Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now, here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 171 for the week of July 13th, 2020. Alex, good to see you in person.

You too, Robb. How many illegal fireworks did you light off over 4th of July, Robb? I lit off zero, but I, I think I listened to somewhere in the ballpark of 10,000 of them. Only 10,000? Yeah.

And my house smelled of fireworks for multiple days. Um, our neighborhood was, uh, was cloudy that on the 4th of July. So that could, should tell you how many were in our neighborhood. Yeah. I don't, I, I don't really care all that much about fireworks.

Like, I think it's fine to do a couple, but like, you gotta stop it. 10:30, 11 o'clock at night. Yeah. They're going off at 1 in the morning, you know, multiple nights in a row. It was a little bit much.

Yeah. People in, in my neighborhood were relatively respectful. 11 o'clock-ish, things generally stopped, you know, 1, 1 or 2 here and there, but it wasn't no big shows after 11. So yeah, that was good. I will say at, call it 1 o'clock, I was, I was ready to go over and, and have a conversation with those people who were doing it, but I was also ready to be asleep.

So it's hard to, hard to get myself out of bed for that. No, I get it. Makes sense. Hey, well, anyway, hopefully you had a good Fourth of July. Obviously, we took a week off and hung out with our families and whatever other things we do when we're not doing this podcast.

It's hard to believe we do anything other than this. I mean, this takes so much time. It's mostly what we do most of the time. Hey, speaking of that, let's talk about this community we're building here. Yeah.

Why is it that we do this, Robb? Well, we believe that Colorado Equals Security. It's not just a, not just a really great name for a podcast. It's actually a movement, right? We're trying to, to help amplify the voices of the cool things happening in the security community in town, let you guys get to know each other.

So we do these newscasts, let you know what's happening in town. We do interviews, uh, and of course we have a community that we're building on Slack. Yes, a wonderful community there, getting really close to 1,500 people in that Slack workspace. Uh, lots of great conversations, always stuff going on in there. You can join by going to our website colorado-security.com and clicking the Slack link.

It'll take you right into that workspace and you can join right up. And while you're on our website, after you click the Slack button, maybe scroll to the bottom and you can join our mailing list. You'll get the, the show notes delivered into your inbox each week. In addition to that, you get nothing else. We do not also send anything else.

That's all the mailing list is used for. You will not get marketed to. You will not get spammed. You will get one email a week. That is it.

If you're lucky. If you're lucky. And it's not so much about our integrity as much as how lazy we are. Yeah. You know, I like to think it's integrity, Robb.

Um, you know, uh, this podcast though, one of the best ways to get it is to subscribe to it through your favorite podcast application or store, whether that's iTunes or Google Play or Spotify or wherever you get your podcasts from. And while you're there, it would be great if you rated us so other people knew that the podcast was great. And, you know, maybe it'll surface for some other people too. And it seems like people are starting to go back to work in numbers. I see, um, a lot more cars on the road and we can see a lot more downloads for our podcast week to week as it looks like folks are back on the road.

Um, this might be good chance when you go into the office through your mask at a safe distance to tell one of your coworkers about the podcast. Help us get some new listeners for their commute. Yeah, so you're gonna have to make sure you say it really loudly so they can hear you that far away through the mask. Articulate. Yes, that as well.

Um, if you want to support us financially, we do put some of our own money into this venture, producing the podcast, web hosting, other things like that. We do have a Patreon campaign. Again, you can find out about that on the website colorado-security.com. We would love if you supported us financially, but even if you don't, we love you anyway. Did you say again?

I think you might've said again. Again, I think I might've heard again. Again, there's one final thing you could do to help us though on the podcast. Uh, if you want to help, uh, help us create content, you know, we have, we've struggled to keep up with doing weekly interviews as much as we love to bring you interviews with folks from the community. We do have one this week, um, thanks to Alex, but, um, we have not been doing a great job of having one each week.

Uh, volunteers out in the community who want to highlight either, you know, what they've done or folks who they know have done or have reached out to us and we'll, we'd be happy to have you do an interview and we'll get it on the show. Definitely. And Robb, since you're making fun of my pronunciation, I thought maybe we should, you know, one of these days, like, do an episode where we, we both do bad accents the entire time.

I need to be prepared for that. Yeah, I don't think I'm quite there right now. Not today. Not today. I think I was there either.

I think Irish is the one I would start with, though, if I had to. I'd do Canadian, I think. Hey, hey, you got that A at the end of everything, right? Hey, we do have one other piece of news housekeeping. Um, we're doing— there's a new book club and Douglas Brush, who's a great member of the community, has kind of volunteered to organize this.

We're having our first book club meeting to talk with the book— talk about the book Start with Why. That's going to be on the 23rd of July. So if you have, you have time to get the book, read it and come talk to us. We'll have a Zoom meeting. You get to the Slack channel to find all the details.

Yeah. Um, in the Slack channel, you also find that, uh, he started a shared Google Doc that people can share potentially other books to do in the future, notes, questions, other things like that. So with that, let's jump into the news. Jumping into the news, we have, we have a couple of big acquisition stories this week. Sunrun, which is the biggest solar company in the US, is buying their rival.

So Sunrun is co-headquartered here in Denver and they're buying one of their rivals to make themselves even bigger. And it is a billions of dollar deal. Yeah. So they are buying Vivint Solar. They are based out of Utah somewhere.

Um, so this is going to make them clearly the biggest company. And this is, you know, good news and bad news for Tesla. Uh, that moves them up to number 2. Uh, but it also means they have a giant rival at number 1. Um, and, uh, I believe this is a, a, an all-stock deal.

I think Vivint, uh, stockholders will, will own about a third of the company and, uh, Sunrun, uh, shareholders will own about two-thirds after the, the merger. Yeah. Interesting. It's, it's a, what I think it was like $1.6 billion stock deal, but then they're also taking on a bunch of debt. Right.

So it turns, turns out to be like $3 billion acquisition. Now the new company's worth about $9 billion. Sweet. Good for them. Interesting stuff.

You know, co-headquartered here in Denver. A lot of it, like 500+ employees in downtown Denver. As an aside, Robb and I both have solar panels on our roofs. Totally recommend it. Yeah, I— we both did SolarCity before Tesla bought them.

Yeah, I've been pretty happy. I've got like 7 years under my belt. No, no problems. Yeah, I'm not quite that long, but it's, it's been a good run. So whether it's Sunrunner or Tesla, you should do it.

Do it. Make, make the world a little bit better place, right? Next, we have another acquisition. We talked about the first one. The second one is Empower Financial, which is really Great West Financial here in town.

Empower Retirement is kind of their new brand. But Great West, they've been, you know, a big company in Denver for a long time. They've bought a kind of a tech startup financial services company called Personal Capital for about $1 billion. Yeah, that's pretty cool. Congrats to the Personal Capital folks.

