Deidre Diamond -- The Soft Skills of AppSec

0:05Chris RomeoThe Application Security Podcast. Here we go. Welcome, friends. We are joined by Deidre Diamond, founder and CEO at CyberSN and the founder of Brain Babe. We discuss employment in the world of application security. We also dive deep into soft skills, exploring why they are foundational in the workforce. Deidre explains the benefits of win-win conversation, how words and common language connect, and how to have fun, compassion, love, integrity, and productivity all in one at work. This is the midpoint of our first season of the AppSec Podcast. We'll take next week off and then come back with 9 more episodes that drive us to the end of season 1. So please stay tuned. So we're back, uh, coming to you live from the ISC² Security Congress. And right now we're going to talk about the world of employment as it comes, as it comes in with application security. So I'll let you, Deidre, I'll let you just introduce yourself if you wouldn't mind.

1:29Deidre DiamondAbsolutely. My name is Deidre Diamond. So the Deidre is hard for everybody, and I don't hold anybody accountable to that, but it is Deidre. And I'm the founder and CEO of Cybersecurity Network, which is cyberascent.com. We are the largest national staffing agency around cyber professionals. We only focus on cyber.

1:50Chris RomeoOkay, and so our first— I don't know if Robert warned you, but our first question we always ask everybody is, what is your security superhero origin story? So every comic book starts with, where did Spider-Man come from? Where did everyone come from? So we're curious as to how did you even get involved in security and what made you make that transition?

2:09Deidre DiamondAbsolutely. So I'm a sociology criminal justice major, and out of college I went into technical recruiting. I was hired by serial entrepreneurs who taught me the business and then gave me the opportunity to build an agency to 36 offices across the country over 13 years. Those founders also started Rapid7, and at about 18 people into Rapid7, I was asked to come build out sales for Rapid7. So I took the staffing model, took it to Rapid7, and we went to $50 million in 4 years of both recurring revenue and new revenue, and had a great experience of building out teams around me and what have you. So, that was my entry into cyber, and I'm lucky and happy that I did.

2:57Robert HurlbutHmm.

2:57Deidre DiamondIt's been fun ever since. I get to put my, you know, my love for studying people into real world in terms of, you know, this is a matter of national security, most of the stuff I'm dealing with. So it's fun.

3:12Chris RomeoYeah, and I know that you had a chance to speak on a panel here at the conference, and maybe you can tell the listeners a little bit about what was the focus of that panel and what was your perspective that you offered to the crowd.

3:25Deidre DiamondAbsolutely. So the panel was about building and retaining cyber teams, and what I brought to the conversation was culture. And that I've been in and around working around technologists for 21 years now. And what I see is just a constant breakdown of communication. And that translates into people leaving their jobs every 12 to 18 months. And that means that there's a lot of people having a lot of emotional turmoil on a regular basis. And it's not necessary, in my opinion, if we can create measurable agreements.

4:06Chris RomeoRight.

4:07Deidre Diamondsuch that they're truly measurable, then I believe we can eliminate a lot of the churn that we have. And so, what I was talking to people was about the soft skills and how important they are and how much we all need to recognize it and go after getting those skills and how those skills translate in the workforce. And what does it mean to be a good culture? What's fun?

4:31Chris RomeoWhat's—

4:33Deidre DiamondWhat does it mean to love in the workforce? You know, I worked for the same people for 20 years and they just happened to retire. They'd still be around me. And the people with me are the same thing. And we build companies and we stick together. And I get that the rest of the world doesn't get that. So I'm out there really helping to— how does that— what does that look like on a daily basis, you know, to come to the table with those soft skills?

4:59Chris RomeoYeah, and that's a topic that's near and dear to my heart as well. So I had the chance to design a master's degree in cybersecurity for a big university in California, and we got done with all the technical courses on the board, and then I said, okay, and the last one I want added, I want a class on communication. And they all looked, all the professors kind of turned around and looked at me, and they said, what? What are you talking about, communication? I said, that's all the technical, that's the easy part.

5:25Robert HurlbutYeah.

5:26Chris RomeoGetting these people prepared to speak to a board about what they found and the plan that they want to put forward, if you don't teach them communication and those soft skills, tech people are not known to be good in boardrooms if they're just technologists. They have to have that exposure. So I'm a big fan of that idea of soft skills too. So what do you think of, so when you're talking about good soft skills, what do you define that as?

