Is the cybersecurity talent shortage a self-inflicted wound? It seems like we’re caught in a vicious cycle of employers not being honest about the roles they need to fill, leading to candidates inflating resumes to have a chance at them. We’re constantly discussing understaffing, so why isn’t the situation improving?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), partner, YL Ventures. Joining us is Steve Person, CISO, Cambia Health.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Vanta

Full Transcript

Intro

0:00.000

[Voiceover] What I love about cybersecurity. Go!

[Steve Person] The reason I really first came to fall in love with security is that it sits right in the intersection of technology, data, and human behavior sort of psychology. And after now working in this field for about 15 years, the thing that I really love most is that it’s really an unsolved problem.

It’s got a simple and noble mission. There are a lot of brilliant people, passionate people working on it, but it’s really in its infancy, and there’s just so much room for creativity and disruption.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I am the producer of the CISO Series. And joining me as my co-host, a recently promoted co-host as of this recording, I should mention, none other than Andy Ellis, partner, not operating anymore. He’s fully figured out his operations.

He’s now the partner over at YL Ventures. Andy, say hello to our audience as a partner of YL Ventures, and we’re going to see if we can tell the difference. Go ahead.

[Andy Ellis] Good evening, folks, or depending on when you are in the world, good morning, good afternoon, or good night.

[David Spark] You sound exactly the same as when you were just operating, partner. So nothing’s changed.

[Andy Ellis] Except I led with good evening instead of good morning.

[David Spark] Oh. Oh, that’s the difference? Can I expect that going forward from now on?

[Andy Ellis] Yeah, got to start work in the evening, just like God did when he created the world, right? First, it was evening, then it was morning.

[David Spark] Oh, you are elevating your stature quite a lot. You just got a promotion to partner.

[Andy Ellis] Shake it till you make it.

[David Spark] That’s it, [Laughter] Andy. Hey, we’re available over at CISOseries.com. We have other programs that don’t involve Andy’s enormous ego on it, and you could listen to those other programs over there.

[Andy Ellis] But why would you want to?

[David Spark] Well, for now, just listen to this. We have other programs like Defense in Depth, Super Cyber Friday, Cyber Security Headlines. Go check them out. And we are working on new programming as well. Our sponsor for today’s episode is Vanta, a spectacular sponsor of the CISO Series. They’ve been continually sponsoring us all throughout the year.

We greatly appreciate Vanta. Remember, Vanta – automate compliance, manage risk, improve trust continuously. More on that later in the show. But Andy, today’s episode is dropping on October 1st, which begins a very critical month in the world of cybersecurity, and that is National Cybersecurity Awareness Month.

Do you find yourself becoming more aware of cybersecurity in October?

[Andy Ellis] I think I’ve become more aware of cybersecurity marketing in October than becoming more aware of cybersecurity because certainly it is on every marketing team’s radar that it’s like, “We have to have our posts for National Cybersecurity Awareness Month.” That said, just so everybody knows, the day after this, I’m not going to be paying much attention because for me, a more important month is beginning because we’ll be in Tishrei, which is the month of the High Holy Days in Judaism.

[David Spark] Well, there you go. Well, let me ask you this. Is there any… Because usually when we hear about Cybersecurity Awareness Month, a lot of CISO security programs do some kind of gamification with their own staff to get them to care, be more aware of cybersecurity. Is there one kind of gamification you’ve heard about, you’re like, “That was really cool, that was really fun”?

[Andy Ellis] Well, I’m going to go to one that Steve reminded me of, and he’ll get to that when we introduce him. But it was what my team did when I was at Akamai. We had a stuffed penguin named George. George doesn’t tweet very much anymore, but his Twitter account is still around, it’s Security Penguin.

And the idea behind George was that somebody on the security team would send him out to go visit someone for a week when they had materially improved security. So, it was not about, “Oh, hey, are you paying attention to security?” It’s “Are you actually doing something?” And you get to take George. We’d have people would be like, “Well, can I have him in two weeks when I go on vacation?” So, George would go to vacation locations.

