Getting Into Infosec, Episode 41: Niru Ragupathy - From Almost Biotech to QA to Google Security Lead
Published August 5, 2021 · 45 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/niru/

[0:00] Niru Ragupathy: I think start with taking up a lead position, pretty much what you said. That's a natural transition, right? Start as an IC, start leading an effort and then slowly transition into management. Definitely take things slow and do things deliberately. By that I mean, don't take the decision lightly.

[0:35] Ayman Elsawah: Welcome to Getting Interned for Sec. I'm your host, Eamon Elsua. My guest this week is Niroh Raghubati. Niroh is a security engineer at Google and is currently a tech lead manager. In today's episode, Niroh will share her journey and learnings and talk about how she transitioned from an engineer to becoming a tech lead manager.

[0:52] Niru Ragupathy: When I graduated from high school, I was initially planning to go into biotech. And unfortunately, I think my parents felt that it wouldn't be the best career opportunity and wanted me to consider engineering, especially a degree in computer science instead.

[1:09] Ayman Elsawah: Although Nero planned on going into biotech after graduating high school, her parents encouraged her to take computer science instead. Nero eventually found her home in security and takes full delight in it. Her experiences and struggles will surely inspire you in transitioning and growing in the field.

[1:27] Niru Ragupathy: I've learned many things from folks outside of security where they've Talked about mitigations that I wasn't aware of. They've explained things about JavaScript, which I wouldn't have known about. And they knew about because they work with it on a constant basis and they were up to date. And stuff like that is always a great opportunity for us to also learn from others and engage in a dialogue and figure out solutions. But keep in mind, always present yourself as being a part of their team. Don't make it us versus them.

[1:58] Ayman Elsawah: Nero also shares her thoughts as a mentor, as well as from a mentee perspective. I know you'll love this episode with Nero as she shares her motivating journey, tips, and learnings in the industry. All right, on to the show. Hi, Nero. Welcome to the show.

[2:13] Niru Ragupathy: Thanks, Eamon. Thanks for having me.

[2:15] Ayman Elsawah: Yeah, thanks for coming on. Been looking forward to this episode for a while. So for those out there that don't know you, maybe tell us a little about who you are and what you do today.

[2:24] Niru Ragupathy: Yeah, absolutely. I'm a security engineer at Google and I work on the offensive security team. So that means I work on routine exercises. So I lead them, I participate in them and we simulate adversaries trying to achieve goals. Currently, I'm a tech lead manager and I lead part of the team in the Bay Area. So I'm also dabbling a bit in managing right now.

[2:45] Ayman Elsawah: Oh, okay. And how has that been?

[2:48] Niru Ragupathy: It's been a very interesting ride. I think managing is something which is a very undervalued skill in tech. And it's definitely got its own set of challenges because there isn't a one size fits all solution to it. And you kind of have to cater to each person and make sure you're setting them up for success. It's very rewarding, but it's definitely something you have to invest time and effort in.

[3:10] Ayman Elsawah: Okay. Yeah. Let's talk about that for a second. Like there are a lot of engineers out there that want to eventually go to management and sometimes struggle trying to get to that role, going from an engineer to a lead to or site manager. Now, what, what is something that you can share as far as, and I know it's, it's different at Google. I have friends there and the structure is a little different there, but in general, what is something that you could share for folks that are looking to eventually go to management from an engineering role?

[3:36] Niru Ragupathy: Yeah, absolutely. I think start with taking up a lead position, pretty much what you said. That's a natural transition, right? Start as an IC, start leading an effort and then slowly transition into management. Definitely take things slow and do things deliberately. By that I mean, don't take the decision lightly. Talk to people about what they like about management, what they don't like about it. And as you kind of grow into that role as a lead and start transitioning into a manager, start weighing like what you like about the role or what you might not like about the role. And this kind of applies to any major decision in your career, right? You have to weigh the pros and cons and see how it helps you.

[4:18] Niru Ragupathy: Whether this is the right amount of work for you that you can cope with. Kind of like, how do I put this? There's always going to be a fraction of your work that you might not enjoy, right? And you kind of have to put it down as a percentage and be like, well, I'm okay with doing 20% of work, which is a little bit of a chore to me, but I'm fine with it. I understand that's important and I understand I'm okay with it. I'm not saying any part of management is a chore, but there's likely parts of it that you might not enjoy as much as others. And you kind of have to put it down as a list and make sure that this is something you're okay with doing and you're taking a very conscious decision to do it.

[4:56] Ayman Elsawah: Okay. Yeah. Not taking it lightly.

[4:58] Niru Ragupathy: Yeah.

[4:58] Ayman Elsawah: Okay. Yeah. Yeah. There are a lot of engineers that have done management and then found that they'd rather go back to engineering and become ICs. So like you said, it has its rewards, but it's a whole package, I guess you would say.

