Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 105 for the week of February 18th. Is that true?

February 18th? It is. I believe that's right. Yeah. Well, Alex, how was your Valentine's Day?

You know, I had a good Valentine's Day. It was not super exciting. My wife and I went out and went to a hole-in-the-wall Mexican restaurant and had tacos. We went to yummy, yummy tacos, Observatory Park by DU. And we, you know, they have a really big, obviously, telescope.

But it was cloudy. Not the perfect time to go to a telescope. We didn't get to even use it. So you got really good views of the clouds. Oh no, they didn't.

They didn't actually even open the observatory. Oh, that's too bad. Well, let's go ahead and jump over to the housekeeping. We have a Slack channel. You know, you're aware of that, right?

That's a good place for people to talk to each other and set up lunch dates like we did today downtown. Alex, you and I are both there responding quite a bit. So if people want to come air their grievances about what a terrible job we do on the podcast, that's the place to do it. Or even better, if you'd like to say how good we are, we'd love to hear that too. Uh, we also have a mailing list.

If you check out our website, colorado-security.com, you will be able to sign up for the, uh, the mailing list there. You will also be able to find information on how to, uh, get to and subscribe to the podcast. Awesome. Um, if we would love it if you'd subscribe and you'd rate us on your favorite podcast listening application. Um, and similar, if you do love us, which we hope you do, um, we would love it if you would help support the podcast.

We are a, uh, uh, we we're basically paying for this out of our own pocket, and we opened up a Patreon website for folks who want to support us financially. Any of the money you give us through Patreon goes to supporting either the hard costs of doing the podcast or some of the swag that we'll sometimes give out. We give out some stickers here and there, and, you know, sometimes we'll have some shirts we can give away. That stuff comes from those Patreons. Exactly.

And finally, if you're not willing to invest money, which is perfectly fine, we would just love it if you told a friend about how wonderful the podcast is. Spread the word about Colorado Equals Security. Um, and talking— speaking about people who support us, we have 2 new supporters on Patreon. Yay! Yay!

Thank you. Uh, first, uh, Kristen Wilson. Kristen is over at Password Ping, or formerly Password Ping, or soon to be Enzoic. Um, they're supporting us at the $15 a month level. Kristen, thanks so much for what you do.

We appreciate your support. Yes, and at that level, Kristen gets a t-shirt, so we will get that out to her. And also, uh, thanks to Michael Lind. Uh, Michael also signed up to support us this week, so thank you, Michael. Appreciate your support.

Yeah. So Alex, when you think of really good whiskey, uh, what state comes to mind? Um, Montana. Montana. Absolutely.

You know, you know what? Colorado has one of the best whiskey distilleries in the country. That is pretty cool. And it's not who everyone might think of right there on 25. That's true.

Leopold Brothers, uh, was rated the best whiskey distillery in all of Colorado, and I believe it was the 9th best in the country. Yeah, so pretty cool for them. Uh, obviously Stranahan's is probably the better known distillery in, in the metro area, but Leopold, I think they moved here from somewhere up north recently. Um, but they, they make all of their whiskeys from Colorado ingredients. Palisade peaches.

Uh, I Can't remember all of the different things they use, but it's all, it's all local and it's all pretty good stuff. They also have a slideshow in the article with many different distilleries across the state of Colorado. So check that out too. Next, there is some disruption potentially coming to Colorado. We could be in the market for digital license plates.

If there's one thing that I thought needed to be disrupted, it's license plates. Exactly. It's a good way. They get dirty, right? They do.

You have to put those stickers on them every year. I hope these new ones aren't going to get dirty. Is that, is that one of the features of the new ones? Maybe, maybe there's lasers that clean the dirt off. I just want a shark with a frickin laser on it.

So digital license plates, there is a company that may be bringing those to Colorado. One of the interesting things that I saw on there, well, first, these are, they're e-ink, sort of like a Kindle, right? So don't take up a whole lot of energy. But also they were talking about how you might be able to have ads displayed on your license plate. Yeah, you could.

I'm hoping that means you can monetize your own license plate. That'd be cool. These license plates are actually pretty expensive. They cost about $500. They say that they're very hard to steal, and if you did steal them, you couldn't use them.

I don't think that'll stop people from stealing them. That'd be my guess. But kind of an interesting thing, and it is strange to see the way the world's going. There were some kind of public interest things you can do with them, like having Amber Alerts go through them as well. So that does seem like a good thing, not just advertising.

Yep. But I've always thought, you know, License plates should probably just stay the same. Not really something that I need to be digitized, but hey, what do I know? Yeah, what do you know, Alex? Not much.

Our next story is around the top 50 startups here in Colorado by Built in Colorado. This is the 50 startups to watch in 2019. Yeah, so a pretty cool list. There were 2 security startups on there. Automox, which is a patching asset management startup out of Boulder.

And we had one of their founders on the show a while back, yep. Uh, and also Overwatch ID. Didn't we have one of their founders on the show too? We did. We are way ahead of the game.

Everywhere. We've been watching them before they were startups to watch, man. Uh, Built-in Colorado just needs to come talk to us. Uh, so one of the reasons we put the story, the story in the news this week is we thought you guys might be interested in actually just reading through these 50 startups. Uh, obviously, um, 48 of them are not security focused, but they're almost all tech startups and really pretty cool stuff going on.

We all have a very healthy, thriving startup tech community here. Yeah, definitely pretty cool. Next, CompTIA released their Tech Towns Research Report, and drum roll, Denver was in the top 10. Oh, top 10. Top 10 is good, but you know, it's really not number 1.

It was not number 1. Number 1 was Charlotte. Next was Raleigh, then Austin, followed by San Jose, San Francisco, Seattle, and then at number 8 was Denver. So the good news is obviously made the top 10. And then, you know, some other good news, while they weren't in the top 10, we had 2 other cities make the top 20 list.

Yeah, we had Boulder at 19 and Colorado Springs at 20. So 3 of the Front Range cities in the top 20, which is pretty cool. Awesome. Next story is about the Colorado Technology Association, CTA, and their SheTech event, or their SheTech Explorer Day event, which is kind of in combination with their large larger CTEC event where they really brought in— was about 150 9th and 10th grade young women from high schools in the area to really give them some exposure to STEM, right? Science, technology, engineering, and math.

Yeah, a pretty cool event. There were a number of local partners as well, different companies that were helping out with the event. But great to see, you know, CTA does a lot of good stuff like this. Seemed like a really good event. Awesome.

Next, We had an article from the Colorado Sun that may be the first one of those that we have, maybe one prior. But the Colorado Sun is a new publication. Some folks from the Denver Post spun out and created the Colorado Sun. It's not a newspaper because there is no paper. There's no paper.

Yeah, it's a, it's a news electronic. Yeah. And this article was actually by Tamara Chung, who we've talked about a number of her articles in the past from when she was with the Denver Post. But this is talking about the new Colorado data privacy law. And the breaches that have been reported since it's been in place.