We have pictures of him skiing, scuba diving. Like you name it, George has done it.

[David Spark] It was kind of a badge of honor when you had George.

[Andy Ellis] It was a badge of honor, but you didn’t get to keep George.

[David Spark] Yes.

[Andy Ellis] You had to send him back. And so every time somebody had George, they built up the momentum for the next person.

[David Spark] And was the person who currently had George, they were the one who bestowed it on the next person?

[Andy Ellis] No, no. It came back to the security team. The security team would bestow him out.

[David Spark] Ah, okay. All right. Well, I like the theme of George the penguin. And we saw your collection of penguins, of which [Inaudible 00:04:41]. By the way, feel free to send us photos of George and we can post it for this very episode if you want.

[Andy Ellis] Oh, absolutely.

[David Spark] Or maybe there’s an example of a photo of George on vacation somewhere.

[Andy Ellis] Actually, I’m pretty sure if we just go to Twitter or X and pull up Security Penguin, there’s probably a handful there.

[David Spark] All right. Enough about the Security Penguins, which by the way, we do not recommend hiring penguins to actually run your security department.

[Andy Ellis] That’s speciesist.

[David Spark] It is speciesist, and I’m going to hold tight to that. All right? I would be surprised if anyone has a penguin that could type on a computer, let alone run a security program.

[Andy Ellis] They’re certainly not clicking on malicious links.

[David Spark] [Laughter] That is the benefit of hiring a penguin. Yes, you are correct. All right. Let’s bring in our guest. I’m sure he’ll have much, much better advice than a penguin would. Actually, I was introduced through an old co-worker of mine when I used to work in television for ZDTV, TechTV, if anyone was a viewer of those programs way back in the day.

[Andy Ellis] Ziff Davis.

[David Spark] Ziff Davis. They stopped being Ziff Davis. And by the way, we had the name ZDTV, but we were not part of Ziff Davis. It was very bizarre.

[Andy Ellis] It’s always fascinating to watch when that happens, when the name follows companies, but not really.

[David Spark] Yeah. And so when I told people I worked at ZDTV, he goes, “Oh, yeah, Ziff Davis.” I’m like, “Well, we’re not really Ziff Davis anymore. Like, we have the name.” And then that’s why I got rebranded to TechTV later on. Which by the way, Paul Allen of Microsoft fame is the one who bought the company and turned it over to that.

All right. Enough of that history lesson. Let’s bring in our guest. He’s the CISO over at Cambia Health, none other than Steve Person. Steve, thank you so much for joining us.

[Steve Person] Thanks, David, for having me. It’s great to be on here with you and Andy and spend a little bit of time sharing some of the insights around penguins as a hazard to the cybersecurity universe, or maybe other topics.

How is the CISO role evolving?

6:30.484

[David Spark] Given the new legal threats facing CISOs, what should be their points of negotiation for taking on the role? So, former Uber CISO Joe Sullivan, who faced his own legal troubles, offered this advice. I saw him speak publicly, and this is what he said. Get independent representation by counsel of your choice.

You should have indemnity across all scenarios, class action, civil, regulatory, and criminal, and also get clarity on your role related to external communications related to security. So, are you the approver or just the consultant? Now, Andy, is this a good starting point for a CISO’s job negotiation?

And what else should be on the table? Besides salary, all that stuff, but more that we’re talking about sort of securing your role and sort of you as a person. And this more importantly, and for the CISOs already in their positions, how can they negotiate all of this posthumously?

[Andy Ellis] Yeah, posthumously might be the right adverb there. So, first of all, I would not recommend following this advice unless you happen to find yourself as a former prosecutor taking a CISO job in a company that is already under investigation for doing very sketchy legal things, and you’re going to engage in sketchy legal things.