I have never used Personal Capital, but it seems to be one of those sort of newfangled retirement kind of applications where, you know, it's sort of a computer giving you advice as opposed to a financial advisor, you know, making your life easier, hopefully getting you to retirement faster, those sorts of things. Yeah. So they, they do a couple things. They, they, number one, they aggregate all your accounts. I don't know if you like, like a Mint type of a service where you can put all your bank information in and it'll pull it all together and they'll give you like budgeting information, all your spending patterns and all that.

But then they also, the way they, the way they make their money is they want to get you to, to, to use their services for how you invest. So you can do the free services, which is just like the, the Mint type of stuff. And then the investment stuff, which you pay a little bit more for. Um, and I think they actually like have, they, they start off with the computer recommendations, but then they have people for like, if you want to with like more than $100,000 worth of retirement stuff that they'll, they'll give you like a personalized approach. So they seem like they were a disruptor in the retirement industry.

And so not surprisingly, um, an incumbent purchased them. Yeah. So, so pretty cool. So both companies, uh, have significant security teams. Uh, I know Douglas Peterson, Doug Peterson, who's the CISO over at Empower Great West Financial, and Erica Boyle.

Hi, Erica. A number of other friends who work over there. And then, uh, we also know some of the folks at Personal Capital. So, so pretty cool. Hopefully those are good synergies and those teams are able to, uh, to work well together.

Sounds like a good thing. Uh, next, we talked a couple weeks ago about, uh, the company Blueprint, which used to be called Craftsy. It was also owned by NBCUniversal, which is owned by Comcast or other way around, or one of those things. Um, that because of the pandemic, they had decided, uh, that they were going to shut down. Um, and not just, you know, go on hiatus, but completely shut down the company.

And so, uh, article this week says someone is actually gonna buy them and revive the brand. Not as Blueprint, but as Craftsy. This reminds me of like a WWF wrestler. You think he's out, but no, he starts to move. Right.

You know, the news of their demise has been greatly exaggerated. Apparently Craftsy's coming back. And not only that, it's not going to be Blueprint. It's going to be Craftsy. They're going back to the original brand and the company that's buying them, what's it called?

TN Marketing. They do a whole bunch of these video communities and this is a pretty good fit with what they do. Yeah. Sounds like they're gonna do a pretty good job with it. Seems like it, it goes right in with what they already do.

They have a, I think, a woodworking and some maybe an automotive sewing circle. Yeah. And so Craftsy seems to go right in with that. Uh, they weren't sure whether or not they were going to, uh, retain or bring back any of the Blueprint/Craftsy employees or if it's just the brand, but they said that they are working through those details. Well, let's lean on them to get the, uh, Denver folks to, to keep their jobs.

Exactly. Let's see what we can do. Well, let's do it. Everyone who's listening, let's, let's start an emailing campaign. Is this work?

Maybe Twitter, Twitter, Twitter campaign, Twitter, maybe snail mail, whatever it takes. Yeah, let's get these, let's get these folks back into their jobs. Let's do it. Next, we talked about a company a couple of weeks ago, Uncharted, that is going to a 4-day workweek and as an experiment, and they're documenting everything that happens as part of this. Yeah, I was— I remember we talked about it, I think, quite a bit of length on the podcast and It's nice, you know, one month in, they have kind of announced the results of how it's gone the first month going to the 4-Hour Workweek.

They have a lot of details, both in the good and the bad. I think it was worth talking about both of those. What's working really well, you know, people have really felt a lot better from a rest and a mental health perspective. People are doing a better job prioritizing their work, focusing on the highest priority stuff. They've done a good job working with partners externally and kind of setting expectations, things— there's some things that are not working quite so well.

Yeah, through those. Sure. So yeah, some of them, I think sort of coincidentally, they had made some organizational changes before they decided to do this. So the, the less time that they have working now is making it a little bit hard for people to get used to the new organizational structure. If things don't go as planned, it's a little harder to recover from that because you have less time in the office.

One of the things we talked about in the last time we talked about the— this asking for help, asking for help, you know, people weren't as eager to ask for help because they felt like they were intruding on people's limited time. And it also sounded like they could still do better around meetings, the intentionality of meetings, what the purpose was, and not just having meetings for meetings' sake. Yeah. I mean, the list of things that didn't go well is longer than the list of things that did go well. However, I get the impression that they're not anywhere near stopping this experiment.

Right. This and I obviously I hope they figure this out. Hope they're able to figure out a way to be as or more productive and and hopefully it spreads. It also said that employees averaged just over 33 hours a week of work versus over 45 hours of work in the the previous five-day work week. So from 45 to 33, I mean that's a massive decrease.

Yeah, yeah, that's that's pretty good stuff. Yep. All right, moving on to our next story. We Colorado is among the states with the most remote workers. This was I don't know how how much you looked into like.

The way they prioritize these. They had like the top, the, the 15 states with the most. Well, the number 1 state was California. And it was right now, it was not per capita. It was just the most remote positions.

Right. Once I realized that, I'm like, well, this isn't that useful. I'm, I'm shocked that California had the most. Texas was number 2. New York was number 3.

Florida was number 4. Like, it's all population-based. But they did show percentages for those top 15. And of— I don't know if you noticed, of those 15, Colorado actually had the highest percentage of remote Yeah. So that is pretty cool.

Also in Colorado, Boulder had the highest percentage of cities with remote workers. I think it was like 15% or something like that. It was a big number, about 15%. So across the state of Colorado, it's 8.6% of workers do work remotely. What was really interesting was only— or was it like 95% of remote workers indicated that they were required to work in that region.

So, right, 90, 95% of those people who work remote couldn't go pick up and move to North Dakota. Right. They're supposed to be there in Colorado, but they work from their home. Right. Yeah.

And it just sort of occurred to me, I wonder if how they're counting, like for the cities, is it where you live or where your company is? That's where you live. It's work because it's workers. Yeah. Yeah.

I know. Whatever. Yeah. Anyway, but, you know, interesting. Glad that people get to work remote in Colorado.

Yeah. Obviously, right now, that's a good thing. All right. Next story, we have a company we've talked— I think we talked about them on the show before, Fivetran. They're, they're not a Denver-based company, but they have created a significant presence here in town.

And they've raised a new, another new round of funding, a C round at $100 million, taking them up to the unicorn status. Yeah, I do have to say, they probably should change their name because, you know, Fortran is the sort of infamous chat website. 4chan. 4chan. Fortran.

Yeah. Is the old coding language, right? Yeah. But this, you know, 5tran. I know it just— it's too close to 4chan.

You say 5tran and I think, oh, that's like one more than 4chan. All right. Yeah. Anyway, so it might— maybe it's on purpose. Maybe it's on purpose.

What do they do again? They do some kind of— they do like data integration automation. Yeah. They integrate between blockchain. It's AI-based machine learning blockchain.