[5:11] Niru Ragupathy: Yeah, absolutely. And honestly, engineers who decide to take a step back from management, go back to an IC role, I absolutely respect their decision. Because if you feel like this is not the right role for you, you can't give it your best. And if you're not enjoying it, You're not going to be able to help people to the best effort possible. So it's okay to take a step back and say, hey, this is not the right thing for me. And that applies to any role. For management in particular, I think having some background in mentoring or finding like your cornerstone of what you enjoy the most in management is really important. For me, I think mentoring as well as watching people grow in their career is something I really enjoy watching and investing time in.

[5:51] Niru Ragupathy: And that was what drew me towards management.

[5:54] Ayman Elsawah: Okay, that's awesome. That's awesome. So give us a little background. How did you get started in tech? And how did you, you know, were you always in security or were you in general tech and then transition to security? Walk us through that.

[6:07] Niru Ragupathy: Yeah, absolutely. So it's a bit of a complicated story.

[6:11] Ayman Elsawah: Yeah, we love complicated stories here.

[6:14] Niru Ragupathy: So when I graduated from high school, I was initially planning to go into biotech. And unfortunately, I think my parents felt that it wouldn't be the best career opportunity and wanted me to consider engineering, especially a degree in computer science instead. And I'm sure a lot of people from India probably relate to that, where parents typically do want you to cater towards roles that will set you up for success as you grow up.

[6:40] Ayman Elsawah: But biotech is a successful field, I know.

[6:43] Niru Ragupathy: Well, compared to computer science, I think the opportunities are a little bit more, they're a little bit more limited, at least the time I was graduating, especially in India. So at least computer science had a lot more roles available around that time. So I understand the decision to do it. And I think as parents, they just wanted what was best for me. And when I started computer science, I found certain areas I really enjoyed.

[7:07] Ayman Elsawah: Yeah.

[7:08] Niru Ragupathy: But I hadn't found what would be like a passion project or something, which is just like, hey, this is really cool. And I love doing this and I want to do this. So I kind of angled about trying to figure out what I liked in computer science. And I definitely wasn't one of those folks where, you know, security was just something They started very early and loved. I stumbled into it. So when I was interviewing for internships and full-time position towards the last year of my undergraduate studies, which was a bachelor's in engineering and computer science, and I started interviewing. And one of the interviews I did, the interviewers were basically like, hey, you should come on as a QA tester for us.

[7:48] Niru Ragupathy: And they offered a role for me in a tech firm. And when I showed up for my first day for my internship, The VP of QA was basically like, hey, so I read through your interview notes and it sounds like you have the mindset, which is the right mindset for security because you really like taking things apart. When we gave you a question, you really like digging into details and trying to articulate where things would break. And I think you would be a good fit for security. Would you be willing to try it? There's only one other person in the team right now, which is a little bit scary, but I hadn't found anything I was super passionate about. So I was willing to give it a shot. I knew I wanted to take things apart, test things or break things, but I had never considered security.

[8:30] Niru Ragupathy: In hindsight, I don't know why. But once I started doing my internship, I started out by automating things to test web applications. And slowly towards the end of my internship, I transitioned into... A role where I was actually doing the black box testing. And that's kind of when things really clicked. And I absolutely enjoyed what I was doing. I was like, Oh my God, what does this do? How does web work? Why is this way? Oh my God, this XSS triggered. And like, it was just, I suddenly found like the sense of belonging or like, Just something I really enjoyed. And things just fell into place. And from there, I realized that while I had studied computer science, I didn't understand it at a fundamental level.

[9:08] Niru Ragupathy: And I really wanted to dig deeper and, you know, go back to school and learn security. So I applied for a master's, ended up going to Georgia Tech for a master's in computer science with a specialization in security. And I really, really enjoyed just diving into those security courses. And more than that, just a sense of community where there are a bunch of people who are really interested in security, right? So I really got interested in security, met a lot of people who are similar. And that's just lights a fire when you come across other people who are just as passionate and you start bouncing ideas of each other, learning from each other. And from there, I kind of did an internship and a full time gig in consulting for a bit.

[9:49] Niru Ragupathy: Unfortunately, that wasn't the right role for me. And after that, I interviewed and landed my position at Google. I started out by doing assessments or black box, white box testing and helped run the program for vendor security stuff. And now I work on routine exercises full time. So it's been a journey. But as you can see, throughout it, once I found that I liked security, I kind of just stuck to breaking side of things. Because for me, at least, I love taking a look at systems, understanding how they work, taking them apart, And I guess breaking them.

[10:25] Ayman Elsawah: Nice. Yeah. So thank you to your parents for having the vision of sending you into the computer science direction. So that's awesome. Sometimes you hear parents doing the opposite. That's great. But the fact that you stumbled into it, I mean, even though we're in it right now, but it's like security still seems to be this like hidden niche that is not really easy to discover, would you say?