That situation, not one many people are going to go on. I wrote an op-ed about this, I want to say like two years ago, for CSO online. If you go to CSO online and search “Uber verdict,” it’s their first hit. But I think there’s some interesting things here. First of all, which is if you’re going to be a CISO, you should have an umbrella policy which will pay for your independent counsel.

Your company is never going to pay for independent counsel. If they’re paying for it, it’s not independent. You might manage to get something there. I wouldn’t recommend it. I recommend you make sure you’re personally covered for the liability there.

[David Spark] By the way, warning to everyone out there, umbrella insurance has gone up dramatically.

[Andy Ellis] It has gone up dramatically. And the important thing about umbrella insurance is you don’t tell people you have umbrella insurance. Basically what it does is it protects your assets by having an insurance policy as an umbrella over it. But it’s generally where you get represented against random suits, and you want to make sure that it covers this because not all umbrella insurance policies cover everything.

So, you want to make sure you have something in there that protects you against libel and slander claims and something that will protect you in the event of government action. The indemnity, you’re unlikely to get. But I did like the point about, like, what is your role?

[David Spark] Yes.

[Andy Ellis] I would actually suggest that nobody…

[David Spark] I think this you can negotiate easily.

[Andy Ellis] This you can negotiate. Like how does comms work? How are we going to run this? But I think the really important thing that nobody’s talking about in this is in most companies, the person with the title CISO is not actually a C-level executive, but from the outside, you’re being treated like you are an officer of the company, and that’s problematic.

When we look at Tim Brown and the SEC, this all comes down to the SEC’s treating him like an officer when he wasn’t. And maybe it’s time for CISOs to do a hard pressure negotiation to say, “I don’t want the CISO title unless I get these things.” I’m happy to be the vice president of security working for whomever I’m going to work for.

But if I don’t work for the CEO, don’t give me the C-level title, and don’t give anybody else the C-level title either if they don’t work for the CEO. I don’t think anybody’s going to do that, but…

[David Spark] Very good tip. All right. I am throwing this one to you, Steve. What’s your take here?

[Steve Person] Yeah, I mean, I think first, the most important thing is the sky is not falling, right? I think a lot of what I saw that was maybe frustrating at times was sort of the knee jerk around both of these situations with both SolarWinds and with Uber that now they’re coming for CISOs, look out, every CISO is going to jail.

That’s not the case, right? And so I always look at these first as put it in the right context and what can we learn from it. I don’t have a lot to add on sort of the legal CYA part of the conversation, but I think it’s really important in a new role as a leader, as an executive to be thinking about what is the regulatory environment, right?

What are we subject to, and what are the ways that I could be personally on the hook, right, for anything that goes wrong? And honestly, this is an area where CISOs don’t need a lot of training, right? Imagining the worst-case scenario, is there anything that we’re more just sort of naturally good at?

Maybe too much at times. So, kind of go into it, right, with that mindset of just what is the worst way that this could go wrong if there was some type of incident from a regulatory and legal perspective.

And then the second thing that I don’t hear a lot of people talking about, but honestly was one of the first things that popped into my mind, with the Uber situation especially, is really just trying to think as much as you can and glean as much information as you can about an organization’s risk appetite, specifically to kind of pushing the regulatory envelope, right, and thinking how that might translate.

If the organization’s business model sort of pushes some of those boundaries, then it’s reasonable to think that you could find yourself in situations where that same sort of culture permeates, right? And so I think just gleaning every insight you can about the culture and about the business model and about how might that translate into the CISO role.

I love what both Andy and I think Joe had said previously about hyper-transparency, right? I mean, I think that’s the other thing is you’ve got to go in with a really strong commitment and agreement on how risk will be managed, how risk will be accepted, how risk will be communicated, and who ultimately kind of owns and signs off on all of that.

So, I think those are kind of the three main points from my seat.

Is training the solution to the lack of security talent?

12:15.694

[David Spark] “We are outgunned and outnumbered.” This was the sentiment in a recent popular post over at the cybersecurity subreddit. The post made the case that organizations perpetuate the supposed cybersecurity talent shortage by refusing to pay fairly and staff fairly. And as for lying on resumes, that happens because employers are not honest about the roles they’re filling.