Yeah, threat intelligence. I like it. It's not a security company. I should stop. Uh, it, it— I think they pull data from various places and put it into, um, other data repositories like Snowflake and, uh, other things like that.

So, well, Redshift— they do say that they're planning to use this $100 million infusion, um, to grow the team. There are about 350 employees right now, and they want to grow to 500 in the next year. Uh, focusing on sales reps, of course, and engineers, of course. Yeah. And I think that their plan, uh, previously was to grow the Denver office to 150.

So that's a good chunk of the company there. So there can be 150 people working from home. That's right. I like it. Uh, next, there was an announcement from, uh, American Cybersecurity Management, uh, talking about their new service, uh, AppSec as a Service.

Yeah, we don't go into these local, uh, consulting companies too much, uh, but we've known American CSM for a while, and Carlin is a been a friend of the community. I think what they're doing there is interesting stuff. They do like CISO as a service and they do DPO as a service if you need privacy help. And now they're doing AppSec as a service. Yeah.

All of their services are people-based. So it's not, you're not buying a, you're not buying an app that is this thing as a service, but it's, I think it's good that they're moving in different directions. You can now get all, you know, sort of integrated different services with them. Search engine optimization too, right? If you're looking for AppSec help now, now they're going to show up.

That's, that's probably good. Exactly. Uh, next, LogRhythm. Uh, I guess you could call this an award. They were ranked number 1 in customer satisfaction by G2 Research.

I thought you were gonna say J.D. Power and Associates right there. That's, that's what I was expecting. Uh, congratulations to LogRhythm. Obviously, you know, keeping your customers happy is, is essential to, to being successful.

They've, they've been successful for what, 15 years now, almost 20 years. I really hope that they get one of those glass trophies like the J.D. Power. I guarantee they've got it. James, could you send us over a picture of the glass trophy, please?

Yeah, we need one of those. All right, next, uh, we have, we have an update from— are we supposed to go— still supposed to call them Route 9B, or is it R9B now? If you are a Route 9B or R9B person out there and you're listening to this, please let us know. Yeah, what should we call you? Because I don't— I just see R9B in, uh, in print now.

Yeah. Um, but I still think of them as Route 9. I don't know. Yeah. Help us out.

We'd love to refer to you guys on brand, help, help reinforce the brand. But with the news from them is that, oh, it's not news. They, they just have a blog post this week. It's about, um, is your enterprise ready for the next cybersecurity phase of COVID telework? Basically kind of talking us through how do we get to today and what does the future look like here?

Yeah. And you know, one of their big services is threat hunting and they're just talking about how in, you know, what is most likely going to be the next phase of this, which is continued remote work and sort of the new— what everyone's calling the new normal. You know, you may need some help to root out some of those new threats that are now in your network because people are all over the place doing who knows what. Root out? Root out.

Root. Yeah. No pun intended. Yes. Next story, we have a Coalfire, one of our— they do such a great job.

Only problem with Qualifier is they generate too much content for me to keep on top of all of it. I can't read all of the stuff they do. But once again, we, you know, we picked one of the many great articles this week to talk about. This one's by Jason McCallister talking about successful DevSecOps begins with a cultural shift. And other than the fact that he says DevSecOps, I like it pretty well.

Yeah. So I think this is a, it's a good article if you want to learn about some things, not technically, but culturally that you need to think about if you are moving to, uh, dev, even DevOps, but also DevSecOps or DevOpsSec, SecDevOps, you know, whichever way you want to look at it, an integrated, uh, delivery of applications including security. Yeah, I, what I, what I really think is the, these, all the points that are in here are, are important for security to know, but you have to be on the same page as your, your dev and your, your ops folks as well. And if they're learning this, if you're coming from your traditional IT environment who don't understand DevOps, um, you might be kind of running ahead of them here. So, so really sync up with, with, you know, where are they.

Of course, if you're moving from a traditional IT environment to a new company that's already DevOps, you know, this would be a great primer for you to understand what am I walking into, how do I speak the language of those companies. And even if you are already doing it, um, it's a good sort of checklist to make sure you are doing the, the things that are mentioned in there to make sure you're doing— checking all the right boxes. I guarantee not everyone is doing all of this, right? No one is doing all of this. It's, it's just, it's a lot of hard stuff here for sure.

Uh, next, there was a blog post from Ping Identity, um, talking about how a few weeks ago Apple had their Worldwide Developer Conference, and as part of that, it was announced that in the next version of the operate— their operating systems, both desktop and iOS, they are going to be supporting FIDO natively as part of the OS. Yeah, I mean, FIDO is— FIDO2 WebAuthn is such an exciting set of technologies that allow us to really get away from this username password combination that we've used since, you know, the world started. And really getting that support in the operating system and in the browser is the only way it's going to— it's going to catch on. So, so Apple coming around and it looks like they're going to support FIDO most of the way. We don't know that it's actually going to be on-spec support.

We're going to see as it comes out. But the fact that they're at least— they've now joined the FIDO Alliance, they're now actually, you know, trying to integrate these things, like, and kind of catch up to Microsoft in that area, is a really good thing for the industry. And I'm excited to see, you know, how much better the user experience gets as we start to get to that passwordless flow. Yeah, I mean, it's one of those things where it's a better user experience and better security. Can't beat that.

It's not very many of those, right? Not very many of those. All right, final story this week is Red Canary. Uh, they had a blog post Which is really interesting. You know, another another company that generates a lot of interesting content, and you know, it's just not not about what they do, right?

This one is around practical ways to teach the basics of cybersecurity to children. You've got to teach teach your children well. Keep going. I don't know this. And I don't know the rest of the words.

But anyway, I don't know this. What's this from? It's what is it? Is that anyway?

I'm bombing here, Robb. Help me out. Crickets. I need the cricket sound. Hey, speaking of bombing, let's talk about this blog post.

No, I'm just kidding. It's a great blog post from, what was his name? Something Roof. Corbin Roof talking about how to teach kids. He has a great list of stuff and I thought I call out my favorite one on here.

He gives some practical advice. Play the, he calls it play the word of the day game. Basically every day come up with what is another word that your kids probably don't come across in everyday life that you can expose them to. You know, if it's network or router, Wi-Fi, he gives some examples of things that especially younger kids might not hear and just start exposing them to technology words so that, so it becomes part of their, you know, their DNA. Yeah.

One of the other things was talking about drawing a moral line, you know, so just thinking about with the things that they do online, Uh, you, you need to understand where the line is and just, it just because it is online doesn't mean it's any different than in real life. Right. That's a great point. And because it's so easy to think of it as being, you know, virtual decisions, right? Is this isn't real.

It doesn't count. Yeah. Um, by the way, it's Teach the Children Well by Crosby, Stills, Nash and Young. Oh, sure. Yeah.

Well done. Thank you for figuring that out. But you know, you couldn't tell by the way that I was saying it because I'm awful. Hey, let's move over to the Slack message of the week. Well, big thanks to Andre Gaeta.

