Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Tracy Maleeff on diversifying the cyber workforce, OSINT skills and “librarian face”
Guest:
Tracy Maleeff
Published:
Updated:
Duration:
45 min
Episode summary
Tracy Maleeff led a successful career transition into the tech and cybersecurity world nearly seven years ago. Now a security researcher with the Krebs Stamos Group, the former librarian still uses her hard-won open source intelligence skills to sort through a deluge of cybersecurity information for clients and for subscribers of her free InfoSecSherpa news roundups.
In the latest WE’RE IN! episode, she speaks to the importance of having diverse perspectives at the table when it comes to cybersecurity and warns of a disconnect between tech hiring managers and HR departments.
“Companies keep hunting for unicorns when they really just need to pay attention to the squirrels at the base of the tree,” Maleeff said.
A few more reasons to listen:
Discover Tracy’s tips for breaking into the cybersecurity industry from other professions: She once helped a mechanic launch a career in pentesting
Learn how she’s used Twitter to advance her own cybersecurity career
Hear about out her favorite episode of Keeping up with the Kardashians – and yes, there is an infosec connection!
Borrow the librarian reference interview Tracy built her Empathy as a Service talk on the seven-step reference interview from library science, using steps like approachability to help security teams understand what users actually need.
Don't assume malicious intent Skilled security staff should be able to detect real insider threats without treating every request from another department as an attempt to get something past them.
The bottleneck is hiring, not people Tracy argues that entry-level postings requiring a CISSP, automated resume screening, and referrals from homogenous networks keep qualified candidates behind the HR firewall.
Reach out to underrepresented candidates Companies should post jobs where underrepresented communities will see them and personally invite people to apply, since candidates of color may not apply blindly to a company whose culture they don't know.
Show, don't just tell Telling someone to use a password manager is not enough; Tracy suggests demonstrating one with a dummy entry so people can see how it works.
Notable quotes
I wanna take it from the none shall pass to welcome. Come in. Do you want some tea?
Companies keep hunting for unicorns when they really just need to pay attention to the squirrels at the base of the tree.
And I literally thought OSINT was a programming language like COBOL…
Just be a security advocate where you are. That's what I did as a librarian.
Questions this episode answers
What is the reference interview and how does it apply to security?
It is a seven-step guideline taught in library science to figure out what a patron is really asking for. Tracy applies those steps to security so teams build allies across the company instead of acting superior. Read this section
How did Tracy Maleeff move from librarian to cybersecurity?
She found cybersecurity in 2015 while still a law firm librarian, quit her job in January 2016, and got her first SOC job in 2017. She says her twenty years of research work turned out to be OSINT experience. Read this section
Is there really a cybersecurity talent shortage?
Tracy does not think there is a people shortage. She sees a problem with hiring and retention, badly written job postings, a disconnect between hiring managers and HR, and companies unwilling to train. Read this section
How can companies diversify their security teams?
Tracy says white women are not diversity on their own and the focus should be on underrepresented people of color. Companies should be allies, post jobs where diverse communities see them, and personally invite candidates to apply. Read this section
Is Twitter useful for a cybersecurity career?
Tracy said all of her cybersecurity jobs had a Twitter factor and that it helped her learn, network, and build a reputation, though she avoids it after midnight. Read this section
About the guest
Tracy Maleeff, known online as InfoSecSherpa, spent about fifteen years as a librarian, mostly at law firms, before moving into cybersecurity and landing her first SOC job in 2017. She has also worked at The New York Times, and at the time of recording she was a security researcher at the Krebs Stamos Group. She publishes free InfoSecSherpa news roundups and speaks about empathy in security and diversifying the cyber workforce.
Yeah. I, I mostly avoid Twitter, but she is one of the few InfoSec people that I do follow, and it's always pretty cool when I see her come up on my timeline. She has a huge following and a lot to say about cybersecurity. But beyond that, she has a really fascinating story about how she got into working in cybersecurity in the first place.
She's been a librarian, worked at the New York Times, and now works as a security researcher at the Krebs Stamos Group. We have so much to talk about with Tracy, but first, a really quick word from our sponsor.
