Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now, here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 126 for the week of July 29th. Alex, we're in the heat of summer and it's hot outside.

It is hot outside, Robb. Luckily, I was out of town a couple weeks ago and it was really the hottest. So good. I think maybe you were also out of town. I missed the first half, but it did get up to like the hundreds or 100, high 90s, touched 100 this weekend.

What we had, you know, talking late or high 80s maybe-ish. Yeah, I feel like 90s on Friday-ish, low 90s. It's super hot. It's been hot. So yeah, that's what happens in the summer though.

So that is what happens in the summer. So yeah, this is not news in the Northern Hemisphere. In the Southern Hemisphere right now is cold. So do they call it the summer in the, you know, the July timeframe in the Southern Hemisphere, or do they call that the winter? They should call it the summer because everything revolves around us.

Right, right. But my guess is they probably call it the winter. Hey, well, you know, since we're talking about things, why don't we talk about something else? Hey, let's talk about something else. You know what, Robb, we have a Slack channel.

We do. And it's well over 1,000 people in there now. Great, great conversation. Not so much talk about weather, more talk about security type things. Maybe we need a weather channel in Colorado Equals Security Slack so we can just talk about the weather all day.

That'd be fantastic. If you want to join, if you think this kind of conversation is riveting, go to the front page of colorado-security.com and we'll— and you can get a link there to join us. We also have a mailing list if you want to stay up to date on everything that we are doing with the podcast, get the show notes in your email. Sign up for the mailing list on colorado-security.com. There is a form at the bottom of the page where you can submit your email address.

Uh, and if you, if you like the podcast, you want to get this delivered into your phone every week, go to your favorite podcast listening app— iTunes, Google Play, whatever it is— and, and subscribe to have this delivered to you. And of course, we would also love it if you would rate us and put all kinds of positive comments about us on the internet so we can find more new listeners. Also, if you would like to tell a friend about how great this is, we would love it for you to do that. Spread the word, let everyone know all of the good things that are happening in Colorado around security. And finally, if you wanna help us support the show, keep things going, there's a couple things you can do to help.

Number one, we have a Patreon campaign set up. We would love it if you'd help contribute some financial support for the show, help pay, defray the cost of hosting and all those good things. Also, we would love it if you'd help us record interviews for the show. So Alex and I, you know, we do an interview every week. That's one of the things that's hard to keep up on top of, and we would love it if the community helped us of get together and do interviews of other folks in the community.

Yeah, one more announcement before we get into the news. Uh, the Colorado Technology Association's Apex Awards, the nominations for those are coming to a close on August 2nd. So this is, I think, the last time you will hear this announcement from us, but go out there and nominate your favorite CISO or CIO or CEO, um, project team, whatever it may be, for one of the Apex Awards. All right. Let's go ahead and jump over into the news this week.

You know, I found out that Colorado, strangely enough, we are one of the highest states in terms of citizens who carry debt on their balance sheets. Yeah, I was actually pretty surprised about this one. I think we were second behind California. There was a couple of— I think we were fourth. There was Hawaii and one other one.

Well, Hawaii, it's an island that doesn't count. So nationally, that individuals carry about $50,000 in debt. But here in Colorado, the per capita debt is actually about $71,000. Yeah, that is surprising to me. And that's pretty large.

So what they're saying is this, you know, a lot of it has to do with the fact that the housing costs are significant in Colorado. And obviously mortgages is a very significant portion of debt for many people. The other one is student loans. So if you look at the other states on the list near us, California was on the list, Hawaii, these are places that have significant, you know, high housing costs. Yeah.

And we also have a highly educated population here. So that would add to the student loan costs. Next, there was an article in the Colorado Sun this week about election security. It was confirmed through congressional testimony that Russian hackers jiggled the lock on the Colorado state election rolls. So this is interesting news.

Obviously, I don't think this is a surprise for anyone. They were looking to see if they could get in. That report suggest that there is no evidence that the bad guys got in. Also, while this is a Colorado story, nationally, it was actually all 50 states had some indications of the Russians trying to get in. So, you know, we're definitely not alone in being a potential victim of this.

Now I don't feel as special that we were targeted by the Russians, Robb. Yeah, obviously the Russians do care about you personally. And, you know, keep an eye on that, Alex. Next, VF Corp, which is the really large clothing manufacturer who's moving their headquarters to Denver. They're about to spend $20 million marketing a breakthrough new fabric called Futurelight.

Yeah. So, um, interesting. It is breathable and waterproof, which is something that you don't usually see. If usually if you have something that is truly waterproof, uh, you're inside sweating. So, you know, you're making your own water.

Right. Um, but you know, they have this new fabric that they've come up with and they're doing this big marketing push for it. Um, as part of the article also, I talked about, how well in general they've been doing for, for earnings. So that's a good sign, uh, since they're moving their headquarters here. We are huge VF Corp fans, or we will be as soon as they get here.

That's right, hurry up, VF Corp. We've got all our banners ready. Make the move. Uh, Zayo also announced, uh, that shareholders approved the, uh, $14.3 billion acquisition by private equity. Yeah, this was something we talked about back in May when it was initially proposed. If you remember There was one bid that was for like $30 a share that they declined.

Then they ended up getting closed with this bid for $36 a share. So the shareholders have now officially voted and approved it. It's expected to go into place the first half of 2020. And they say that they are planning to maintain the team and the headquarters in Boulder after they go private. Yeah, pretty cool.

Next, Gusto, which is a San Francisco-based startup but has a large presence here in Denver, closed on a Series D funding round of $200 million. Million dollars as they're looking to, uh, do more R&D and growth. $200 million. That's a lot of money. It's a lot of million dollars.

A lot of million dollars. It is a lot of money. A lot of money and a lot of million dollars. Um, so, yeah. So Augusto is a payroll service provider, and they're looking to add some additional services to their portfolio as well as just grow.

I pulled a couple of interesting things out of this article. They have 600 employees in Denver right now. That's a lot. That is a lot. They have that big office on 16th Street Mall, like, like literally on the mall.

Um, and it's— they're planning to go to 1,000, uh, over the next few years here. Uh, also, you know, that you talk about payroll services, I was surprised one of the benefits that they offer for employees if you use Gusto for your payroll is employees can actually like take, you know, take their, their earnings before their payday. Flex payment. Yeah, flex payment. So, so, you know, you get paid every other Friday, uh, and you need a little money halfway through that pay period, you know, know, based on hours you've worked or the expectation that you're, you know, salary employee, you can take that money out in advance and, you know, give yourself a little bit of a loan.

So pretty cool idea. It looks like they don't charge interest on it. That's what it looked like too. Yeah. But, you know, it is nice instead of having to go to your boss and, you know, asking for, you know, you know, exception and things like that, then yeah, just part of the process.

That's pretty cool. Awesome. Next is— next story is actually from the Denver Business Journal. And I don't know if you noticed, it's actually an advertisement. It is an advertisement.

It's a promotional article, I guess. But it's by a cybersecurity insurance company. Really talk— and the headline is, is your small business covered in case of cyber attack? I actually thought it was pretty interesting thinking about what is it you need to do in terms of cybersecurity insurance, especially for small companies that might not have a bunch of dedicated resources for it. So they had a list of questions to consider as you're thinking about your insurance policy.