Others called out hyper-competitive company cultures that encourage gatekeeping rather than mentoring. And nepotism and moving jobs overseas were frequently cited. So, it’s clear these frustrated security professionals want their employers to invest in them. I will start with you, Steve. Do you buy the premise that the talent shortage in cybersecurity is self-inflicted?

[Steve Person] I mean, yes and no, right? You could find anecdotes to support every hypothesis, right? Every sort of scenario that’s described in that Reddit thread. All of those things exist. I hate to cast a wide net with that and just say, “And therefore, right, the entire industry is to blame.” I kind of look at it more like what can I do, right?

I consider myself to be in sort of a position of privilege, right, where I can invest in the next generation of security leadership. And so how can I do that, and how can I use my network and my influence to do that? And I just try to be sort of solution oriented.

One of the things that I have spearheaded inside the Blue Cross Blue Shield system is a partnership with an organization called Cyversity that BCBSA is running, where we actually bring alongside security leaders from across the entire nationwide Blue system to mentor folks who are wanting to advance their security career, get into a security career.

And we also invest in their education and certification, right? I think it’s those kinds of things where we can lift people up, especially in kind of the traditionally underserved communities, this is how I think about what’s next and how do we advance this and how do we build this talent pipeline.

I think the single most impactful thing any of us can do as security leaders is mentoring, right? I mean, just I’ve benefited from that personally, like to invest in relationships with others. And it’s always 100% of the time mutually beneficial, right? I always learn something from the people that I mentor as well.

So, I think that’s the big thing. Honestly, I don’t think there’s a lot of constructive time spent kind of playing the blame game with some of those specific scenarios though. All that stuff is real, but it doesn’t have to exist everywhere.

[David Spark] All right, Andy. I believe you have an opinion or two on this subject. Is that true?

[Andy Ellis] I have all the opinions on this subject. First, I want to say kudos to Steve. People taking action to solve the problem – very important. But this is a systemic issue that actually resides within the HR function more than resides in security management. Now, security management can contribute to the issue by letting HR run amok, which is what has happened, right?

And people who disengage who say, “Oh, I need to hire. Oh, I don’t need to check the job description because HR has them.” No, you need to check the job description to make sure that the job being posted matches what you’re actually trying to hire for. Because what often happens is they take a job description for a related job – you’re looking for a senior analyst and they have a junior analyst one – so they level it up by two spots, but in a way that’s very surprising to you.

And so you’ve contributed to that.

[David Spark] And I must say that the other thing that frustrates me is the throwing in everything to, “Let’s just see what we get.”

[Andy Ellis] Right, right. You throw in everything, and the problem is everything you throw in becomes a filter because recruiting teams are overwhelmed with resumes being submitted, and so they’re filtering. There’s a lot of dynamics in here that if you haven’t spent time looking at them, you’d be surprised that any resumes actually make it to your desk, let alone any good ones.

So, you can engage on that.

[David Spark] I recommend a different kind of filter which I’ve done when we’ve done hiring is we have our just core requirements [Inaudible 00:16:23], but then we make them take an action to see if they really want the job. And the actions we’ve requested were, “Go to CISOseries.com and tell me what you think.” You wouldn’t believe, I mean, the first time we did this, of the 45 resumes, only 6 people did that.

So, we didn’t look at the other 39. That’s how you create a filter.

[Andy Ellis] Right, that’s it. There’s new active filters that are like, “Did you actually read my job description versus every other one?” Because what happens now, there’s literally AI, generative AI that will take your resume and a job description and tweak your resume to mention all of the keywords in the job description.

That’s what people are doing. And so when you wonder why you’re getting people that make it past recruiting that aren’t qualified, it’s because recruiting is mostly just doing keyword verification. And the more keywords you have, the fewer qualified people you’re actually going to see, not more that you’re going to see.