5:51Deidre DiamondAbsolutely. I think the major categories of soft skills is the ability to have a win-win conversation. And I have a friend of mine who jokes about this all the time that says, Deidre, it's not really win-win in what you're doing because there is a loser. And it's funny that he says that, but my point is such that, you know, all of us, we're involved in conversations every day where somebody's not getting what they want as a business owner. And that could be a loss, right? They're losing in the conversation, or they can walk away feeling like they want. In both examples, the results are the same. There's something that they're not getting. And it's the cyber leader's professional interaction that will make that person walk away feeling good and accepting that they didn't get what they want. However, understanding it and getting the greater good and wanting to participate versus, I have to do it because I was told. And That's a win-win conversation. So that skill in itself is game-changing for one's ability to climb the ranks and also to be more involved in the business. Who doesn't want to be more involved? Everybody really does. It's just what does involvement look like? So win-win communication is one. Word choices. So we all communicate with words, and so a common language is absolutely necessary. What's the common language that works you know, for cyber and what are the words we ought to eliminate from our vocabulary. I talk a lot about that, you know, the words of when I say to you, I really like what you just said, but blah blah blah. Well, whoever you're talking to is saying you didn't like what I said, and that's not a compliment. And yet we, the majority of us, use that word in our— in having these conversations all the time. And so I say get rid of it, get rid of the word but. There's some other words that do the same thing, which is not win-win, you know, turn people off versus turn people on. And so, I think, you know, words and really focusing on a common language is a big piece of this. And then the other is, how do you have fun and compassion and love and integrity, you know, and productivity all in one? What does that look like? What does that look like? And people sometimes are amazed in what I'll have to say. I'll tell you, love in the workforce is making sure people, and particularly women, are dressing such that they can advance. And if men are 90% of the population and they're not willing to tell a young woman that they're not dressing in a manner that's going to move them up the ranks, well then that young woman isn't going to move up the ranks. And so, you know, there's So many things that fall under the category of what's love in the workforce and, you know, helping people get out of the sexual thought that comes to their minds and really saying this stuff matters. This stuff really matters.

8:58Chris RomeoSo you think about how much time we actually spend in— if you work in a standard office, you're with those people almost more than anyone else on earth. You're spending more time with them than you do with your family. And I mean, I've been lucky to work from home for the last 10 years, so I'm in a little different spot. And I know you, Robert, you're the same way, you work out of the house. But for those people, the majority of people still work in an office and they're spending a lot of time with these people.

9:22Deidre DiamondAbsolutely. And even working from home, mentoring or managing somebody in my mind is mentoring them. You know, ought not take the management title if you don't want to be responsible for that person's career advancing. And so It's really important, really, really important. And had the gentleman that hired me didn't have those conversations, didn't set a policy for how we dressed as young women, then we wouldn't have had 40% of our companies as women, which is what I grew up in and have been a part of. And what do we have now in the industry? 10%. And not only were we 40 to 50%, we at times we were 50.

10:01Chris RomeoLeadership.

10:04Deidre Diamondwas, and running the company was a female, you know, replacing a male, and tons of women in leadership. And so, you know, I see a direct correlation to the sort of the rules of engagement that they were willing to set in place. And so that's just one example of how to show love in the workforce. Love is helping others, giving to others. So we talked about those, I talked about those.

10:31Robert HurlbutYeah.

10:32Deidre DiamondAnd do talk about those 3 things a lot. A lot. They matter.

10:36Chris RomeoI think those are very applicable to our average audience member who is a developer, a tester, manager, not necessarily part of the security establishment, for lack of a better term at this point. But I think these are 3 things that you can apply these to anything.

10:51Deidre DiamondAbsolutely.

10:52Chris RomeoThese aren't industry-specific. This is something I'll go back and share with my children.

10:56Deidre DiamondYes.

10:56Chris RomeoWell, just to say, here's some good things to think about for life regardless of where you're working. If you're wherever you are, even just dealing with people, win-win conversations, choosing the right words, having fun, and knowing how to show love. And when I think of— when you're talking about the word choices, I think about you get into the whole dynamic of some people speak this language called technical, and they don't realize when you go to the boardroom, if you start talking about SQL injection and cross-site scripting, those people, they've already— they're done. They shut down. They may be looking at you, but they're not hearing anything that's coming in. Sure. And so, is that— have you seen What have you seen about from the talking technical versus talking— Cyber terms, as they call it.