He is not awful, and he's been sponsoring this for a couple years now. Each week we get to call out somebody from the community who has, who's had, who's contributed to the conversation in Slack, and we get to give them one item from the Colorado Equal Security store. Since we have a new logo this year, it's a good time for people to win this because they can get the new logo on their swag. Exactly. Uh, and this week's winner, uh, is, I forget, Janelle Hsia.

It is Shaw. I was gonna say Shaw, then I couldn't remember. Janelle Hsia. So congratulations, Janelle. Um, she, uh, posted, uh, about the new Hong Kong security laws, which essentially are the Chinese security laws that are now being imposed, uh, imposed in Hong Kong.

Yeah. I, I, I'd say there's some nuance to what you just said. At least the way it's written, it doesn't look like they can just go do warrantless searches. But not yet. But who's like, or what?

Right. That's always the question because apparently from everything I hear, like there's no, there's no questioning the decisions made by the party. So, you know, you can't go to Congress or go to the courts and challenge a decision. So it's really interesting. You know, there's been a lot of conversation around China and Chinese companies and kind of how does that look in the US right now?

I don't think we have clear answers, but I do know that it's definitely a challenge right now. Yeah, I mean, and Hong Kong was always, you know, because of their former British rule, was sort of a stopping point. You know, you could be in Hong Kong and not be in China, but basically be in China. But now with turning that over, the, the rule of Hong Kong to China, then basically that's going out the window now. I wonder how many companies chose to put a data center in Hong Kong because it could serve China.

I'm sure a lot. And like, and like now they're like, oh my God, I thought I had another whatever it was, right? 20 years to do this. Yeah. Wow.

All right. Anyway, congrats to Janelle. You'll get to pick one item from the Colorado Equal Security Store, which of course the rest of our listeners could go to as well. Speaking of the Colorado Equal Security Store, Robb, there is a whole bunch of new stuff out there in the Colorado Equal Security Store. We have many logo variations on our new logo and they are now all in the Colorado Equal Security Store.

So you can get color, grayscale, black and white, white with a blue background. Plain white, all kinds of different stuff. Horizontal with words, vertical codes, no codes. Man, you spent a lot of time on that, didn't you? I like that.

And all kinds of different items in there. Also, CafePress, which we do the store through, just started offering face masks. So if you want a Colorado Equal Security face mask, you can now get one in all of those different logo combinations in the Colorado Equal Security store. Did I order— I think I ordered one, but it hasn't come yet. Yeah, mine hasn't come yet either.

Yeah, I'm looking forward to seeing if it's any good. Yeah. And I'll let you know on the show if it's any good. Yeah. And you can also find the store by going to the website, colorado-security.com.

It's like that website would be a good place for people to go. You know, you can find just about anything there. Speaking of that website, while you're there looking at the store or Patreon or Slack or whatever else, you could click over to our events, our events page. And we have a calendar of events with all of the virtual things you might want to do here in Colorado. You know, the first one of those things, Robb, is talking about end-to-end security for IoT product design.

On the 15th of July. Yeah, that's interesting. I, I don't know who that's by. Well, it's Cardinal Peak did it, and I remember they actually— oh yeah, note asking. It was, uh, what's his name, uh, Trent.

Trent Hine had, had sent that over to us. Yeah, yeah. So that should be interesting. So Trent will be a part of that. Uh, also on the 15th, ACES, which is the local physical security group, is doing a Crisis Leadership Together, uh, meeting that's obviously virtual.

On the 21st, ACES, which is the physical security, uh, group in town, is doing a Women in Security Coffee Chat with Dawn Gregory. Of course, this is a virtual coffee chat, but there's a few of those coming up. We have a few things on the 22nd as well. OWASP— it's actually a combined OWASP Denver and Boulder meeting happening there on the 22nd. They're going to be doing their virtual June-July meeting.

Also, the ISC² Pikes Peak chapter is doing their July chapter meeting on the 22nd. On the 23rd, Colorado Springs ISSA is doing their online meeting. And then on the 24th, DC303 is doing their July meeting. All right, let's jump over into jobs. Starting off at the top, we have a job— neither of us have jobs right now.

We do not. We filled all those positions. Congratulations to new employees, or condolences to those folks. We, we have the top list job on the list this week is from Red Canary. They are hiring a Director of Incident Response Engagements.

Insurity is looking for a Senior Application Security Analyst. Be working for Joshua Foltz over there, a good friend of the show. Synoptec is hiring an IT security consultant focused on Microsoft 365 and Azure. I would assume you'll be working with Mike Pedrick on that one. Oh yeah.

VMware is looking for a senior information security engineer, remote opportunity. I wonder if this is one of those 5% that can be anywhere. Must be. SnapDocs is hiring a security and compliance analyst. Shellman and Company is looking for a senior IT auditor.

First Bank is hiring a cloud security engineer. Colorado's bank for you. Connect for Health Colorado is looking for a security analyst too. Working with Michael Stephen over there. He's the CISO there.

We're doing some name dropping this week. I know, right? Stanley Black Decker. I meant to look up, are they in town? What's happening here?

You know, I've seen several posts from them, so they must have some sort of place here. I wonder if it's like through acquisition or something like that. Well, Stanley Black Decker is hiring an embedded security system administrator too. And Dish Network is looking for a Google Cloud security engineer. I assume you'd be working with Artie Wilkowsky over there.

Artie, Jeremy's over there. A lot of great folks in the Dish security team. Yeah. Well, that is it for the newscast this week. We do have an interview.

Who'd you sit and talk to this week? Yeah, so I have kept going in my self-proclaimed deck series. I had Jen Wilson of MHR Partners. She is in cybersecurity recruiting. We sat down on my deck and had a nice chat about recruiting and the state of jobs right now and what she's done in her company and all that kind of stuff.

It was a good chat. Awesome. Jen has been a very active supporter of the community in general. A lot of work with women in security. She's helped us out as well.

Yeah, for sure. So good job. Obviously appreciate Jen and look forward to hearing the interview. Yeah. All right, everyone, have a great week and we'll talk to you again next week.

Thanks, Robb. This is Henry Yu, head of security for Red Robin. Welcome to Colorado Equal Security, the podcast for security professionals by security professionals. Welcome to Colorado Equal Security. This is our feature interview continuing with my, my deck series coming, coming to you live from my bar shed.

Hopefully the audio continues to be good. Uh, today I'm joined by a very special guest, Jennifer Wilson. Welcome, Jennifer. Thanks, Alex. Thanks for having me today.

And your, um, bar series is awesome. It's beautiful back here. Well, thanks. Appreciate it. Glad you could, uh, come over and, and keep far away from me, but, you know, still have a nice conversation.

Um, I'm gonna totally digress here. The— I saw a thing today on, uh, it must have been LinkedIn or something. It was a list of behaviors and how risky they were related to COVID, and being outside was really low on the list. So I'm glad we're out here outside keeping each other safe while we're talking. So anyway, this isn't about me, it's about you.