So when I look at this, you know, they, they do summarize that there's been 33 breaches reported since it went into effect back in September. Um, but when I look at it, I— this article is much broader than just that. It's really kind of a, you know, hey, we're 6 months from putting the law into effect, how has it impacted people? You know, from the 33 breaches that, that have been reported really to a lot more discussion around how do you make a decision about notifications with these pretty strenuous requirements around notifications. Yep.

That they, you know, we're the strict— most strict state in the, in the country at 30 days from when we find out about the breach. Exactly. Uh, so some good stuff in there. One of the things that I took away from the article was, you know, while this law is new and it may seem, uh, you know, 30 may seem like a small number compared to all the breaches that are out there, I think prior to the law there were probably zero breaches that were reported because there was not the requirement to have them reported. So I think net, that is a good thing that we are getting these reports on the breaches.

Yeah. And, you know, 30 might not seem like a big number and the 90,000 Coloradans who are impacted might not seem like a big number. But just remember, these are 90,000 people from, you know, right here, right here in our state, close by, who have been impacted by these breaches. So interesting news. Obviously, we'll keep an eye on this law as it develops.

But it looks like, you know, so far it's been at least partially effective. Next, there is a new startup in Denver. They did not make Built in Colorado's 50 startups to watch list, but we do have a new startup called Randori. And this is a little bit of a teaser for you. If you, if you want to look at this article and start to get your appetite whetted for next week's podcast, because I sat down with the, the co-founder of Randori last week, and you guys are gonna get a chance to hear him in next week's episode.

Nice. In case you were not aware, Randori is a startup that does sort of automated defense detection or, excuse me, testing. So they will try and attack your assets, see if they can get in. And this is, you know, you might think like a pen test, but it is actually a platform that does this as opposed to a person. Yeah.

So, you know, discovery of assets, looking like an attacker might really look, and then they're actually trying to exploit those things and then pivoting and, and doing things that an attacker might really do. Yeah. Pretty cool stuff. They're trying to really give you scale and of course be able to provide high quality pen testing for, you know, very low modest pricing. So good stuff.

Uh, take a look at the article, be, be ready to listen to us next week as we dive into it. They are headquartered kind of, I, I'd say that their headquarters is split between Boston and Denver with their CEO and founder in Boston and the CTO and founder here in Colorado. Yep. Uh, next there was a Red Canary blog talking about detecting Emotet and preventing lateral movement. So Emotet, you know, the reason that they, they outlined this one isn't so much that Emotet is, um, is, you know, the only one to look at, but because the techniques that they use for detecting Emotet can be used for just about every other kind of exploitation.

And, you know, Emotet's also pretty popular right now, so I thought it was a good one for them to highlight in this blog. Yeah, very practical blog. There are, you know, IOCs in there, things you can look for in your own environment. Make sure that you were able to detect those things. Next story we have is from Secure64, the secure DNS provider, and they're announcing this week that they have now surpassed 1 billion subscribers.

They have over a billion people in their system. These are all mobile users, so they're at about a fifth of all worldwide mobile users who they're covering. That is pretty cool. Yeah, I don't have a fifth of the world doing anything. I'm kind of embarrassed, you know, they're making me look bad.

Step it up, Robb. Step it up, Robb. Once we get a fifth of the world listening to this podcast, we'll be there. I would say at that point we will definitely be undisputed number one security podcast in Colorado. Uh, and then finally, um, in case you didn't get any Valentines this year, Route 9B wanted to send a happy Valentine's Day to everyone.

So there was a blog post that they put out this week. Talking about what hackers like for Valentine's Day. So what do hackers love? Well, they love phishing. They love weak passwords, malware, ransomware, open ports, lateral movement in networks, slow and steady operations.

They're not the only one. Weak encryption, exfiltrating important data, and they love covering their tracks. Of course, who doesn't like covering their tracks? So, uh, yes, check out the blog. Of course, you know, unsurprisingly, Route 9B says if you're having any problems with these types of attacks from hackers, they're happy to help you with them.

Yeah. Well, so that's it for news. Go ahead and jump over to the Slack message of the week. Uh, big thanks to Andre Gaeta. Andre's been sponsoring this since it started.

Basically, you know, what he's doing is making sure we identify one person who had an interesting, uh, you know, conversation-starting post in the Slack channel. This week and, and, and giving that person one item from the Colorado Equal Security store. Speaking of the Colorado Equal Security store, we haven't talked about that in a while. We haven't. You can, even if you don't win the Slack message of the week, you can go to colorado-security.com and find a link to the store and go there and purchase all kinds of Colorado Equal Security logo merchandise.

Do you have, do you have a favorite item from the Colorado Equal Security store? You know, I have to say it is probably the, the magnets. You know, I expect to see people buying these magnets and putting them on the sides of their car. So, you know, when you're driving around in traffic, people are like, oh, what's, what's that thing on the side of their car? I better check out Colorado Equal Security.

You know, we do have hoodies out there as well. If you are one of those hackers who likes to stay in your basement with a hoodie on, this is your opportunity. Water bottles. We have a big stein if you like to drink beer out of a flask. Flask if you want to see if you're an alcoholic, I guess.

So that's, that's really what a flask is for, right? Um, you know, if you have a young child, you can get a Colorado Legal Security onesie. All good stuff. I can't imagine why you wouldn't want to get your child that kind of a onesie. So we do have an actual winner this week who can pick from any of these wonderful gifts.

Indeed. So congratulations to Gene McGowan. Uh, Gene posted a YouTube link to an interview with Travis Kaufman. And who is Travis Kaufman? Exactly.

You might say, who is Travis Kaufman? So I'm sure everyone has heard the story going around this week of the man who was attacked by a mountain lion while jogging on a trail near Fort Collins. He then fought back, ended up killing the mountain lion and escaping. So Travis Kaufman is the gentleman that did that. And this is an interview with him.

So Alex, I loved the interview. I spent the, whatever it is, 2 minutes to watch it. Very laid back guy. Did you have any favorite parts of the interview? I definitely had a favorite part.

So near the beginning, he starts describing the situation, says that he hears, you know, a noise behind him, he turns around. And he says, I was pretty bummed out to see that there was a mountain lion trying to chase me down. I have to say, I would be pretty bummed out if there was a mountain lion chasing me too. Yeah. So I actually think that Travis Kaufman should win the Slack message of the week, but I don't have his email address.

So it's gonna, it's gonna be Gene McGowan. It is. Congratulations, Gene. We'll hook you up with Andre and you can get your Colorado Equals Security merchandise from the store. All right.

So moving ahead into the events section of the podcast, where this is where we go through the next couple of weeks of events that are coming up in the area. If you want to know further out than the next couple of weeks, go out to our calendar at colorado-security.com. You can see this stuff coming up all the way through the summer right now. First, uh, SnowFROC is coming up in March. What is SnowFROC?