Sponsor – Vanta

17:20.041

[David Spark] Before I go on any further, I do want to tell you about our spectacular sponsor, and that is Vanta. Now, whether you’re starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more. With Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing trust center.

Those suckers are hot. If you don’t have one of them, you need one. So, currently over 7,000 global companies like Atlassian, Flo Health, and Quora, they use Vanta to manage risk and prove security. Now, our listeners get $1,000 off of Vanta at vanta.com/ciso. So, if you want that $1,000 off, you have to go to vanta.com/ciso.

It’s time to play “What’s Worse?”

18:18.226

[David Spark] Steve, are you familiar with how this game is played?

[Steve Person] Absolutely. Andy always gets to go first and then brag about the statistics.

[David Spark] Of how much people agree or disagree. Yes.

[Andy Ellis] Although lately it’s been getting worse, so I’m trying a different tack.

[Steve Person] All right.

[David Spark] Well, we’ll see what happens. This one comes in from the CISO over at The Weather Company, Jonathan Waldrop, who has submitted lots of “What’s Worse?” scenarios, and here we go. What’s worse? And these are both pretty crappy, I will say. You get a security leader who underreacts to security events.

Now this results in no one understanding the real issue at hand and not appropriately responding. Or you get the opposite, a security leader that overreacts every time, which brings chaos, causes confusion, and incidents are also mishandled. Pretty bad, both of them. Which one’s worse, Andy?

[Andy Ellis] Yeah, so this one’s sort of fascinating because the way the first one is framed is not quite the connection I often see, but it is weaponizable in a great way. There’s an overreaction to suppress, which often gets read as an underreaction. I know security people who they’re like, “Oh, my God, this is awful, but I can’t let my boss find out about it.” And they look like they’re underreacting, but they’re actually overreacting.

And so as I answer this one, I’m almost going to put that into the second category and say that’s still an overreaction. The interaction of, “Ah, who cares? Doesn’t really matter.” I think that’s also going to be a problem. If I look at these two and say, like, which one would I rather be? I’m clearly not either one of those security leaders.

So, I’m going to say that the second one is actually worse than the first one is, and the reason for that is that overreacting is worse because we’ve posited that both of them, the reaction itself is ineffective. That you’re not actually handling the incident. So, therefore I can’t measure them on like, well, at least the overreactor is getting more incidents handled.

Not very clear there. But the overreactor is completely disrupting all work in progress, whereas at least the underreactor is not. So, I’m going to go with, well, I’d rather have the underreactor who lets me keep doing security improvements because the overreactor is making me do worthless work during an incident and not letting me do any work at any other point, and so I think that’s going to be worse for your company.

[David Spark] Well, I don’t know if the first one is actually doing security improvements. It’s just no one responds appropriately. It’s essentially an incident happens, and nobody does anything.

[Andy Ellis] But if I’m in the organization, I’m going to posit that I get more done with an underreactor as a boss than with an overreactor as a boss. And certainly if I’m in the rest of the company, the overreactor is disrupting everybody and the underreactor is not. So, if they’re not going to add value doing their core job, I would like them to stop hurting the rest of the business while they’re not doing their core job.

So, I’m going to take the underreactor is better. The overreactor is worse.

[David Spark] All right, Steve, we throw this to you. Do you agree or disagree with Andy?

[Steve Person] Oh, 100% disagree on this one, Andy.

[David Spark] Oh, I love hearing that.

[Steve Person] I’m glad, yeah. My instinct went right to the underreactor being worse. And I think here’s why, right? It’s pretty hard to put process in place, right, that’s going to compensate for someone not having maybe the sense of sobriety or the instincts or whatever it is that causes them to be underreacting to security incidents.

I feel like with the overreactor, you can dial that back over time.

[Andy Ellis] Oh, no, no, sorry. One of the…

[David Spark] Well, you don’t know how this game works. You can’t dial anything. That’s the way it is.