11:39Deidre DiamondAbsolutely. So, as a CEO and today building my own technology, but also being a CEO prior to this at an established software company, I can tell you that the software developers have been, you know, sort of left behind as it pertains to business. And so, it's sort of unfair to all of a sudden say, oh my gosh, you guys are terrible in the boardroom. Meanwhile, we've kept them in back rooms and, you know, out of meetings on vision and strategy and sort of just go code.

12:13Robert HurlbutRight.

12:13Deidre DiamondAnd so, I look at, you know, sort of this, what's going on and say to myself, you know, we all, we create what we have and leaders are the creators. So, they, you know, us leaders out there sort of created this and really, All it means is that the software folks aren't bad in the boardroom because they're not capable. They haven't been exposed to the vision in a capacity that allows them to be a part of the strategy. So, when they can be in tune with the vision, they can be in tune with the strategy, then they'll think security, they'll think boardroom, they'll think, how do we all do this together in a really powerful way? You know, I always tell people, technologists, cyber people, they're no different than any other human. We all want to feel like we're doing a good job. We all want to feel wanted. We all want to be a part of a team that's, you know, inclusion and transparency. And then we take our most brilliant humans, our technologists, and we somehow, you know, convince ourselves that they don't have social skills or that they're too introverted for the business stuff.

13:25Chris RomeoRight.

13:26Deidre DiamondAnd again, I don't think people did it on purpose. purpose, but that's what happened.

13:29Chris RomeoYep.

13:29Deidre DiamondAnd now geek is chic, and chic means in the boardroom, and we're playing catch-up. And it's really about how willing are the leaders of today to make sure that they bring everybody with them and educate them and help them and put them in some courses and give them the training, because it— and then expose the business to them. Must expose the vision and the mission and the plans of the business To all technologists, such that— and to everybody in the company, quite frankly— such that there is harmony and people don't walk into boardrooms speaking a different language. There's a complete common language regardless of our own specialties. That's what I see.

14:09Chris RomeoWhat are some ways to do that? I mean, I've heard that. That's a great thing. And I think we should do that. But what are some ways that we could do that, where that change could happen?

14:19Deidre DiamondI think that it's literally the town hall stuff. It's the leaders of the organization sharing the knowledge of the vision and the mission and the strategy. And then depending on where the company's at, how frequent that is. So for instance, when I'm doing startups, it's weekly.

14:35Robert HurlbutOkay.

14:35Deidre DiamondYou know, when a company's established and the plans are literally for a year or 2 years, then it's monthly or maybe it's quarterly with everybody. With management, it needs to even, be more often. But, you know, as a startup's changing so much, it's sort of weekly, monthly for sure. And really, startup, to me, the definition is until the framework's in that, you know, you sort of know the entire model and you're just scaling at that point. And so, I think the leaders of organizations need to be in front of everybody and bringing everybody into the story. And it's a constant. relationship with that story and keeping people in tune with the story. And then making sure it drops down into the lines of leadership, that everybody's got one common language of what we're doing, why we're doing it, and the challenges that we face doing it. Because we want our brightest of bright thinking about the business challenges, not just the SQL injection stuff that they're dealing with. We want them thinking, I mean, My CTO today was a leader at the last company I was with, and he was the first to jump into the sales bullpen and, you know, dive in with me when I took over the role. And, you know, he's my CTO today and is, you know, doing incredible stuff with us. And it was because he put himself into the sales and the business side of things that made him so valuable to me and so interesting. And, you know, just the friendship that comes from that too, and that we're both here to work together and help each other is incredible.

16:16Chris RomeoSo how do you see people— so if we have— we like to talk on the podcast about this average developer.

16:22Deidre DiamondYep.

16:24Chris RomeoWhat would you recommend that the average developer do in the first week if they're listening to this, they're saying, wow, I struggle with social skills, I don't know how to talk to the people that aren't coders like me. What would be your guidance to them right away, week 1? What should they do to get them to move forward and be better?