WE'RE IN is brought to you by Synack, the premier crowdsourced platform for on demand security expertise. Synack delivers twenty four seven pentesting, intelligence, and vulnerability management from a global network of vetted and trusted researchers. Their work is enhanced by smart technologies to accelerate your critical cybersecurity missions. Synack gives businesses the best chance of finding every vulnerability that matters. Find out more at Synack dot com. That's synack.com.
Welcome in, Tracy. It's lovely to to get to chat with you today. I've been really, really looking forward to this conversation. So I guess first of all, how are you doing today?
Absolutely. The first time that I ever actually saw you speak was at the Diana Initiative Conference in 2020, which I think it was their first year virtual. I was so jazzed to get to attend that conference, especially virtually. Just made things really easy and all the talks were beautiful. But specifically, your talk was titled Empathy as a Service to Create a Culture of Security. And I found it really, really interesting and impactful. And I loved this concept of approaching security, you know, with a more human centric approach. I was wondering if you could just sort of tell us a little bit about that approach and what that means.
Sure. Thank you so so much for that that kind feedback. Yeah, that's a talk I'm really proud of. And yes, and it came about because of my unique career change from library science world. I was a librarian, mostly at law firms for about fifteen years total. And I was very shocked to see in InfoSec how much the end user or customer, whatever term you want to use, the consumer of security services at an organization was met with a lot of disdain and ridicule. And coming from the library science world, I mean, don't get me wrong, there's plenty of anonymous librarian Twitter accounts that like to complain about library patrons. But this was open hostility that I hadn't really experienced before.
And I found that really troublesome because I am well aware that we want these users on our side. And I know that there's a better way to go about that. So I based that talk, Empathy as a Service, on a seven step guideline that is taught grad school for library science and used by librarians all over. It's called the reference interview. And the purpose of that is to help you figure out what a patron's really asking for. Because sometimes it's not clear. But I was able to take those seven steps and apply them to our information security world through stories, true stories that I experienced, and really trying to get people to understand that if you create allies within your company, not just, you know, not just a receptionist through the C suite, but also just other tech departments too, that we really need to get rid of that attitude that somehow security is superior and doesn't have time to talk to any other departments or work with them.
So, I'm just doing the best that I can in my little corner of the world to try and get people to have a really different approach about security. I wanna take it from, you know, the none shall pass to welcome. Come in. Do you want some tea? You know, I really wanna turn it on its head. So that's what I'm trying to do with with that.
It was really cool. The... Listening to the talk, there was a lot of... I think a lot of the talk was focused on sort of how a security department can, like, be more approachable to the rest of the company and the C suites and things like that. But I've also had conversations where we come with like, we found this really interesting vulnerability. When we focus more on let's turn this conversation into a learning experience for both of us. Let's focus on how to make this. I don't want to say a pleasant experience, right? Because it's not fun to find bugs. It's not fun to find vulnerabilities. But that culture of this is a cool thing that we now get to learn about together. I find it way more successful and then customers come to me with questions and we just get... When those experiences happen, I find the customers more often to ask me for advice and things like that.
Yeah, that's approachability, which is one of the steps in the reference interview. And yeah, you have to be approachable and it's all about empowerment. You want your customers or your users to feel empowered and be a part of the process. So yeah, rather than admonish them, turn it into a teachable moment of, okay, so yeah, hey, we did find something bad, but let's talk through it. Let's see how we can improve it. But this also goes for other departments too. And if I can share a quick story, I had a real wake up call in one of my jobs as a blue teamer, where we were asked to meet with an engineering or development department within this company because they wanted to use an open source free software, and we were there to evaluate it.
And in hindsight, I realized the team was probably going in a little harsh. And the wake up call came when the manager of the other department said, Why do I feel like I'm being punished because I asked security to weigh in on this product. And that was like a gut punch and a real wake up call. And that's when I really spoke up and said, Okay, let's, you know, you're absolutely right. You're not being treated fairly here. Let's go about this a different way. And in my own way, was able to cut to the heart of the matter, which was they didn't have the funding to get the more secure paid version. So that's when I said, Okay, well then who do we as security need to talk to to get you more money so that you can get the more secure paid version for this product?