[Steve Person] Well, okay, so it’s worse because I think it’s harder to fix, right? I think I can…

[Andy Ellis] You can work around it, work separately.

[David Spark] There’s no fixing it. That’s how this game works.

[Andy Ellis] But you have a CISO who, no matter what you do, you implement process, their overreaction overrides your process. That’s going to be key to this one.

[Steve Person] Okay.

[Andy Ellis] Yeah, this is the problem is everyone wants to fix it, and it’s like which one is it easier to fix? And I’m like, no, which is easier to survive?

[Steve Person] Yeah, yeah, to kind of manage around, right? That’s where my head went.

[David Spark] Are you sticking with your answer here, Steve?

[Steve Person] Well, I think I might have to side with Andy then, if I’m not allowed to…

[Crosstalk 00:22:32]

[David Spark] Ah. It comes over to Andy.

[Steve Person] I’m not allowed to contemplate which is more, which is more kind of fixable and manageable. So, yeah, I mean, obviously just the disruption and the credibility that it’s going to shoot to the security organization.

[David Spark] I know, it’s going to blow. I think I have to agree with both of you here on this one. Yeah, the second one just blows everything up.

[Andy Ellis] Right.

[Steve Person] Yeah.

[David Spark] It causes everything to explode.

[Andy Ellis] Now, one thing I do want to point out, which is moving outside of this scenario, which is if you’re a security professional, you should actually underreact more than you overreact. But I don’t mean wildly underreact like this scenario. If you walk in and there is an incident and you’re slightly underreacting, in an incident, every other executive wants to contribute, and the way that they contribute is by correcting you.

So, if you walk in with a slight underreaction, the way in which they will correct you is to react harder. They’re like, “No, no, we have to fix this right now. Why aren’t you demanding this go out immediately?” The answer is because if I demanded it to go out immediately, you would tell me it wasn’t that bad and it could wait.

So, if I tell you, “Well, this is important, but we could wait a little bit,” and you correct me, you’re correcting me in the way I want it to be thrown, like throw me into that briar patch. And the way you get thrown in the briar patch is by underreacting, not by overreacting.

First 90 days of a CISO

23:59.382

[David Spark] When you’re a brand-new CISO, do you even know what skills you need to do the job? It took Rob Labbé, CISO of Mining and Metals ISAC, six years to realize he was only following about one-fifth of what was happening in business meetings, reported CSO online. To get those necessary business skills, Labbé ended up pursuing an MBA.

And I’ve heard many CISOs doing this. Other CISOs just ask questions. When he started as a CISO at Nextdoor, T.C. Niedzialkowski looked for all the help he could get. He would schedule one-on-one sessions on Slack with experienced CISOs. He would just pepper them with questions. Andy, first, do new CISOs realize what they’re in for?

And second, if they do, how do they build up those skills quickly?

[Andy Ellis] Well, the first thing they should do is read my guide. I literally wrote an eBook on this. It’s 13,000 words. If you Google “CISO 91 days,” if you put in first in there, it’s also good, but it’ll find it. I’ve published this. I’m actually about to update it with a new version. This will help you get started.

But the most important thing to recognize is that everybody who has a C-level title has a massive remit that you need to understand. You’re going to go around, you’re going to talk to all those peers, and that MBA is a great proxy for it. You’ll learn about marketing. You’ll learn about sales. You’ll learn about finance.

You need to actually understand how these business processes are running, how these teams operate, what’s interesting, learn that marketing hates itself.

There’s like 20 different organizations in marketing. They are always working at cross purposes. So, when you say, “I can’t get anything out of marketing,” nobody’s sympathetic because everybody in marketing actually feels that way. Once you start to learn how marketing operates, now you can work amazingly with them because you can partner with all those organizations.

Same thing for finance. Do you understand the difference between an account receivable and an account payable? Do you understand the difference between cash accounting and accrual accounting and why that matters and gap versus non-gap? And again, why that matters.

