In cybersecurity, we often focus on technical skills. These are easy to demonstrate and are part of the foundation to getting the job done. But everyone needs soft skills. It’s core to communication. Which soft skills are necessary for each role in cybersecurity?

Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and Edward Contreras, senior evp and CISO, Frost Bank. Joining us is Ryan Dunn, Leader of Product and Supply Chain Technology, Specialized Bicycle Components.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, HackerOne

Full Transcript

Intro 

0:00.000 

[David Spark] In cybersecurity, we often focus on technical skills. These are easy to demonstrate and are part of the foundation to getting the job done. But everyone needs soft skills. It’s core to communication. Which soft skills are necessary for each role in cybersecurity?

[Voiceover] You’re listening to Defense in Depth. 

[David Spark] Welcome to Defense in Depth. My name is David Spark, I’m the producer of the CISO Series. And joining me, he’s a regular co-host now, it’s Eddie Contreras, the VP and CISO over at Frost Bank. Eddie, say hello to the audience. 

[Edward Contreras] Hello, audience. And David, thank you for having me back yet again. 

[David Spark] We love having you on the show. By the way, if you have not visited our website, that’s CISOseries.com, you should go there every day because we have daily news there every day, daily cyber news. Please check us out. It’s lots of great other programming besides this show.

But we’re glad you’re here. Stay where you are. Our sponsor for today’s episode is HackerOne, secure at scale with humans and AI. More on HackerOne and how they’re doing just that a little bit later in the show. But first, let’s talk about a topic at hand, Eddie.

So, technical skills often define if you can do a job in cybersecurity, but I should also mention, not all cybersecurity roles require technical acumen. But Evgeniy Kharam of Discern Security made the case on LinkedIn that we need skills like empathy, communication, and adaptability to apply effectiveness.

So, I’ll ask you, Eddie, can soft skills be trained or you just have to have them, or you don’t? 

[Edward Contreras] You can train everything and maybe you can tune your skills, but I think the reality is to some degree, everybody has them but having explicit acknowledgement and then the ability to tune, I think is really the key where you master this skill.

[David Spark] Very good point. Well, the person to help us mine through this very conversation about when and how you need soft skills and what roles need them and in what ways, we have, actually, Evgeniy is the person who recommended our guest, the leader of product and supply chain technology over its specialized bicycle component, none other than Ryan Dunn.

Ryan, thanks for joining us. 

[Ryan Dunn] Thank you, David. Great to be here. 

I didn’t think of these options. 

2:21.725 

[David Spark] Yana Klebanov of Valant Security said, “Too often overlooked yet incredibly impactful skills in sales are genuine curiosity and resilience. It’s one thing to understand what your customer wants or needs, but the real key is to dig deeper and uncover why they need it.

With true sense of curiosity, you can explore how your solution affects their broader goals, challenges, and vision, then by articulating that value back, using their own language and framing.” Good point. And I will just say, a telltale sign that someone is not listening is they just say the word “interesting” over and over again.

Active listening is more important. 

But let me also read Helen Oakley of SAP, her quote, “One often overlooked but critical soft skill in cybersecurity is conflict resolution and stakeholder relationship management. The ability to resolve conflicts diplomatically and maintain strong trust-based relationships with stakeholders is just as essential as technical expertise.

It’s these skills that help drive collaboration, build consensus, and ultimately ensure that security initiatives are successful and well-integrated across the organization.” So, I love this. True curiosity and conflict resolution. Those are great soft skills.

Eddie? 

[Edward Contreras] They are phenomenal skills. And if you think about what Yana said there and try to unpack that a little bit, in the military, there is a concept or a phrase that we use called right seat right. At my company, we talk about day in the life.

Do you actually sit in the shoes of the person that you’re helping solve an issue for? Because then, now you’re talking relevance. Can you now alter your language? Yes, you are the subject matter expert. You happen to bring an acumen of technology expertise.

But sitting in there and actually understanding what the problem is, the way they live through it, now all of a sudden, you can start to apply your expertise in the way that they would receive it. 

So, I think it’s a critical skill. It’s just a phenomenal way to approach things is start in that seat of the person you’re solving a problem for. And while conflict resolution, where do you start with that? Every conversation you can think of needs somebody to have that skill set because you can’t close out an argument without having some type of resolution.