You know, do you know what exclusions exist in your policy? So If you have a third party that gets breached and they have your data, is that, is that gonna be covered? They, you know, talked about specific breaches and some policies that don't cover that. Um, how much is your reputation worth? Something you might wanna think about when you think about the, the, the cost, the, the limits for your policy.

Anyway, some interesting questions. If this is something you're thinking about, might be worth taking a look at this, uh, article. Yeah. One that I thought was interesting was, um, you know, how will your, your policy respond, um, if you try and make a claim when you've had, um, attackers in your network, you know, prior to signing up for the policy? Is there some preexisting conditions, preexisting condition coverage or other things like that?

So good stuff. Pretty cool. Uh, next, this is probably the biggest announcement of the week. Uh, LogRhythm announced this week that they appointed Mark Logan as their new CEO. So congratulations to Mark Logan.

This is a, you know, pretty big change for one of the biggest security companies here in town. Uh, we, we've had Andy Grolnick on the call, on the show before, and, uh, Mark's going to be taking over for Andy as the, at the head of the helm there for LogRhythm. Yeah, and, uh, we are working to actually get a chat with Mark, so hopefully we'll get him on the show and find out what his vision for LogRhythm is. We'll see if we can twist his arm to get it before next week, or hopefully in the next 2 weeks. But previously, previous to coming to LogRhythm, he was the president for, uh, Attunity, which is a public company.

Uh, he, and he also worked for Wealth Engine, um, Rivermine. I, I don't know those companies, but I do know he worked for PeopleSoft and JD Edwards as well. Nice. Yeah, it sounds like they're, uh, you know, bringing in a new CEO, trying to get into that real growth mode. He's been in those positions before with a number of startups, so hopefully it's a good move for them.

Uh, speaking of big Colorado security companies, Ping Identity was in the news this week. Ping was named as one of Denver's best places to work, uh, our top workplace by the Denver Post for the 5th time. Congrats, Robb. And I can, I can actually vouch for this. It is a pretty great place to work.

Yeah, I was surprised, I guess, maybe not too surprised to see in that article that Ping has 900 employees. I didn't realize that Ping was quite that big. We just passed 900 employees recently. We should hit 1,000 this year. That is pretty cool.

Yeah. Next, there was a blog post from Red Canary talking about building security from the ground up as a team of one. So this was an interesting article talking about, you know, things that you can do where your priorities need to be if you are a single contributor that is trying to get a security program going. Yeah, they talked— they go through some specific controls, and I love the fact that, you know, the very first control they talk through is know your inventory, know your environment. Yep.

Which I'm sure would stop all of us if we had to get that actually right before we moved on, right? But it's a really good article, and if you or someone you love is looking to be a one-person security team, this might be a good resource to look at. All right, uh, next we have an article here by Managed Methods around cloud application security architecture fundamentals. And this is talking about, you know, how do you have an application that's meant to kind of be the security foundation for you? And what does it look like?

I like they kind of draw the line between being cloud native and, you know, being a, uh, kind of a— what's the word— non-native, uh, cloud immigrant. That's, that's probably the right word, right? Interloper. Interloper. Uh, but anyway, as a cloud native application, you know, resiliency built in, uh, using the native APIs, you know, really all of the things that make kind of seamless security with the cloud.

Um, so anyway, this is an article by Managed Methods. Obviously they, they have a cloud security product that is native to the internet. Interesting stuff. Yeah. And a lot of the talking here was about SaaS, um, which, you know, for one thing I think is sort of interesting because a lot of times when we think about cloud security, we think about infrastructure as a service, platform as a service.

Uh, not as much on the SaaS side. Yeah, they definitely are more a SaaS play, I think, than infrastructure for sure. Uh, next, uh, there was a blog, a blog by Webroot this week talking about the dark web. So the dark web, is it illegal, Alex? Uh, the dark web is not fundamentally illegal, Robb.

This is one of the facts that you could, you could learn from reading this article. It is. Um, we have some definitions. So there is the open web, which is what we think of as the the regular internet. There is the deep web, which is, you know, essentially things that are behind, you know, some sort of authentication or some way that, you know, search engines can't get to them.

And then there's the dark web, which is populated solely by people in hoodies in their basement, right? Yes, exactly. Yeah. But things that, you know, you need an additional step to get there, like using Tor or something like that. So they talk about things that are on the dark web.

Um, that you shouldn't have your information end up on the dark web, other things like that. And they can help you out with that, right? I'm sure they can. All right. Uh, so that is it for the news this week.

Moving over to the Slack message of the week. Big thanks to Andre Gaeta. Andre has been a sponsor for us for the last couple of years. We really appreciate that. And because of his sponsorship each week, we're able to recognize one person who posted to the Slack community and made the Slack channel better.

Um, and that person gets to pick one item from the Colorado Equal Security store to wear some swag around town. Yeah, pretty cool. So this week our winner is Brad Judy. Congratulations, Brad. Brad posted some news about an ERP vulnerability that was being exploited that caused about 60 schools to have security incidents because of this vulnerability.

Yeah, I appreciated that post because, you know, I don't, I don't have my finger in the higher education security community so much. And this was interesting to me. Like, that's a pretty big impact and something that maybe kind of was flying under the radar for me. So thanks a lot to Brad. Well, Robb, when you only have a 3rd grade education, I can see where you wouldn't be that interested in higher education.

Well, you know, I am the furthest in my family though. So, you know, you just got to keep moving things forward, right? A little better every day. All right. Moving over to events.

You know, as a reminder, we have an event calendar on the website at colorado-security.com. We have months worth of events all the way out into 2020 right now where you can go out and see what's happening in the security community. Uh, you want to plan your you know, how you get involved with the community, that's the place to go. You wanna plan an event, check there first, make sure you're not scheduling on top of somebody. And if you're planning an event, let us know and we will post an event on that calendar for you.

We love doing that. Um, all right. Well, so speaking of events over the next couple of weeks, there's not a, not a lot going on. Um, you know, generally we have several per week. Uh, I think just the heat of the summer, people are taking vacations, a little bit less busy.

But on the 31st, there is a conference in town, the Denver Cybersecurity Conference, which is a full day event. Also, uh, the AWS DoD Immersion Day down in Colorado Springs is happening on the 31st. On the 1st, the National Cybersecurity Center is doing a meet and greet down in Colorado Springs. And on the 6th, SecureSet is doing a capture the flag cybersecurity hackathon. That's it for the next 2 weeks.

Moving over to jobs, uh, at Ping I am hiring a GRC analyst. This is an entry-level, you know, someone maybe right out of school or someone looking to do a career change who doesn't have a lot of relevant experience. This is someone who can help us with our ISO and SOC audits, help us with risk assessments, policies, kind of the internal, uh, softer risk assessment type work within the security program at Ping Identity. Charles Schwab is looking for a senior manager of risk and maturity assessment. Digital Globe is hiring a manager of security.

Zach Lee is looking for a senior security analyst. First Bank is hiring a senior information security analyst. CableLabs is looking for a senior security engineer. Empower Retirement, which is also Great West Financial, is hiring a security analyst. AeroGrow International is looking for an IT security specialist.

