Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security Podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now, here are your hosts, Robb Reck and Alex Wood. Welcome to the Colorado Equals Security Podcast. This is episode 16 for May 22nd, 2017. This is Robb.

And this is Alex, and we're here to, uh, talk to you guys about the news in the area here. But first, Alex, uh, you had some travel this last week, right? I did. I was actually in Houston for a day this week for a SecureWorld conference. I was teaching a class on the NIST Cybersecurity Framework, so that was fun.

Got to meet some nice people down there. And you traveled as well this week, Robb? Yeah, so I got to go to the ISSA Los Angeles, uh, annual conference. So very similar to what we do for RMISC, they have They have one every year out there. I was lucky enough to get on a panel with some great folks, Malcolm Harkins from Silence, previously of Intel, and Gary Hayslip, who we've talked about on here, who's now with Webroot, and a gentleman as well from financial services company in LA who I hadn't met previously.

And of course, since we recently wrapped up from our ISC, we have to say that our conference is definitely better than the LA conference, right? It's definitely a different feel. Our conference, significantly larger. And, you know, the convention center gives it, I think, a little grander feel with those, you know, really high ceilings and big ballroom. Whereas where they were in a hotel at a Hilton there in LA, which kept everything pretty segmented, so you couldn't really tell how many folks were there at any given time.

Yeah, I'm sure it was great though. ISSA does great conferences all over the country. Yeah, they did a good job there in LA as well. So you've been doing your SecureWorld training for what, 2 and a half years, is that right? Something like that.

We did the first one together here in Denver. That was probably 3, 4 years ago even. It was right after the framework came out, uh, so it probably would have been 2013, '14 in there. Yeah, I was thinking it was— I think 2 and a half or whatever. I think you've had 2 full years of doing these tours.

Yeah, yeah. So it's fun. I do a full day training. I did it for the ISSA chapter here. Um, I've done it for some other groups around it.

It's a, in my opinion, a really good training. I think it gives you a good ground— grounding in, uh, building a security program and the Cybersecurity Framework. Well, I'm sure your perspective is unbiased as, as possible. Yeah, very, very. All right, let's go ahead and jump in here.

Um, first, before we go into the news, um, we just want to remind you guys, if you're interested in getting the show notes emailed to you each week, go ahead and go to the website and subscribe, and you'll— we'll make sure you get a notification when the, the episodes are posted, and you'll have all the show notes at your fingertips as we go through this. Yeah, at the bottom of our webpage, colorado-security security.com. There's a place where you can put in your email address, submit it to us, we'll add you to our mailing list. Um, the first story for the week, uh, Colorado's unemployment rate dropped to a record low 2.3%. Yeah, I think that this is— they say it's been 40 years since unemployment's been this low.

And basically what they would consider this rate, uh, negative unemployment, where everyone who wants to work is basically working, right? And so this is the, the lowest that in that time period for not just Colorado but you know, the lowest of any other state. There were 4 other states, I think, at one time that had gotten this low. Wow. So pretty cool.

Tough to hire, though. Yeah. And I mean, one of the things they talked about in the article too is about job growth, you know, is it's gonna be tough to sustain job growth here if you don't have people to put into those jobs. Yeah. So Shark Tank is coming to Denver.

They're coming, I think it's just this week, actually, the 24th, they're going to have the opportunity for 500 different companies to pitch the producers of the show to show why you should be— why you should come on the TV show. And, you know, Robb, we're, we're not definitely not in the TV business, but having 500 companies pitch, that seems like it would take an awful lot of time to do. Yeah, we were sitting here doing some math trying to figure out, well, if you, if you took 5 minutes per person, you know, 2 minutes to pitch and 3 minutes getting them in and out, you know, you can get 120 done in a 10-hour day. That's just, you know, it's going to be a long day for those folks, however many people are watching. Yeah, exactly.

Um, next on the list, also on the startup front, um, the city of Denver is doing what they're calling Race to Raise. So they're doing the— a startup pitch night. Um, basically they're looking for early-stage companies. Um, there's some criteria about how much money that you have to have raised so far to be eligible, but you can go in and then you'll pitch your company at the, at the pitch night And then the, the winner will get, um, $25,000, $25,000, and then 2 runners-up I think will also get $15,000. Uh, and then there will be a, a continued competition to see which can raise— which company can raise $500,000 in equity first.

Um, and then there's a potential for an additional $75,000 from the city. So it looks like a really neat opportunity if you have an early-stage company and you're, and you're looking to start raising, not only is this a chance for you to get some of that money, right, get that $25,000, $15,000, or even, you know, even more later, it's also a chance for you to make the relationships with other companies in the area. And I'm sure there will be investors here looking for, you know, interesting companies. This will be a great chance for you to get your company's name out and start to, start to get a line on some of that funding going forward. And if nothing else, a good opportunity to practice your pitch in front of an audience, right, and get some good feedback.

Um, so next we, uh, we actually have a submission for the Colorado security scene into the, the Denver Startup Week, uh, process. So if you guys haven't seen the Denver Startup Week process, every year there's submissions for what kind of talks people want to hear, and there's way too many submissions for the number of open sessions there are. And there's different categories. This year in the founders category, there is a submission about cybersecurity founders kind of telling their story, and And I get to moderate that with founders from ProtectWise, Red Canary, Ping Identity, and I'm not sure who the fourth is off the top of my head. But really, this is kind of how Colorado Equal Security talks to the rest of the community.