So why don't you introduce yourself for people that might not know you and, and give a little background? Sure. Again, my name's Jen Wilson, founder of MHR Partners. We're an IT staffing and recruiting firm. We've specialized in security, gosh, for I guess about 8 to 10 years now.

Started the business almost 12 years ago and becoming independent and kind of going off on my own, but I've been recruiting in the Denver area for longer than I'll admit to anyone and been really just focused on security. Over the last 8 years, and we just, we support local companies, we support companies nationally. I've done international recruiting and I'm really involved in the security organization and industry here. Nice. And you, have you always done security-focused recruiting at MHR, or was that something that once you started your own, hung up your own shingle, you thought, oh, this is a good place to go, or how did that part come about?

Yeah, I, I actually had a fairly significant group of friends that were all in cybersecurity at the time I started my business, and so it was just a natural way for me to get in. And as I started to learn about it, got excited about it, really just dove deep into understanding as much as I could about the industry, the trends, networking. It's huge to continue to create significant network. You know, you guys are not easily found, right? And all gainfully employed.

So, so your network is tough for you. Yeah, so your network is everything. And so we just decided at that time, that's where we were gonna go. Cool. So let's go, let's go back.

Sure. Where are you from originally? From a little town called Mount Pleasant, Michigan. Okay. Home of the Central Michigan University Chippewas.

Nice. And came to Colorado in the '90s. Cool. Yeah. And have you always been in recruiting type?

No, prior to this I was in financial services. I worked for ING and 9/11 happened and Enron happened and we know exactly what happened to the economy there. And I got introduced to this this industry and becoming a recruiter. But prior to this, I was in process improvement, so I worked with the IT and the business to make their processes more efficient and then would document those processes and then train. And, and so then when I was found without a job in 2002, I got into recruiting.

It just seemed like a natural fit. I was interested into technology, and it just seemed like it made sense at that time. And then I imagine you worked for a larger— some other recruiting kind of company to start out with. Is that— yeah, I started out with a boutique firm that's local here. They did a lot of executive placement, and I think that that's where I really start— learned the importance of a network.

I would help place these executives, and if that relationship was successful during that recruiting they would then in turn hire me to help them build out their team. It just made sense. There was a relationship, there was trust, and they believed in my ability to deliver. So I started there, then I joined a larger recruiting firm. That just wasn't a fit for me.

I prefer to be able to customize an approach for recruiting and not be pigeonholed to a certain process, which is interesting because that's what I was in prior before, but I really like to customize and make— let it make sense for whoever I'm working for. And so then I decided to go on my own. Nice. Yeah. And how has that process been?

You know, I'm sure some of it, you know, becoming a business owner is always scary, and there's lots of pitfalls and trials and things like that through, through that process. Yeah, you know, I have— we were talking prior to this about reflecting, and I think having these last few months of being home and no outside networking events and really just reflecting on what it is that makes you tick and why do you like what you do and are you in the right place in your career and all of those things that we've all thought about. And as a business owner, you're constantly juggling. You're juggling all of the ins and outs of daily operations of a business. Everything that you have and everything you don't have rests solely on your shoulders.

Right. So there's a lot of tenacity involved and perseverance that you kind of have to naturally have. And then I think for me, I just know how I want things to work or how I want things to go that it just makes sense for me to constantly overcome. But it's a challenge. I mean, it's— you're the business development manager, and then you're trying to deliver late at night and making sure you're meeting with clients, and you're making sure that you're continually keeping a good network of talent available.

So when those roles come in, it's just, it's a struggle. It's, yeah, especially times like this. But I try to flip it. Spent a lot of time these last few months just reaching out to my network saying, let's, let's do resume reviews, let's have career discussions. Everybody's at home so they don't have to go sneak out of the office to actually get on the phone with a recruiter and say, hey, just in case, you know, something happens with my job that I have, take a look at my resume and let's talk about it.

And so I've had a lot of really good conversations with people, and that's where I've spent my time these last few months. Nice. So you mentioned in these times, I imagine With COVID everyone being at home, lots of people being out of work, companies struggling and probably not hiring at the rate that they were prior. I imagine that's affected your business, you know, somewhat from a bit to a whole lot. Yeah, I would say a whole lot, definitely.

You think about internal— you think about large corporations that already have their internal recruiting function. What we're seeing is all these companies want to keep their, their existing staff. The last thing they wanted to do when all of this hit was lay off anybody. And we're seeing now more layoffs happening, but their internal recruiting staff got juggled around to make sure that they were supporting the roles that were essential to continue hiring. But for— so if you think about going external to a third party, we're kind of last on the list from a budget perspective.

They want to keep their employees busy. I think also though, 100% of the work didn't fall off because I'm so niched and I've got such the network that I'm the call that a lot of people make to say, hey, look, we're really struggling here, we need help in finding these types of people. I think what we traditionally find in large corporate corporations or even startups, I mean, quite honestly, is internal recruiters are busy. And right now they're busier than ever just funneling through applications, and they don't really have a chance to actually go heads down and go out there and recruit and talk to people and network and expand that search. Because they're doing all the administrative work behind the scenes and it's killing them.

So he's— so when you have such a kind of a niche thing like we chose to do a number of years ago and be specialized in this certain thing, people will reach out. But it's certainly not where it was in March. Right. At all. Yeah.

Yeah. And I'm curious, how is it on the, the people looking for a job side? My assumption would be that as people have gotten laid off, all of a sudden you're getting an influx of people saying, hey, will you help me find a job? But has that been the case? Yeah, I mean, I've always been in the camp, whether times are tough for me or times are good for me, I've always been in the camp to have the phone call.

If somebody is referred to me, somebody's reaching out to me, I take that call. Call. I've had relationships where folks have been my candidate, then they've become my client, and they've become my candidate again, and then they've become my client again. And I've known them over the course of a decade and in this, and I've always taken the call. And so that's what I'm finding myself doing right now.

I help make introductions without asking anything from my hiring managers or different clients that I might have relationships with. I just, I feel like giving a little bit gets you a lot in the long run. Yeah, yeah, yeah. I'm curious, you know, you mentioned, you know, seeing sort of initial wave and then maybe some more layoffs now. If you pull out your crystal ball, where do you think we are in, in the whole process of getting through this, this crisis?

Obviously we don't know when it's exactly gonna end and when people can go back to the office or when things are gonna pick up, but I wonder if you've seen kind of any, any trends or where you think it might be going.

I wish I had a crystal ball. Yeah, I, I don't know. I think that what I'm seeing right now is a lot of, a lot of folks that are, that are used to being in office and they need to be in office for just the sheer fact because they have to run an office. A lot of that layer is getting taken away. Think that you have organizations that still need to run, they're still operating, they're actually still doing business, but they're doing it from a remote workforce perspective.