OpenTable, which is a social network platform for making reservations for table— for restaurants, is hiring a global IT help desk manager here in Denver. I didn't realize OpenTable was here or had an office here. I didn't know that either. Uh, and FireEye is looking for a staff data scientist. Yeah, so if you want to do data science around staffs, then, uh, feel free to apply for that job.

And if you're really good at that, they might let you do some data science for their products too. Oh hey, that'd be cool too. All right, well, that is it for the news this week. Um, so this week I sat down with Liz Ryan. Alex, Liz is a, a founder and CEO of an HR consulting company.

She's actually kind of a pretty big LinkedIn Uh, influencer. So that's where I'd seen her writing articles like, here's the tips for how to go into your interview effectively, or as a manager, here's how to build a good, you know, cohesive team working together. So as, you know, as someone who's native to Boulder, um, and someone who's a pretty big influencer, I thought it'd be great to bring her in to talk to our listeners around how they can, you know, be better as they go do their own job searches or how they can be better bosses as they run their own teams inside their company. That sounds awesome. That type of information is stuff that we get requests for a lot.

And not only that, this is the first interview where we're going to have someone doing live opera singing as part of the interview. Yeah. I— wow. I look forward to that, Robb. And it's not me.

It's not you. Yeah, that's it. Well, that is it for the news this week. Alex, we'll look forward to talking to you next week. Sounds good.

Thanks, Robb. Hello, this is Ian Buxton, Senior Director of Information Risk and Security. At Vail Resorts. This is Colorado Equals Security, for Colorado security professionals, by Colorado security professionals. Okay, thanks.

All right, this is Robb Reck with Colorado Equals Security, and I have a special treat today. I'm sitting with Liz Ryan. Liz, you know, I really know of you as like a LinkedIn star. I don't know if that's an official title or I'm making that up, but it— but now I found out that you have an even more interesting interesting background that I want to talk about before we dive into your, your, you know, talent management and your, your career advice that you give. I understand that you also are an opera singer.

Yeah, yeah, that's my background way before HR. Yeah, well, how did you get into opera singing? Well, just being a musical theater person in high school. I was a classical musician, you know, and music nerd, you know, stuff like that in, uh, in elementary school and all the way up. And, uh, you know, if you're musical theater kid, you might verge into, you know, sort of roll over into opera.

So I started taking voice lessons, you know, in 9th grade, and I just went to conservatory after high school. So as a part of becoming an opera singer, do you have to learn Italian? Yeah, yeah. Well, you have to learn Italian diction. That's a class for every freshman opera singer.

And then German diction and French diction— those are the main languages. You got to know those 3. And, you know, you have to learn enough Italian to be able to know what you're singing, obviously. Obviously. Yeah, but I'm certainly not an Italian speaker, but I can pronounce the heck out of it.

Yeah, yeah. So you said you went to conservatory. Yeah, that's like opera school. Yeah, yeah. Or it could be, but it's just not opera school.

It's also school for pianists and violinists and all the, all the musical kids, you know, that's where they go and, uh, learn, you know, music theory and notation and, you know, in the case of singers, you know, sight singing and all this kind of stuff, and diction like I said, and of course performance classes and all that blah blah blah. That's so fun. Did— so after you, after you finished schooling, did you go become a professional opera singer? Well, I actually left music school early. I left high school early, a year early, to go to music school, and then I left music school after 2 years because I was singing with a punk rock band too, and we went to Chicago to perform.

So I— there's also that. But I kept singing opera all over professionally. So you were singing professionally for punk rock band. Yeah. And then, and opera while doing opera.

Oh, of course. Where did you sing opera? All over, but especially Chicago. Is there like a, is like a, a group you're a part of? Like, how's that?

Tons, tons. So in New York there's like the, the Metropolitan Opera and then tons of other opera companies, right? And in Chicago there's the Lyric Opera where, you know, the great stars sing, and then tons of other opera companies. And all over the Midwest and all over Colorado and everywhere. Yeah.

So I did all that kind of stuff and musical theater and singing punk rock, and so till I stopped doing that, you know. And, and loved all of that, and I still sing opera all over the place, but I bowed to sort of— I wouldn't say reality, but just sort of let that— I didn't hate also using my brain. And, and I just couldn't see, am I just gonna wait tables for the rest of my life doing opera, you know what I mean? And I took a little office job, and I mean little because it paid like $5 an hour at the time. And, um, I wasn't horrible at it, I didn't hate it, and I just stuck with it.

And so in parallel, I kept singing, but I also became like an office person. And I got into HR and I liked it. And I, and I, and I thought, wow, this is— I didn't want to go in HR. My boss put me in HR against my will. And I was like, wow, there is a lot to be done here.

There's a lot that's broken in HR. Now that's a big topic that I write about all the time— what's broken at work and what's broken in HR. And, and so I said, well, let me, let me just— this will be a canvas then, right? This is a different way to make art. And so that's the story.

Awesome. So I feel like I would be remiss if I didn't at least ask if you'd be willing to sing a little bit about— I'll sing. I'll sing. I mean, if you want. Do you have a favorite aria?

I wish I could tell you. Or an opera that you like or have heard of or anything like that? No, I don't. Don't say Phantom of the Opera. That's what people say all the time.

Phantom of the Opera. Now I'm trying to remember the one from Seinfeld with the sad clown. Oh, Pagliacci. Yeah, let's see. Yeah, what's her aria?

Oh my gosh, no. That's for a super high soprano, which I'm more like what they call dramatic soprano. I'll just sing a couple notes. Right, okay, okay.

You know, that's awesome. Whatever, someone has to do it. That's, that's so much. And I'm really hopeful that the mics were able to pick that up. Seriously, keep it in the podcast.

Yeah, yeah, so much fun. And, and, you know, no one around here all of a sudden stared at us either. So again, you have good walls here. This is good. Good glass, double pane.

So, you know, now that we've got to get a little bit of the fun background, let's dive For sure, the fun business work stuff. So would you describe like what you do professionally right now? Okay, I lead a company and a movement both called Human Workplace, and the idea is our mission is to reinvent work for people, which obviously presumes that it is not— work is not necessarily optimized for people right now, right? Which is my observation over these last 30 years in the business world. I love work.

I love my work. I love work, the topic of work in general. I think work is, you know, a creative place. It's a human place. All of the stuff that employers say they want, collaboration and innovation, is, you know, exactly what I want people to be doing because it's fun, right?

And it's where everything from economic good stuff, productivity, you know, remaining with your company. What am I trying to say? They call it engagement. All of the good stuff comes from the same place, and the same— and that place is having a work environment be a human place. And it's a project and almost a grind for a lot of organizations because they didn't grow up that way.

That's not their baseline orientation. So really what we do at Human Workplace is 2 things that, that, that, that come together. We teach people how to run their career like a business, how to take control of their career. You mentioned you've seen my job search advice and career advice all over LinkedIn. That's the piece of our mission that is empowering individual people to follow their own path and have standards and speak with their own voice, all of that.

Terribly important, especially now that long-term cradle-to-grave employment is going away or a thing of the past. The other piece of the mission, of course, is working with employers that get this notion: the more human the workplace is, the better it's going to be for everybody— customers, shareholders, etc. Let's do that. So that's really what I do. I write and speak on this topic and sing.