So I hope you guys will go out. There's a link in the show notes. Go out and vote. Try and get us into the show. I voted.

Thank you, Alex. This week, there was a story in the Denver Business Journal called, Would Your Company Survive a Cyberattack? So the, the advice here, it's good advice. Uh, it's nothing revolutionary. It's just interesting to see this in the Denver Business Journal, something that you, uh, you know, might be able to give to someone that's a little less experienced in the area, talking about ransomware, making sure that you have good backups, an incident response plan, uh, those sorts of things.

Yes, it's a good opportunity for you to hand this off to your boss who may be less technical and just understand what what other folks in the business area think is important. Next, we have a link from kind of learnings from or insights from RMISC from Lewis Fowler. That's a local firm here, actually written by Justin Rowe. I met Justin at the conference and he wrote up some of his insights, what he, what he thought was most interesting from throughout the conference. And hopefully you guys will find that interesting as well.

Yeah, one of the things that was in there was the, the CISO panel that we both participated in. So, it was nice to see that mentioned. Yeah, very cool. Thanks, Justin. And then next, Optiv, their third-party risk management product, Vantix, wins an award at the 2017 IT World Awards.

Yeah, so Vantix looks like a platform for managing your third-party risk and really building out your program around third-party risk, which we both think sounds pretty similar to what CyberGRX is doing here in town. It's nice to see a local company's product and offering being recognized in a national competition here. Yeah, and I don't know anything about the IT World Awards, but it sure sounds fancy. It may very well have been created by 2 guys in a basement, but there's lots of good things that have been created by 2 guys in a basement. Lots.

And then finally here, Clavister has selected Webroot's BrightCloud IP reputation service for their systems. We hadn't heard of Clavister before. As we started looking into it, It looks like a fairly large network security company from Sweden. Yeah, it looked like they were from Sweden. And we've probably never heard of them because they really target telcos, people with really large wireless infrastructures.

Yeah, it seems like they're providing more carrier-level kind of technologies and services as opposed to enterprise level. Yeah. So, you know, just kind of a good piece of news for Webroot, who's seeing better penetration there. And I think that they, they do a really good job getting that penetration that's not quite as visible to enterprises. They, they work a lot with MSSPs.

They work a lot with vendors rather than directly with the enterprises themselves. Yeah. Threat intelligence, IP reputation, even their endpoint solutions as well. They do that through MSSPs. Yep.

So moving along to the calendar, just first want to mention we do have that calendar on our website. Go to the, you know, colorado-security.com. Go to the security events page and you'll see a calendar layout showing all of the different events coming up. So if you want to know not only what's happening this week, which is what we'll talk about here, but what's coming in the next few weeks and few months, it's a good place to go. And then first on the list on May 23rd, the CSA, they're having their May meeting here.

Yep. And they moved that meeting from the middle of RMISC to hopefully— Right. Always better to move out from around a big event to get better attendance. And then SecureSet on the 26th, which is Friday, they have their capture the flag event. So you can come at 6 o'clock for, uh, for the— excuse me, 5 o'clock for the entry, uh, the introduction to it, and then 6 o'clock for the main event.

Uh, one other note, it doesn't start this week, but Colorado Springs ISSA chapter, we mentioned this back— what was it, in April when they had the last one? So they're doing a Security+ training It's 2 weekends in June, the 3rd and the 10th, and that registration for that is open now. So if you're interested in the Security+, get signed up for that. So I think you'll probably want to go to both if you're going to go. So plan to go on the Saturday the 3rd and then Saturday the 10th, and that's a good opportunity for you to get the basics of Security+.

They do have in July, there's going to be a CISSP training coming. Registration is not open for that yet, but I think this is a good introduction if you're thinking about doing that as well. So there's a few different women, women in technology things coming up. The Colorado Technology Association has their SheTech event on the 8th of June, followed directly on the 9th by the Women in Technology Conference. Those both look really interesting.

And then we want to, of course, highlight the ISSA's Women in Security chapter. That's— they had their first meeting in April. The next meeting is coming on June 29th. And that's going to be downtown and the events are definitely in the calendar here. Awesome.

I think that's all for the events, Robb. Was there anything we missed? Wanted to just call out the healthcare special interest group meeting that's happening on June 22nd. Registration is up for that as well. If you're either involved with healthcare security or interested in getting involved in healthcare security, take a look at that.

That's going to be meeting at Dave Buster's on the 22nd. So moving on to jobs. If you haven't looked at the show notes, uh, and you're, you're listening to the podcast every week, we put the— every week when we talk about jobs, we put those into the show notes. So go back and take a look at those older show notes if you're interested in seeing some of the older jobs that we talked about. And if this is the first time you've listened to a podcast, uh, take a look at the jobs from previous ones if you're looking for a job.

We really try and highlight those jobs that we think are interesting and, and maybe a little different. So you're not gonna see 6 different security analyst positions show up in the, in the show notes, but you will see a variety of different stuff that we think might appeal to those who, who maybe they're not actively looking for a job, but would love to have something really unique going on. Yeah. We also try not to highlight them more than once. So if we talked about a job, uh, you can go back and find it in the show notes, but it's probably not gonna show up again in what we talk about.