They have some initiatives, maybe some upgrades or different things that they need to do from a technology refresh. We're seeing that that's still happening. The money is still there. The budgets aren't— they're maybe being shifted a little bit, but it's really the cost of doing business. And so what I'm seeing in, you know, my small viewpoint, certainly I haven't done some huge survey, but I'm seeing that those things are still happening and people are still hiring and people are still moving along.

I think that we know naturally some of those industries that thrive off of people commuting to work and being in an office and, and having a full downtown or those types of things, that's where we're going to see hit first. And then, you know, the ancillary effects. I don't— I don't— we're not— I don't believe we're out of the worst of it. Yeah. Yeah, I think you're probably right.

Sadly, I wish we were a little bit farther along, but I think we got a little ways to go still. I know it is. It is, but we'll get through it. We will. So you mentioned resume reviews and some other things like that.

What is it that people can be doing now, whether they have a job or whether they have been laid off or furloughed or whatever? What can people be doing now to make sure that they're preparing themselves for whatever might be coming? I mean, I always believe that your resume is a working document. It's a living document. Anytime you touch a new technology, anytime you are working on a new project, even if you've been in the same organization for 10 years, if it's a new project, that resume should constantly be updated.

I think that you should be able to grab it when anybody asks for it and maybe do a couple of tweaks and be able to send it off. So that should always be kind of in your back pocket, so to speak, as far as a living document goes. I also am a strong advocate of staying relevant and networking. You can do it remotely. I mean, look, Colorado Equal Security Slack channel is wonderful.

I mean, I think there's a lot of different places. There's groups that you can participate. You should have a GitHub if you're a technologist. And you're doing any work like that where you can share your information or you can do some crowdsourcing and crowdsharing, collaboration, and stay really relevant as you're working from home, there's a lot of ways to just keep your network fresh and communicate. I think oftentimes people correlate networking with happy hour, and it's sort of true, and we're learning how not to go to happy hour right now.

Still network. I think that there are going to be ways that we can keep doing that and staying relevant. I strongly recommend to all the folks that I talk to is keep that resume updated. It's a living document, it's always something that you should, you should add to, and then stay relevant, whether that's sharing content on LinkedIn, whether it's posting something new, whether it's just kind of resharing stuff that you see. But as long as people are seeing you out there and, and, and they're noticing you, that's always helpful.

Because when the time comes when you want to reach out to your network, they'll have seen a feed with you on there, or they— you know, they— you're on the fantasy football team, right? Or something like that. They'll, they'll see that out there and they'll know you that way. Yeah, I think that that's one of the more powerful things is is people often associate networking with business-related functions, even if it is a happy hour, but you're going there to talk about security or something sort of job-related, right?

I think a lot of the most powerful relationships that you make are not related to that, right? Whether it's through fantasy football, whether it's through getting to know people that also go mountain biking, that, you know, whatever kind of shared interest that it is. Yeah. You know, those are really powerful, usually pretty natural too, right? Because it's not— you're not having to force yourself to talk about work, or, you know, it's not uncomfortable in that way.

It's like, hey, you both have a shared interest, let's talk about this shared interest. Yeah, I agree. I mean, right, the activity that I've been able to do over— I don't know what you've been doing, but outside I've been golfing golfing. I live in a golf community, and so they didn't shut down the golf courses, right? So that's been awesome.

And we weren't sharing carts, just unless you were in the same family. And we— I ended up getting paired up with a lady, and it was— I think we were on hole 15, and she said, what do you do for a living? And then now we're working together on a project. So it was very easy, and it just made sense. We enjoyed golf.

We were outside when, when that's the only place you can be. Yeah. And I think that's right. I think, I think that, I think that people do miss that they— there's so many other ways to create relationships and sharing that and getting into those meetup groups that are now all virtual and online. I also really strongly recommend Take a class.

Take a class. Sit in a webinar. Share that experience. Find out who else is taking it. Use some of those things that are being given to us right now that normally wouldn't be.

Take opportunity to really expand yourself in that regard. And then survive, honestly. Like that whole, we're gonna, like, you know, everybody's gonna be fit and lose all this weight and they're gonna— no, don't do that to yourself, right? Just survive, but try to keep, try to keep that forward motion. Yeah, I do have to say that at the beginning I tried to be really good.

I was like, I'm gonna try and accomplish a whole bunch of things over this time while we're at home. And I was, you know, constantly on it. And as it wore on, you got less and less and less. And I mean, there was a little while where I kind of felt like I was in a rut because every day was exactly the same. Um, that would be the month of May.

Yeah, I think. Yeah, it was probably, uh, end of April, May. Yeah, in that time frame. So we realized we weren't coming out of our holes. Well, I— and then I also realized, um, I mean, obviously there are weekends, but I hadn't taken a vacation day all year.

Um, I had had some vacation plans, uh, in March and in April that got canceled. Right. So, you know, we had had some stuff that we were planning on doing but didn't end up doing that. And so in May, I was like, you know what, I— it's a Wednesday. I'm just taking the day off.

I don't really have anything I need to do, but I am gonna break my pattern and I'm gonna do something else, whatever that may be, and, you know, go from there. And hopefully that'll help. And it was nice, you know, just doing something different. Other than getting up in the morning, sitting at my computer, and then, you know, doing yard work or whatever. Yeah, I know that for a lot of people, they need— they— I think they're getting the kids through school, right?

Having them remote learning. I wouldn't even call it homeschooling. It was definitely a remote learning situation if they, you know, if they could. But I mean, that was hard. People were walking in.

The video conferences that I was a part of were hysterical. I loved every second of it. Listen to— listening to a baby cry and ask for daddy and getting on the lap, it was just fun. And, and, and really seeing people for who they are versus in a more professional environment where you're kind of— the walls up. And people got to really get to know each other during this time.

I think that's probably one of the benefits of it. Now people— now that kids are not in school, so that's helpful. There isn't this learning time that you're also trying to juggle with work. Yeah, a struggle for sure. I also— I'm horrible at golf, but, but I got out and I played golf.

I think it was 2 weeks ago now, and it was, you know, even though I know I'm horrible at golf, I, I accepted the invitation to go play and Because, um, I just, I was like, oh hey, I can get out and go play golf. It's something different, let's go do it. I don't care if I, you know, if I shoot 100 for 9, that's fine, right? Um, I'm just gonna go and have fun. So that was, it was nice being outside and just, uh, enjoying it and doing something else.

I'll have to have you out to our golf course then. Oh, it sounds good. I, it'll be, it'll be painful probably for both of us, but, uh, at least for me. Listen, if the beverage Wish cart is on point. There is not a problem.

We're going to do it. Exactly. Sounds good. Yeah. So the security industry is interesting in that I think that the people are generally pretty unique, even for IT people.

What are things that you have learned about the people in the security industry? And then also, what advice could you give to people who have the interesting personalities that we have in the security industry?