I think there's this weird stigma in cybersecurity when individuals try to think about admonishment for asking questions and doing things. When in fact, us either on the cybersecurity side or Red Team side, Blue teaming side, we look at it as they're trying to get over one on us, or they're trying to bypass security controls, or they're trying to, you know, circumvent the system. And and that doesn't help anybody, right? Because we're not coming about it from a perspective of trying to understand. We're coming about it from a perspective of of they're doing wrong already. Right. And I think that's that's an important distinction that you just briefly touched on. I just kind of want to, you know, say that those of us individuals in the industry that are doing this might want to reflect on that.
Yeah. That's a good point for you highlighting that. And I wanted to mention that again too, that yes, I'm not naive enough to think that everything is innocent. Yes, you may uncover some, you know, some insider threats, or somebody may try to be putting something past you. But this is my perspective on that. If you are good at your job, you will be able to ferret that out. So don't assume mal intent, but if you are skilled at what you do, you should be the one to pick up on mal intent and not assume that everyone who is... Comes across, you know, your your department is is trying to get one past you.
A quick question. You started your career in around 2015. From the outside look again, it seems like you've had tremendous success across the board in a number of the initiatives that you've gone through. Bella just mentioned one of the fantastic talks that you've done. Right? You've also worked at the New York Times, and now you currently work in the Krebs Stamos Group, which was ultimately formed by CISA director Chris Krebs. And I... If I pronounce that wrong, I I apologize.
2015 is when I declared the year of my career. And I was still a law firm librarian and I decided to dip in a the tech world first because I knew that I wanted to make a career change. So it wasn't until about maybe halfway through 2015 is when I found cybersecurity. So I actually quit my law firm job in January 2016, and then it took me a year and a half from there to get my first SOC job in 2017. So yeah, so you're not you're not entirely wrong, but yeah, I was still a law firm librarian, through January 2016. Yes. Yeah. Which is another point I want to mention real quick too, if that's okay, is a lot of folks say that they're interested in cybersecurity, but they're not ready to make a change yet or things like that.
Or I actually had one woman say to me, I am completely content as a software engineer, but I'm feeling all this societal pressure that I should get into cybersecurity. And I tell people,
Just be a security advocate where you are. That's what I did as a librarian. You know, when I described it to the CIO of the law firm as security is my quirky hobby, you know, and that's when I offered to run. Yeah, that's a longer story. So was like, great. Bloom where you're planted, you know, just just become a security advocate where you are.
It's interesting for me to learn about the perspectives of individuals that started elsewhere and then migrated into cyber. Because one, there's a huge talent gap shortage. Everybody realizes that. And so the more people, the more people we can get into cyber, the more women we can get into cyber and the more individuals that want to come in and participate is exciting to me because I've always been enamored with cybersecurity. And so I'm kind of curious where your journey started to think more broadly about culture and InfoSec and the community and trying to bring it all together.
Sure. Well, this came about, my career change came about because I felt like I had reached everything that I could do in the law firm library world. So in the fall of twenty fourteen, I would be very sad, a very sad commuter on the train in and out of Philly. And I mean, were times when I was crying on the train. I was that awkward person crying on the train because I had worked so hard to get to this level at the law firm and within the library world, and I had accomplished a lot in the library world. And I just thought, is this it? Like, I feel like I don't I, you know, I don't feel like I can coast on this career until retirement. Whereas I do have former colleagues and friends who are completely content to coast in library world for, you know, till the end of their careers.
And I wasn't satisfied with that. So I happened to read an article in the train. It was in Entrepreneur Magazine. And the title of the article is called How to Future Proof Your Career in 2015. And I read this article and a couple things stood out to me. And one was, take a look back at all the jobs or classes or things that you've done in the past and try to find a common thread. And when I thought back, I've realized that tech was my common thread. Whenever something need to be fixed in the office, whether it be a printer, I had one job where I discovered a back channel email that nobody knew existed. I found things like that. I enjoyed going to the computer lab, pre-GUI internet, because I am that am that senior. And that's when I realized that.