[10:45] Niru Ragupathy: Yeah, I think so. I think even within computer science, there are a lot more. I think it ebbs and flows, right? There'll be some buzzword or specific area that just becomes really famous for a bit. Like IoT was something everyone was talking about for a bit. Then there was machine learning. I'm not saying any of these fields aren't great fields. I'm just saying they ebb and flow in terms of popularity with other folks. And I definitely saw schools trying to offer those courses. Security was always there. Crypto was where courses were offered in schools or database security or one-off courses offered here and there. But they don't necessarily dive into as much details as some of the schools. Specialized courses for machine learning or iot at least in my undergrad they didn't in the grad school i think you had a little bit more leeway to go about it yeah i'd say it really depends on the school though even because there are some schools which have like really nice security clubs and georgia tech had security has a security club called krihat

[11:46] Niru Ragupathy: And I think that sense of community or having some kind of like grassroots initiatives in those schools alongside good courses, I think does make people gravitate towards more security initiatives. And these days, I'd say a lot of people kind of stumble into security very early. Like they discover things either by, you know, CTFs, war games, playing around with games, taking things apart in games. I think that still exists a lot, but people consciously taking an opportunity to explore security has gone up, but not to the extent of some of the other fields in tech, probably.

[12:26] Ayman Elsawah: Okay. So I'd like to talk about that topic, you know, education, the formal education for cybersecurity. It's a little bit of a somewhat controversial topic, but instead of seeing it as controversial for this discussion, I think our job is to just help people, right? If they want to go to school, then that's fine. But I think you touched upon something really important there where like the actual extracurricular activities like the clubs and how the school teaches it are the differentiating factors. So, you know, from a weight as far as the courses and the community, what are some things for folks out there to look for? And then I'd like to explore other alternative education paths that someone can take instead of spending the time into a master's course.

[13:10] Ayman Elsawah: It's kind of a deep topic.

[13:11] Niru Ragupathy: Mm-hmm.

[13:12] Ayman Elsawah: But part of it, I think, is how you learn things. Right. Yeah. So that's really and, you know, Marcus Carey really talks about like, you know, how to learn. But from your experience and given the current job market and I see people all the time wanting to go back to school and then people saying, no, you don't need to go back to school. So let's take both sides. And from your experience, since you've done that already, what are some things you could talk about in that from and offer your advice?

[13:38] Niru Ragupathy: Yeah. Plus one to what you said about people learn differently. I think oftentimes people tend to say, don't go to school. You can learn everything you want outside of school. But you have to take into consideration that different people learn differently. And I'm definitely one of those folks who like structured learning. I like coursework. I like things being structured and Having deadlines, having assignments. For disclosure, I have ADHD. So I think that sense of structure really gives me something to work towards and good guidelines to work within. The other aspect I would probably say is going back to school is a decision that every individual should take By them, like take for themselves.

[14:25] Niru Ragupathy: What works for someone might not work for you. There are many things to take into consideration. One is you are going to be spending, especially for a master's, you're going back to school, you're going to be spending two years if you're going to do a PhD on top of that, I don't know, four or five years. And in addition to time, it is also like an investment of sorts, right? You are paying for it. So it depends on where you are financially. Can you afford it? Can you take a loan? How long is it going to take you to repay it? People don't often talk about that part of it. So I would definitely say please take that decision. Don't take it lightly. Weigh your pros and cons. Do apply for financial aid and have that factor into your decision.

[15:06] Niru Ragupathy: I would say that going to school opened more opportunities for me personally, but that differs from person to person. I don't think like there are many people I've worked alongside who haven't done a master's, who haven't done undergrad degrees either. And they're great at their job, right? I think it really depends on how you learn. Some folks really do well with just taking all the resources we have available, blogs, bug bounty programs, CTS, war games, and learning from it, applying it, digging deep into it. Others prefer structured learning. So figure out what works for you and go from there. And if you feel that a degree is going to open doors for you and you're You have the time and the means to do it, go for it.

[15:51] Niru Ragupathy: At least for me, having that master's in security added a lot of credibility for me in some of the earlier roles I was searching for. Thankfully, I think a lot of things are changing and there are a lot more junior friendly security positions opening up in many companies because I think people took a hard look at the roles they needed and realized they don't have enough people to fill it and said, oh, we're going to start training people. That's great to see. I'm really happy that as an industry, we're trying to hire in junior talent and teach them the skills they need and grow them in their career. So I would say that these are good options. I haven't dabbled too much in certification, so I can't necessarily talk about it in depth.

[16:34] Niru Ragupathy: The only one I've personally done is OSCP and I definitely enjoy the hands-on aspect of it. I do know that SANS offers some great courses and Coursera and a lot of other platforms are offering great courses online. There's a really good Stanford web application security course, for example, which I've listened to on and off recently. I really enjoyed it and dives very deep into all of the aspects of web and it's very up-to-date. So it's awesome that These kind of opportunities are available now, but it depends on you personally. Does it fit your style of learning? Does it fit your schedule? Then pick it up if it does.