You can’t close out a debate without having a resolution. So, phenomenal skill set on both ends of those quotes. 

[David Spark] Yeah, I’m in complete agreement. And Ryan, what’s cool about both of those soft skills is they can be very apparent. It’s very clear to show curiosity. It’s very clear to show that you’re aiming to resolve a conflict. What are sort of telltale signs you’ve seen?

[Ryan Dunn] I think just being curious and staying curious is just part of being a human. Having that conflict resolution is part of being a human. I think it starts when, if I’m just meeting someone for the first time, instead of kind of diving right in, asking a bunch of questions about how can we sell you this and how can we sell you that, let’s get to know each other a little bit first.

What I look for anytime I’m working with someone new is, hey, is this someone that I see as a partner? Or is this just kind of a transactional relationship? You can tell within the first couple of minutes if this person really cares about what I’ve got going on or what the company has going on.

And that’s all through asking the right questions, leaning in, and understanding what are my wants and needs and what is the business getting after. And then conflict, we have to embrace conflict. I think it makes us all sharper. We get to better outcomes.

It’s not always fun, but it’s just a part of the job and part of being human. 

[Edward Contreras] David, I’ll say that you had mentioned a word, right? And then you said, “Hey, you can tell when someone’s disengaged.” And I love that phrase that Ryan used, which is transactional. Is this conversation engaging or are they going through the motions here?

Is this something that you feel is just mechanical? Something’s off with this conversation? 

[David Spark] Are you the decision maker? 

[Laughter] 

[Ryan Dunn] Exactly. 

What needs to be considered?

6:24.304 

[David Spark] Dheeraj Joshi of BAAR Technologies said, “It’s important to effectively communicate complex technical issues to non-technical stakeholders, collaborate with cross-functional teams, and build trust within an organization.” I would say that is kind of what most people think about when they think about soft skills, what Dheeraj just explained there.

But he goes on to say, “Soft skills like problem solving, adaptability, and empathy enable them to navigate challenging situations, respond to incidents, and ensure comprehensive security strategies are understood and implemented. 

And Val Dobrushkin of Tricentis said, “Soft skills are crucial for all professionals, especially in cybersecurity, where we often need to convince people where to spend the resources. We have cross-functional responsibilities with ownership of security, but no direct authority out of our own InfoSec team.” So, Ryan, explaining complicated stuff to a non-technical audience, I’m going to start at sort of like a high view here.

When you approach this challenge, because we all have to do it in cybersecurity, do you think of a metaphor or do you think, oh, how does this affect you and your business? I mean, you kind of have to think of a lot of these aspects. Like, where do you approach the challenge there?

[Ryan Dunn] Yeah, I think communicating complex topics is one of the biggest challenges we have as a security community and vendor community. I not only see that in my security days, but in my role on the product side of the house. And the way I look at it is CEOs, they don’t wake up every day talking about CVEs.

They could care less. They worry about growth and margins. CFOs want forecast accuracy. So, where I’m going with this is I always anchor back to the business. What are we trying to get after? Who are our competitors? How do we make more money? How do we increase those margins?

So, I anchor any conversation I have, whether it’s on the security side of the house or product and supply chain, it’s, hey, what are we trying to get after as a business? 

[David Spark] Yeah, and this is a philosophy, Eddie, that I think we echo through most of our programming on the CISO Series, what Ryan just said there. 

[Edward Contreras] Yeah, I would agree. And I know we’ve talked about this before in the past, and I’ve said this before, where you hear somebody say, “My budget wasn’t approved. My funding is not there.” Okay, well, then there’s an opportunity for self-reflection.

What happened in that conversation where you were seeking funding? Because I can assure you the conversation is valid, and the need is just. But if you’re not getting the funding, it could be because that soft skill may not be present. Did you personalize the conversation?

Did you bring too much technical jargon into that presentation? Were you lenient or maybe even repetitive on certain words that you felt were the homerun words, yet the person receiving the message completely missed that? And so, that’s where I think the soft skills do come in.

Funding is a great conversation. Are you talking the language of the person approving and/or issuing the funding, and are you talking about a business risk that’s resonating with the stakeholders versus, to Ryan’s point, are you talking just CVE, number, date, risk score?

Because that’s not going to get you the funding, right? 