SnowFROC is the Front Range OWASP Conference. So if you're into application security or you just want to learn a little bit more about it, you should check it out. Tickets are on sale now. It's very affordable, $75 for the full-day conference. $105 if you want the training that is included in the conference as well.

Serge, who's on the board for OWASP, posted in the Slack channel that tickets might sell out. So I immediately ran out and got my ticket, and then I immediately had someone schedule a meeting in the middle of the day on that day that I have to go to. So I will be there for much of the day, but not all of the day. I have my ticket as well, and I'm looking forward to it. Uh, also coming up next week on the 19th is the ISSA Women in Security February meeting with, with, uh, with a couple of losers who, who they, the best they could get.

So Alex and I are going to be talking at this event. I, I'm not sure how their judgment, uh, decided that was a good idea, but, but we have a lot to say. We, we might. And if you want to come hear what that is, you know, come check it out. We're going to get interviewed about who we are and what we do.

And, and, uh, hopefully it'll be interesting to people. And you do not have to be a woman in security, but you do have to want to come listen to, uh, to a couple of guys like us talk and help support more diversity in the industry. How about that? Yeah. And if you come to that event, you know, you could actually just walk out of that event and walk directly to the Cloud Security Alliance's February meeting.

Yes, we were corrected after last week's podcast. These do not really overlap in time, so you could definitely go to both of them. So check out the CSA meeting also on the 19th. On the 20th, OWASP is having their February meeting at the Chinook Tavern down in the Tech Center. And that's Matt Shufeld, friend of the show, who's going to be speaking there.

He's on the, he's on the board, but Matt is a great speaker, has a lot to teach you. So I recommend you make it there if you can. Also on the 20th, ACES, which is the physical security organization, is doing a meeting around selecting a trusted business partner. And finally, on the 20th, CitySec is doing their February meetup at the Wright House. On the 21st, SecureSet has a Hacking 101 about asset management.

On the 22nd, you can go to office hours with Davis, Graham, and Stubbs. There's an event in town. I think it's a full-day event, the Managed Security Services Forum coming to Denver on the 26th. Basically, if you're someone who's either working in an MSSP or interested in learning about it, this seems like a pretty good opportunity for you to do that. Also on the 26th, SecureSet is doing a cybersecurity career convo with Jason Zaffuto on pen testing.

Um, on the 27th, the CTA, the Colorado Technology Association, is doing their Tech Day at the Capitol. This is cool. This is a chance for you to meet legislators, really kind of get your voice in around what are the tech matters that you want to, to be advocating for. I love the fact that CTA gives these kind of opportunities for, for normal folks like us. Yeah, they do some cool stuff.

If you can't make it to that, ISC² Pikes Peak, which is the Colorado Springs chapter, is doing their February chapter meeting on the 27th as well. The next day on the 28th, the NCC, National Cybersecurity Center down in the Springs, is doing their Smalls meeting. They're hosting the Smalls. Yeah, so I'm not sure exactly. Biggie Smalls?

Is this what we're talking about? No, I'm afraid— I don't want to start any rumors, but Biggie Smalls might be there. Yes. So go check it out. See if Biggie Smalls is there.

If not, maybe you'll learn something. Finally, SecureSet is doing a capture the flag event. It is one of their cybersecurity hackathons. This is on the 1st of March. All right.

That is it for our events. Moving over to jobs. Believe it or not, I actually have an open position at Ping. What? But just one.

That's a little mystery. I'm looking to hire a manager of security operations and engineering. This is someone who's gonna help us mature the processes across our teams, help develop the relationships with other organizations within Ping. Looking for someone, reach out to me if you want. I'm happy to talk more about the position.

Charles Schwab is looking for a senior analyst in their service provider oversight group. So if you wanna assess the third parties that Charles Schwab deals with, check that out. Code42, one of the backup and recovery companies, the big ones for endpoints, is looking to hire a senior security risk and compliance analyst here in Colorado. Deloitte is looking for a Cyber Cloud Security Senior Engineer focusing on Microsoft Office 365 and Enterprise Mobility and Security. That's 11 words of a title right there.

That's a lot of words. That's the longest title of the day. I think that they should get a prize. Uh, now if we're gonna go the other way, a company that's known for their brevity, uh, Twitter is looking to hire an Application Security Engineer. And I believe that is out of their Boulder office.

And that is fewer than 140 characters. That is. Stantec is looking for an IT security analyst. What's Stanton? Do you know those guys?

You know, I'm not super familiar with them, but I think that they're in the digital advertising business or something similar. GBProtect is looking to hire a cybersecurity hunt analyst. They're a managed security service provider down in the tech center. Also similar to that, not for a managed security service provider, but Spectrum is looking for a Security Engineer 1 SOC analyst. So if If you're one of those folks who's maybe graduating from Securaset or, you know, looking to get your first job in security, both of those 2 jobs at GBProtect and Spectrum might be a good place for you to get started.

Kaiser Permanente is looking for an IT senior auditor. And finally, Verizon is hiring a dark web OSINT investigative research consultant in Colorado Springs. That's a lot of words. It's not as many words as— not quite as many words, but it's pretty good. It's a pretty cool sounding job.

It is pretty cool sounding as well. Well, that is it for the news. Uh, next we have the feature interview. I sat down with Elaine Marino. Um, we, we talked about, uh, really, she's, she's actually the founder of LadyCoders.

She's been working a lot on really helping get more diversity within, within technology more broadly. She's not specifically a security person, but she is, uh, really interested in helping security get there as well. Sounds like a good interview. Um, and if you're interested in learning a little bit about meditation, Hang out and we talk about it. Meditation on the interview as well.

Yeah. Well, Alex, that's it for this week. We will look forward to doing this again next week, and maybe next week we can just have one recording of the newscast. Yeah, that would be good. Most often we do that, but sometimes we don't.

All right. You guys have a good week. Did we? Hopefully we sounded good because we we had to practice. We better sound good.

All right. See you guys next week. Thanks, Robb. Hi, this is Chris Martinez. Cizzo at Digital Globe.

Welcome to Colorado Equals Security, for Colorado security professionals by Colorado security professionals.

Welcome to Colorado Equals Security. This is Robb Reck, and today I am sitting with Elaine Marino. Elaine, I'm very excited to have you, and you have— you do some really interesting stuff. But before we dive into, you know, the work you're doing around coding and equity in the technology space, You just gave me a little bit of a teaser, and I had to hit record immediately so I could find out what's going on. How did you end up living in the Czech Republic with a Buddhist monk?

Yes. Yeah. Okay, actually, this will play very well into the whole story of how I got into coding anyways. But essentially, in my previous life, I was in advertising, and I worked in advertising in Los Angeles and in New York City for about 11 to 13 years depending on how you count it. And I got very stressed out.

And it was during the height of the financial crisis and my client was a bank and everyone was very stressed. And I basically swam with the sharks. And so I found meditation in New York and decided— That's not the place I expect to find meditation. Right? New York City or New York State?