[17:12] Ayman Elsawah: Yeah, well said. Like you said, different people learn differently. So that's wonderful. Cool. So last we physically met... It was at the Day of Security Conference in San Francisco. And you gave a wonderful talk on mentoring. I really appreciated it. I know mentoring is a big passion for you. You're a member of a variety of groups. Maybe if you could share with the audience what you've done lately with mentoring and various groups that are out there that you're participating with and some insights and we could take from there.

[17:39] Niru Ragupathy: Yeah, absolutely. Talking about meeting in person, that feels like it was so long ago.

[17:44] Ayman Elsawah: So long ago, right?

[17:46] Niru Ragupathy: And I think the last time I met people in person for like security stuff was like besides SFCD, I mean, SF and just things started closing down after that.

[17:55] Ayman Elsawah: Yeah.

[17:55] Niru Ragupathy: But back to topic, mentoring is something I really enjoy and I feel very passionate about because I wouldn't be here if it weren't for people taking time to kind of like mentor me, help me through a lot of personal and career struggles, I would say. Mm-hmm. And for me, this is a way of giving back, I guess. And also just realizing I wouldn't be here if those folks hadn't taken the time to set me up for success. And I want to do the same for others, especially coming from like underrepresented groups. I think having someone take the time to like walk you through and offer like a no judgment approach. Space to just give you answers and help you work through what you are thinking about is really helpful.

[18:40] Ayman Elsawah: What's an example that you could share either that you've helped someone or maybe someone has helped you with?

[18:45] Niru Ragupathy: Let me go with the someone has helped me with. I've had the good fortune of having good mentors in all three of my roles so far. And I'll talk about my mentors at Google just because it's my longest role so far. I've been at Google for five years.

[19:02] Ayman Elsawah: Right.

[19:03] Niru Ragupathy: And right from day one, I've had a mentor at Google. Phil Ames, and he's helped me tremendously. I didn't have the most tactful way of responding to some of the security questions I would get sometimes. He helped me rephrase things and be firm, but articulated in a way where I would address the problem and not address it as the people. Again, I didn't ever consciously try to do it, but it was good to have someone kind of walk me through it, help me with that. He's helped me with everything right from, hey, should I be a lead? These are things that I'm thinking about. This is why I'm anxious about taking on additional responsibilities. How do I push back in this particular scenario, all the way to kind of helping me speak up in meetings or backing me up to in harder situations where I felt, hey, can you just be an extra person in the room where, you know, this is what I'm going to articulate, but I just want someone to weigh in and provide an outside opinion from what I'm offering.

[20:00] Niru Ragupathy: And keep me honest so things like that he's always like been willing to step up and help me through it and there are many other folks at google who also help me i'm sorry if i'm not going to go through that exhaustive list right now and you happen to listen to this sorry guys but i've had the good fortune of like people helping me pretty much with everything and offering a very no judgment space where i can just tell them hey this is what i'm apprehensive about this is what i'm anxious about do i do this and they'll just help me brainstorm or Kind of act as a sounding board for me to reason through it and say, hey, what do you enjoy about this? Why are you apprehensive? What do you like about it?

[20:37] Niru Ragupathy: What do you think you'll get out of it? And asking me those questions that I arrive at those conclusions and I'm not pushed towards it, you know, and I really appreciate that. For me personally, I think I've tried to mentor people who are newer to Google. I've tried to mentor people who ask for help. There are currently, I think, three people I'm mentoring on a regular basis. I have either biweekly or once in three weeks, I have meetings with them where they can just use that time however they need to. They can ask me for help with what they're working on. They can ask me stuff like, hey, I'm doing this particular project. How do I approach this? How do I articulate my input or output the best way possible here?

[21:20] Niru Ragupathy: Or they can ask me things like, hey, how do I communicate better? So it's really up to them. And I try to work alongside it. And if I feel like I'm not the best person to provide that for them, I usually introduce them to someone else who I know can better help them. So currently, that's kind of how I'm approaching it. In addition to this, usually folks who I end up meeting in cons or through trainings that I offer occasionally through Black Hoodie or other venues, I usually give them my email or my Twitter handle and they're welcome to reach out to me and ask questions. And I try to just answer them the best way I can and offer support. So I think try to do both ad hoc style as well as a more structured style of mentoring right now.

[22:05] Ayman Elsawah: Okay. Yeah, there's a lot to unpack there. So I want to dig into those two topics you mentioned. One, speaking up or having the being backed up. Do you think that's common in security? For those out there that don't know, I mean, I think sometimes security can be a lonely field in a way. Mm-hmm. Where you're often the one that's trying to get others to either change behavior or you're the one educating them, right? That takes some energy to do. Do you think that's common? It's good to have an ally to back you up and things like that?