[David Spark] Let me also ask how deep you go into this because we’ve heard this a lot, like speak the language of where they’re at, like what the CEO thinks, what the CFO thinks. But how much recon can you do? Because you have a general idea of what the CFO and CEO is concerned about.

You may not know what they’re concerned about that day, that week, that month. How much kind of recon do you do beforehand to understand what the current problems are, Ryan? 

[Ryan Dunn] Just do some quick research. As a product company, we always have new products coming out. So, get an idea of what those are, what the market’s saying about them. Are they hammering it because of price? Do they like the performance of these products we’re putting out?

I would also say just get a general feel for what the industry is doing. The bike industry has gotten bigger, it’s contracted. So, know where the industry’s kind of going in general, and those are all things that you can find just through some quick searches.

So, I would say, again, going back to curiosity, stay curious. Just do a little bit of research to understand where the company’s at, where we’re going, and what does the broader market look like? 

[Edward Contreras] And I think if you can bring it to personalize within the company as well, if you’re going to meet with the CFO, you should look at some of the meetings that the CFO’s attended. Bring and review the meeting minutes of some management meetings.

What was discussed? What were they being pitched that you may not be aware of? And so, a lot of times before I go into a stakeholder meeting, I need to see what they were just exposed to. Okay, does any of my risk that I’m going to talk about, is it associated to that conversation?

And if it is, great. 

Sponsor – HackerOne 

11:06.976 

[David Spark] Well, our sponsor this week is HackerOne, and stay tuned, especially if you’re concerned about AI and security. So, AI is changing everything, right? Your product, your infrastructure, your threat models. And the only way to stay ahead is with security that is just as smart.

HackerOne combines cutting-edge AI with human ingenuity to protect your systems from evolving threats in the Age of AI. At unprecedented pace, cyber criminals are exploiting AI to launch faster, larger-scale attacks. Meanwhile, organizations are rapidly integrating AI into every layer of operations, escalating risk, and calling for increased regulation.

Bottom line? Offensive AI is outpacing defensive strategies. Enterprises need a positive, proactive approach to AI security and safety. 

HackerOne is the global leader in offensive security solutions. Trusted by AI innovators like Anthropic, Adobe, and Snap, HackerOne helps customers find and fix vulnerabilities across the entire software development lifecycle. The HackerOne platform offers bug bounty, vulnerability disclosure, pentesting, AI red teaming, and code security, powered by AI and the world’s largest community of security researchers that give organizations an unmatched edge, whether you’re testing large language models or identifying bugs before production.

AI needs both protection and participation. HackerOne uniquely offers both, testing your models in ways internal teams simply can’t. Just go to their website, find out more at hackerone.com. 

What’s most important? 

12:55.025 

Katherine Isaac of Flare said, “I like to think of advocacy as a group of essential soft skills, working together to help customers better meet their needs. Advocacy involves persuading and influencing others to support an idea. Advocating internally for our customers demonstrates that we are more than just a vendor.

We are partners invested in their success. When we advocate for our customers’ interests, they feel supported and empowered and are more likely to trust our recommendations and solutions.” All good advice. “Customer advocacy also encourages feedback loops that drive innovation and helps build new solutions to solve real world challenges.”

And Fernando Montenegro of The Futurum Group said, “I’m not a fan of the word soft, as some may read it as easy. They’re anything but. I tend to prefer social skills instead. But the point remains true. Being empathetic to what others need or are going through is essential.

Cybersecurity is more and more about cooperation with others. If one can’t understand and empathize with how others are dealing with their own constraints and objectives, then the chance for collaboration drops significantly.” So, I think this is a nice combination here of these two quotes of speaking about advocacy and empathy because they kind of go hand in hand.

Eddie? 

[Edward Contreras] I would agree. And I think Fernando and Andy must be really good friends. I know Andy really hates the phrase “soft skills.” 

[David Spark] Andy Ellis we’re talking about? 

[Edward Contreras] Exactly. Andy Ellis, the infamous or non-infamous Andy Ellis. 

[David Spark] The Legendary CISO, as I’ve called him many times. 

[Edward Contreras] Exactly. Well, he has a lot of names. [Laughter] But if you think about that phrase, really, you may have honest and valid intent, but if the perception is taken the wrong way, if the perception is you’re dismissive or you’re bringing authoritative language to the conversation, you’re not really recognizing the work that I’m doing here, then regardless of what your intent is, it’s going to fall on deaf ears.