So your customers, are your customers, you know, people looking, you know, individuals looking to further their career? Companies who are looking for you to help them revise their talent and retention programs, both of them. Yeah, that's exactly right. We have downloadable ebooks and podcasts and videos and courses and all kinds of stuff for individuals. I wrote a book called Reinvention Roadmap: Break the Rules to Get the Job You Want and Career You Deserve, and that is for individuals, although lots of corporate people have it on their bookshelf because It's the individual piece of this mission, is to learn how to figure out what you want to do and how do I brand myself for that and how do I get the attention of these employers.

You know, it starts with the premise that the traditional system for getting a job is way broken and dysfunctional and soul-crushing, by the way, which makes it harder for people on the job search trail. So that's all the stuff we do for consumers or individuals. And then for employers, it's tons of keynote speaking and executive coaching and designing systems that are going to work better for the people side of business than what they have now. Yeah, that's awesome. So, you know, I'm sure there's many people listening who wonder what in the world does this have to do with cybersecurity, and I'm sure you were wondering the same thing.

You know, I don't wonder, Robb. It's your podcast. You do what you feel. So, so the, you know, the reason we are so excited to have you here is Number one, you're a Colorado lady. You're up in Boulder, I believe.

Oh yes. And number two, you know, we have a lot of folks who listen who are in security in general who are really good at solving technical problems, right? And what we find is, you know, having a solution written somewhere isn't the same as being able to influence change, right? And, you know, manage your own career, own your own career, build teams, right? We're all— I'll tell you, I'm watching you seen about security, but we're way understaffed in general.

There's a big shortage of talent and of individuals to do the jobs. So, you know, these are all the biggest problems that we're working on. Yeah, I think, you know, you'd have some really valuable advice for us. Hope so. I just had coffee with not specifically a security guy, but an IT consultant, high-level, you know, very, very experienced IT consultant a couple weeks ago, and he said He goes, you know, is there another function where people will say, you know what, we have this problem and that problem and the other problem in our company, maybe you could make some recommendations?

And I will say to them, this is a consultant, my consultant friend speaking, yeah, actually those are security issues and I know a great IT security guy that you should really talk to. He's going to help you figure all this stuff out. No, we were just hoping you could do it. You know, just kind of figure it out, you're an IT guy. He says, you know, 40, 50 years ago, people sort of realized that you better have this backbone of your business really steady under your feet, or why bother doing anything else, launching a product or doing some great marketing scheme.

But still, we're still kind of fighting that battle in some ways, that there are disciplines and sub-disciplines that matter a real, real lot. And that, yes, no, it's not a CEO's responsibility to know all the the latest ins and outs and what's happening. But certainly to have a baseline understanding of something like IT security, you know, it kind of comes with the job description. But a lot of people still feel like they have to fight that battle or they have to do that education. And for security folks, I mean, I get a ton of email.

I get about 150 emails a day or so from readers, because we've got a lot of readers, like 10 million readers. And often this issue comes up. It's very hard to translate what I've done so that people can see how it applies to their situation. Well, so I'd love to kind of set— that's a great intro. I'd love to set the table for the biggest problem I see and get you to talk to me about it a little bit.

We have this continual, you know, delta between how many people we need and how many we have. Yeah. And, you know, let's There's estimates, you know, a million jobs across the US in security that are unfilled, whatever the number is. But then I personally, on a regular basis, hear from people who are looking to make the move from IT, where they have some pretty relevant experience, into security, and tell me they're banging their head against the walls. They can't get the jobs, right?

They can't get the interview because they don't have experience, and their perception is they're competing against lots of people for these roles. The employer's perception is, you know, we can't find a single good person for these roles. I'd love to hear, you know, you just talk a little bit about what you think's going on there. Well, you know, I've had a few different really helpful mentors in my career, but the most significant one of those is a guy who's passed on now, a professor who I met when I was running HR for a company. You might be too young to remember them, but it was a data communications company in Chicago called US Robotics.

Sure, I had a US Robotics modem. Okay, you had a Sportster modem. I had a Sportster modem. Okay, so I was running HR when you bought the modem. Yeah.

And it was a tiny little company that grew to be a really, really big company. And one of the things that would happen that you would— that we would run into is that there would be issues from time to time with employees, you know, how should I say, behaving erratically, because that happens. Things happen. People have substance abuse issues or they have psychological things going on. So we had kind of on the speed dial a psychologist who also happened to be a professor and an author, amazing guy, Dr. Dave Thompson.

And I spent a lot of time with him. And the big thing that he always hammered home with me is look for the fear. Look for the fear fear in an environment. And I was like, what are you talking about? You know, he said, look at fear coming down from the executive suite.

Look at people who are driven by fear, because that really tells you everything you need to know about a culture and also about individuals. When people behave erratically, you know, the first thing to do is kind of look, what are they afraid of? So that doesn't necessarily mean someone is off their meds or there's, you know, major emotional problems. Just when you see somebody do something kind of unexpected, there could be this extra element that is sort of invisible until you go looking for it. They're under huge pressure from their boss, right?

They're afraid of getting in trouble, or they're going to miss a bonus, or they're afraid of losing stature relative to— and fear is a massive issue at work that we seldom, if ever, talk about. It's really what lies behind most of corporate politics, right? Why do people lash out and stab one another in the back? Fear, okay? So, what happens in hiring is when you have a discipline or a field like IT security that is moving fast, and the technology is moving fast, and the buzzwords, and the certifications, and all of this stuff, your average CIO or CTO or whatever doesn't necessarily know what the stuff means.

And you know that, right? They do not understand it, yet they have to hire somebody. So, what are they going for? They're going for the credentials that are going to reduce their risk and fear. They're going for the safest hire.

They cannot always intelligently interview candidates for these jobs. They cannot always get through an interview feeling like they're on the top because they don't know as much as the person they're interviewing, if they've been to school or even have been steeped in this stuff on the job. So they tend to hire for credentials. They tend to hire for certifications. And if you've done 20 years in IT, but you're morphing into an IT security person, and you've picked up some expertise here, you've worked on a project with this one, you've got your guidance here, that just might not pass muster for someone whose principal lens for looking at your background is fear or insecurity.

That's a super interesting dynamic. It's something I'd never considered before. Huge. It's really the insecurity of the interviewer. 100%.

It's the reason why it's hard to change careers. It's the reason why it's hard to get a job when you have a non-traditional background. It's the reason they fear anybody who's walked outside and been a consultant and they don't want to come back. This person's been a consultant. That's super scary to me because I've never been a consultant.

I've never dared to think that maybe I could be an independent consultant. So somebody coming from that world might intimidate me psychologically. It's the reason ex-military people have a problem getting a job. You look at their resume and it's got all this military jargon, and I mean, hiring managers have told me in confidence, I didn't serve, I don't— in other words, the guy's more badass than I am. It's that gut level, it's that playground level, and I think we have to look at work a little bit more realistically from a human standpoint, this is the stuff people react to.

How's it going to look for me? What risk am I going to subject myself to if I hire this person over another person? It's a real dynamic. It's very, very significant. So let's take it from both sides.

You know, you just talked about a dynamic that is a challenge, right? But it's, you know, the challenge is an opportunity as well. Exactly. So from the candidate's perspective, from that You know, put yourself in the shoes of someone who's been an IT person for 10 years, ready to make a move. They understand this dynamic exists.

