
What other skills and traits?
Honestly, I think just kind of knowing what you're talking about overall, it's not really like a skill or a trait, but being able to, I guess, pick up things quickly, be a quick learner is very important because there may be some technology that's out there that you want to kind of talk about and why it's important. But you have to be able to know what it is. Enough to be able to translate it into the, I guess, business language, the business acumen. So it's not really a skill. It's more so it's something that you can learn to do, I guess. Yeah.
Okay, great. So I think you're starting your own company from what I understand. Yeah. So do you want to take a second to talk about that?
Sure. So I'm starting my own consulting, I guess, firm. I don't know what the right term is. And it's called Vic Cyber LLC. And what I'm specializing in is working with other smaller to medium sized companies that are interested in Doing something in the technical space, but have no idea what to do to, number one, protect their clients' data or to protect themselves, and also kind of figuring out how to maneuver in the cybersecurity space. So my company will basically provide strategic cybersecurity services. And I'm specifying strategic because a lot of people just think that Oh, all you got to do is just have strong passwords and TLS 1.2. And all that's great. Don't get me wrong. You need that.
But understanding, hey, I'm going to do some sort of peer-to-peer financial sharing app. There are a lot of compliances that come with that. And people don't consider that upfront because you all just have this really great app idea. But imagine you need to understand what the security requirements would be for that so that you're not... Putting people's information at additional risk for doing something like a peer to peer. And so my job is to basically have like some sort of advisory services that can kind of help people maneuver around that space. So they're avoiding additional fees and so that they're being able to worry about their actual business side.
Right. Great. That's awesome. You know, there's something to be said about being tactical, but a good strategy kind of just wandering out there. Well, Ismael, thank you so much for coming on. I really can't wait to publish episode and hope to meet in person one day.
Yeah, thank you. And this has been really great conversation.
Great. I'm glad you like it. I really enjoyed it as well.
All right. Have a good one.
Thank you. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