Yeah. Yeah. I'm on the gopher boards and everything poking around. My funniest story is when, just as a side note, I met up with I managed to track down someone I was friends with that she moved away when we were in elementary school. And I remember we met up for brunch one day. And And I remember she said to me, she's like, you know, it was so great to hear from you, but I'm so surprised you found my email address because my college's, you know, address book or, you know, directory is really locked down. I'm like, is it? I'm like, so, but I at the time, I didn't realize that was hacking. I didn't again, I wasn't to people or media or anything to know that what I was doing was a skill. So, you know, and again, I do have some regrets that I didn't get involved in this sooner, this is why outreach is so important.
I didn't know. I had no idea. For so many times, I was the only woman in the computer lab on campus and nobody would talk to me. I feel like there's so many more options now and I want to be part of that catalyst for change.
That completely brings up another question for me that is just I feel is right on point. And clearly we have a diversity problem in cyber security and throughout the tech industry as a whole, really. So what are some of the things ultimately that we can all be doing to change this dynamic and increase the pipeline for underrepresented communities to be able to come in?
Absolutely. Yeah. This is really important. This is a big passion of mine. And I'm gonna, you know, say this here, and I I have said it on Twitter, and I've said it out loud. White women aren't diversity. Okay? Yes. We do need women in the industry, but white women already have certain privileges and have also broken a lot of barriers already. It's the underrepresented folks of color that we really need to help get in further. And you need to do that by being an ally. And need companies need to be better about also posting jobs where communities can see them, underrepresented communities. For example, there's a hashtag BlackTechTwitter. And there's a bot that will retweet you if you use that hashtag. So if you've ever followed me on Twitter, you'll notice that I try to tag as many diverse groups and hashtags that I can fit into the tweet because I want to get on their radar.
Another thing you can do is sometimes you need to reach out to folks from underrepresented groups in order to invite them to apply. And people may be saying, well, that's, you know, an unfair advantage and all this stuff. No, you need what I have found in my experience, I'm not going to speak from anyone else's experience, you need to help ensure to that person of color that they're not walking into a bad situation. You know, they may not apply someone of color may not apply to your job blindly because you know, for to your company blindly, because they don't know the culture there. They may not know any people there. And, you know, think about that. You know, that might that's a very scary situation to walk into. And you you don't know what the culture is like there. So I feel like we need...
The burden is on us. The onus is on us to reach out, make folks from underrepresented groups feel more inclusive and wanted. And that falls on us, you know, to reach out to folks. So that's the way I see it. It's also crucial to have diversity because we all have different threat models. And if we're only basing thing on a, you know, cis, straight, white, you know, profile, that's doing a disservice to so many different groups. I actually do a lot of mentoring with Africans. I feel like Africa as a continent is a huge growing future workforce for cybersecurity in addition to the source of a threat. It's both. But it's no more a threat or a resource than anywhere else in the world.
I feel like people make Africa out to be more of a threat than a resource. There are very brilliant minds in Africa and the African diaspora who can definitely help us with tech and cybersecurity issues, but they're just not getting the chances.
I think all of this that we're talking about with the different perspectives in particular, I know that's something that you mentioned is how important it is to have different perspectives in the cybersecurity conversation and tech conversation. And it reminds me of like this. I feel like this is almost a cliche example at this point, but it's one of the clearest illustrations of this for me is when a Black woman realized that facial recognition technology didn't catch or was incredibly less reliable on particularly Black women's and Black people's faces. And it's like, this is one example. It's not possible for any one person to be able to account for everyone's perspective. And so it's important to get as many perspectives as possible in the room, particularly for tech and cybersecurity.
Absolutely. And I take an aqua jog class, which is filled with mostly senior citizens and myself. And this morning, I had one of my ladies swim up to me, and they know what line of work I'm in. And she said, What do you think of Waze, the app Waze? Because that's how she used to get around. And, you know, first I commended her for asking me about the security and privacy features. And I said, you know, let's make sure that your profile is locked down so that people can't follow you. I said, I know that there's got to be an article or instructions from the Waze Web site to direct you how to make sure the privacy setting is enabled. I'll text that to you later and and do that. And then another woman came over and said, why does my Google Maps pop up and prompt me to get...