Yep. So this week, um, the Colorado Credit Union, excuse me, Credit Union of Colorado is hiring an information security officer. Also, uh, Fluor, they're hiring a security manager. So if you want to manage a security program for a construction company. Digital Globe, we've talked, we talked about their CISO position a few months ago.

Chris Martinez moved over there. Looks like Chris has, uh, has opened up a senior security architect role. So if you want to help him figure out the, uh, the way that the security program should go, that looks like a good opportunity. Rise Broadband is looking for an engineer of network security. Rise Broadband, it looks like they provide fixed-point broadband wireless access.

Kind of interesting. Coalfire is hiring a healthcare consultant associate. Yeah, so they're looking for someone a little bit lower level but to do some security consulting around healthcare. My guess is you don't, you probably don't have to have a lot of healthcare experience in order to get this position, and that they'll probably train and give you a lot of great experience to help you along with your career. Lockheed Martin is looking for a technical trainer.

So if you're someone who knows cybersecurity and likes to build educational products, sounds like it could be fun. And our final one is not a security position, it's a position at a security company. LogRhythm is hiring a senior UI developer up there in Boulder.

All right, I think that's it. I think that's all we've got, Robb. All right, well, we'll go ahead and call it a week. Thanks everyone for your time, and we'll talk to you soon. We do have Andrea Young, the president of the Colorado Technology Association, Coming up here in just a moment to talk about what they do and and how we can get involved.

Great, have a great week, everybody.

This is Lucia Turpin, CISO at Polycom. This is Colorado Equal Security for Colorado security professionals by Colorado security professionals.

All right, this is Robb Reck from Colorado Equal Security here with Andrea from CTA. Andrea, why don't you introduce yourself to the team? Great, I'm excited to be here. Andrea Young, Colorado Technology Association. I'm the new president and CEO.

I started in June of 2016, so not quite a year yet, but third-generation native to Colorado, so I'm really excited to be able to be here and talk about Colorado and talk about tech. Yeah, CTA has been around for quite a while. Yeah, there's, there's obviously some association between what you guys do and what we do in the security community. And I think we want to try and build on that. So as a starting point, you know, the folks who are listening probably are more involved with the security communities in town and may not know what CTA does.

Would you mind just kind of giving a high level what the organization's mission is and kind of the structure of it? Love to. So Colorado Technology Association, it is an organization that was put together back in 1994. And when software was a new thing, I mean, we, yes, we had code and we had programming, but where you're going distributed architecture, software was new, the internet was new, and there were leaders in our community who wanted to represent themselves. And so being a 501, we're a membership organization, we can collect dues, we can lobby, and we can advocate for what's going on in our industry.

So that was actually the beginning. Beginning. And, you know, 22 years later, our goal is to advance the tech industry in the state of Colorado, and we do that multiple ways. We still have a lot of activity that happens during legislative session and to advocate for our industry to be tech-friendly policies. And our economy today, as you know it, is very diverse, and I think a lot of that diversity has come from tech capabilities.

So we have more than just oil and gas, we have more than telecommunications, we have more than agriculture going on in Colorado. And, and so being able to represent the tech industry, being able to work with the governor's office and mayor's office across the state of Colorado on economic development, it's kind of the tale of two states. It's what goes on on the Front Range where there is a lot of economic activity, but also being able to drive economic activity in the rural environments as well. So access to broadband, so on and so forth. And then we also have been spending a lot of time developing a high-priority topic for our membership where workforce is so critical to having those high-skills, Future occupations are largely based on technology skill sets, and so we've been working on a lot of initiatives, impact initiatives, that would allow us to develop that workforce pipeline, greater access to talent, greater access to capital.

So those are our key pillars, but just bringing the community together, having a place where people can collaborate and connect, then advance the tech industry in the state of Colorado. So obviously some lofty goals and some, some really worthwhile goals. As an organization, how do you measure success? How do you know it's working or it's not working? I think that a core measure is membership experience.

So we have over 320 member companies that are members and then more than 17,000 professionals. We have more than 8,000 following us on social media. So I think that membership experience, it's being able to be a part of a community but then also being able to get some business done in the community. And I would say that, you know, if we're, if we're hitting on all the right cylinders, that our members would have a great experience. And our membership is from emerging tech, enterprise tech providers, meaning vendors, consumers, them coming together in a marketplace, being able to buy local, be local, stay local, all of those components.

We, we, I would measure it largely based on membership experience, and that if you as a member company or you as an individual have a great experience and you feel like you're connecting to your bigger Colorado Tech community, that would be a key measure. So do you, do you do like customer surveys to try and understand how, what their experience is and if it's going well? We do. We, most of the time, a survey of our membership would be following a key signature program. So we have multiple signature programs that go on throughout the year.

And we collect feedback. We have a lot of different participants in the things that we do. We have those who are actually part of the program, so the day of the event, for example, but then there's a whole volunteer workforce. So being a nonprofit organization, being a community organization, we rely heavily on our volunteer workforce. And that's a member benefit, and they get involved and they have a way to help us achieve our mission.

But in the process of that, they're building really great relationships. So I would say the volunteer component is really important— those the day of, and then that there was something that was able to take place after the event as well, or after the program. So there's quite a few, like, logistical questions I have for you. Starting off with, you mentioned, I think you said 320-ish company members? Yeah, 331 I want to say that was the last count in the kitchen this morning when I was talking to our salesperson.