How do they start to manage that? Genius question, Robb.

Okay, so what do you do when you're trying to sell somebody? And what do you do when you're trying to sell somebody and you have a sense that they could be, because they're human beings, a little bit fearful you might show up as scary or not what they were expecting? There's an analogy that whenever you want to sell somebody something, including when you're selling yourself on a job search, you have to think of the buyer as an amoeba swimming in a petri dish, a single-celled organism. They don't have a lot of sophisticated reactions to things, but they recognize predator or prey. And you don't want to look like a predator.

You don't want to be scary. You don't want to overwhelm them with your technical expertise, and they're like, I don't even know know what that means, right? You want to be soft. You want to go in soft. The approach is actually called here kitty kitty.

Okay. Okay. So this is detailed in the book Reinvention Roadmap I mentioned before. Okay. So you, you do not spray and pray resumes out to the, you know, wherever.

That's pointless. You identify CIOs or information security folks, leaders that you, you might want to work for, and research the heck out of them, their company, and them. LinkedIn. It's so easy now. It's so easy.

So you have an understanding. You try to develop a pain hypothesis. What is the specific pain these guys might be up against given their business circumstances, the competitive set, what's happening in the industry, right? And you can do this with anything. It doesn't have to be IT security.

Security or IT, could be anything. You could be looking for an administrative assistant job or a vice president of marketing. The pain approach is really how all people sell anything above sort of the commodity level of toothpaste or Ritz crackers or whatever. So you've— let's say you make a target employer list and you've got an Excel spreadsheet. Here's all these companies I'm going to focus on in Missouri or San Francisco or wherever I'm located.

Denver. Or Denver. We're Denver. It's so easy. It's so easy.

We're right here. Who's the CIO? Who's the CEO? Look at the org chart. Look at the About Us, the management section.

It gives you a sense for their priorities. When you see who the leaders of the company are, you know what they care about, right? If they have 15 VPs of marketing and one guy doing all of IT, plus, by the way, technology, you're like, wait. Look for what they care about and look for where they might be vulnerable. Can I say one more thing?

Please do. Press releases. Go to the press release page. Any news that they think is worth putting out a press release, probably they— whether they're good at it or not, they want people to think they're good at it. So there's some fear or some pain there.

Exactly. The worst way to find a job is by responding to posted job ads. And I say that as a former Fortune 500 SVP of HR. Because that's when all of the degrees of freedom are like shut. They've already decided.

It's like now it comes from Moses on the tablets, you know, we must have 14 years of this. And you know how ridiculous some of these job ads are. We want 10 years of experience with a piece of software that was invented 6 years ago, right? They don't think it through. They're bolstering the job ad so that this person, when they come in, is gonna be a mix of Iron Man and Batman and Superman.

And it's like, it's a defense against the fact that they really don't necessarily know what they need. You know what I mean? So the way to get around that is you do not respond to the job ad at all. You don't even have to read the job ads. You look at employers and you look at what you can learn from, like you said, their website, about us, management bios, the press releases.

You look at LinkedIn. LinkedIn will show you all the executives who work for a given company. Who's my person? Who's my decision-maker, my hiring manager? What are they up against?

You know, looking— get inside their head. And how do I approach them in a way that is not going to scare the amoeba in the petri dish, right? So it's typically going to be— I invented and teach something called a pain letter because you're talking about pain. Yeah, it's not a cover letter. Dear Jack, I was lucky enough to catch the last 15 minutes of your CEO's talk at the Security Expo last week, and I couldn't agree more with his observation that whatever he would say.

Paragraph break. I can only imagine that given blah blah blah business condition, blah blah blah the new joint venture you're doing, blah blah blah, your IT security team must be up against the wall. It's very soft. I can only imagine. I'm not coming in to tell you how to run your business, bro.

You know way more than I do about this stuff. I was just thinking. Next paragraph. When I was doing IT security for Wiggly Devices before their acquisition last year, we had a similar situation and we were able to do blah, blah, blah. Humble.

If any of this stuff warrants a phone call, you know, let's talk or shoot me an email. Soft. You're coming in from the outside, from the ether. Now this guy— I've made him male, he could be female— he does not get acknowledgement from his boss. He does not get acknowledgement from his team.

Nobody gets enough acknowledgement, right? You come in over the transom with a physical letter that hits his desk and says, yeah, I don't know, but I was just thinking you might be running into this stuff. You said physical letter? Physical letter in the mail, Robb, with the stamp. The whole old-fashioned thing.

Typed? Type the letter. Not handwritten? Handwrite the envelope. No, no, you can't.

That'd be fun, but we don't know how to do that anymore. We lost that. It's an ancient art, handwriting. You know why you handwrite the outside, the block printing? So it gets to them?

Gets to them. If you— if you— if it goes through your laser printer, the mailroom throws it in the garbage. It's a business letter. It's not personal and confidential. It's business.

But it just says, I wasn't sure. I was I just noticed your company, you're doing some great things. You start with that hook I mentioned, I caught the last 10 minutes of the talk, but it could just as well be, hey, congratulations on the green building award you just got from the city of Denver. It doesn't have to be an accolade related to what you want, to this job or this relationship, it's just saying I'm here and I notice you because a lot of people don't notice stuff in the world now. And I didn't type out 20 of the exact same, print out 20 of the same letters.

Exactly, and by the way, you also don't say anything about yourself. Resume's attached and stapled, it's all there, all they have to do is flip it over. Yeah, but you don't say, I had a long background in— that just drops emotionally immediately. They're going to shove it into HR's inbox. You want to stay with the hiring manager and their pain.

And these letters get a return rate, a reply rate of about 25%, which is low but so much higher than the black hole, right, of just responding to posted job ads. The problem is when you respond to a— many, many problems, but one of them is when you respond to a posted job ad, it's clerical now. They're just screening for the exact same things that were in the job ad, which are not sacred. There's nothing— they don't know. Story: recruiter friend of mine, headhunter, was in the office of a VP of HR she works with all the time, and they're talking about candidates, they're talking about whatever, and a guy walks in And it's the CIO, and he walks in and he goes, oh, I'm glad you're here, Marjorie.

I got a new spec for you. Great, let's see it. Here it is. We want this certification, this certification. What's this one?

I've never even heard of this QXL. Oh, I don't really know a lot about it. I read about it in an IT magazine. He read about it in a magazine. Now it's on the requisition.

So in other words, I want one. I don't even know what it is. But I want one. I saw it in the catalog. I saw it in the catalog.

So he has no idea how he's just constrained. Why would you— you don't even know what it is. That's irresponsible. But I have to tell you, Robb, 95% of job ads that are published are also irresponsible. We don't know enough to say 7 years of IT security.

Well, it was IT security stuff, but I was under a different department. How could you possibly have a 22-year-old screening me out. Nothing against youngsters, I have several of my own. I'm just saying you have to find a way through the broke— the wreckage of the recruiting system to get to the decision maker and say something impactful to them just to start a conversation. And so that's what we teach.