[22:35] Niru Ragupathy: Let me make sure I understand this. Just to make sure I'm answering it correctly. I think you're referring to being in a company where you are working on the security team and you're offering security advice to other teams. Right. And you're working on a smaller team. Then how do you best articulate that message and who do you work with as an ally?

[22:55] Ayman Elsawah: Well, I guess there's two parts. One is the approach. So you mentioned that your approach towards folks was needed some tuning, right? Do you think that's common out there in the security field? And then the other part is the psychological drain as a security professional at a company working with other teams, you know, talking about that.

[23:16] Niru Ragupathy: Yeah, thanks for clarifying. I think for the first part, it really depends on the person and their communication style. I don't want to make a generalization. I'd say it really depends. But the nice thing is that a lot of folks are always willing to give you feedback and work with you if you're willing to listen and take advice and feedback. I think one piece of advice I can offer there is pretty much what was something I learned. Address the problem, not the people. And always present it as like, this is the problem I found. These are ways to fix it. And then articulating what would be the risk if it's not going to be fixed, right? Like having it as a three-part answer. And don't speak in absolutes if possible.

[24:03] Niru Ragupathy: Yeah. Don't say this is very insecure or this is very hackable. Instead, just keep it a bit more objective. Like, hey, this does leave your system insecure because of these reasons. And this is how you can address it. So make it actionable feedback as well, where it feels less so as you as a system and more so that, hey, I'm here to help and make things better. So I think that's one piece of advice I can definitely offer for the first part. For the second part, yes, there is a certain amount of strain if you articulate like your security advice and isn't taken into consideration. I would say that pick and choose your battles, right? There will be some cases where you have advice and that might not be taken into consideration.

[24:48] Niru Ragupathy: And there might be other cases where you feel very strongly and you want to push for it. Obviously, in those kind of cases, make sure you have buy-in from your reporting chain. Make sure that you're working within the boundaries or what is the capabilities that your security team has. Yes, you can change it, but sometimes some stuff you kind of need support from above for you to affect change. So don't burn out. Instead, speak up and ask for help from your reporting chain. And with their buy-in, push for changes.

[25:20] Ayman Elsawah: Yeah, there are a lot of folks that are security conscious, but don't have the necessarily upper management support. Right. And they're trying to make their case. And you talked a little about quantifying risk. From your experience, you know, when someone is pushing back on a finding that you've presented to them.

[25:37] Niru Ragupathy: Mm hmm.

[25:38] Ayman Elsawah: How have you dealt with that? And what are some tips that you could share with folks that has been successful without necessarily escalating it to your management, right? To get them to understand your perspective, because they may push back and you're like, well, this is not a big risk. What are the chances? And, you know, sometimes quantifying risk is hard in security. Any tips you could share on that?

[25:58] Niru Ragupathy: Yeah, I think following the benchmark of risk is likelihood and impact, I believe.

[26:03] Ayman Elsawah: Yeah, right.

[26:04] Niru Ragupathy: So quantifying it in terms of likelihood impact is usually something that resonates with most folks. And speak to your audience, right? Don't throw technical jargon at someone who isn't in the technical background. If you're speaking to stakeholders who might be executives or someone higher up, Then speak in terms of business impact. Speak in terms of what it would be, put the risk in terms of business impact. If you're speaking to a technical audience, yes, go into details, but also make sure, never talk down to people. Obviously, that goes for any role, the security or otherwise. But make sure you're kind of like bringing them along, right? Say, hey, this is what I see as a risk and this is ways to improve it.

[26:49] Niru Ragupathy: And if they push back and say, well, this is not actually a risk because of A, B and C, then try to understand where they're coming from. And then like, you know, go back and forth. Like, hey, actually is this way? This is what you could do to address it. But here, this is another thing that counters it. And you can kind of engage in good faith dialogue and go back and forth to try and understand where they're coming from. Sometimes you might even find something that you think is really bad, but you might hear their side of it and realize there might be a mitigation in place that you just hadn't noticed. So don't brush things away. Either engage in a dialogue and try to understand where they're coming from.

[27:25] Niru Ragupathy: A lot of times just having a conversation is helpful. There'll be other times, yes, there'll be pushback and you might not make a lot of headway. And that's kind of when you start escalating and getting your leadership or your reporting chain to kind of chime in. I think having that backup is always helpful, but I completely understand that I kind of was lucky to always have a really supportive team and reporting chain was always willing to go to bat for me. And I understand that it's not a luxury that a lot of us might have in the industry. So play it by ear, play it by how much support you have and also do your best. But sometimes you just have to pick and choose your battles.

[28:06] Ayman Elsawah: Yeah. And then have humility, right? I think you said right there, like you could be wrong. There's a chance that you could be wrong or maybe overlook the particular workaround or something that would decrease the severity of your findings. So.

[28:18] Niru Ragupathy: Absolutely. I've made many mistakes in my career.