Yes. And what, you know, for those who work at a company that might want to get involved, what's the kind of company that wants to be a member and what does it take to be a member as a company? Well, the Being a member is a real easy part. It is being able to understand your organization. So we have multiple levels of membership.

So Premier Corporate members are based on the size of your company. If you're an emerging tech company and you're just starting out, then we have membership pricing for that. We have a lot of government partners. So, you know, the State of Colorado, for example, might be another nonprofit. We have a lot of, you know, engagement with our legislature.

So, you know, people, they're not officially members, but they're definitely involved in the community and what we do. And so learning about what you're looking to get out of a membership and any one of those impact areas that I mentioned, and then with the signature programs as well. A lot of times what will happen is that someone came to a signature program like Sea Level at a Mile High, learned about some really amazing things that we do for our community. I want to get involved, become a member. And it's, it's, it's— that process is, is pretty easy.

Some of the member benefits, as I said, you know, being— building relationships, especially if you're new. When you think about the Colorado population, There, there's fewer natives like me being a native. There's fewer natives, and if you're new to the community, you came in 2001, what's the best way to build a network in our community? I think Colorado Technology Association is one of the best ways to build a network. So on the company side, you talked a little bit about that.

On the individual side, you said 17,000 individual members. That's a big number. Yeah, yeah, it is a big number, and that just identifies our reach. So you're new to the community, you want to get involved, you become a member, you have discounted access to tickets, you have the ability to volunteer, as I said, and it's one of the fastest ways to build your network within our community is to be a member of CTA. And then, you know, there's other things that come along with that.

So when we have a signature program going on, we'll push out early bird pricing to members before we send it out to the rest of the community. We have an amazing Women in Tech Conference that's going to be happening. Part of our focus on diversity and inclusion, we have a Women in Tech Conference that happens every June, sells out very fast. We have an amazing keynote that we're planning for. So members would get the, you know, ability to buy the tickets in advance of anyone else and get on that access list.

So some other events I know I've seen you guys do, you do a Day at the Capitol. Yeah. That's an annual event as well, right? Yeah, that's an annual event. We do our legislative reception, is an annual event.

Where one thing that's really interesting from a legislative perspective, in our collaboration, we have been talking to representatives and they're going to start a tech caucus. And a tech caucus means that we can have a focused dialogue, we can identify an agenda, we strengthen the awareness that we're a resource as an industry, bring industry in to provide input, autonomous vehicle testing, for example. You know, that is something that Colorado has become a great test environment for companies. One of the first long-range tests that happened, it happened on I-25, and it was transporting beer, for example. So there's some really great innovation that goes on.

So is that the first legal drunk driving on I-25? Well, there was no driving under the influence. And now just with the influence. Got it, got it. But, you know, those are really great opportunities for Colorado to be a part of innovation and be a leader in innovation.

And so we have worked with the Colorado Department of Transportation. They have their RoadX program where they're going to use smart technology to have better transportation system and data science. They have just recently announced a collaboration with Galvanize for data science. And Galvanize, for those who may not be aware of it, you want to summarize what those guys do? So Galvanize is a Colorado startup.

They do have locations beyond Colorado, and they were one of the original coworking spaces. And it was where innovation happens here kind of thing. And so they started their first location at the Golden Triangle. They've expanded to multiple locations outside of Colorado as well. But one of the things that they realized in the building up of their coworking space is they had so much talent there that were looking for ways not only to how to start up a business, but to improve their skill set.

And so they have this whole level up programming where they can— it's data science and software development. So, you know, coding schools, for example. So it's been very— it's just been a great model. And because of their data science capabilities that they've been building up, they had a conversation with Colorado Department of Transportation. If we implement all of this smart transportation capability, it's one thing to implement it and have the sensors, it's another thing to know what to do with the data.

And so being able to have that relationship of data science is a, is a great collaboration opportunity for them. So it's a great Colorado success story, Galvanize, to be able to be a great model for coworking space. And we have lots of coworking space now, lots of companies that have gone into that industry, but they were one of the originals. And in 2016, they closed on having their venture fund, so they're investing in the companies that are now located in their locations. So it's very cool.

Yeah, yeah. And they're, they're something of a, of a, uh, oh man, incubate— incubator. Yes. Yeah, they've— yeah, they're starting to more formalize that, right, with their fund. So looking what you guys, you know, the last couple months I've been watching your events and you guys, you know, had the CTA 101, kind of, you know, giving people the lowdown on what the organization does.

And then I saw you guys on February 23rd had the immigration, it was talent immigration series, yeah, yeah, and innovation meetings. Yeah, so obviously there's kind of some different types of events going on. What What is it that folks should look for, or another way to look at it, what kind of activities should people look to you guys to provide? You know, if they, if they, if they're interested in A, B, and C, they should come to you. What kind of things?

You know, I think our signature programs are the ones that we do every year. So Sea Level and Mile High happens every March. Women in Tech happens every June. We picked up a new event 2 years years ago called Tech Tour, where we drive across the state of Colorado and we uncover tech stories going on across the state of Colorado and we report on it. It's a storytelling event, putting Colorado tech stories on the map.

5 different regions, 5 different days. We literally board a bus as a group and drive across the state. When do you do that? It'll— this year it's going to be July 31st through August 4th. Last year it was the last week of July, so around that time frame.