To always come to the gym when it's time for class? And so I was just as quickly as I could in the middle of the pool, got into, you know, machine learn... Machine learning and things like that. Was like, well, it's it's learned patterns. So again, I know that not everybody's up for that, answering questions in public. I kind of got used to it as a librarian. But there's a condition called librarian face, where people will just approach librarians in public because they can just tell that you're a librarian. And I'm just so used to that that I just kind of carried that over to cybersecurity. An example of this is, I know some people say, well, I told someone to use a password manager and then, you know, slapping hands like, my work here is done. No. You can't just tell them to use a password manager. Maybe pull up, you know, maybe have something on your phone that's like a dummy entry so that you're not showing people your password.
Maybe have like something called, you know, four A's or something. So it sits up top. And just say, hey, can I show you real quick? This is what a password manager does. You can't just say, oh, go to, you know, insert name of password manager here and just use that. That's not really super helpful, is it?
Yeah, because like to someone who doesn't know about cybersecurity, I feel like the the word password manager alone is like, what is that? Is that a website? Is that a person? Do I have to pay for it? Do I have to redo all my passwords to use it? Like, that doesn't... It means almost not... It's funny that you talk about password manager because that example is one that I have with my friends a lot is like people constantly ask me, like, how do I do better passwords? Or like or like, I was shamed once for having a bad password. How do I fix it? And it's it's always passwords. And and it really is, like, if if... I feel like that example of, like, if you're if you're not, like, giving someone advice that, like, meets them where they are with their understanding level, it's kinda useless.
But I mean, think about it this way. It's like kindergarten. We had show and tell, right? You didn't just hold up your stuffed monkey and not say a word about it. Or you didn't stand there and describe something but had no pictures to show. It was called show and tell for a reason. And we kind of need to get back to those basics. So that's what I want people to think about. When I give my empathy as a service talk, I talk about Dungeons and Dragons in one of my talks. I said, did you ever have a mean dungeon master who made fun of you because you didn't know how to do things? And you can hear all these murmurs and see the nods in the audience. And I'm like, if that's what helps you realize this, then think back to that. I say to people, you weren't born knowing how to code, you had to learn. And your code was probably really crappy when you first did it, right? You know?
Yeah. And speaking of this idea of like, you know, people being novices and learning a new skill and things like that, we talked a little bit earlier about the diversity issue in tech. I think beyond just a lack of diverse individuals in tech and in cybersecurity, there's also just like a lack of of people. You know, people talk a lot about this, you know, the talent shortage, and there's a bunch of different cliche names for it. But it's this idea that there are a lot there, like all these open jobs in cybersecurity, and then there aren't people with the expected skill sets or the interest or background, whatever it is, there aren't people to fill those jobs. How do we get people interested in in tech?
Well, get comfortable because I have very strong opinions about this. And if I may respectfully disagree, I don't think we do have a people shortage. I think we have a problem with hiring and retention and getting past, you know, the HR firewall. There are too many job postings that are not written correctly requiring a CISSP for an entry level position. I think there's a big disconnect between the hiring managers and the HR and personnel departments. And it is very difficult to get past those screeners and all the technology that companies are utilizing to screen resumes and letters and applications and things like that. So that then requires people to rely heavily on people networking.
Well, what happens is too many people have homogenous professional circles. So who keeps getting referred for jobs and getting behind that HR firewall are just other people who just look like you from your homogenous professional network. So I really don't think we have a shortage because I'm on Twitter all the time and there are constantly people begging for jobs. And I really don't think it's a shortage. I think it's that the companies aren't really well equipped to hire. Companies aren't willing to train. They turnkey employees to show up on their doorstep. Well, you know what? That's great if you're in a long well established industry. We're still in its infancy, especially compared to other industries. So you need to change your mindset that you're not going to find these fully functional, you know, Red Teamers.