16:45Deidre DiamondWell, definitely training classes. And so first checking what your organization offers and then looking outside. Situational leadership is something that I really enjoy in terms of, you know, them helping people manage up and down.

17:01Chris RomeoIs that a class?

17:02Deidre DiamondIt's a class. Situational leadership has been around forever. I, you know, we had executive leaders from Rapid7 bring them in and we loved it. I love it. It's a great program that's established today.

17:16Chris RomeoYeah.

17:16Deidre DiamondAnd then I would say, you know, get out there and practice. Practice talking to people. Go to networking events. Put yourself out there. Go to an improv event where you can practice being uncomfortable because Until that uncomfortableness goes away, one's not gonna love, you know, the art of communication. So practice, get in front of a mirror. I took some courses that put me in front of a mirror a lot, empowerment training courses for leadership, and I never thought that could be so powerful, and it was. It was really interesting to In front of a mirror, practice saying the things that you want to say to people so that you can see your own facial expressions, you can see your body language, and such that the first time you're, you're saying that isn't in that important conversation. And so I really think that, you know, got to get out there and get some training. There's books, you know.

18:22Chris RomeoWhat would be your top recommendation?

18:26Deidre DiamondSo The Power of Now is my top recommendation. It is not gonna say, you know, do this and here's your 5 things. It's about the concept of consciousness, living in the now, meaning really engaging the person you're talking to versus all the stuff that goes on in our minds and being able to put that aside. It is very much a, a, a, a Understanding the conscious mind versus the subconscious mind. And so, and then I would watch videos. I would make it a large portion of my life is to be trained on these skills because they will impact your personal life as much as your professional life. Although to me, I don't separate them, but I know that registers with folks. Yeah.

19:15Chris RomeoSo what about Toastmasters? I was thinking of that when you were talking about practicing. Toastmasters is an environment that causes you to have to be pushed out of your comfort zone with a hard push, either doing an impromptu talk or something that you prepared.

19:31Deidre DiamondI've heard about it. Yeah, I've never participated, but I've heard about it, and I think that's what I did in my training courses. They would— I had to walk around a restaurant with a hat and sing and ask people for money, right? I mean, I was sweating, and I almost didn't do it. And it was the advanced course, and I really struggled. However, the minute I did it, it was this extra level of confidence. It was— you can't even explain it until you experience it. And that's why I tell people all the time, just do it. Just break through that fear of talking. Break through the fear of, I'm gonna say something wrong, by practice, practice, and then just do it.

20:11Robert HurlbutRight.

20:11Deidre DiamondBecause at the end of the day, if any one of us are working for somebody that doesn't like what we have to say when what we had to say was not malicious or unprofessional, then great, let them fire you. Get out. And if they push you out, fabulous. There's too many places to work today for technologists and particularly application security engineers.

20:36Chris RomeoYeah, and that's something that I'm a big believer in that as well. Just go out and do it principle. That's how I got started in public speaking. Somebody invited me to join them up on stage with a particular talk. I was scared to death, but I'm just— and I realized that I just have to not worry about what people think about me.

20:57Deidre DiamondYes.

20:58Chris RomeoYou just have to go up and say, you know what, I'm gonna have a good time, I'm gonna laugh, we're gonna have fun, people are gonna— hopefully some people are gonna enjoy it, other people may hate it, and you know what, that's okay. I'm okay with that because I'm just gonna give everything I've got and there's nothing else to do. So just getting out there and doing something though is better than sitting back and worrying about it.

21:16Deidre DiamondAbsolutely. Fear is our number one enemy. You know, it was designed for us back when we were being chased by wild animals that wanted to eat us. And so we still haven't figured out— our minds haven't yet figured out how to manage fear. And what's happening in modern society is just the fear to speak. It's so massive, and it's really slowing us down because we don't work in manufacturing plants anymore. It doesn't— it matters now that people aren't speaking. It didn't matter before.

21:48Chris RomeoYep.

21:48Deidre DiamondWe're in a business of communication. Everything's communication now. When I was telling this story earlier today, when I started in January of 1994, the first company that I recruited for in tech was looking for a Pascal developer. And anyhow, one of the questions I was trained to ask is, does this person have to interact with anybody? I mean, literally, we were trained that these people sit in the back room and you just want to make sure they don't have to interact with somebody because if they do, man, that's a hard person to find. We probably don't have them, you know. And so that was only 22 years ago.