And last year, and we expect to happen again this year, that the governor's office proclaimed it Colorado Tech Week. So we, in addition to what we're doing as part of our tech tour, we're trying to promote Tech Week in Colorado and have other organizations do their own Tech Week event, and then we'll write about it. And so that's, that's again storytelling hopefully storytelling that gets picked up and people become more aware of it, not just inside the state but outside the state, because that elevates our access to capital and, you know, people are really aware of what's going on here. Then when we go into the fall, there is the Colorado Tech Summit where we talk about macro trends, what's going on, bring the community together, a lot of our subject matter experts on one stage for a day and highlighting showcasing what's going on in Colorado Tech. And then we recognize all of that Colorado Tech achievement for the year at— that culminates at Apex Awards.

So that's every November, and it is a nomination process. So we look for the community to provide the nominations, and then we use the community to do the— go through the judging process, and then we make awards. For CIO of the Year, CEO of the Year, Project of the Year, Entrepreneurship of the Year. And so we have a lot of different ways in which those awards, the Advocate of the Year, to recognize the achievements that have gone on throughout the year. And this year, another thing that we're adding is Colorado Demo Day, where it's a collaboration with the Innovation Pavilion.

The Innovation Pavilion is a Colorado startup started in the Denver Tech Center, has coworking space, a member-based organization, but they have so many community-building things they do. They have an incubator as well, and so they've announced some really cool things. So in 2016, we did our first Colorado Demo Day where we took emerging tech companies from Colorado to Silicon Valley to showcase what's going on. So it's getting getting that message out there about tech is happening, innovation is happening in Colorado. We're a leader.

We like to say the definitive tech hub between the two coasts. So those are kind of like the signature things that we do. So I want to go back to your awards for a second. What's it take to get you guys to do a CISO of the Year award? That's a great one.

Chief Information Security Officer of the Year. Yeah, absolutely. Yeah, I think that— I think Colorado Equal Security can help you find the, the, your folks to choose from, and I do too. We can, we can help you get that going. Yeah, I agree with that.

You know, I think that one thing tied to the cybersecurity that I'd like to be able to highlight is that, you know, we get involved in a lot of early-stage thought leadership things that go on. So, so in 2016, early in 2016, because I remember I remember this because some of my peers— so before I was in this role, I came from the board. I was on the board of Colorado Technology Association, and I'd been on the board for 6 years. And when the position became vacant, it just kind of was interesting serendipitous timing where I might be able to step in and be a part of this. But I was a CIO at an engineering company in Boulder.

I'm very familiar, you know, certification, accreditation, DHS, you know, IT security compliance. I've been through it, I've been through it for sure. And I did the same, I got them through SOX compliance, I got Janus through SOX compliance the first time, you know. So I was the first data privacy officer at Janus Capital Group. So all of those things I'm very familiar with.

And when I was having conversations with our peers. So Governor Hickenlooper, going into a second term, wanted to understand, so this is what I was able to accomplish in the first term, what am I looking to accomplish in the second term? And looking at Colorado and ways in which Colorado could be a leader in some capability. And so we've already been emerging as beyond oil and gas, we've been emerging beyond telecommunications, communications. You know, we're, we're a great thriving community, diverse economy, but what are some other things that we— he just hadn't uncovered in his first term?

And realizing everything that's going on in Colorado Springs with the presence, the military presence there, Department of Defense, all of those, that area of expertise. There's over 100 cybersecurity companies in Colorado Springs alone. And so being able to really highlight that as a center of excellence, he wanted to put together what is called the National Cybersecurity Center. And that was something that, within sight of a year from its, you know, since inception and being an idea in the governor's head with other thought leaders, was opened with its first conference by November 1st. Of 2016?

Of 2000— all in 2016. 2016. And so I think that that's a really great example of where we want to be able to, as a Colorado Tech community, we want to be able to highlight all the great things that we're good at. And so the national cybersecurity being a Center of Excellence, I think that when we went to our DC fly-in, which was last week, I was in DC, fly-in every year, fly-in with other tech councils across the United States, and we talked about cyber and Internet of Things. Those were the 2 most important topics to everyone.

And then outside of that was workforce, which is an important topic for everyone, and a workforce in cyber is a huge issue because of the specialized skill set. So we had the CEO of the National Cybersecurity Center who joined us for the trip, and we were able to to talk to all of our legislation connections there and tell them about what Colorado is doing to lead in this. And the— it's a national cybersecurity center. It's not a cybersecurity center for Colorado. It's designed to be a national model.

And so we met with Senator Bennett, met with Senator Gardner, and other offices, and they definitely know that this is something that is a very public-facing issue, right? And that there is some actions that need to happen but not be burdensome to industry at the same time either. So it's just very interesting how consistent of the things that we're trying to accomplish and show leadership in Colorado, how that translated so well in what we experienced when were in DC. Yeah, I mean, the whole purpose— we talked about this— the purpose of this podcast and really this effort is to show how healthy the security community in Colorado is. And, uh, you know, you talk about what The Springs is doing, and in Denver, we've— in Denver and Boulder both, we've got, you know, some real large players in security between Optiv and LogRhythm and Webroot and Ping Identity, and ProtectWise coming up, and Swimlane and Red Canary.

And then there's, you know, dozens of other smaller ones that are, that are coming up. I think that what you guys are doing to give them that platform to get known is a big part of success, right? As we start to be successful in the state, it's gonna breed more success. And yeah, that's great. I totally agree.