Yeah, what I love about it is, you know, the comp— the level of conversation you get if you get to that executive in charge of the hiring is going to be, is going to be more strategic. And instead of saying, do you fit into this rec that I've already posted, it's how do I see value in what you would bring to my team and what's the right strategy to try and bring that in? Yeah, and absolutely. And even at a lower level, you're not putting pressure on them. It's pressure for hiring managers who already have a ton of pressure to get, you know, all these resumes.

Hire me, hire me, I'm this, I'm that. I can't even take in what you're saying. You have to come around the table and be with me in my pain and my lens on the world, and then we could talk. So you're not asking for a job, you're not mentioning a job. If they happen to have a job ad posted, you're not mentioning that.

You're saying, maybe we should talk. The most common response is they get an email that says, let's talk on the phone. So you talk on the phone and it's so chill because all of that ick, all of that stuff— I'm going to an interview and it's like to get screened by HR— it's all gone. There's no tests, there's no obnoxious autoresponders. You just go in, you probably meet at a coffee shop, maybe say, so, so tell me, you know, a little bit about yourself.

Oh, I absolutely will. I'm happy to tell you my whole story and where I've come from. I'm just curious to know, you know, what you guys are doing. Pain. Pain is the key.

This is what Dr. Thompson taught me. Stick with the pain. Anyone will talk to you about their pain. They love to do it. Yeah, the only The only misstep that is possible, because I mentioned here kitty kitty, is that you go too hard too fast and say, so I see you guys had a major data breach last week.

No, no, no, no, no. So that's like the emails I get that say your website sucks, but I could fix it. You can't do that. You have to say, I wasn't sure whether you were dealing with this. I know it's an issue for a lot of people.

That's what consultants do every single day. They say, I wasn't sure. Maybe that's fine, I hope it is. A lot of people have this issue. Well, now that you mention it, you know, it's that kind of an approach.

And people— when I was at US Robotics, the engineering managers would bring me in letters like this, and I give credit to those people back then in the '90s because there was no LinkedIn, right? Easy, much harder. And they found those— found the guy's name, and they found— and he said, I want to enter this person— interview this person. I'd be like, of course I want you to interview this person. They have pluck, they have initiative, and I want the job filled, and I want the job filled by someone awesome.

Interview this person first. Right, that's great. So when you look at like a candidate looking for jobs, you know, I can imagine their first thought when they hear this is, wow, this sounds like a lot of work. Yeah, versus, versus, you know, going to Indeed and picking 30 jobs. Absolutely, it's a lot more work.

And so it's just like anything. What's important? You know, building a model car, or, you know, learning to ski. What's important? What's broken about recruiting is the, you know, 2-click and apply for a job.

We can't complain. I complain incessantly about the inhumanity and the cruelty in the recruiting system as most people encounter it. But we really can't complain when we're like, I don't want to do the work. But if you are worth If you are worth an hour or 2 to research an employer and get behind the veil and get behind the job ad, then you'll do it. And if you're not worth that and you want to just click, click, click, click, click on LinkedIn and then be bummed out when they send you a test and you don't pass the screen, or you actually go to an interview and the clueless HR person is like, I don't know if you're a good fit.

I mean, that's All nonsense, but we really can't blame the system when we are also part of the system. Both sides. Yeah, I have a pet name for this system, this broken system of rules and, and, and structure and hierarchy and fear and all this garbage bureaucracy. I call it Godzilla. Okay, you know Godzilla?

Sure, like, um, the, the, the monster of the sea. Of course. Yes, yes, yes. Uh, there was a song, Robb, you're not old enough perhaps. Blue Oyster Cult.

Yes. Oh, Blue Oyster Cult. Yeah, Eric Bloom is one of them. Okay, I know them. Yes.

Okay, so they said, history shows again and again how nature points out the folly of man. Godzilla. Yeah, this is our name for this thing because if we lean on this scaly monster of bureaucracy and fear and hierarchy, then we can't complain that it's there. And so when we say, well, it takes time to research, you know, it takes time to do everything worthwhile, and everyone who doesn't want to do it don't do it because I want the people to get the jobs who do it. And that it's really a sorting device.

Okay, and I don't mean to sound unsympathetic. I put out reams of, you know, free job search and career advice every day on LinkedIn and Twitter and our website and everywhere. But I'm just saying, this is the reality. We are all entrepreneurs now. We are not flunkies.

We are not lackeys. We are not working people. We are not salarymen and salary ladies, if you wanna take control of your career, this is a really, really powerful way to do it. And what happens is you send out a couple of these pain letters and you have these pithier conversations you were mentioning, you see yourself differently. You really see yourself as a person on a level.

Anybody who's going out and looking for an IT security job today is already more of an expert in that topic than 99% of the people on the planet. So we claim that rather than saying, please, Your Majesty, I hope you find me worthy. Who— you know, there's nothing compelling in that. I don't know for sure, but I could imagine that you might be dealing with XYZ. If any of this stuff warrants a call, then let's talk.

Yeah. So regarding Godzilla, yes, would you say he's got to go? You know, I would say Godzilla has got to go, Robert. I think for those who don't know, that is the line in the song. There goes Tokyo.

He's gotta go. I just saw the new movie. I did. My son dragged me to see the new movie. Just came out.

Yeah, I haven't seen it. I've seen Godzilla: King of the Monsters.

Well, the pause makes me think. Depends what you like. I, for me, in terms of like visual assault, visual and oral assault, it was a step below Transformers, which is like the worst. I went to all of them. This is You know, it's not heavy on plot or character development, but you know what, for just to go and have fun and see monsters fight each other, why not, right?

Right. All right, so let's take the other side of the table. So we have a lot of folks who listen who are on the hiring side of this. Yes. And we're not the ones in charge of HR and recruiting.

Yeah, we are— we're broken. We're within Godzilla as well. How do we overcome? Okay, genius question. Um, I'm good at these.

You're so dang good at these questions. The first thing is, in the recruiting realm, IT security managers, use your voice. You know your field. HR people don't know, and I am one of them, so I speak with love, that you have to assert yourself. You do not accept a job spec off of some HR person's hard drive because they say this is what it has to be.

You know these specs. You know what's important. If you want IT security experience but you don't care If it comes from someone with an IT security title, then say so, right? The average job that has 16 essential requirements, that's obviously ridiculous. Get it down to like 6.

You don't necessarily know how many years they need to have spent. You need to know what their accomplishments are. What did you came and saw and conquered, right? Be firm and insist on seeing every resume. Do not let anybody screen resumes for for you.

You interview who you want to interview. That one's a hard one, Robb. It's like, no, but the thing is, get all the resumes. I'm telling you something, HR is part of Godzilla, and I am an HR person, but when you don't see the resumes, you're giving up something incredibly powerful. There could be a person in that stack of rejected resumes that could absolutely change your organization.

If they're uncomfortable, sit down at the same table and go through and discuss. But this wall that you placed in that you're the hiring manager, you're the one with the budget, you're the one with the pain, I can't see the physical piece of paper, that's just too weird if you think about it. It's just too weird. Sit down together. I would have a meeting every week with every department and go through all the resumes.

So IT and then, you know, R&D and manufacturing and sales, whatever, and we go through all the resumes. That's how you come to common ground. Ground. That's how you come to, you know, to understand the thinking and also improve the job recs over time and the job ads. To have this, this wall up where you only get these resumes, it's terrifying, man.