for me. But I think it's such an... It's it's almost like a self fulfilling prophecy, right? Of like when these companies are like, oh, no, we don't have like there's nobody to hire to fill these jobs. But also, we require, you know, 10,000,000,000 requirements. And then the people that are interested, the people that you're talking to on Twitter that that would would be able to do this job, have the interest, but maybe don't have a degree because Lord knows there's a zillion different reasons why people can't like why getting a degree is not accessible to everyone or they don't have a super expensive certificate, whatever it is, then those people might have interest. It feels like it discourages them from from like I've seen people who try to get into this industry can't and then switch. Right? Because you can't you can't, like, look for a job for years and years. And it's like when companies are saying, like, no, there's no one to fill these jobs with these requirements and then no one can fill them because they're looking for these absurd requirements.
Someone reminded me of a pull quote from my entry in Tribe of Hackers, and I forgot that I said this, but I said something about companies keep hunting for unicorns when they really just need to pay attention to the squirrels at the base of the tree. There are so many squirrels out there, but they keep looking for unicorns. And nobody wants to train. They don't want to spend time. And then it gets into the debate of is cybersecurity an entry level industry? And I can understand why people say no, but I feel like the people saying no are also the ones with a lot of privilege and also fell butt backwards into security after being in tech. So I feel like it's very curious to me about their gatekeeping of, you know, oh, you can't be entry level and be in cybersecurity.
Well, you started somewhere. You know, you probably showed up one day at work and were told, Okay, now you're part of security. Well, you weren't necessarily up to speed, were you? But, oh, well, that's different, is it? Yeah. So I have very and maybe it's just the Philadelphian in me, I have very low tolerance for this kind of BS. I don't believe that there's a person shortage. I do believe that we're growing. There's a growing need, which is a difference. And my situation is very unusual and I admit that. And that's why I'm very careful about when I give career advice. I already had a master's degree coming into this with a transferable set of skills. That's why I was able to jump right in because I was doing OSINT for twenty years, but I didn't know it was called OSINT. It literally wasn't until I started to move into the infosec space when somebody said to me, Oh, you have all this OSINT experience.
And I literally thought OSINT was a programming language like COBOL because of, you know, I didn't know what it was. And when they described to me what OSINT was, and the guy said to me, Well, what did you call it when you were a librarian? And I said, Doing my job. Like, we didn't have a fancy name for it. Like that's so what I'm getting at is, is you may have transferable skills and you know, whether you worked in fast food or you were a nanny or you're a nurse or anything, construction, mechanic. I actually recently helped a gentleman who worked as a mechanic. He really wanted to be a pentester. And I said, okay, let's, you know, that's that technical mindset troubleshooting. And he now has a part time job as a pen tester. And he is also working on certs and finishing his degree and things like that.
It's such an interesting concept for me, just the transferable skills that are aligned with librarians and the capacity to conduct OSINT and to identify information that that may be embedded in troves of knowledge, right. And so I never quite thought of it in that manner until you were talking with us a little bit ago about this very concept. It's and it's so very interesting to me. Right? So you mentioned there's not really, you know, in your perspective, a talent gap shortage. There's, you know, it's a people being hired problem. And I'm kind of curious about that. Like, how do we fix that very cyclical problem that Bella mentioned, right around this individuals hiring the individuals they know that look like them that are in the same circles, right?
Well, a lot of it's education. I mean, kind of going back to what I and awareness and things like that. Like I mentioned before, I didn't get involved in tech or cybersecurity sooner because I just didn't know. I didn't see other women in the computer lab. Visibility is so important. And, you know, awareness of this is important. So, you know, a lot of cybersecurity folks need to be more proactive. You know, if you don't feel like going to a library, maybe go to your Chamber of Commerce where a lot of small business owners are who may not necessarily have the funds to protect themselves, but you can give them some tips and, you know, give them what's available and help them with that. So, I mean, it's very complicated issue.
it CISA? CISA is working to improve this. Really love the leadership of my current boss, my former former CISA boss, and the current CISA boss, Jen Easterly. I feel like there's a whole new push now to really kind of get that career information out. And actually today, they put out something about free tools and resources So to those initiatives are fantastic. So I think it's there is a skill issue to an extent, but I think it's because we don't really have some good standardizations of, you know, these are the skills that you need. Because it's pretty clear. Like, for example, for me to be a librarian, I knew that I needed a Master's of Library and Information Science degree. That's what I knew I needed to do.