And, you know, it's such a critical area. And one of the key topics, as we had our panel members, that, that, you know, we had a panel member from, from NSA, and, you know, just, just very broad because because we had access being right there in DC to have them speak about it. But one of the calls to action that they challenged us with as an industry is that we have to get education out there that has it be secure from the beginning. Build it in, right? Yep, build it in.

And secure code, cross-site scripting, all those things that come into play. And when you're talking about the sensors, So everything is an endpoint, right? And so when you're generating data, you have to take into consideration when you build Internet of Things, how as an isolated component in the bigger picture of the ecosystem, how does that be secure? And how do you address that when you need to patch it? And, you know, all those things.

Upgradability for those things is a huge part when you're trying to create this sensor for, you know, for a couple of cents. You want to keep it as cheap as possible. How do you make sure it's upgradable and flexible for that? Yeah, so, so, so that, you know, I think that there was a pretty decent awareness about Colorado's capabilities. Yeah.

Not just by those individuals who are our U.S. representation, because they've been to the center, they've been through the NCCS presentation. We had a meeting with DHS. That was a really cool opportunity that we had some agency meetings in advance of the conference starting, and then we had our Capitol Hill meetings after that. And so we sat down with DHS and we were talking to them about some of the things they're doing. I asked them if they had any employees in Denver, and they said, yeah, I think we have some employees, and they're really struggling with the cost of living in DC, and they're really struggling struggling with attracting talent, especially if you're going to be in a government wage kind of situation.

And I said, you know, build your workforce, build some of this competence in Denver because there's a huge interest in people living in Colorado and being part of the Colorado community. That would be a great way to attract them. So have a site in Colorado and have that workforce in Colorado, and that would be a great way for them to have a remote site. And so tried to convince them to come here. Lakewood, there's already a big federal center, right?

That's right. Makes a lot of sense and maybe not quite as expensive to live in Lakewood as it is downtown Denver, right? Or just Washington, DC, right? Oh, absolutely. Yeah, yeah.

So, um, that was pretty well received, and I said, you know, come to Colorado and do a strategic planning meeting, and we'll, as community leaders, facilitate it with you. Because one of the things that they identified is how does DHS interact with the small to medium-sized companies, which is something that the National Cybersecurity Center has identified as one of their pillars, is that the Rapid Response Center can be a solution for small to medium-sized companies that they don't have a big IT department. They don't even have a CISO, you know, like they— but they need a resource. And how does that be a safe place for them to get that resource, but then additional education that comes through that? So it was a really great conversation, and I think that the things that we've been talking about in Colorado were resonating there as well.

That's great. Yeah. So give me some of your background. I know you said you didn't join CTA all that long ago, and you were a CIO previously. What's your career path been?

How did you get to where you are today? Well, I was really enthusiastic about technology when I was in middle school. My mom worked for the first Frontier Airlines, and it was a great organization, and she worked in the finance department, and she would bring home the big green bar paper with computer printouts to, you know, that was the expense report. Extension of what she had to do from the office, and then I would be able to, once it wasn't usable by them anymore, I would be able to use it, and I would role model and role play that I was in business and I was working with computers. And so I had the ability to do a vocational study during high school, and so my senior year I did what was data processing at the time, so I am kind of dating myself.

Punch cards? Yeah, punch cards. And, but there was this thing in the room in our lab that was, had an Apple on it, and there was this thing in the room that was IBM and a personal computer. And it's like, well, that's interesting. Why would someone need a personal computer?

And so I was really excited about what technology could do for business. And that was my initial inspiration. And then I went to Metro here in Denver and went to computer science. And just have always been a part of leading transformation. I will be honest with you, I wasn't a coder for very long because I was too excited about being able to define it and be a product manager and be a part of the marketing and be a part of the customers and meet with them.

And so I went to telecommunications early in my career in the Denver Tech Center, did some really unique things there, and then I went to work for— use that telecommunications background and went to a company called ConferTech International. And ConferTech was conference services, and distance education was the primary application. But we invented the earnings call. So the earnings call as you know it today was invented by a Colorado company. And so previous to having the earnings call, we just had to read the reports ourselves instead of listening to the CFO read it?

And Well, the CEO and the CFO had to do in-person visits. With all the key investors? Yeah, so they had to go and they'd go to the major markets, New York, and then insider trading, did I say the right things, did I say a consistent message? You get it at different times. Yeah, yeah, yeah.

And so we did that and it was a startup 40-person company within 2 years with thousands of employees working in a call center running earnings calls. So that was really interesting, and it was all proprietary product development. I loved it. Windows 3.1 had just come out. We were doing, you know, graphical user interfaces.

That was a good one. It was good, you know. And so then I thought, well, you know, I probably need broader exposure. And I saw an advertisement for some things going on at Janus. And I was like, wow, every job you can imagine is going on at Janus.

What's going on there? So I submitted my application, got called right away, and I got there right at the right time. E-commerce was just— what'd you come in there as? What was your role? I was emerging technology project manager.

Yeah, and anything you could do in a walk-in center, anything you do in the call center, we were putting it online. And, and we did. And, and so that was really, it was important because this was, you know, '97, '98, '99, and people wanted into Janus at that time. And so scalability-wise, it was critical, and that's what we call Virtual Janus. So everything, the whole business changed as a result of us being able to create those capabilities.