It was New York State. So I got— There's a lot of New York State folks that are out there. Right, right. So I took the train after work one day to upstate New York and learned beginning meditation from a Buddhist monk. And when I was there, he said, this summer I have a retreat I'm doing in the Czech Republic at this castle, and, you know, offered the whole class to go.

And I was like on it. I was like so stressed out. I was like, I'm definitely doing this. Well, what I ended up doing was quitting my job, moving all of my stuff to Boulder, Colorado, putting it in storage, and then I went to the Czech Republic. So this was about 6 months after this meditation retreat in upstate New York.

6 months later, quit my job, put all my stuff in storage in Boulder, Colorado because a good friend of mine was getting her law degree at CU. And then I promptly hopped on a plane and went to the Czech Republic and for 1 week did a silent retreat with this Buddhist monk and others. And then I stayed on for another 2 and a half months doing what they call seva, where I essentially just volunteered my time. And during that volunteering time, I ended up helping this monk write his book, because I could type really fast. And so I ended up living in this retreat center with him, and every day, you know, meditating, doing our nature walk, and then I would type up his book.

So what did you do? I'm sorry, how long was the retreat itself? The retreat itself was 7 days. So you were there a week for the retreat and then you did seva afterwards? Yes, and then I transitioned for seva to be a volunteer.

And then that was sort of how I managed to live in Boulder, right? Because I went from New York City to Boulder, but in between that I did this life change of, you know— You kind of reset. I completely reset. In the Czech Republic forest. Because the subtitle of this is Colorado equals meditation, I want to learn a little bit about this.

I've been poking around a little bit at mindfulness meditation, and I'd love to know what is the kind of meditation that you're talking about that you learned from this monk? He is a Theravada Buddhist monk, which is, I believe, the oldest tradition. He is from Sri Lanka. But essentially what he taught me in upstate New York is what I do to this day, and I do it for about 10 minutes in the morning and I try for 10 minutes at night. And all it is is to sit up straight with your back straight.

So either you need to sit cross-legged or sit in a chair, and you close your eyes and you breathe and you follow your breath. And anytime— yeah, and anytime your mind wanders which it does, you just acknowledge the thought and you just literally say thought. Or you— he would also say you could say past, present, or imagination. So, because that's what— those are one of the 3 things you label the thought: past, present, or imagination. And then after you label it, you let it go and you go back to your breath.

And that is the basics, and I do it to this day. That's basically exactly what I have been one of those apps, the Waking Up Shawn Harris app, whatever. Yeah, yeah. And what I found is that by labeling the thought, then after a while you just, you just start to see your thoughts go by and you stop engaging with them. And then if you do it, it's just like any muscle.

If you do it long enough, you stop engaging with the thoughts and you get, you get much— you get into that meditative state a little quicker. One of the, one of the really cool things things that I have experienced as a part of that was the ability to label emotions, even very strong emotions. And, you know, anger— anger is a really good example of it. If I feel a really strong anger and I have the presence of mind to label it as such, it just goes away immediately. Yeah.

I cannot stay mad once I recognize that it's anger that I'm experiencing. And like, it's not just recognizing it, it's labeling it and also saying, okay, what does anger feel like right now? And when I have that presence to think that, like, the anger is gone. What I have found with anger is that if you meditate regularly, you have the presence of mind to be like, ooh, I'm really angry. And then if you, if you can do it, you have the presence of mind to take 3 really deep breaths.

And I find that by the 3rd breath, the anger goes away. But on that 2nd breath, you're like, I don't want to let go of the anger, but you know it's dissipating. With the breath. But again, that requires a strong meditation practice. Don't always have it.

So I don't know if the people listening will believe us, but I had no idea you were going to talk about this. This was not my plan. That's fantastic. All right, well, we can dive into the rest of the story because after I got to Boulder, um, 8 and a half years ago, I decided I was never going to do advertising again, and I got very involved in the tech industry that was there and I just started poking around and getting to know people. Talk to me about that.

You moved to Boulder. You had been in the Czech Republic for a few months, moved to Boulder. You have your stuff in storage. How do you come and get involved in the tech industry? What does that mean?

Gosh. This is old school. This was 2010. But I would go to Boulder Open Coffee Club, and I just met lots of people. That was one of the great things about Colorado, I think, to this day is that people are very kind and it's a very open community and people want to help each other.

So I literally would just say, here's my skill set, and people would be like, oh, I have a friend looking for that, or you should talk to this person. But you knew you wanted to do marketing, right? Well, I didn't want to work at an ad agency. So what happened was I ended up doing marketing for startups, and I very quickly realized I didn't really want to do that either. But I wanted to know more about the technology.

In a startup environment, you all sit together. So I was sitting with all these developers, And I didn't know what they were doing, and it really bothered me. It was like a black box that I didn't understand. And I asked the gentleman next to me, my coworker, I was like, how did you learn to do this? And he was like, oh, I went to the University of Iowa, and I got my computer science degree.

I was like, well, that's not gonna happen. I'm in my mid-30s. I'm like, no, I'm not starting again. But at the time, one of the very first code schools in the area opened up. Actually, it was one of the very first code schools in Colorado or in the country, I should even say, because Galvanize wasn't in existence, Turing didn't exist.

This was 2011. Da Vinci Coders was actually first, and I was in their first class. I dove right in. I actually learned the language of Ruby and the framework of Rails and a little bit of JavaScript and learned it all on a Linux virtual machine. And really, I didn't even know HTML.

I was completely clueless. Had I had any bit of understanding of what I was doing, I might not have done it. But it was also a really fantastic experience, and I had an excellent teacher. Through the course of that, because of all of my marketing skills, I did a lot of networking. I started to go to all the software development meetups.

I would go to Boulder Ruby meetup. It was the Ruby Group in Boulder. It used to be held at Pivotal Labs. I don't know where it's held now. But anyways, I just got to know everyone in the community, and I had mentors.

And I figured out even before class ended that there was a gap in our knowledge between even the most entry-level developer and what they were hiring, what I knew. But at the same time, I didn't know nothing. I could spin up a Rails app. I could pull in gems. I even built a gem.

But I didn't have any architectural experience. I didn't have any real serious experience with big data. I could work in a SQL database and do a little bit of Postgres, but I needed more training. And I found that companies were not willing to train. And at the same time, I started to also experience a ton of marginalization.

And I didn't even know that that had really existed because when I was in the advertising world and in the business world, the leadership was very male-dominated. But my coworkers and my life, I worked with everyone. And now I was in an environment— and you have to think I'm like, gosh, mid-30s woman walking into a software development firm and I would be the only woman in the building. Then I had some really fascinating experiences. My very first day with my mentor, he invited me to his office and I got to work with them for an entire day.

It was very cool. In the morning, they did a daily standup. So the whole software development crew came together in the lobby, So I could see everyone. It was very clear I was the only woman. But then as I stood there, I actually just did mental math.

I'm like, okay, I'm the only woman. I'm also a little bit older than everybody here. This is skewing really young. I think me and my mentor are the oldest people in this room. I think everyone here is in their 20s.