And all of these things, you kind of need to know because that’s what the conversation is. Like, oh, we’re going to invest in a new product. Is it CapEx or is it OpEx? Why does that matter? How does that affect what your budget is? You’d be kind of amazed at how much money you can make materialize out of thin air if you can capitalize the work instead of treating it like an operational expense.

[David Spark] Very good point. All right, Steve, I throw this to you. How do you build up those skills quickly?

[Steve Person] Yeah, so important. And the stuff that Andy hit on, right?, I sort of categorize as like the business of cybersecurity, right? You’re operating this shop that has a budget and has commitments. I think understanding that part of it is just foundational.

[David Spark] Let me ask you, how much did you know of that when you came into your first CISO job?

[Steve Person] I knew quite a bit. I did a super minor, I call it, in business in college, so I had a lot of exposure to marketing and economics and accounting and finance with a broad brush. So, I feel like that was something that really benefited me in that first role. But to answer the question plainly, nobody’s ready for their first CISO job.

There’s no being ready for it. I mean, it’s an overwhelming amount of responsibility. You’re sort of expected to know everything about both technology and what your business is doing and the regulatory environment and risk management. So, there’s just an overwhelming amount that you could choose to prioritize.

I think depending on what your background is, super important to make sure you get those basics dialed in just to run your shop well.

And then I think the second bit is going around to all of those executive business leaders and understanding what their priorities are because your successes are going to so much be predicated on being able to kind of align incentives and motivations with your business partners and how they’re measured.

So, I think you have to start there. And then I think the two other things I would add, one that I’m really passionate about as we kind of look to just mature the discipline and transform what a CISO is and the role that it plays in the organization, is risk management and really understanding risk management much better than we have traditionally and much better than most sort of technologists coming up understand risk management.

And then I say the second thing is just really understanding the broader ecosystem of your business. So, Cambia is the parent of the four Blue Cross Blue Shield regions health insurance plans in Oregon, Washington, Idaho, and Utah. Healthcare is incredibly complex. Insurance is incredibly complex. Trying to just really understand how those systems work and who our partners and stakeholders are from a sector perspective and how we can partner maybe with the CISOs of provider organizations and our employer groups and others is huge.

So, I think those are the couple of things that I would start spending time on. And again, depending on where you’re coming from but just assuming you’re kind of coming through that traditional kind of technical background.

What’s broken about cybersecurity hiring?

28:50.924

[David Spark] So, we just talked about adding skills for a CISO, and in one example, a CISO got formal education. How useful is any kind of degree for a cybersecurity professional? Like is a PhD in cybersecurity only useful for academics? So, this question came up on the cybersecurity subreddit and many pointed out that insisting on being called doctor at work would be a worthy perk in its own right, but others pointed that it would be useful in newer fields like decentralized identities and cryptography.

But in a larger context, do we have a problem in cybersecurity linking formal education to actual jobs in this field? And I think that’s the critical question. I’ll start with you, Steve. What would you like to see from universities and training programs to create a clear path to getting hired? I mean, we have talked plenty like don’t put a requirement of a college degree for a cybersecurity job.

We’ve talked plenty about that. But if we wanted formal education to help us what would you want?

[Steve Person] Yeah, a couple of things here, right? I love logic and critical thinking as a foundation, and I think you tend to see that more emphasized in a liberal arts background than a sort of purely technical background, so I think that’s one interesting bit of well-roundedness. Andy’s making a face at me, so I can’t wait to get to this.

But I think that just well-roundedness of critical thinking skills that cross disciplines is something that I like to see. And I know part of that comes from diversity of hiring and not requiring a specific degree or a specific background.

I think a second thing is some very kind of hands-on experience. I think a lot of people are getting into security maybe or studying security because they see the headlines that there’s all these jobs. And I think it’s really important that people have had a chance to kind of go through the motions and understand, “Is this really for me?” and have some hands-on experience and know kind of what the day-in-the-life looks like.