I was there for 11 years. As I said, I was the first data privacy officer, so went through— Did you work with my friend Joe McCollum over there? He might have come after you left. He's the director of security there now. Oh no, I think it did.

So the person that was the right-hand person for security was Randy Carmichael. And for those of you in your community who might have had the privilege to work with Randy Carmichael, who's not with us anymore, but he was amazing. And he put all of the programs together. I mean, we went through SEC sweeps, we went through— I mean, we went through a lot. And it was interesting.

It was a very interesting time to be there. And technology changed a lot over that time period. And then I wanted to get back into product development, so I went to a company called BI Incorporated. BI? BI.

And before BI was BI because it stood for something So when they started it as a startup in Colorado, it was behavioral— or it was Boulder Industries and Community Corrections, so ankle monitors. And so data off of— it was the Internet of Things before the Internet of Things. So data comes off of a device, it gets processed through a backend host platform through a bunch of business rules, and then if there's something that an individual in in the community was doing that they weren't supposed to do, it goes— an alert goes to an officer, for example. And so, um, great organization. Worked there for 7 and a half years.

When I first started there, I was asked to be a celebrity at Sea Level. So this was my first introduction. Be a celebrity? I don't know what that means. So, um, Sea Level at a Mile High is our largest event of the year.

It happens in mid-March every year, and it's where we— celebrities who have IT budget. Those celebrities get auctioned off, and they are committing to spending time with the highest bidder following the event. It's what we call our executive auction. So all the proceeds go to CTA, and they go back into the community to be invested. But then it's this great relationship-building opportunity, and I was asked to be a celebrity, and I didn't know what it was.

I had the same reaction, like, what is that? And it was an amazing night, you know, 1,000 people under one roof for one night at Mile High Stadium. And I really got to know people. And you would think, having lived here all my life, that I would know all these people in the tech community. And in reality, I knew people in my industry.

I didn't know people in the community. And so I got more and more involved, and I thought, you know, I want to live in Colorado for the rest of my life. And I didn't want to be a long-term financial services industry person, even though it was great. It's an amazing industry. I learned so much.

What I want to do is— it's tech. For me, it's tech, and it's tech in my community. So it was a great way to get plugged in. Later that year, I joined the board. I was on the board for 6 years.

I was part of the process to recruit Andre to the board. Andre Duran, CEO of Ping, my boss. And he, that's the first time I met him was through him joining the board. Well, actually I take that back. I might have met him because BI became a customer.

So BI was a customer of Ping because we had some integration that we needed to do with some outside contractors. And we wanted to do that in a secure way. So great opportunity to meet leaders and get involved in the community and have an impact. And then when the position became vacant in 2016, it was just one of those things where it was like, have you ever thought of being on, you know, in this role? And I hadn't.

I mean, honestly. And when the question was asked, I couldn't think of anything else. So I thought of it as a sign. So I joined and I get to continue the mission. So when I was board chair in 2013, I hired Eric McGee.

Tysik, who was my predecessor in the role. And he and I— I onboarded him. He and I wrote the 2020 strategy together. So I'm very familiar with the organization, but I'm just amazed about all its different capabilities that you learn from inside the organization that you just are not aware of. Yeah.

And it's, you know, economic development, as I said, the resource that— the things that we're doing, trying to do in education, and the list goes on and on. In addition to being a networking resource for our community, we also are the back office of the Colorado Cyber Group. You know, all different kinds of things that— programming that goes on that brings people together, either as a subject matter expertise, area of subject matter expertise, or just generally that you wanted to be a part of your, your tech community. You're new to town great way to get plugged in. Many, many facets of Colorado Technology Association.

So you are now full-time staff for CTA, and I know there's some others on staff. How many folks do you guys have totally working for you? When we're full, you know, we have a couple vacancies right now, but about 12. That's pretty good. Yeah.

What's that break down into? So sales, marketing, events, programs, so policy, some of on the team that is dedicated to policy, and we have a lobbyist that they interface with, Axiom Strategies. And then we have a talent program specialist. They do a lot of internships and apprenticeships. We're working with CareerWise Colorado as an example.

So going back to the workforce development and talent pipeline topic. There's an organization called CareerWise Colorado, another Colorado startup, and it's a nonprofit organization headed by community leaders with the inspiration and support from Governor Hickenlooper and bringing the Swiss apprenticeship model to Colorado and creating a national model for that in the United States. What's the Swiss apprenticeship model? So the Swiss apprenticeship model is— a lot of people are not aware of this, but a majority of the workforce that are in some of these mid-wage jobs, they came from being an apprentice. So there's some that are, you know, similar to Canada, for example, you're university-bound or you're trade-bound.

Well, there the apprenticeship model is where a majority of their workforce comes from. And from there they have the ability to pursue, you know, greater education over time in their career, but the beginning of their career is as an apprentice and they go through a special vocational educational program. And so in the United States, 30% of our students are college-bound, even less than that. And so what do you do with the balance of the 70%? Especially if they have really great capabilities in future— based on future occupations.

So we're working on a youth apprenticeship model with CareerWise Colorado. CTA is the partner for this for our sector, and what we're doing is we're going out to industry and we're identifying opportunities for them to be able to be a part of this apprenticeship model, and it puts these individuals to work, creates a great workforce pipeline for us. Over time, they can pursue their 4-year degree in things like software testing and desktop support, entry-level positions. So it becomes a real great feeder for us as a workforce model and leverages some of the best practices that, that the Swiss model has brought. I mean, they're one of the leading innovative countries in the world, and they attribute a lot of that success to them putting this apprenticeship model together.