I mean, it'd be better to go out and play darts at all the bars in Denver and hire people that way, you know, which is not a bad way. So I hear what I think I heard, key points here. Number one is really own your job description and Don't let somebody else say, here, you know, here's what we came up with on the web, and then really prune down that list of essential qualifications. You said to 6. I'll say in my head I get to more like 3.

Maybe. And it could be awesome. And it's— and yeah, maybe it might say more than that under essential, but like, which of them are really essential? Exactly, exactly. And then in the interview process, you know, I don't I don't understand why, if you're looking for somebody who can do X, Y, and Z and, and can resonate at your frequency and your team, I don't want you to have HR screen the people out of the resumes you guys already selected.

Oh, we screen them out because they're not a good fit. But man, you better back that up, especially IT people. We know about all the different kinds of brain chemistry out there, right? We know about all the benefits and the, and the, and the treasure in that diversity, right? So this sort of traditional business idea that like, oh, the person didn't laugh at my jokes or whatever— I don't mean to trivialize, but this is a real thing.

And I've hired so many people on the spectrum 20 years before we talked about the spectrum, right? And you said, oh, he's a comic book dude, or autism spectrum disorder. Autism spectrum disorder. Is it a disorder? This is a question, Robb.

Who knows? I'm just saying that's the name of it. I know, I know. DSM is garbage. Let's not even— DSM is made to file claims with insurance companies.

Being gay was in the DSM up until recently. DSM is nonsense. Well, it's, it's what the official people use as their— it's Godzilla. Okay, but anyway, yeah, so is your, is your HR screener, are they gonna have the breadth to say, oh my gosh, I mean, if I see on somebody's resume they're a chess grandmaster, they're getting it, right? They're getting an interview.

Right? I don't care. I don't care about anything else about them. If someone is that excellent at anything. Exactly.

Or anything else that they care about. We have to broaden our repertoire of what we consider an appropriate person to work in a business office. And, you know, there's been talk about this, for example, at Google for years. When you hire the smartest people— I just talked about being a chess grandmaster, but there's lots of other ways to be smart than the sort of linear way with the grade, the straight A's and all this stuff that we don't recognize, and amazing people are sort of left on the cutting room floor, and that's a shame, it's a tragedy, and it's also not good for our economy when we have millions of jobs going unfilled. So I, this leads to a question I wanted to get to as well.

Standardized testing, you touched on it a little bit. I'd love to get your take on, you know, what they call aptitude tests, during the screening process? Horrible, immoral, unethical, should be illegal. Really, what I learned back when HR people were routinely sent to classes to learn about things like the legality of pre-employment testing, and I don't think that happens very much anymore. I'll tell you one story and then I'll answer your question.

I went to an event here in Denver put on by a newspaper, a newspaper in Denver, a really big daily newspaper, and it was about recruiting. And I spoke blah blah blah recruiting to recruiting managers. And I was really curious. I don't spend that much time with recruiting managers, so I wanted to hear like their take. And this woman came up to me and she said, oh my gosh, your talk was so helpful.

I'm trying to hire people and it's really, really hard. I said, what kind of people are you looking for? She says, Mexicans. I said, I'm sorry, what? She says, Mexican people.

I said, okay, haha, that's funny in a really weird way. But actually, what position? She goes, customer service and sales support. And I find Mexican people make the best employees. This is a recruiting manager.

And I'm sitting there like turning green, purple, and 40 colors. And I said, um, are you familiar with the EEOC? She says, is that a job search group for Mexicans? Okay, this is— she said that. She said this is the baseline.

This is the baseline. Okay, don't assume— we can't assume that these systems hold. Just like IT security systems, you don't keep them up and you don't keep the protocols and things up, you know, they go down. There's good parts of Godzilla, right? Chaos reigns.

There's good parts of Godzilla, okay? So, and essential parts. So, so that's the baseline. So pre-employment testing is supposed to be used for specific positions when it has been shown to be effective as a predictor of future performance, which requires something called local validation on-site, where they actually hire people who passed the test and people who didn't and compare their performance 6 or 12 months later. That's flawed as it is because performance is obviously incredibly subjective, but even if it weren't so subjective, no one does that.

Vendors are just shoving these tests at unsuspecting HR people who, powered by fear— I better have this test because then I can show my boss that I'm really being vigilant— they're Garbage, Robb. Look at them, read the questions, and you will see DISC and MBTI, the 2 biggest, you know, the, the personality ones. Those are aptitude tests. They're used in, they're used in recruiting a ton, and people defend their use in recruiting on LinkedIn and comments to my posts, even when the manufacturers, the publishers say don't, don't, don't, don't, don't, don't do that. Those are, those are personality, like, uh, like fits, and I was thinking more like the aptitude, like the CCAT, if you're familiar with that, which gets more into cognitive ability.

I'm not a fan. I'm not a fan. It's all culturally based, Robb, just like IQ tests, like the SATs. You know, they've just recently put in a modifier for the SAT to level out. They're actually gonna give you credit for adverse life circumstances.

Just shut the H up and sit down. That's absurd. The test in itself is biased and unfair, so let's, let's add in this little feature that says if you were poor growing up or whatever. No, you're asking, you know, cup goes with saucer. Well, you wouldn't know that unless you grew up in a house with cups and saucers.

So, so I'm not a fan of aptitude testing unless it is literally, literally, you know, sitting in an interview and asking, how would you solve this coding problem? Or how would you— that might be the replacement. That's, you know, here's the job you'd be doing, literally related to what you would be doing, just to make sure that we understand that you know how to do this stuff. It's, it's, it's not something that you can sit down and take a test and say, well, they have this math skills to this proficiency, will they use any of that? No, we use it as a general indicator of— well, I wish you wouldn't.

We have basically no enforcement of labor laws in the United States. Now that's changing. The states are picking up what the federal government has just completely abdicated, and you see a lot of movement towards a higher minimum wage and, and more ability for people to join unions if they want to, and paid family leave. There was just a law passed in California that allows fast food workers to keep their jobs, to not be subject to employment at will and terminated just because somebody doesn't like their face. I love all that stuff.

I think it's past due, but as individuals, we also have the ability to say, no, I'm not taking that test. I'm just, I'm just gonna opt out. Because I say to job seekers all the time, if they don't get you, they don't deserve you. And there is this aspect that the best talent in IT security, in any field, may well be outside consulting because they just have had it with the corporate stuff. They just are not down to you know, to put up with it.

And that's going to be the competition for talent, is independent consulting versus necessarily another company. Right. So one of the things we have within security is a dynamic of people changing jobs pretty frequently, and I'd say it's because we're at, you know, roughly a 0% unemployment rate. Sure. Any thoughts about— I'd like to take this from both sides too— from the employee perspective, how do you feel about that?

That? You know, obviously there's good and bad to it. I'd love to just riff on that a little bit. Well, I have a little aphorism for that too that says an employee's job is to go to work and give their best every single day, every working day, and a manager's job is to give them a good reason to come back to work tomorrow. And I started putting that in stories like 15 years ago when I was writing for Businessweek, which is now Bloomberg, and CEOs and retired CEOs would write very, very upset, you know, really took umbrage with this because they said, what about the work ethic?