[28:22] Ayman Elsawah: All of us. Yeah.

[28:22] Niru Ragupathy: And I mean, that's how you learn, right? And that's how you get better. And I've learned many things from folks outside of security where they've Talked about mitigations that I wasn't aware of they've explained things about JavaScript which I wouldn't have known about and they knew about because they work with it on a constant basis and they were up to date and stuff like that is always a great opportunity for us to also learn from others and Engage in a dialogue and figure out solutions. But keep in mind, always present yourself as being a part of their team. Don't make it us versus them. Just go into the conversation and say, hey, let's figure out a way to fix this. Or, hey, I know we are using this particular framework, but why not use this one instead, which offers us these capabilities.

[29:08] Niru Ragupathy: And kind of use language that also makes it sound like you're working alongside them.

[29:13] Ayman Elsawah: That's right. That's great. You know, avoiding us versus them and like, hey, we're all on the same team, right? At the end of the day. Cool. So let's talk about the younger Nero. Were you always creative when you were younger or involved in technology? What was your first exposure to a computer and things like that?

[29:29] Niru Ragupathy: Oh, man, I feel so old.

[29:33] Niru Ragupathy: I'd say I've always enjoyed computers because I love gaming. I've always been someone who's gotten a lot of hand-me-down games from folks in the family. So I think gaming was probably my first foray into computers like most people. And I think I started Windows 95 was my first OS. I'd say I did get enrolled in a bunch of holiday or the summer camp, computer summer camps. So I guess I was the nerdy kid right from the start. So yeah, I learned SQL, I learned to write C, Java right from seventh or eighth grade.

[30:08] Ayman Elsawah: Really?

[30:09] Niru Ragupathy: Yeah, yeah.

[30:11] Ayman Elsawah: Did you have any family influences? How did that come about?

[30:14] Niru Ragupathy: So my aunt is also in computer science. She's a software engineer.

[30:19] Ayman Elsawah: Okay.

[30:19] Niru Ragupathy: And she is currently like focusing on taking care of her family. But she's definitely like someone who paved the road for herself. I would say like decided that she wanted to do a master's and whatever. Got spoke to her parents about it and came here i did her master's that was something which was new to our family like no one had moved across the world and you know done a master's so she kind of paved the way for it and definitely okay was one of the reasons i decided that i wanted to do something similar like doing a master's so i'd say that she was definitely like someone who influenced some of my choices in life and also someone i could talk to about Whether or not you know software engineering or computers or something I want to dabble in but more than anything I think it's just my parents trying to get me out of their hair and I think the computer one was also like in an AC and I would just not bother them so they just enrolled me in like back-to-back classes and like sent me off to it so I think it was a very practical decision in their part that's funny but I did take part in like some computer clubs at school where we would like make presentations or like

[31:30] Niru Ragupathy: Play it on in the console. So I would say I dabbled in computers, but I'd just be the person who would always be with their nose buried in like an encyclopedia or learning about biology and learning about like reading scientific journals on genetic engineering. So that was more what I did when I was younger.

[31:49] Ayman Elsawah: Nice.

[31:49] Niru Ragupathy: But in addition to that, talking about the creative aspect.

[31:52] Ayman Elsawah: Yeah.

[31:52] Niru Ragupathy: So I do have ADHD, full disclosure. That means that I kind of jumped around with a lot of different hobbies. I've dabbled in like trying to learn chess, trying to play a piano. And then sketching, debating, a lot of different things. But I think sketching is like one creative hobby that really stuck from when I was young. So it started as doodling. Then I think I drew a lot of like a comic or... Anime characters. And I've kept sketching since then. And when I moved to the US, I still kept sketching. But once I got a job, I started like sketching almost every other day. And it means like a way to de-stress. It's also a way to see something come to life. Sometimes I definitely enjoy gaming or enjoy Netflix binges.

[32:44] Niru Ragupathy: But doing a creative hobby to de-stress also has And end result you can see. And it's very satisfying to one, see that on paper and two, see your progression across time. Because if you collect your sketchbooks, it's also really cool to see, oh man, okay, I can see that I was in a good mood that day. I used really bright colors. So I think it's also like a way to catalog how you feel or what you're doing. But I would say that creative outlets help me de-stress, help me declutter my mind. And for me, that's always very important. In addition to that, I'd say, does it help improve my approach to things? I guess. I've always been a person who thinks creatively or outside the box. And I think participating in these creative hobbies does encourage me to keep doing that.

[33:33] Niru Ragupathy: And you can do drawing challenges where you just draw a line and try to come up with something, which is kind of similar to what you do in your role, right? Like you look at a system and you have to figure out Some way to break into it and you're working with what you have. So I would say it does teach you to think on your feet, being creative in some ways or pushing yourself to be creative. But more than anything else, it's just something to declutter my mind, helps me de-stress and it's really enjoyable.