22:29Chris RomeoYeah, I think about that, that fear to speak, and I have the luxury of teaching a high school computer class twice a year and The kids, a lot of— so the kids have 2 choices, speech or computers, and they think, oh, I want to get out of speech, so I'm taking computer class. What they don't realize is I make them stand up in front of the class 5 or 6 times during the semester and deliver 5-minute talks, 10-minute talks, and nobody gets out of it. It doesn't matter who you are. Everybody does. And they're always like, well, why are you making us do this? We didn't want to take speech.

22:59Robert HurlbutYeah.

22:59Chris RomeoBecause this is a skill I see so many people don't have. And we have to refine it when we're young so that when you get to be out of college and someone says, will you stand up and talk about that at the meeting? You're like, yeah, sure, you can. It can't be any worse than a group of high schoolers, you know? So they can, they can stand up and they can be confident to speak and not have that fear going on.

23:19Deidre DiamondAbsolutely.

23:19Chris RomeoI'm about trying to, trying to teach them young on how to deal with that.

23:23Deidre DiamondPlease do. I'm out there saying we ought not separate these disciplines anymore. We can We can separate out once we get deeper than the frameworks of any— but the frameworks of the disciplines all are now the same because we're in IoT. We're in the age of wars with technology from far away. So, it makes no sense to say that, you know, one is a good communicator and one's a good technologist. It just makes no sense.

23:51Chris RomeoIf they want to be CTO someday, they gotta be able to do both because you can't be a CTO even though it says technical in the title. It's so much more than designing on the whiteboard for what the next product iteration is going to be.

24:05Deidre DiamondAnd even just the happiness level versus the titles and the money, it's not fun to work in teams and be the one that isn't a good communicator. It's not fun for them either. They're not enjoying it.

24:20Chris RomeoYeah, right. So if we were to change gears a little bit here, I think our listeners would be very interested in, since you do have a very wide view of the industry as far as where the needs are, and we're catering towards application security people, developers, testers. So first, from the application security perspective, what does that market look like right now, and is it as hot as all the news releases and things say it is?

24:47Deidre DiamondSure, sure. It's absolutely as hot as all the news releases are saying. However, if you talk to a cyber professional, they'll tell you it is hard to find a job. And that's really why I founded my firm, is that I realized that the cyber community was not being serviced and that they all were settling because of how hard it was. So we've got 2 problems. We've got digital search is a mess. It's not for an individual job seeker. They're for agencies. And number 2 is all the recruiters and the internal and external recruiters don't speak the language of cybersecurity. So if I'm a cybersecurity professional and I put my resume out there, I'm going to get 15 to 20 calls a day, minimum calls, never mind emails. And when I show up to these calls, it's not the right fit because the common language is so poor that— and we're putting keyword searches everywhere and it's, you know, You know, it's a mess. And so they're working and nobody can afford that sort of a distraction. So they either stop their search or, you know, their search lasts 7 or 8 months, sometimes a year, because it's only through their network that they're finding things.

26:04Chris RomeoRight.

26:04Deidre DiamondAnd it's just crazy because so many people are hiring that a cyber professional could really pick, you know, some really cool opportunities, but they can't even find— it's just mind-blowing to me how bad it is. So that's why we're doing what we're doing. But I can barely service, you know, a small portion of the population. So most cyber professionals will say it's terrible. It's terrible to look for a job. So that's one thing that's going on. We're absolutely short hundreds of thousands of people. We're robbing Peter to pay Paul for sure. So the companies that have the best cultures and the best packages are going to keep their people and win.