So, I think one of the personality traits is they're highly suspect, right? And they do their due diligence, and they're not going to speak freely. They don't take every invitation to talk or email or have a meeting. It's— they like to do their due diligence before they start opening up to people like me. So I'm going to talk from my perspective as a recruiter and reaching out.

I, I've had to be very— I'm— I've learned from my initial kind of starting in recruiting and just technology to taking that leap into cyber to be extremely transparent. So I'm extremely transparent with my potential candidates that I could place and even more transparent with my clients as far as how I do what I do, what my rates are. I don't like hidden numbers. I don't— I really— I've learned that specifically with security folks, you have to have that with them because The second that they don't feel like you're operating in their best interest, that trust factor is gone and you're done. You're just gone.

So I learned that very quickly, that this is a different group of folks. They're gonna ask a lot more questions. They're more diligent on who they're doing business with, how they're gonna do business with you. I pride myself on being extremely confidential, so people don't have to worry if they make that phone call to me that that name is going to be broadcast anywhere else. From my clients to my candidates, I don't really share who I work with.

Yeah. Yeah. Nice. I also often hear frustration from people on several fronts around, around job hunting. So some of it is on the hiring manager side.

Some of it is on the candidate side where it's on the recruiter side. Well, I'm sure some of it's on the recruiter side too. I hear less of that. But, you know, on the candidate side, sometimes it's, hey, why are— there's all these security jobs, why can't I get a job? Or, you know, is there really a shortage?

Because it doesn't seem like there's a job for me out there. Or, uh, yeah, ghosting or other things like that are, you know, common things that I, I hear about. You know, uh, do you think that those— I guess maybe just get your comments on those, those sorts of, uh, perceptions. Are they real? How can people, uh, work to prevent that stuff?

What can they do? Is it something they can do better? Is there really a problem out there? Yeah, so Yes, on all of those things that you mentioned. Yeah.

So shortage of talent. Yes, absolutely. What I find is with my clients, they, they need— they're in a position where they need somebody that has the experience. They need that technical depth. They need somebody that's kind of been there, done that.

There aren't a lot of companies that are offering kind of a boot camp scenario where they can bring them in at entry level and train them up. There are now third-party organizations that are helping fill that gap, but even when folks come out of those training environments, it still lacks that hands-on, real-world experience that a lot of my clients are looking for. So until we kind of have a solution that that bridges that gap from entry level to, you know, that, that 2 years of experience sitting in a SOC and really seeing it. I, I think we're still going to have that challenge. So I think— I don't— I guess my, my only advice is if somebody wants to get into cyber, that they really need to take a step backwards and go in.

If they— maybe they're a technologist, right? Maybe they have some level, maybe they're a sysadmin or a network engineer or something like that where they have that foundation but they really want to go to this next phase or go into cyber, they have to be able to be okay taking a step back. That's what I'm finding from that. Ghosting, you mean the candidates ghosting or the clients ghosting? I think more often the recruiters, everyone I think it could be more on the hiring side, whether it— I think I heard it more around hiring managers.

Hey, I've been talking to so-and-so and then all of a sudden, you know, they disappear or I'm supposed to be getting an offer and then nothing or, you know, things like that. So I think that that does happen a lot. I think that they're trying to tighten it up from a company perspective as far as making sure that if you've applied for a job and you got an interview, that they're properly dispositioning you and saying thank you and kind of wrapping that up. The pro— nobody likes to hear you weren't selected, right? But I think it's a really big deal when we talk about how do these companies go to the market to try to attract people that are in demand.

And if you're a company that's not treating those people good during your interview cycles and that process, that, that word gets out pretty darn quick. I mean, I think we could all rattle off the top 5 companies in Denver that probably doesn't have a great reputation, right? And that's, that's because of how they treat people during the candidate process, right? And, and I think that they're realizing that company brand and company marketing and marketing to potential employees is a huge part of their business if they think that their business is gonna scale, because there's no way it will if they can't get the people to come in and do the work. Yep.

So I think that that's getting better just because I just attribute it to social media. Listen, there's— it's It's out. Once it's out there, it's out there. And so doing everything they can do to keep their name off that in a negative light is probably pretty important to most companies. From a candidate perspective, I think they have a harder time telling a potential opportunity no.

If they got a counteroffer or if they got another offer from another company and they were interviewing with 2 companies at the same time, there— I give them a little sense of forgiveness because their job isn't to figure out how to tell somebody no. Their job is to do their job, and that's whatever they're being interviewed for and hired for. And so coaching them to— as a recruiter, I like to coach them and say, you need to send a know or make a phone call, they put a lot of time and effort into getting you through the process and getting an offer out there. And it's the right thing to do because you don't know, in 18 months you might want to come back to them, right? And if you end it well— and that's kind of coaching people that aren't particularly savvy in that perspective.

They don't want to say no to an offer. They don't know how to do it. And I don't think it's ill intent. I just think it's just not being knowledgeable. Yeah, I give everybody benefit of the doubt first time.

Yeah, well, that's good. So you mentioned experience and people are looking for people with experience. So, you know, that comes to the sort of chicken and the egg problem that I feel like we have in security where we're trying to get all of these people into the security ecosystem because we feel like there's a shortage of people. Many of the people that are entering don't have experience in security fields or even in technology fields sometimes, or, you know, other things like that, career changers or, you know, boot camp people, things like that. And, you know, you mentioned taking a step back to be able to, you know, sort of take an entry-level job, but there's also only so many entry-level jobs.

Right. So, so how is it that we solve that experience problem?

I really think that it's going to be these corporations investing in it. They have to create an environment in which they can bring in entry-level folks or no— with no experience and be okay with suffering the attrition because what inevitably happens, right, you get— and this happens whether it's security, IT, or a call center. You have a company that's really good about bringing people in and putting them through their training and getting them ramped up, and then what happens in 12 months or 18 months? Well, they leave for another company that's going to give them $10,000 more or whatever the dollar is, right? And they have to they— that company's always like, that's the training ground for this company, and then they're the training ground for that company.

And, and we see that here in Denver. I think that companies will have to really decide whether or not they need those people. And if they need them, they bring them in to train them up and career track them instead of losing them after 18 months. That, that's just a commitment to an organization that an organization has to make if, if those roles are really, really needed. I don't know that there's another solution other than more third-party boot camps.

And it's still— it's helping, certainly it's helping, and you can get some good graduates out of there that are really awesome and they do a great job and there's a success in that hire. I don't know that that's gonna— that's the end-all be-all for them. Next phase. Yeah. And if I knew, I'd create it right now, Alex, and we'd be in business.

Let's do it. Um, you know, one of the other things is, uh, security is— I don't want to say unique, but is, is, uh, is definitely very focused on a certain individual. There's lots of now older white males that are that fill security positions by, I don't remember the numbers, but it's a lot, a very large percentage.