[33:59] Ayman Elsawah: That's amazing.

[33:59] Niru Ragupathy: Yeah.

[34:00] Ayman Elsawah: In a way, it's kind of like journaling, but an art.

[34:02] Niru Ragupathy: Yeah, absolutely.

[34:03] Ayman Elsawah: Wow. That's amazing. You know, someone asked me on Twitter, how can I be more creative? And I found it difficult to answer, but there were some ways. And for those out there that may be struggling to get those creative juices flowing, any recommendations?

[34:17] Niru Ragupathy: I'd say being creative is just like any other muscle, right? People often say you're more creative or Creative things or something that you inherit or you're either good at it or you're bad at it. No, it's just like exercising. It's just like a muscle, right? You have to invest time in it. You have to grow it. You have to push yourself to grow outside your comfort zone and keep trying. When you look at a lot of artists, yes, some folks might start out being really good, but most folks just apply, like invest time and effort in it. And honestly, I know I'm jumping a little bit ahead, but creative things are just the same. You can teach yourself, you can push yourself, you can learn from it. One aspect I will say, though, is it's just the same as what you would see in security.

[35:03] Niru Ragupathy: I think oftentimes people might look at someone and go, oh, my God, they're really smart. I wish I was that smart. I wish I was born smart. Or I wish I had these innate security hacking skills. It's not like that. The more you kind of dabble in any field, you realize that oftentimes you look at the end result of hard work or effort or time spent on growing the skill. And you are often, you might dismiss what went on behind the scenes. It's important to take a step back and be like, this is a person who's invested time in it and as a further part of their career and you are starting. So rather than compare yourself, look at it and say, that's where I can reach and say, I should work towards that.

[35:48] Niru Ragupathy: And apply effort and time in it, learn from others, invest time in figuring things out And work towards it. And that's the same for creative skills as well, honestly. It's just like any other skill. Invest time in it, not invest effort in it. Anyone can draw if they invest time in it.

[36:04] Ayman Elsawah: It's a journey.

[36:05] Niru Ragupathy: Absolutely.

[36:07] Ayman Elsawah: Great. Well, I think you mentioned Black Hoodie and I saw that you're involved with Wises. Can you tell folks about all the groups that you're involved in and how they can get involved in those groups?

[36:16] Niru Ragupathy: Yeah, absolutely. So a couple of things. One, I volunteer to teach courses for free through Black Hoodie. I also help a little bit with organizing stuff that runs. We posted some Black Hoodie sessions at Google.

[36:31] Ayman Elsawah: In addition to that... Can you tell us about Black Hoodie? Like, what is Black Hoodie?

[36:34] Niru Ragupathy: Oh, yeah, absolutely. Sorry. Taking a step back, Black Hoodie is training for women by women. And it's a really cool initiative that Miriam started. And it's a good opportunity to provide a safe space for women to just come and learn and look around and see other women. Because one of the things that I definitely felt when I first joined security is like going to security trainings and looking around and being the only woman in the room. Right. Looking at like 80 plus people and seeing one other woman on the other side of the room.

[37:02] Ayman Elsawah: Mm-hmm.

[37:03] Niru Ragupathy: And I always felt awkward, like raising my hand and asking questions or engaging in those training and having a place where, you know, it's mostly women teaching for women. You don't feel that awkwardness. And it's a very safe space where we just try to teach people skills. There's no judgment. And I think Miriam has done an awesome job. And a lot of the trainers who Offer time to come and teach there are amazing and i've learned a lot from them so in addition to helping out just by teaching courses through black hoodie i also help out with besides sf cdf i've been doing that i think for two or three years now i work on it with david brandon and ron shout out to them i really enjoy writing cdf levels turns out that i don't particularly like i like playing cds but i really enjoy writing cdf levels

[37:51] Niru Ragupathy: Because you have to solve your levels to do it. And that's another thing I help out regularly. In addition to it, I typically try to offer free trainings or webinars through other venues. So recently I've given a webinar called Red vs Blue with Matt Linton, who's on the DNR team at Google. And we kind of talk about what it means to be in a red team, what it means to be in a blue team. So defense and offense and how we kind of like Learn from each other. And we offered this webinar through Vysis, which is women in cybersecurity, as well as WISP, which is women in security and privacy. So I would say that all of these venues are great. WISP, Vysis, Black Hoodie, if you're looking for... Most of them offer things for free as well.

[38:36] Niru Ragupathy: So do keep an eye out for what opportunities they publish. And if you are interested in teaching or giving a webinar, just reach out to the organizers. They're awesome people and really nice to engage with. In addition to that, I would say I typically just try to go to cons and meet people and chat with them. Like you said, either give like one-off talks and stuff like that. So if people are interested, you know, go to your local con, meet people there and definitely chat with people, see how you can help out and just pick an event, volunteer and make connections. I think that's kind of how I stumbled on a lot of these opportunities.