And I was like, the work ethic was invented to have people feel like they have to work hard. Like, where's— you know, your work ethic as a CEO was very personal, right? It was about, let me, let me have my own flame grow and feel like I'm in charge and be a leader and make a lot of money. You know, you can't put that on someone. Like your work ethic should be X.

That's really part of the old mindset. But the danger to an employee who moves around— and this is famous obviously in Silicon Valley, cross the street and get 5 grand or 10 grand or whatever— it's just that that becomes your brand. Yeah, that's the danger. It's up to you. I wouldn't tell you not to.

I would just say be aware, then that becomes your brand. This guy will go anywhere, this person will go anywhere for 5 or 10 grand. If that's your deal and that's what you want to do, God bless, but I don't recommend it because I feel like, you know, it's kind of like a tattoo that covers your face. Like, once you've done that, then it's kind of hard to undo it. It feels to me like if that's the way someone's making their career decisions, there's no moral judgment for me on this.

Yeah, there's no morally right or wrong, right? When I look at the life that that person is living, they're probably not getting anything from their job other than that paycheck. If you're making the move for an extra $5,000 or $10,000 to go across town, yeah, then you don't feel like you're giving up something, which means you're not getting a lot of value from your job. Yeah, absolutely, absolutely. And I think that's the answer to the other side of the equation, right?

If you ask as an employer, how do I hang on to people in this tumultuous market where they can be lured away for cash and How do you keep them? Way back in the day, me running HR at US Robotics, our big competitor for talent was at the time Cisco. It seems kind of quaint in retrospect, but I was paying entry-level— I mean, 2 years— not entry-level, but 2 years out of college salespeople at that time, you know, $125 grand in Chicago. And your average 2 years out of college person in Chicago at that time was making like $50 grand, right? Which sadly there still are.

Uh, so Cisco came in offering $250. It's— there's no conversation. There's nothing I can say. I would say, you know what, you got to do what you got to do. As a matter of fact, if you go there and you don't like it, come back.

Yeah. And so like half of the ones who left came back for half the money. They said, oh my God, it was like— it was like, no offense Cisco, but this is truth. They said you know, we work you to death and you travel all the time. You guys are so chill.

And it's like, yeah, that's okay. You had to go out in the wide world to learn that. Obviously, you have to pay people fairly. You have to pay them enough to live on. And that's a problem for a lot of employers.

I don't know, I wouldn't guess in IT. Yeah. But— or IT security. But you have to pay them enough. And you have to give them as much latitude over the job as you possibly can.

Give them as much flexibility over the hours as as you possibly can. There's a way they can work from home when the weather's bad. Do it. Like, do all the stuff. People tell me over and over, that kind of stuff, the adult stuff, giving me credit for what I know and what I do and my commitment, is so much more important than foosball and, you know, all of those things.

Not that those things are bad and they have their audience, but the fundamentals are, you know, give me latitude, let me know if I screw up. You know, tell me what— give me visibility into where the company's going, what is going to be important, so I can tell my family, like, look, you know, here's what they're working on. We have employment at will in the United States uniquely. It's the only industrialized country that has that doctrine where you can just say you're history. So people want to have visibility to know kind of what does the path look like so that I'm not going to be worried about my job security.

And I think when people have that stuff, they will stay for years. They will stay, they will get offers, they'll, they'll have headhunters call them and they'll say, nope, nope, nope, not interested. I love my coworkers, I love my job. All right, so I'm gonna— this is an awesome conversation, we've gone over time already. Oh, sorry.

But no, it's great, it's awesome. I want to ask you a couple more things though, I don't want to end yet. Number one, I want to say for those people who are maybe earlier in their career, what's the tip that you wanted them to kind of carry with them throughout their career, you know, owning their own career? What does that look like? You have an amazing, you know, device for discerning the real people from the fake people, the people that have your best interests at heart from the ones who don't, all of these things.

And it's your gut, obviously, and you have to listen to your gut. So many times, especially early in my career, I was misled. I allowed myself to be misled by people who said, oh, listen, I, you know, blah blah blah blah blah, do exactly what I say, or this job is going to be great for you, or, you know, no, you're not ready for that yet, or all of these things that people tell you. Listen to your gut, and it's— it works slowly, but it's very, very, very, very accurate. Listen to it, tune into it, pay attention to your reactions around people and situations.

If you're sitting in a job interview and every little hair on the back of your neck is standing up, it's probably not the place for you. And you can rationalize like crazy— salary is great and it's close to my house and they have t-shirts and, you know, whatever. Listen to your gut. It will not steer you wrong. That's the best piece of advice I wish someone had given me.

I listened too much to outside authority figures, people that seem to know more than I did. And then a couple years later, I was like, why did I listen to that person? You know, so I guess it would be that. That's great. And for someone running a department in a company, and you know, you want to, you want to have a world-class team.

What's your— you have one tip for how do we make a world-class team? Ask, ask, ask, ask. I'm not a fan of the once-a-year, you know, employee engagement surveys. It's actually really insulting. It's like slipping a survey through the bars of the cell in prison and like, here's when you're allowed to tell.

No, no, no. Ask, how you doing, Robb? How you— you all right? How's your workload? You okay?

What are you doing? How's everything? Is good? What can I do for you? Always, always, always stop and say, how's it going?

How was your weekend? What are you working on? Yeah, you okay? How's the workload? Ask, ask, ask.

The more you ask, the more people are going to tell you. And at first, that load of to-do items is going to be overwhelming, and you just get rid of 60% of them, and people are going to be like, wow, this person is for real. They take care of stuff. Managers who don't realize the service part of their job, service to their employees, always have trouble. And they call me and say, why are my employees so mad at me?

Well, I don't know, but I, I guess it's because there's some pent-up things, expectations that were not met. So you got to address that. Yeah. And another thing for managers, it's not my decision is not— please don't ever let those words Cross your lips, because that's the ultimate, I have nothing, I'm juiceless. Well, who wants to work for a juiceless manager, right?

So you say, look, here's what I can do, here's what I can't do. I'm looking at this maybe in 3 months when we go to the new reorg. You know, be realistic with people. You can't— you know, you're not a genie that can grant every wish, but, but bring them into that thought process rather than just saying it's out of my hands. Yeah, that's great.

Well, Liz, this has been a ton of great advice. I'm sure that a lot of people listening will want to hear more from you. You mentioned a couple of books, you mentioned you have a podcast. What's the best way for people to connect with you and follow you? Thank you, Robb.

Well, Twitter is easy, it's @humanworkplace. The podcast is called The Truth About Work with Liz Ryan. It's on iTunes and YouTube. We've done 5 or 6 episodes now, it's new. So is it a video podcast?

No, it's just audio for now. I couldn't do with that pressure, Robb, to be on stage. I mean, we will go to video eventually, and I do videos, but I just was like, nah, I just want to talk and have— be all sprawled on the couch and whatnot. And then the book, Reinvention Roadmap: Break the Rules to Get the Job You Want and Career You Deserve, and it's at Amazon and every bookstore. And what was your website?

Oh, humanworkplace.com. I love it. Well, Liz, this has been fantastic. Thank you so much for taking some some time out of your schedule to, to learn up the security community so we can all be better at what we do. Oh my gosh, thank you, Robb.

All right, well, that's a good one, and we'll talk to you guys again next week on Colorado Equal Security.

Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado Equals Security.