And with, you know, for a long time, you know, companies have tried to focus on diversity, you know, with everything that's going on in the country right now, there is even a greater focus on diversity and equity and things like that.

How is it that we help that problem in security as well?

Well, as you know, I started this initiative several years ago with Sarah Avery. They asked me to join the Women in Security Denver board and really get that going and engage women. And we actually had lots of conversations during those meetings about how do we get women involved and at what level do we start engaging them. Elementary school, middle school, high school, college, and continue to keep filling that funnel, understanding that the best security teams have a diverse look and feel to them because they all come with a different set of eyes and how they're gonna attack a problem or how they even view what's happening differently. And that we know, we know based on a lot of facts and figures that that is the best type of team.

It's just then how do we actually make that happen? I think it's the only way it's gonna happen is if there's strong initiatives around it and a true commitment. I think you can say we, you know, we want diversity in our hiring, but if you're not actually going out there and tactically doing things that are going to attract people, different types of people to your organization, then it's just a lot of talk. I think that there has to be allies. There has to be women championing women.

You know, there's Black and brown people championing Black and brown people to come to these organizations. I think mentorships are so super important. And I also think that I, I actually have a very good friend who's a partner at one of the Big 4s, and she and I've had lots of discussions about this. And one of the things that she says is she's always had this open-door policy of like, come see me, come see me anytime, you put your name on my calendar. And over the last few months, she's realized there's a subset of her team that's not.

And it was very clear that people that looked like her were very comfortable and people that didn't weren't. And so she took an initiative to reach out to them directly, get them scheduled on her calendar, and, and, and make that effort. I think that we can easily say, hey, I have an open-door policy, come talk to me, but if they don't know you're a safe person to talk to, if they don't really know you, that's probably not going to happen. And so she had to go out and make sure that these folks on her team knew that it was a safe place and it was a place where they could come and sit and how can she help them grow in their career and what is their track. And so she's really made a concerted effort in doing so and she said it's been game-changing for her and her team to be able to have those stronger relationships with different folks that she wasn't having because they were just not naturally going to see her.

Yeah, yeah. I mean, and I think, you know, ideally you, you want your organization, your HR department, your, your executives to, to buy in and have some sort of initiative like this that, you know, affects the whole company. But if you don't have that, do you still think that you can make a difference, say, as an individual hiring manager? Yes, I do. I do.

And actually, I was just reading this study and they said it was, I think, only 45% of large corporations have a diversity hiring initiative. So that's 55% I'm surprised the number is that high. Yeah. So that's good. It's good and it can be better.

Yeah. But I think that every individual has an opportunity. I mean, I'm just me sitting in my home office, but I definitely get involved in special organizations and groups to help bring young women to security and technology.

I think that there is a lot that as a individuals we can do. I don't think that— listen, I'm not a proponent of not hiring the best candidate. I think that the best candidate needs to be hired in every situation. I'm a proponent in making sure that you've uncovered every rock for the best candidate and not just fishing in the same old pond, if that makes sense. And so I think that really it takes a conscious effort to do that.

What do you think about job posts themselves? Because I, you know, I've read things where, again, I'm not going to remember the numbers, but, you know, male candidates, for example, if they see that they meet like, you know, a third of the requirements, they're like, oh, that job's for me. Whereas female candidates, it's like two-thirds or three-quarters or something like that before they feel comfortable that they can do that job. So that is still true. What do you think people need to do for, for the job applications themselves to make sure that they can get that good pool of candidates in?

Right. I think that, I think that people would be really surprised about the internal conversations that are happening when we talk about job postings. And it's a forever thing, right? So like, I want all of these things, and people are really hoping for the best. They're listing every single requirement under the sun and hoping.

Well, the chances are there's not a person that walks around with all of those things. And I think that oftentimes people, especially women, because I've seen similar studies, they don't believe that they are qualified. And where men are less qualified and think, well, I could do that. Well, you know, and so I always— I'm a strong advocate for people to say, you know, pick 5 of those things, and if you're qualified, highlight the 5 things that you're qualified on. Yeah, hopefully people can hear that on the recording.

That is awesome. The Kona Ice truck— we don't have an ice cream truck in our neighborhood, we have a Kona Ice truck— just drove by. Oh, and it looks like they're actually stopping right outside the fence. Is it a boozy Kona Ice truck? I wish.

We could go buy one and then add booze ourselves. That's great. So we'll have a nice potential soundtrack in the background while we're talking. So, so what do you think that people should— I don't want to say dumb down because that's not the right word. Do you think that they should be more— did you think it should be less specific in their, in their job posts?

Do you think that they should be— how is it that they can make them better? Because I mean, obviously everybody wants all the requirements if that's what you think you need for that job, is it just thinking about, do I really need this? Is it— how do you approach that part of it? I mean, I always say when I have conversations with hiring managers, I would want them to just give me their top 3 to 5 must-haves. Give me those and let me know what you— outside of that, from a soft skills perspective, what is it that you really want?

And so let's just— let's minimize the hard skills, and then let's go to the soft skills. Because ultimately, I mean, I know you've probably interviewed enough people where they check all the boxes, but you're like, I could never work with this person all day long. And so that's just not gonna happen. So when you use a recruiter, especially a third party where you're not having to follow all of the HR guidelines, and you can really kind of get down to brass tacks and say, this is what I need in my team, this is the environment in which we work, these are the personalities that they're gonna to work best with. I think we can minimize the long list of requirements.

Let's, let's see if we can get— and then let's start talking about soft skills and culture fit and all those things that make sense. And gotcha. Um, I think that's from a job description. I think that would help people be more inclined to apply. Yeah, no, that makes sense.

You know, I mean, I look at things and I'm just like, geez, like, what, really? Yeah, no, it's just not going to happen. And then I can coach or consult in that regard. But yeah, and the women, when you're listening to this, go apply for the darn job, especially now more than ever. I mean, I think that there's a huge push on diversifying the team.

Like you had said, a lot of middle-aged, upper, older-aged white men men kind of dominating and running this industry. The one thing that I will say though is those same men are— they, they have realized that they need to diversify their team, and they're open to doing it and welcoming it and, and championing it. So that's what's been nice over the last several years, watching that. Awesome. Well, we are just about out of time.

Uh, was there anything that you wanted to cover other than Kona Ice? Well, right, we, we can wrap up and go check out Dakota Ice. No, I mean, I think this is it. I really appreciate it. I mean, I've been part of Colorado Equal Security since you guys started it.

I've known you and Robb for, I think, years now. Yeah, working with Robb, I've done different things over the years, CISO dinners and all of those things over the years. So it's been a lot of fun watching you guys kind of grow this and create this environment for the local people. So thanks for having me. Well, thank you.

I appreciate it. Appreciate it. Yeah. So appreciate your time. Thanks for the interview.

This has been Colorado Equals Security, and we'll talk to you next time. Thanks, Alex. Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado equals security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.