26:45Chris RomeoWell, you know, I'm always curious when I hear that number, the number of openings, because I never see— and I just haven't dug into it deep enough to see where's that statistic coming from, because I've heard anywhere from hundreds of thousands to 1.5 million to—

27:00Deidre DiamondYes, it's hundreds of thousands of now, and you're right, the numbers get tricky because people are using them for now, and then they're using by 2019, which which is the 1.5 million. So you've got hundreds of thousands now, and then it's the— by 2019, it's 1.5 million. And ISC² has some of the best research on this that we've got, if not the best. And a lot of that is IoT. A lot of that jump is really coming from that, as well as risk and compliance and legal. And, you know, that side of the world is really beefing up. And the other thing that is in those numbers are the jobs at tech companies, which completely get overlooked when we say, you know, there's jobs in tech. Well, marketing and sales and, you know, finance in those companies, that's considered in those statistics. But we're absolutely short. I can't service the, you know, the community fast enough, and I'm the largest and growing every day, which is why I'm building a solution, a digital search solution that I think will change things. So because I want to service everybody and I can't possibly do that without us solving digital search partially.

28:20Chris RomeoYeah, so the other segment of our audience here are developers, testers, non-security people. And so I was hoping that you could explain and give them some perspective on what could they— if there is someone who just codes on a day-to-day basis and they don't have any security background, What are the opportunities that exist for somebody that's a developer and a strong security set? And what, how much would that make their job more profitable? Would there be more rewards for them moving from a developer to a developer that is a security expert?

28:56Deidre DiamondI would say that it's critical. It's sort of like you won't really have a job in, you know, certain X amount of years if one doesn't. To take security seriously because regulations are moving into application and software security and responsibilities for firms in their own writing of code or in software companies' products. We're gonna see that trickle down pretty fast here. So, for instance, people are saying, why does Microsoft get to release, you know, Patch Tuesday? Why does that exist? That's the problem, actually. And so, you know, that fight's been happening for a while, and the result of that is going to be regulations. And we're already seeing a shift in venture capital firms and how they evaluate an organization based on did they build their products thinking security first. We're seeing that now.

29:57Robert HurlbutYeah.

29:58Deidre DiamondAnd so in my opinion, it's, uh, if one doesn't adopt security, they're gonna have a really tough time in 5 years finding work.

30:06Robert HurlbutMm-hmm.

30:07Deidre DiamondAnd number 2, absolutely more money. So cyber professionals make 15% on average more than any other technologist. So just right there, being a security applications engineer means you're fif— you're making 15% more. And that's— those are neat numbers. And again, you know, what's best about all of this, if somebody's becoming security-focused, that means they're becoming business-focused. That means they're just more valuable in general to people. And as they converse and show who they are within an organization, to have that is game-changing in how people see each other.

30:47Chris RomeoI want to hyperfocus in on something you just said because this is really fascinating to me. And that is that you said the venture capital firms are starting to look at security as a differentiator, or maybe even to make a decision here.

31:01Deidre DiamondYes.

31:02Chris RomeoThat's a big switch. It used to be, show us the graph of new users and the momentum that you have. So can you talk to us a little bit more about what you've seen and what you've heard in that? Because I think that's a message that Helps all of our audience that are trying to, even in small startups, they might be debating, do we do security? Do we not? If you're telling them that their Series B or Series C rounds may be disrupted by not doing that, that's a message they need to hear.

31:32Deidre DiamondAbsolutely. So venture capital firms are in the business of making money. That is their business. They have people they must make money for. So the risk of investing in a firm that didn't think of security particularly when you're in IoT or healthcare devices, what have you. It's a checkbox that says, yes, there's risk. They didn't think security. And then they're gonna measure that risk, and they're gonna measure it by the industry that they're in, in terms of regulations and compliances that are coming down the road. They're gonna be well ahead of what that looks like in the Senate and Congress and what's going on. And then they're also gonna look at it from the perspective of, okay, so when we have to go re-engineer, because if If we're really gonna be legit, at some point, we must reconcile the fact that we didn't think security. And so, what's that cost gonna be? How expensive is re-architecting the product going to be? So, there's a dollar amount.

32:27Chris RomeoA friend of mine refers to that as pay me now or pay me later principle.

32:31Deidre DiamondThat's right. That's right.

32:32Chris RomeoThat's right.

32:33Deidre DiamondAnd I'll tell you what, if I'm the venture capitalist negotiating that deal, I'm gonna say, Because you guys didn't think cyber first, it's going to cost us X down the road, which I know is going to be money that you're going to spend that you're not even thinking of. I'm just going to have the upper hand from a financial perspective of the plan of where that money is going to go and what have you. And so, in my opinion, it's not something that folks want to do. And so, yeah, it's a game changer. That's why I don't even imagine them having careers. It's that significant. I mean, this is going to come down from the federal government. It's not even going to be an option.