I happen to be half Mexican and I thought, I don't think anyone else here is any other ethnicity. Everyone is presenting as straight. I just kept going through all what I now realize are underrepresented groups. I don't think anyone's been in the military. I don't think anyone has a disability.

It narrowed, narrowed, narrowed. In my observation, I figured out that I thought tech has a little bit of a— I think tech's largest problem is actually classism. Everyone here comes from a very well-off socioeconomic background, and they all went to really good schools, and they all grew up together, and it just was extremely narrow demographic group of people I was with. And I like to tell everyone, everyone was kind to me that day. No one was mean to me.

Like, it wasn't, it wasn't overt. It was much more, why is it that everyone is so young, healthy, fit, white male, right? Like, why, why is this Don't they know it's strange to only work with people like themselves? That's not how the world operates.

Around that time, Heroku held a conference called the WAAZA conference. Their COO, Oren Teach, was actually put on the spot by a reporter because there were more men in attendance named Matt than there were women.

He said something profound that I thought actually really described what I was feeling. He said, it's not that the number is a problem, it's an indication that something is wrong. Yeah, and that's the problem. And I completely agree. It wasn't that I was the only woman in the room.

It was, where is everybody else? Well, how did it— how did this industry get to this point that there's no one else other in the room, that we are pulling from such a deeply narrow demographic. 27-year-old young white men is very narrow. I, I think we're probably going to spend a good, a very good chunk of this interview talking about that, and I want to, but I don't want to run us out of time before we get to hear what other things you've done since then. Sure, absolutely.

So if you don't mind, just talk me through— I know you went there that day and you kind of recognized something. So where'd you go from there? So from there, um, I got an internship doing Ruby on Rails, and then I also went out to find women's organizations. I ended up starting something called the LadyCoders Conference, and I did that in Boulder in 2013. So that was 6 years ago.

Yeah.

Had a successful one last year, and I'm doing one again this year. It's April 4th and 5th here in Denver. Are you associating with any other groups that, or is that just your own thing? It's just my own thing. It actually started by 3 women in Seattle, and I attended their first one in, gosh, 2011, 2012, somewhere around there.

They ended up disbanding, and I took it over. So there was one prior in Seattle in 2012, I think. Yeah. And then I did the one in 2013 and have kept it going since. And I am not working with any others, but I do know all the other groups And I invite them.

But really what it is, and what I figured out really quickly, is that women don't have the mentoring they need. And so I try to utilize this conference as a way for them to get the mentoring, the tools, and the information to stay in the industry. There's a horrible statistic that 50% of all women will leave tech within 12 years. And it's at 2 times the rate of men. So, so for men it's roughly a quarter of them leave, and for women it's half of them.

Yes. I heard another stat, and I'd be curious if— mine might be a year or two old, and maybe you've heard other stuff— something to the effect of there's 11% of people in technology are women, and 11% of CIS degrees from colleges are women, and something like 11% of high school students who get involved with technology are women. So it was— which just changed the mindset for me. If, I don't know if this resonates with what you'd heard, that the problem starts way earlier than I might have expected. It's not that women were dropping out at a significantly different rate than men, it's that they just were never opting into the pipeline in the first place, or they, or they dropped out before even high school, right?

It's a— there's a It's a multifaceted problem. So as I'm standing there in this standup, I'm like, what is going on? So then I dive in and I figure out, yes. I'm not sure about all of your stats. I do know the 11% degrees is correct, the computer science degrees.

The reason why that's troubling is that it's going down. So in 1984, it was like 30%. So it's significantly been going down over the years. Many factors contribute to that. And part of the opting out are the optics of tech, right?

Of being male-dominated and not being for women and women being steered away from those jobs. So it's a compounded— it's like a chicken and egg problem, right? They're compounding each other. To that point, as a pretty solutions driven person, uh, you know, I'm trying to identify, well, what's the real problem I'm trying to solve? And if the problem I'm trying to solve is, um, well, you need to get more 6th graders, just 6th grade girls, to be more engaged— and frankly, I think everyone, right?

We need everyone more engaged. Absolutely everyone. So that we can increase those numbers from that point. That's different than I need to go target people who are just graduating from college with CIS degrees and say, oh, don't stop doing this because, you know, you don't see any guys out there. Make sure you do it.

So I love— it sounds to me like what I hear you saying is it's not one or the other. It's really some of each. Yes. So the problem starts very young. It continues into high school.

It continues into college. It continues into their careers. What I would say is, if we're going to talk about solutions, that it's actually— and the inclusion part is the solution. So most companies, most people, what they go to is that the pipeline just isn't there. There aren't people to hire.

There aren't women to hire.

There aren't Black talent to hire. For many of us, there's not anyone. There's not even white men to hire for a lot of these positions. Yeah, yeah, exactly, exactly. But there's a talent shortage.

Isn't enough talent, so we need to fix the pipeline. And for something like what you said, 88% of your workforce are men. If you want more women, you've got to make that 12% feel a lot better about being there, right? You have to stop the 50% from leaving in order to trickle down that the few women that are coming in stay, right? So my whole point for the LadyCoders Conference and actually all the work that I do is to really dive into what is making them leave.

Because you can fill your pipeline as much as you want. If they're leaving at 2 times the rate, what's the point? It's a leaky faucet. So I know I said I was going to let you keep going through your background and then I took us on a tangent. Sorry about that.

It's okay. We talked about LadyCoders Conference and I will have that on the— well, it is on the website on the calendar for folks to go get information about it. Talk to me about what else you're doing. Absolutely. I did go in and I would say I was a baby developer for 2 years.

I was an intern. I started at the bottom. Because I had had this previous career in advertising as a manager, as a director, and then starting at the beginning in this other industry, I could watch and see from a manager's point of view what they were doing wrong. There were some very fixable things, the way they were posting jobs, the way they were interviewing me. Talk about that.

What do you mean? Sure. I have a great example. I literally, when I was doing my presentation, I'm like, well, let's just see what's out there. I put in Ruby on Rails, and I found a junior position and a senior position.

I show them, and I show how there's no standardization for what people are looking for because in general, The hiring manager, the VP of technology, does not really give great requirements to the recruiter. The recruiter is just throwing out there 3 to 5 years Ruby on Rails experience. That is not— that's actually extremely vague and it's very unhelpful for me. So I'll give you an example. There was a job description that said senior Ruby on Rails developer, and I would never apply for a senior position.

But everything that was listed with the exception of the 3 to 5 years experience, everything else they were asking for, I had done. I was like, well, that's weird. Then there was a junior Ruby on Rails posting that had things like must have a bachelor's in computer science, must be able to solve complex algorithmic problems, and was much more what I would say listing senior-type activities or senior-type requirements, I should say. Are you saying these are 2 from the same company or just 2 different random ones you found on the internet? 2 different random ones from 2 different companies.