[39:15] Ayman Elsawah: Any parting advice in addition to that? Any parting advice for those looking to get into the field?

[39:20] Niru Ragupathy: Two things. Don't be afraid to fail. I think too often you look at things and think about it as either a success state or a failure state. And honestly, it's more like a journey, pretty much like what you said. And don't be discouraged by failures. That just means it's an opportunity for you to learn and overcome things. I will be very honest that this is something I'm still working on. This is something I struggled with earlier in my career. Where I felt, oh my God, why do I not know this? Do I suck? So don't go through those motions. Instead, take a step back and say, I don't know this, but I can figure it out. I can fix this. I can learn this. So approach it from a growth mindset. Don't be afraid of failing.

[40:01] Niru Ragupathy: The second advice I would give you is don't be afraid to ask for help. There are wonderful people in this industry. Ask for help. Learn from them. Don't be afraid to say, I don't know how this works. This is what I figured out. Can you help me figure out the rest? And I've had the good fortune of working with some wonderful people who've always been willing to teach things and answer my questions and have badgered them endlessly to learn from them. So don't be afraid to do that. And I guess one last thing I would say is this is more for folks from the underrepresented groups is don't feel like you have to prove yourself.

[40:37] Ayman Elsawah: Hmm.

[40:37] Niru Ragupathy: If someone tells you're doing a good job, chances are like you're doing a good job. Don't feel like you have to push yourself to prove that you belong. You don't have to. Just do your best and focus on yourself, focus on learning. Honestly, a lot of this is also just you worrying about how people perceive you rather than how things are.

[40:59] Ayman Elsawah: Right. Wow. Yeah, that's yeah.

[41:02] Niru Ragupathy: That went really deep.

[41:03] Ayman Elsawah: Yeah, it went really deep. It seemed like imposter syndrome was somewhere in there.

[41:08] Niru Ragupathy: That was definitely imposter syndrome. And that's something I've struggled with a lot when I first started my journey in security and it was amplified when I started working with a lot of smart people. But I think it was what really helped is having a supportive team who helped me see my achievements and who would always stop me and From spiraling and say, hey, stop being so self-critical. What you did here is awesome. So take a pause and celebrate your win. Yes, things can always be better, but you shouldn't take it as a negative thing. And having that sense of grounding helped. And a lot of it was just taking some time to kind of look at things objectively, framing my achievements as like, hey, if this was something another person did, how would I view it?

[41:53] Niru Ragupathy: Are just looking at things and taking stock and saying this is imposter syndrome talking to me let me take a pause and just look at it a little bit more objectively and see where I'm coming from and stuff like that is really helpful and underrepresented groups are definitely folks who End up having a lot more imposter syndrome. And I would say, have someone to hold you accountable, be critical of anything you say, but holding you accountable and saying, hey, is that really the case? What do you think that you could have done better? But what did you do well? And just kind of help you reason through it, but also be willing to do it for yourself and just say, hey, is this me being too critical of myself or is this something that actually happened?

[42:34] Niru Ragupathy: It's not easy. I will definitely admit it's not easy and it takes time.

[42:38] Ayman Elsawah: And it takes patience and a lot of self-love yeah wow well said well said yeah find a partner and even they don't even have to be in the field just find a partner you could talk things with and just getting that outside perspective will kind of get you out of your head because sometimes it's all in your head right the idea just keeps circulating in your head and sometimes we have to get out of our heads

[42:58] Niru Ragupathy: It really is. And sometimes your toughest critic is yourself. And just having someone to hold you, like just be a cheerleader and just help you work through those things is super helpful. And plus one to what you said, you don't always need a mentor within the field. You just need a mentor who you connect with, who kind of relates to a lot of things that you're going through. And can help you through it. For example, when I went through a lot of struggles with imposter syndrome, talking to other people who have experienced that and who would overcome it was what really helped. Because talking to folks who have not experienced imposter syndrome, while they are definitely helpful and sympathetic and try to be supportive,

[43:38] Niru Ragupathy: Sorry, they are supportive. I think talking to someone who's gone through that journey and overcome it was what really helped me because I was like, you understand what I'm going through. Yes, what you said, I relate to it so much. How do I fix this? How do I overcome it? So I think finding a mentor that you relate to or has gone through a similar journey is immensely helpful for those kind of situations.

[43:59] Ayman Elsawah: Yeah, well said. Well, Neeru, thank you so much for your time. It's been a pleasure. And I know everyone is going to definitely enjoy hearing this episode and or has enjoyed what you said. So it was very helpful. Thank you so much.

[44:10] Niru Ragupathy: Thank you for having me, Eamon. And if folks have any questions, feel free to reach out to me over Twitter. I'm sure my handle will be linked in the description. And yeah, keep on trying and don't give up.

[44:21] Ayman Elsawah: Awesome. Thank you so much. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.