So I got that. But in our world, I mean, some people don't have high school diplomas or maybe they have a GED. That's great. I'm not saying that as a disparaging way. I'm just saying that, you know, I have a master's degree, but there are some people with GEDs. We're all over the place. And we do have people with PhDs and we have lawyers. And so that's the problem is that because, again, because we're a relatively new industry, we're kind of all over the place. And I think that that opportunity also becomes overwhelming to some people because it's not in nice, neat little Kubernetes boxes for us.
it. So So I think that's a benefit and a detriment at the same time. I think it's great that we have so much variety and different perspectives and different skill sets. But at the same time, it does kind of make things a little chaotic, right?
There are so many transferable skills. And I think it's almost like this issue of I think sometimes hiring managers or maybe not hiring managers, but HR in tech need to remember how many transferable skills there are from so many different industries and what that looks like. Because it does feel like sometimes they're looking for, do you have a degree in cybersecurity? And it's like everything else gets ignored and for what? That's not really getting us anywhere.
Yeah. And the CISO of... Is it Experian? That she had a music degree and she... Am I naming the right company? There was a CISO who had a couple years ago, there was a huge breach. I want to say it was Experian. And she had music degrees. And she got thrown under the bus left and right because of these music degrees. And it wasn't that she was an opera singer, was that she did music theory and music, right? It was and it doesn't even matter if she even did singing. But I remember being very angry about that. What different and like whenever there's breaches, I don't recall ever hearing what college majors the male CISOs had. But whenever there's a female CISO, all of a sudden it's like, Oh, she was a liberal arts major. That's why this happened.
No, it's not. You're just trying to find a reason to, you know, discriminate against women in this industry. There was a while when there were a lot of breaches going on that I would go online and use my OSINT skills to look up the major of the male CISOs at certain companies and make sure I tweeted that because it seemed only fair that, you know, people know what major everyone had when these things happen because it's oh, so crucial and really matters in the real world.
There are people that I've seen in the industry and individuals that that do do not have cybersecurity degree, I myself do not have a cybersecurity degree. And others that I've known and seen don't have degrees in cyber. There's an individual I know that has a degree in psychology. And this particular individual is one of the most creative folks that I know of to be able to analyze people from a humanistic approach and have that kind of training. And then they apply it to cyber like yourself.
Yeah. Well, and it's so new, too. Yeah. I mean, it's such a new discipline that there's not going to be a lot of colleges. There are some institutions that seem to be jumping on the bandwagon and you do see a couple articles a week of colleges starting labs and majors and minors and things like that. And that's great. But yeah, again, I think that for the current workforce, it's going to be more unusual that you actually have. And even if you have a computer science degree, it doesn't necessarily mean that you know security. I've talked to many computer science majors who don't understand security because that's not the computer science classes that they took. So yeah, we need to kind of get past all this and you need to look at the person's skills, their aptitude, their ability, their interest, their curiosity, and then, you know, problem solving skills.
There's an interesting perspective around individuals and their ability to bring their current skills, right? And as I think about that, and as you speak, I'm wondering more and more if our talent gap, and I'm using air quotes this time now instead, I'm wondering if our talent gap is aligned to the fact that we're looking for people with individuals with cybersecurity in the tagline, and when they're not meeting that, we're just immediately discounting them.
Yeah, we're getting too in the muck and mire for this and not really thinking outside the box. And I think gone are the days when you just assume that the tech folks will just roll into security and happily take on those jobs, because I think that's kind of what has been happening for the most part. Basically, if you want to get into this industry, you know, you're just going to have to really fight for it and not expect anything to be handed to you because, you know, we're kind of like the old, you know, early 90s websites with like the construction worker diggings is under construction. In many ways, we are that, you know, we are still under construction as far as our industry goes. So if you want in, you just kind of need to jump in the pit with us.