But my point is that neither one I could apply for. And yet I knew enough to be a Ruby on Rails developer, and yet I couldn't find job descriptions that I even felt comfortable applying to because they were just all over the place. I really coach companies that you have to clean up what you're asking for. I actually just got off a call recently and talked with them about— and I really love doing this, actually. I love going into technical job descriptions because I have just enough technical knowledge to know how to poke at, well, do they really need that?

Is that a requirement? So what I like to tell companies, and this is a real tactical action item for people, is what do you need them to do? Give them an example of a bug that you need fixed, or give them an example of the platform that you're building and how you expect it to be built. One example I like to give is JavaScript. We need 3 to 5 years JavaScript experience.

What do you need them to do with JavaScript? We need client-side validations. And here's why this is important. Because 3 to 5 years JavaScript experience is very vague. And to your point earlier, women won't necessarily— or I should say underrepresented groups are already like, wow, I don't really belong there.

I don't know if I have enough experience for 3 to 5 years experience, what they're looking for. But if you flip it and you say, we would like you to do these 4 tactical things with JavaScript. Now I can say, well, I've done those 4 things and I will apply. It's much clearer what you're asking me to do. The vague actually plays into false bravado, and those that have false bravado are already in the industry because they're like, oh, well, I was over at Uber and now I can just go to Ping and now I can just go But if you're on the small minority other group, you need a little bit more tactical reason.

I'm thinking why we put 3 to 5 years in a job description, and it's probably mostly because it's easier. As a hiring manager, it's easier to type 3 to 5 years security event management than it is to say, experience managing these types of events, right? It's a really interesting point. I think it'll be hard to change the behavior of all of the hiring managers. It might be a little bit easier to change the behavior of recruiters who can, who can like push back on hiring managers.

I don't know. My recruiters push back on me. Well, to be honest, what I tell recruiters is to create like a Google Form and have you fill it out and literally say, give me an example of a bug you want them to fix. Give me lists of libraries you want them to know. Lists of libraries or tools that can be taught.

Give me an example of the Git commands that you use on a regular basis. One thing I did realize as a developer, we all rely on the things that we love. There are literally, very rarely are you going outside and just all of a sudden going to plug in a whole new method that you've never used before. You're only going to do that if you absolutely need to. There's usually things that you're pretty solidly using over and over and over again.

Think about what those things are and put those in the job description. That's great. So you talked about some of the work you're doing there, but what is it? Is it Equily? Equily.

So what ended up happening is that I put on the LadyCoders Conference. I really struggled, actually, to find a job. I went on so many job interviews, and again, saw really marginalizing behavior. What ended up happening is I started to speak about it. So I started to get invited to different events.

This is very early on. This is like 2012. I got invited. I spoke at Denver Startup Week about diversity and inclusion, but I got invited to Dreamforce, got invited to OSCON, and I started— What's OSCON? Open source conference.

O'Reilly's open source conference, and started to just really talk about it. And I found that there was a real need for me to consult on this. And so I started a consulting business to help tech companies. So you're giving talks at these different conferences, and someone says, will you come to my company and tell us how to do this right? Is that what it was?

Yeah, a little bit like that, yeah. Because things like I just told you about the job description, it's very real. There are real practical, tactical things they could do. I had a terrible job interview where I went in and I was put into a room and given coding challenges for like 3 hours. That was great.

I actually really enjoyed that. Then went into a room to review my code, and there were 8 gentlemen in the room and myself, and they projected my code onto the screen and we went line by line and reviewed it.

I ask men all the time to put themselves in that situation. Imagine having to go in a room with 8 women and having to defend your work. It's just an uncomfortable situation to be in, and no one's going to get my best performance there. Not to mention, as you know, solutions can be subjective, right? Because if you get to an answer that is correct, but maybe you didn't like the way I did it— Elegant code.

Yeah, the elegant code. And so they actually would start arguing. About, well, this was the better way to do it. Well, no, but this one worked. It was a really, really uncomfortable situation.

I would just tell companies, you have to stop putting people on the spot. The tone I got from that interview was that it was an interrogation. Are you good enough to be here? Not, let's see what your skill set is. Let's talk to you.

Are you a good fit for this company? What can you bring to the table? And frankly, under no circumstances should there be that imbalance of power. There's no need to ever interview with 8 people at once. At most, it should be 2 to 1.

So I'm definitely guilty of some of what you just said. I want to talk about it. Yeah, let's talk about it. I'm a really big fan of— I'll say I don't have a lot of confidence in the general interview process. I think that generally speaking, being a good interviewer is a skill.

And if you're good at knowing what the interviewer wants to know, the interviewee can give the right answers and can give the appearance that they want to give. It's like a sales job. Absolutely. I'm a big fan of having the person do the job. As a part of the interview, I'm going to have— I don't hire coders, but I might say, if I'm hiring an application security person, I might say, here's an insecure application.

Take some time and see what vulnerabilities you can find in this. Let's come back and talk about them. They have time on their own to do that.

Then what I'll usually do for most of my positions is ask them to turn that into a presentation. And show us what they found. So I get to see, number one, can they do the job? Number two, do they know how to communicate? Pretty important thing.

And then we have a discussion around it. Certainly I hope that it doesn't come across as an adversarial situation, but it is, you know, a question where they're going to show us what they did and we're going to ask them, well, how'd you get there? You know, what is— what, what would it look like if you'd seen this result? And have that, have that interaction. Absolutely.

And, and, but I can see, you know, As someone on the other side, you know, it's definitely more than 2 people in the room. Probably not 8, but, you know, 4 or 5 people could be in those panel interviews to see that presentation and, you know, experience what that person did. You know, my first thought is it's given me the best results I've ever had from an interview process, and I'd love to see your take on how can you do— how could I do better for that? Have you ever had a woman or a person of color interview that way? Have I ever had a candidate who— Yeah.

I've hired both. And did they perform better or worse? I'm just more curious. I mean, I've hired, I've hired a variety of both women and people of color. Did they perform better or— I don't know.

I don't know. I don't think I'm prepared to answer that question. I don't know. Yeah, yeah, yeah. No, no, no.

It's just in general, it's hard to be the underrepresented person in that room and perform very well, right? I'd say we— I am fortunate that we have— we're not a bunch just white men interviewing either. There you go. Yeah. I mean, it's— there's probably more white men than there is any— well, there's definitely more white men than any other group, but there are women as a part of that and there are people of color as a part of it as well.

Yeah. And I actually, I want to say something for you and all the audience. White men are not the villains of the story. I think that that's part of what makes the diversity and inclusion problem— not problem, conversation uncomfortable, is that it seems like we're pitting against what's not diverse and what's not inclusive. What I like to say is that all it is is that what I found in tech as I was going through and trying to become a software developer is that it was just unbalanced.

They were doing some things to keep it unbalanced. So that's why I would try to rebalance it. So in your interviewing, going back to that, I actually don't necessarily think there's anything inherently wrong with the applications challenge that you're giving them. I think that that is really, really strong. Like I said, as a developer, I was really excited to go in the room and see what's next, what challenges up next, and that was actually really, really exciting.