33:14Chris RomeoGoing back for a moment in terms of the searching and trying to find the right people. So let's say, take the perspective again of a developer or QA person who doesn't have a security background, but they really would be interested in it. They want to go that direction. What's attractive? for a company looking for a cybersecurity expert or somebody who is now moving into that field? What should they—

33:41Deidre DiamondSo cloud, cloud, cloud. We've seen it forever. However, particularly in AppSec, cloud AppSec is just, you know, they're making another 10%, 15% on top of the 15% because everybody's cloud. And so absolutely cloud.

33:58Chris RomeoSo any kind of like any engineer AWS, any of those kinds of cloud?

34:04Deidre DiamondAt this point, they'll take any. Absolutely. I'm sure it'll narrow— the leaders will narrow it down, but any experience right now is acceptable.

34:14Chris RomeoOkay.

34:14Deidre DiamondYes. And in general, it's the engineers are the most wanted today because of the fact that most people came from IT, right? So they don't have security experience. So network engineers and network architects are in high demand. Of course, the incident response folks and the threat intelligence, but, you know, that really comes with experience or serious, you know, going to school, right, for it. And then analysts, analysts, analysts, analysts, because we're moving into an era of proactive security versus reactive. And in order to be proactive, we must analyze data in a way that says threats, threats are out there and we can find them before a breach occurs. And that's the name of the game today, right? So those analyst skills are critical.

35:11Chris RomeoYeah, that's good to know. So we're coming in towards the close here, and one of the things that we like to do is just understand some call to actions here. But I'm going to put Niecy on the spot here, who's been listening to this, this whole conversation, and say, based on what you heard here, what do you think is the number one call to action that we should recommend that our listeners go and do?

35:31Robert HurlbutBe kind.

35:33Chris RomeoBe kind.

35:35Robert HurlbutIt's the way in which you communicate with our fellow human beings. It's the way in which we support them. And Daedri is huge on kindness. She's fabulous. She's got amazing integrity. So if you throw those 2 things into your basket, you can succeed with anything. She, for example, there's no one that works for her that is afraid. You know, she spoke to fear earlier. That's afraid to come to her with a problem, with perhaps something that someone might say, oh, you messed up on, that she won't handle, that she doesn't take personal responsibility for because she She has this amazing ability to say, I want everyone around me to succeed. And if you're not succeeding, I'm not succeeding. And we get there through kindness.

36:19Deidre DiamondYou can be productive with kindness. I mean, Rapid7 went public. To get to $50 million, I was absolutely running a machine. And that's the measurable agreements. And I think that's what people mistake is that it can happen. You can have kindness and run high productive organizations. CyberSN, the largest firm, we're barely at our 2-year anniversary. It can be done, and I do require high levels of production. However, it can be done with kindness. So I would say the same thing, be kindness and you'll get more kindness. That being said, practice talking. Practice, practice, practice. Get out there and enjoy it.

36:57Robert HurlbutAnd you know, jumping back to what Deji was telling you guys about the empowerment, leadership empowerment course that she took, I was there with her. I took it with her, and I got to see her in that restaurant with that hat singing, you know.

37:10Deidre DiamondIt was awful.

37:11Robert HurlbutBut you know what?

37:13Chris RomeoIt worked.

37:13Robert HurlbutIt worked. Yeah, she has transformed, and she continues to, and she continues to impress the bejesus out of me every single day with her kindness. And that is why people are so attracted to her physically, in, in your world, any world that that is. It's just because she's a kind person, and people forget about that. They look at numbers. They look at success. They look at what da da da da da. They look at the board, you know. But no, just be kind.

37:40Chris RomeoYeah, I think that's a good way to good way to conclude our conversation here, Daedri. Daisy, thank you for being a part of the conversation. Absolutely. We look forward to talking to you some more in the future.

37:49Deidre DiamondAbsolutely. Love to. Thanks a lot.

37:54Robert HurlbutThanks for listening to the Application Security Podcast. Our intro music is 8-Bit Kung Fu by Boring and TJ, and the outro is Southern Delight by Stefan Kartenberg. You can find us on Twitter @appsecpodcast or on the web at www.appsecpodcast.org.