It's sort of the last question that I want to ask kind of related to that. So I know you mentioned Twitter earlier. I know you're very active on Twitter. And in this kind of conversation of getting more people into the industry and talking more about how to improve this industry. How do you feel like Twitter as a conversation tool works for that kind of motive?
Oh, well, all of my cybersecurity jobs are a result of Twitter. So I say that it works. I have learned so much from Twitter. I've connected with people through Twitter. I've helped so many people through Twitter and LinkedIn too. We'll just lump them in here too. No, I think it's a very useful tool. Is there drama? Yes. Is there drama in every industry? Yes. That's what makes me laugh because, again, I think about Librarian Twitter drama and people in InfoSec Twitter saying like, Oh, are we the only industry that fights like this? No, no, every industry has their own, you know, villains and heroes and rock stars and, you know, we're not unique, which makes me laugh like, oh, I bet we're the only industry does that.
No, it's and if they don't use Twitter, they use something else. They say it to your face or something. So Twitter can be a very useful tool to help you connect with people, to help you learn. Like I said, I was able to build a brand and reputation and professional networking through Twitter that, yes, literally all three of my cybersecurity jobs had a Twitter factor in there one way or another. And yeah, it's great.
Yeah, it's amazing. So yeah, I mean, it's not again, I'm not trying to look at it through rose colored glasses. I know that there's also a lot of bad stuff that happens. But, you know, again, it's I also have a personal rule that I try. Don't like to go on Twitter after midnight because in my experience, it's kind of just like gremlins. They just it... Yeah.
Just it just gets weird and... Yeah. And it's just not a good... So that's... I I was... I'm like, you know... Like, even try not to look at it because I'm like, it is... After midnight eastern time, Twitter turns, it's like after dark and it's like, you know what, I am too old for this club. Like I just, I'm gonna just go wait for you at the donut shop across the street
your drunk, you know, self get home into bed. So yeah, it can be very useful and it can be a very fun and community place and everything. But again, just like anything, it's a tool and it's how you use it. And if you're going to go on there and be a jerk and smash people down and make idiotic comments and mean things, then yeah, you're not really using the tool right then, you know. But if you go on and you try to help people and you're a decent person, then yeah, it can be a very beneficial place. So that's how I feel about that. I mean, I know it's not the best place in the world, but it's not the worst either.
So on that, our very last question for you. This is a question that we ask all of our guests. It doesn't have to be too serious. What is something that we wouldn't know about you just from looking at your LinkedIn, Twitter, social media presence?
So of I mean, I I feel like I've... I don't think I've tweeted this before, but, I do have a favorite episode of Keeping Up With The Kardashians, and it's the episode where they try to teach... I wanna say it's Kendall, a lesson about privacy and security.
Yeah, it was, I think she kept geotagging her posts. Again, this was a this was like many years ago by now. The show's been on forever. But I want to say it was like Kim and Kourtney and who's the other one? Khloé. I think they wanted to... Because I think she got a stalker out of it because she kept posting where she was and they were trying to teach her about geolocation. Yes, I am very well aware it is not real. I know it's a reality show. I know it's not that real. But I still think that it was a very good way to show folks that who wouldn't normally sit for a privacy and security conversation to do that. Then later, unfortunately, Kim had the issue in Paris where she was robbed. And again, I feel like they were able to turn that into like a PSA for privacy and security to reach people that normally wouldn't sit still for something like that.
I'm like, this is really valuable privacy and security information that they're dropping, but they're doing it in such an approachable way. And people are going to be listening to it who may not even realize that they're what they're listening to, but just know to do these things because Kim said so, you know, because because
from So thank you for sharing. Sure. I think that's it. I think we did it. Yep. Tracy, thank you so, so, so much for joining today. This was a really a really great conversation, and it was great to get to talk with you.
If you like today's episode, please give us a five star rating and subscribe wherever you're listening to this. It'll really help us get noticed on your favorite podcast platforms. Also, share this episode with your friends. And if you haven't already, make sure to check out all the other really fascinating people that we've already interviewed. We're also open to suggestions. If you know someone we should be talking to, drop us a line at we'[email protected]. That's we're [email protected].
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