The thing that you're doing right that made the difference, that was very different than my experience, is that on the team that's reviewing them, they need to see themselves represented. If it's a woman, having other women in the room. If it's a person of color, having— Just trying to be conscious of not having it be— So imbalanced. That's all it is. Diversity and inclusion is a balanced conversation.

88% is not very balanced. Right? Like that, just that number, not very balanced. So that's all it is, is it's really a balance. And so that's what I would tell companies is I would say, okay, you can't have it be so imbalanced that you make the person uncomfortable because they're not going to give you their best shot if they're that uncomfortable just even being there.

And the other thing I would say when people, you know, say, well, they push back a little bit on what I just said, the solution I would give is is to do exactly what the first thing you said was, which is have them work. Have them come in and pair program for a day. Have them come in and solution solve with the team that they might potentially work with. See what they're like working with them. You'll get the better read on their skill set and if they fit into your team.

You're most of the way there with your process, actually. I do think it'd be hard to have a person— like, I can't give access to systems. Of course. Yeah, of course there's questions about that. But, but I am, I'm a really big fan of not asking you, can you do it?

Just saying, here, go do it. Absolutely. And it's funny, I don't have any challenge. I don't worry at all about people cheating because they're going to come in and talk to me about it. And it's so obvious.

It's just so immediately obvious if you cheated. 100%. No, I get that all the time. They're like, well, they could cheat. And I was like, Yeah, and you'll know.

Immediately. Yeah. Just ask a few questions. Or one of my other pieces of advice is to set the candidate up for success. Give them all the tools that they need.

Give them all the answers that they need. Say, here's where you can find everything. And if they come in and they haven't done well, well, then you know, right? And if they do really well, well, then you probe a little deeper. Yeah, it's actually a really good test to see if they follow your instructions.

I think the best thing I heard from you is is just to be thoughtful about what's the— what is the feel of the room gonna be like for the candidate when they walk in? And, you know, do they— to yourself, do they see themselves reflected? And not that I necessarily have all of the pieces to make it look right exactly, but I can be more conscious about it. I can be thoughtful about it. That's absolutely the point.

Okay, thank you. Awesome. So I know You talked a little bit about what you've done with Equally. Do you want to talk more about that? You created it based on a demand.

You've been talking to companies. I've been talking to companies, and I go in and consult on different problems. What I like to say is that in every part of the candidate experience, there's an opportunity for diversity and inclusion. We talked a little bit about job postings. We talked a little bit about interviews.

I think there's opportunity in screening candidates. I think there's even opportunity before the job postings, like where you're posting the jobs. Then going back to screening candidates, hiring them, how you offer their compensation, what are your benefits. We can go into that in a moment. And then onboarding them, and then what's their experience like once they're in the company.

And that's the retention piece. Let's talk through all those as much as we can. Yeah. The drafting job descriptions. I remember a press release or a news— maybe it was a news story, Denver Post news story about SendGrid having done some analysis on their job descriptions.

Um, gosh, I, I want to say for sexism. That's not quite the right word though. There's probably maybe gender bias. Yeah, gender bias. Gender bias.

So there is like, you know, there's some, uh, there's some analysis or some reviews that you could do to really remove gender bias from your job descriptions. Yeah. For anyone listening and wants to know more, Textio is a really sophisticated machine learning tool. They give you a 2-week trial and then it's very expensive. It ramps up real quick in the cost department, but it's absolutely fascinating because it will tell you all of the masculine-coded words and all of the feminine-coded words.

Give me some examples. Absolutely. Aggressive versus compassionate, athletic versus kind, loyal versus— let's see. Loyal is a masculine word? Actually, yeah, loyal is— yes, loyal is a masculine word.

Oh my goodness, what was the— what was another word I was gonna think of? Empathic. What about like process-oriented? Am I masculine when I say process-oriented? You are.

But I want process-oriented. What do I do about that? But this is the great thing about Textio, and this is why it costs so much. It will tell you the alternative of what you should say. Don't get me wrong.

What happens is you cut and paste this in there, and it pops up all your masculine-coded words, all your feminine-coded words, and then it will give you terminology to make them neutral. That's the most beautiful part. It's not that you want a feminine-coded job description all of a sudden. It's that you want to be trying to be as neutral as possible. What I have found with these masculine-coded words and these feminine-coded words as well is that in general, we elevate the importance of those words, meaning a word like active or athletic or champion are all male-coded words.

Those are really strong words that we think are really positive in business. Then some of the feminine-coded words that are empathic, compassionate, kind are less emphasized in the business world. However, you absolutely want empathic, compassionate, kind leadership. Those make better leaders. Those types of people make better leaders.

It's looking— it actually helps you look at the words that you're using and why you're using them. Okay, so that's the gender coding. But then there are other parts to that tool that I think are absolutely fascinating. It tells you when you're being repetitive. It tells you when you're being unclear.

And so over time, as you're like getting all your words neutral and you're taking out the repetition, the score in the corner goes up. And all of a sudden you're in this like really high zone, and then it'll tell you— and this is why it's such an expensive tool— how your job description compares to others in the same zip code in terms of your score and performance. And what they have found is that they get more diverse candidates when you use these types of job descriptions because it cleans them up, so to speak. There are cheaper tools. Skillful has a job posting tool.

Kat Matfield, if you look up Kat with a K Matfield Gender Decoder, she has a very basic free tool that will tell you, because she was a software developer and put it together and just got tired of the job descriptions being so biased. But some, like, a really fun example I like to give is the words feisty and bossy, rarely used for men, right? Our language is coded in ways that we don't necessarily always hear or see. Or obvious. But another example I give is, I would like an aggressive salesperson.

How about an effective salesperson? That's not as coded. And it's probably more what you want than aggressive. Right, than aggressive. You want effective.

If someone asked you, do you really want aggressive or do you want effective? And you're like, I want effective. So process-oriented, I actually think is probably fairly gender-neutral. What I find in this industry a lot more is we want analytical. And analytical is very masculine coded.

All right. I'm going to keep us moving along here. Yeah, keep moving. I want to ask you about the onboarding and what can you do in the onboarding to make it more welcoming to a diverse set of candidates? Yeah, absolutely.

So for onboarding, let me think about this for a moment. A couple of things. If you hire, and I have found this, like the one woman to your department, like it's brand new and like you've hired the one woman. She cannot automatically become your person for diversity and inclusion, your go-to person to go to all the women in tech events, your go-to person to make your office a more inclusive environment. That's actually an added job.

It's the same thing for the one Black person in your office. They can't represent their whole race. That happens a lot. All of the majority unintentionally is like, oh, well, we're going to this women event. You should You should do that.

And what really what you did is you hired her to be an engineer. You didn't hire her to be the diversity and inclusion officer. And so I would ask for companies to be very mindful of their underrepresented person or group to not overtax them to fix the larger problem. That, that really has to be a leadership issue. Other things to be more inclusive is to think about the type of activities activities you do.