And so putting academic— academia together with these apprentices, they get better solutions, they think about things, they, they have that workforce option, and, and they have much higher participation in the workforce than we might have in the United States. So it's really amazing. It gives kids an option. And so if you're, if you're geek and you may not have the money to go to college, for example, you can go into an apprentice program. You can come out of this apprentice program in 3 years with a certificate.

You have employable skills. You can continue to pursue your education following that, possibly with tuition reimbursement with your employer, and it gives the employer a great workforce option and also a way to give back to the community. So it's really a win-win. And then we're also doing high school internships. Our beginning of that has been working with DPS.

DPS has a Career Connect program in connecting kids to see themselves in careers in tech. And so we've been doing that. We have a lot of member companies that have stepped up to the plate and want to, want to be a part of and put interns for the summer be able to spend time with them in a job shadow situation or even just in an afternoon to be able to help them understand what these organizations do and what does a career in tech look like. That's great. You know, obviously you're a native Coloradan.

You've watched the tech industry go from nascent to pretty thriving and mature here. Where do you think we're going? Any thoughts on what the future looks like? You know, I think that there's a lot of different things to say about that, you know, and, you know, some of them are the obvious things, right? It's the smart world that we live in, and how does that play out in Colorado?

How is Colorado a leader in that? How do we, you know, create access to capital where we can continue innovation that we've been doing, and those have all kinds of implications. So the autonomous vehicle testing is an example, and being able to be an open environment for that innovation to occur. But then there's real serious considerations of security, cyber, you know, everything happening in cyberspace. How do we keep our world secure?

So I think that Colorado has been a great place place to show leadership in that, but that's also a responsibility. So I see that. And then when I get to the workforce, one of the things that I heard as a statistic recently from an HR counterpart, someone who's in a similar role but in— for HR leaders, is that by 2020— and this was something that was identified a couple years ago— by 2020, workforce will be 50% freelance. And so there's a lot of implication to that. 2020, that's really soon.

That's really soon. And they said it's even accelerated. And so you mentioned the workshop that we had on February 23rd, talking about immigration in the tech industry. And in Colorado, 10% of our workforce comes from an immigrant population in STEM. So we're heavily dependent on immigration.

We're heavily dependent on that being a supply chain for our workforce and expertise that we need in STEM occupations. But if you think about just in that workforce, if you go through a process like an I-9 process which is when you're hiring someone new, everyone has to go through an I-9 process to identify their citizenship and their permit to work in the United States kind of thing. And so you think about even that small process that's a requirement for all employers, that if a majority of your workforce is freelance, then how do you control compliance and show the government? And then how do you do that from a remote worker perspective? So if a majority of your workforce is contract, then, you know, what does that mean from IT security?

So, so I think that we're gonna learn a lot of things tied to our workforce in the next 5 years. In the last 5 years, Colorado has definitely increased in terms of tech industry and tech occupations. We've seen an increase from 170,000 jobs to 90,000 jobs, and, and that's growing. So we represent a big part of our state's economy. And I think that the other important topic is that we're not the tale of 2 states anymore, where things going on the Front Range versus things that are going on in the rural environment.

We have to address that digital divide because innovation— a remote worker, they can work from anywhere. And there's so many great places in Colorado. We've seen communities in Grand Junction. There's the Southwest Innovation Corridor. Durango, that's great.

Durango, Telluride. And so we have to make sure that we have— provide reliable access to broadband across the state for students, for workers, and being able to really look at it from an economic growth perspective, that the more attention that Colorado gets being a top destination for millennials, all this development that's going on, we have to address affordable housing, we need to consider transportation, we also need to consider that people don't always work in the Denver metro area. You know, all of those things I think are, are things that we have to really pay attention to as community leaders to keep up with that growth and, and be able to scale so that we can continue to grow and we continue to benefit from what comes out of that. Because if you start to say we have 10,000 open jobs in Colorado and we're trying to attract new employers here, or we want companies not to move away from here to other markets, we have to be able to deliver on all of those those things, which is a workforce, workforce housing, transportation. All of those things I see are playing out actively now and will into the future where we'll have to, we'll have to address those.

But I know that there's some real standout things that Colorado has been doing, and I know that the word is getting out there and it's resonating. I think the other thing, I was in the elevator the other day and there was this statistic on the screen in the elevator that by 2045 that each one of the coasts will be experiencing flooding every 3 days because of what's happening. And, and people are moving inland, right? And so, you know, it's a great opportunity for Colorado, but then how do we address all the growth? Because we want to be able to maintain our infrastructure.

And yeah, a lot of changes. Yeah. So, you know, as, as a community We want to support what you guys are doing. We're going to continue to highlight the events you get— you're doing, especially those that are relevant to us. I think you're doing some really good stuff.

Any, any final things that, you know, folks who are listening, maybe what you'd like them to take away from this? Get engaged, get involved. Let's elevate Colorado together. Awesome. Well, Andrea, thanks very much for your time.

Thanks for the opportunity, and you can always reach me, andrea@coloradotechnology.org. Sounds good. We'll definitely keep in touch. Okay, thanks.

Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.