And that’s where you really have to, again, understand what those social skills are, the soft skills. Okay, I have a message. I’m going to be delivering a very uncomfortable message. I have to acknowledge the fact that they’re already hardworked, there’s a lot of things going on within the organization, and I know what I’m going to talk about could be disruptive.

And so, you have to be able to understand how do I need to convey this message? 

And I think you group these quotes so perfectly together because you come right back to that first quote that said, okay, this is not my drive. This is not your problem to solve. We’re in here together to help the customer out, and we’re both here getting a paycheck on behalf of this customer, and so how do we solve that problem?

So, if you can merge those two quotes together and really understand how do I now remove the perception, focus on the customer, then I think together you’ll pretty much land on really good soft skills. 

[David Spark] And Ryan, if you can, and this goes whether internally communicating people’s, you know, emphasizing and advocating, or externally to customers, this works in both ways. But if you can truly show it, they will see you’re on their side and they will sort of embrace you.

Everything else becomes easier, essentially. Yes, Ryan? 

[Ryan Dunn] Couldn’t agree more. I think what we’ve covered when it comes to conflict resolution, being curious, it starts with intent and stating your intent. Eddie, you hit on it. I’ve fallen over myself a couple of times by having the best intent.

I didn’t state it and tripped all over myself. So, I would totally agree. Advocacy is super important. And when it comes to stating your intent or these soft skills, I know from experience, these soft skills make or break teams. And I know in a lot of cases, I’m sure yours and Eddie’s and a lot of others, we’ve worked for probably 15 to 20 years on what are so-called soft skills.

Again, I think it makes or breaks the team and can make or break an actual relationship as well without them. 

What do most people think it is, and what’s the reality? 

16:48.417 

[David Spark] Damian Tommasino of Cyber Informant said, “Soft skills tend to matter more than technical skills, yet they are often non-existent on job descriptions or post-hire training. They touch everything we do, but we tend to put the least amount of effort into them.” I would agree with that, and that goes to my initial question of can they be trained?

Brian Laing of AccuKnox said, “As someone on the autism spectrum who has spent over 20 years in cyber security, I’ve come to deeply appreciate the power of soft skills in our field. For me, developing soft skills has been a deliberate journey. Being autistic, I’ve had to consciously work on skills like communication and empathy that may come more naturally to others.

This effort has paid dividends throughout my career.” Now, we know people in autism, there’s a wide spectrum in terms of severity there. I am not someone who has this, but I have friends, and their family members have it. It can be a struggle depending on the level of severity.

Have you worked with people, Ryan, that are on the spectrum? 

[Ryan Dunn] Not directly with on the spectrum. Not that I know of. 

[David Spark] So, maybe they’ve trained very well like Brian did. Who knows?

[Ryan Dunn] Absolutely. I think Brian hit it spot on. 

[David Spark] But maybe you’ve, if not that, maybe you’ve worked with people who struggled with soft skills. Now, this I’d be interested to know. Have you seen anyone make a marked improvement on them? 

[Ryan Dunn] Yes. So, I think it absolutely can be trained. I think in this world, in the engineering world, in the cybersecurity world, we can be super, super rigid. It’s our way or the highway. We have to do it this way. They can absolutely be trained.

But I think as Brian pointed out, you have to want it, and you have to work at it. Find your opportunities, whether it’s through coaching or leadership programs or mentoring, you have to want it. It’s still something that I work on today, but it absolutely can be trained.

[David Spark] But the interesting point of it, you don’t see it in job descriptions, and people often get certifications because they see in job descriptions that you need X, Y, Z. Nobody says, “You need to have this soft skill,” which again, is hard to measure.

There’s no job training. Although in a sense there are, there are Toastmasters for people who need help with public speaking, but that’s just kind of one aspect of soft skills. I think in the case of Brian, he clearly knew he needed to get better at this.

What do we need to communicate, Eddie, that people need to get better at this? Because maybe it’s not being communicated. 

[Edward Contreras] David, if you remember and look at Damian’s quote, now you remember the good old days here. On your resume, you put Word proficient, Excel proficient. 

[David Spark] I have an old resume that says that. 