The RSA conference, we'll get there in a second because I'm speaking there. But I will give an example. I have a friend that works at a company that goes to RSA every year. And it's a whole team of men and her. And every year they get special golf shirts made for them.

And they don't buy a feminine cut for her. They just tell her, well, go buy a blue shirt that matches. Every year. Now, that is a really small minor problem, right? She does not feel like she can go to her manager and be like, this is stupid, you should buy me a shirt, because it's a stupid conversation.

And yet the message is you are other, you are not part of the team, and you are not as valued because we're going to spend hundreds of dollars on everyone else's attire and we're not going to spend any on yours. And so it's a little ding in the marginalization. So that's part of the onboarding is to make sure that you have clothing items, swag, office space that's accessible, things that are just a little more intentional about who they are as a person. And frankly, making one shirt for someone is probably extremely expensive. Maybe it's like $250.

Replacing her is probably $10,000. So you have to start thinking about it in those terms, right? And I think you don't even have to think of it that way. I think another way to think of it, and the way I do, is the cost of buying these shirts is the cost of the number of men's shirts I'm buying and the cost of the number of women's shirts I'm buying. It's not— her shirt doesn't cost all of the women's run.

It's just that is what it is, right? And as long as you have that expectation up front, you're not saying hers costs $300, you're saying the whole team's costs $1,500. Absolutely. That's how I look at it. And I can't tell you how common this problem is.

Like, this is extremely common because there's always one. There's always one person. I had a gentleman I gave this talk to. He was a, uh, um, he was first generation. He is, um, South Asian.

And he said, I'm a men's small. He's like, not once have I ever gotten a men's small t-shirt at any of these conferences. I always joke, I'd go to these conferences as a woman developer, and I would come home with a bag of large men's t-shirts. The first year, here's for my brother and here's for my boyfriend. The second year, you're like, oh, here they go, here's your next round.

By the third year, you're like, really? Come on. You've literally just said you don't belong here hundreds of times over. To be. So it's small things like that to just pay attention because what happens and the reason why I harp so much on inclusion is that it's really death by a thousand cuts.

That's why the underrepresented groups leave. That's why women leave. That's why that statistic is the way it is. It's not the t-shirt happened once. It's the t-shirt happens every year and I'm not invited to lunch because because they're going to go to Topgolf and I don't play golf.

And I can't go to the conference because it costs more because I can't share in the house with everyone because I'm the only woman staying in the house. And, you know, like it just compounds over time. And so what I would say is, is to make it inclusive is to just never exclude, to always have to pay the extra money. Just figure that out. Figure it out.

Like you said, what's the total cost? Oh, the total cost includes another place for me to stay.

I feel like we have so much more to talk about. We don't have that much more time. I want to keep moving. Any other guidance? There's a lot of people listening who run departments.

Any other guidance for things that you— behaviors you'd like to see change among leaders in our security community here at Penn? Yeah, absolutely. I would just say that being inclusive requires intention and it requires getting out of your comfort zone, expanding your network. This is my all-time best tip actually, and I saw it in action. So, I'm a developer.

I am in my— this is back in the day when I was a developer. I would walk into that room, right, and I would be the only woman. But I had to go and find my community, and so I did. I would go to Women Who Code. And it was great because that was my community.

Well, one gentleman came in once and he said, I'm the VP of engineering. I have a staff of 50 men and I want to hire all of you. And he was just super authentic and he put himself in an uncomfortable position, right? He was the only in that situation. And he said, I will sponsor this meetup.

You will have food and drinks for as long as I can do it, and I will be here at every single one of your meetings, and please come and talk to me. Over the course of time, he got to 30% women engineers in his department, and we all felt very safe working for him or telling friends to go and work for his department. He demonstrated a lot of leadership there. Then to take it a step further, when my first LadyCoders Conference happened, I announced it at that meetup, and he said, my company will sponsor. He was my first-ever sponsor.

It was a very long tail of effect that he had, of impact that he had. He changed his department. He affected the lives of hundreds of women by sponsoring my conference. He continues to be an ally. And so that's what I would tell for all leaders is to go where you're a little uncomfortable, be as authentic as possible, sponsor, mentor, pass it forward, and put yourself in that only position so that you just for a moment understand what it's like to be the only woman in that room.

Awesome. I know you have a couple of things coming up. Yes. You're gonna be at RSA conference. Talk about what you're doing there.

Yes. Okay, so I'm at RSA on Monday. I believe I'm on at 9 or 10 o'clock in the morning on Monday, the first day, and I'm essentially doing a workshop on this to give tactics, to give real tactics. A lot of people talking about diversity and inclusion, but it's sort of what you just said, like, well, what can we actually do? Tell us.

Is it a half-day thing? Full-day thing? No, there is a half-day thing. Yes, it's a, it's a 4-hour blog. I will be also on a panel with Karen Warstall, who— I love Karen.

We've had her on the podcast. Oh, good. I was going to ask, did you have her on the podcast? Oh my goodness. Jim Gordon from Intel and a few others to talk about what companies can be doing and what they are doing.

Then, like I said, I will be giving a workshop on tactics. If you really want me to dive into tactics for your company attend it. Awesome. Um, it would be— yeah. And then Lady, uh, LadyCoders is happening April— remind me— 4th and 5th.

4th and 5th. 4th and 5th. It's still around. Where's it going to be? It's going to be at the Curtis Hotel, right around the corner from— right next to Ping.

Yeah. Come say hi to me and go to the LadyCoders. And go to the LadyCoders conference. Um, and actually Thursday night is a community event. You can buy just a community ticket and attend, and I highly, highly recommend it.

We're going to have Sylvia Kwan speak. She is the Chief Investment Officer of Ellevest. Ellevest is an investment firm specifically made for women. It's out of New York City. Sylvia Kwan is particularly impressive because she started her career in computer science and now does big quant work for investments.

Part of the reason why I want to encourage everyone to come is that I'm really, really big on building community. And I do something called intentional networking. And so I make sure that there's a room full of women software developers, but I make sure that the men that are in attendance, the sponsors, everybody interacts with each other and really gets to know each other and this community. Well, this has been a really cool thing for me to get to know you. I told you before, I use this whole podcast thing as an excuse just to get to meet interesting This is, you know, mission accomplished today that I get to sit down with you for an hour and learn about you.

This has been really fun. Oh, good. Any final stuff before we call it? Yeah, you know, I really believe that diversity and inclusion is actually and should be seen through a positive lens because it really is for everyone. And I know that it feels, it can feel like it's not for everyone.

But actually, it is really about making people feel heard and seen and valued in the workplace. And that goes for everyone, no matter who they are. And the more we do that, the happier people are in their lives and in their work and in their jobs, and the better we are as a tech community on the whole. Awesome. Well, and this has been really good.

Thanks so much for your time. Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.