I’ve been involved with a really neat program here at Oregon State University where they actually manage an active SOC, right, and students that go through the program – it’s called ORTSOC – students that go through the program spend time in the SOC. It’s a working SOC.

And so they’re coming out of the program really knowing what that work looks like, right, and with some real experience. And at the same time, the ORTSOC is supporting kind of underserved municipalities and other organizations that are really kind of struggling with ransomware and other cybersecurity incidents.

So, I think it’s things like that, right? It’s those critical thinking skills, it’s that well-roundedness and diversity of education, as well as some hands-on experience that I’d like to see more of.

[David Spark] And that’s a very good point – I’m going to toss this to you, Andy, in a second – is I’m not a huge fan of “learn this application.” As I always point out, I studied Fortran in college. Not that useful today, is it, Andy? [Laughter]

[Andy Ellis] Well, it’s not sure any programming language would be useful to you today, David. So, maybe we should…

[David Spark] Right.

[Andy Ellis] But there’s a really good point here which is in between what Steve said, which is there are entry-level careers in cybersecurity that often start in the SOC. That is not the entire cybersecurity career field. So, I love these programs that are like, “We will train you and develop you.” It’s really actually a technical degree.

It’s like going to get a technical certificate in auto repair. You get a technical certificate and working in a SOC. And yes, you learn on specific technologies, and we’ll teach you how to grow beyond them, and that should all be part of it. But it’s fascinating to me that the most effective college programs that we tend to talk about for cybersecurity are basically trade schools, just inside a larger university.

And they’re fantastic program, this is not me criticizing them. This is me pointing out that’s what this is.

When people talk about a PhD, I’ll give my mother-in-law’s advice. My mother-in-law retired as a professor at Northeastern, has a PhD. And she said the only reason to get a PhD is you cannot conceive of anything better to do with your life. There are a handful of jobs that require a PhD. Most cybersecurity jobs don’t.

What I would love to see? I would love to see every university program take every single degree track that they have, whether it’s philosophy, whether it’s English, whether it’s operations research, finance, whatever, and say, “What is the cybersecurity minor that attaches to that degree that provides people with that skillset, the correct grounding?” So, we do not need people to get a cybersecurity architecture degree.

I want software architects who are trained in cybersecurity, which might look a little different than an operator in cybersecurity, different than a marketer with cybersecurity. That’s what I want to see is the minor programs in cybersecurity that are focused on supporting specific degree programs.

[David Spark] Very, very good. And I hope some university leaders are hearing this and will change their program as a result of it.

Closing

33:59.386

[David Spark] That brings us to the end of this very episode. I want to thank you, Steve, for being our guest today, the CISO over at Cambia Health. I’m going to let you have the very last word, but first I want to thank our sponsor, and that would be Vanta – automate compliance, manage risk, improve trust continuously.

Get yourself a trust center if you don’t already have one. Go to vanta.com/ciso to get a thousand dollars off of Vanta. Andy, as always, thank you very much and congratulations on your promotion…

[Andy Ellis] Thank you.

[David Spark] …over at YL Ventures. Steve, any last thoughts? And the question we always like to ask our guests, are you hiring?

[Steve Person] We are hiring. Go to cambiahealth.com and scroll to the bottom and look for the Careers link. We have one open position on my team, and others that are security adjacent across the IT organization. So, check that out. It’s a great place to work.

[David Spark] Awesome. And you get to work with Steve. What could be better?

[Steve Person] That’s right.

[David Spark] I’m assuming people can connect with you directly through LinkedIn, yes?

[Steve Person] Absolutely.

[David Spark] All right. And they can mention that they heard you here too as well. I want everybody to have a happy National Cybersecurity Awareness Month. Please be more aware of cybersecurity, even though if you’re listening to this, it’s probably your job and what you’re thinking about all the time.

But just think about it even more because you’re supposed to be more aware this month. When it hits November, you can dial it down. But for October, crank it up. Thank you again for listening and contributing to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cybersecurity Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.