[Edward Contreras] Everybody does. Everybody has that. What they didn’t say is work well with others, can lead a conversation, can follow somebody’s direction. That wasn’t on the resume. And to this day, it’s not there. What’s taken the place of Outlook and Excel and Word?

Java proficient, C++, scripting, right? So, again, the focus on the resume is capability, not delivery. And so, I think that’s a challenge, and it is an industry challenge, and I don’t think that’s unique to our profession at all. I think that is something that a lot of companies that do understand ethics and they do understand how you work within a team, they interview for that, but they don’t post for that, right?

They don’t put it on the job description. How do you put that on there? I think it’s going to take some time, but I don’t think it’s unique to our industry. If you look at how most people look at those things, they just seem to prioritize technical capabilities above all others, and then that’s what you get paid for.

So, I get it. 

[David Spark] Let me review some of the key words that we have mentioned on the show. Curiosity, conflict resolution, empathy, and advocacy. Those are kind of the four big ones. If you put those on a resume, now it’s hard to prove it. And if you have may be a line to describe it, but it could be, “Ask me how I do these four things.

Ask me about curiosity. Ask me about advocacy.” Then that can come up in the interview and hopefully you have a good story. Ryan, I mean, that would be kind of a great way to conduct an interview. Yes? 

[Ryan Dunn] A hundred percent. Yep. I think “ask me” is one of the best ways of doing things. If you can ask me about, hey, what do I got going on? I’m a big rider, a big snowboarder. Ask me about that. Ask me about difficulties at work. Just stay curious and treat it as a conversation.

Be curious like you’re talking with a friend. Couldn’t agree more. 

[David Spark] The “ask me” where you want the conversation to lead also will create curiosity too, even on your resume or in any sort of engagement. 

[Edward Contreras] It does. But think about also the software that’s used with HR teams. They’re not scanning for the soft skills. They’re scanning for what did the manager ask for? They wanted these 10 things, okay. That’s what I’m scanning for. And maybe it’s also training or management teams.

When you’re in the interview process, maybe don’t start off with, “Hey, can you compile this code?” or “Can you actually go through a Snort policy or read a SIEM rule?” No, maybe it’s can you hold a conversation, and can you grab the room’s attention, right?

But again, we don’t ask that in the initial conversations. 

[David Spark] Awesome. 

Closing 

22:04.219 

[David Spark] Well, that brings us towards the end of our show, but I have one question to ask you first, Ryan. And that is, of all these wonderful quotes that I read, which one was your favorite? 

[Ryan Dunn] Well, thank you, David. I liked the one from Yana. I think staying curious is a skill that I think is missing sometimes. It’s missing from a lot of conversations. It’s missing from how we buy and sell and build those partnerships. So, it’s also key to building trust.

Yana’s has to be my favorite.

[David Spark] Curiosity. All right. Your favorite quote, Eddie. 

[Edward Contreras] Well, I was thinking about Brian because he just, again, sums up everything that I said, which is it’s a teachable, it’s a trait that everybody has. You just tune it. I’m going to go with Helen, conflict resolution. And I love the fact that every conversation is going to have a debate or some type of back and forth, but if you have the ability to have conflict resolution, at the end of the day, no one’s thinking about a bad meeting.

You’ve come away with a conclusion, and you moved on from it. So, I love that skill. 

[David Spark] Well, that brings us to the very end of the show. I want to first thank our sponsor, and that’d be HackerOne, secure at scale with humans and AI. Remember, go to their website, hackerone.com. And when you go, let them know you learned about them through the CISO Series.

Thank you very much, Ryan. We greatly appreciate you coming on. First time ever on a CISO Series show. We’d love to have you back again. And Eddie, I believe you are still hiring over at Frost Bank. Is that true? 

[Edward Contreras] We are not only hiring, we are hiring a specialty trait. So, if you’re in Texas and you want to be a part of a security AI team, please come. We have an opening, or many openings. 

[David Spark] That is very attractive. And by the way, you can contact Eddie directly, I’m assuming, through LinkedIn, yes?

[Edward Contreras] Absolutely. 

[David Spark] And we always have the link to his profile page on the blog post for this very episode. I want to thank our audience. We greatly appreciate your contributions and for listening to Defense in Depth. 

[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site CISOseries.com where you’ll also see plenty of ways to participate, including recording a question or a comment for the show.

If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.