Jim Routh -- The CISO Transition to the rest of life

0:00Chris RomeoJim Ralph is currently on the boards of Savvy Security, Accountable Digital Identity Association, and the Global Resiliency Federation. Jim is the Chief Trust Officer for Saviant. Jim is a former CSO, CISO for American Express, DTCC, KPMG, Aetna, CVS, and MassMutual. Jim is currently an advisor for Wiz, Transmit Security, Netscope, Armis Security Scorecard, DEVO, Gurukul, DataTheorem, Calypso AI, Code Zero, Picnic, and Legit Security. He serves in an advisory capacity and investor for cyber-specific venture funds, including Cyn Ventures, CyberStart, Security Leadership Capital, Ballistic Ventures, and Rain Capital. Jim is an ICIT fellow and an adjunct faculty member where he teaches cybersecurity for the NYU Tandon School of Engineering. Jim also mentors over 80 cybersecurity leaders and potential leaders. Jim wrote an article on LinkedIn. caught my attention, so we invited him on the podcast to unpack the details. We discuss career trajectories, retirement, and how to get fulfillment from life after you wrap up your typical 9 to 5.

1:09Robert HurlbutThe Application Security Podcast is brought to you by Security Journey. We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC. Learn more at securityjourney.com.

1:32Chris RomeoHey folks, welcome to another episode of the Application Security Podcast. My name is Chris Romeo. I'm the CEO of DaVinci and co-host of this much beloved podcast. As always, happy to be joined by my co-host and good friend, Robert Roma.

1:50Robert HurlbutHey, Chris.

1:50Chris RomeoYeah, it's Robert and a threat modeling architect, actually principal application security architect as well, and working at Acquia and thinking about application security again today.

2:01Robert HurlbutYep.

2:02Chris RomeoAnd you've been off training the next generation of threat modeling people. I did.

2:06Robert HurlbutYes.

2:07Chris RomeoYou've been doing that over the, over today. So that's always a rewarding experience to jump into classrooms and be able to share your many, many, many, many years of wisdom on how to be, how to be effective with threat modeling. So that's one of the most fun things I ever get to do is stand in front of a group of students and just let them kind of pick our brains, so to speak. But we're joined by Jim Ralph, who's been a frequent guest of the podcast and is still the hold, the, the, the record holder for our most downloaded episode. The one that we did, I think it was 2017 or something. We did an episode with Jim, which you'll find in the show notes. You can go back and listen to it where he was breaking down various software security programs that he was a part of over the years. And so it's still one of the most popular ones. So Jim, I always love the opportunity to interview you and just talk to you because I always leave the interview with a lot of things to think about and just really enriched by the process. So glad to have you back again as a guest.

3:14Robert HurlbutHey, I'm happy to be here, Chris. Appreciate the kind words, and I hope I live up to those expectations. I think Robert will take care of me if I don't. He'll put me in the trunk of a car and dump me somewhere, right? Yeah. Well, that's what they do in Jersey. I don't know.

3:31Chris RomeoI'm sure you'll, I'm sure you'll live up to it. So, um, because you've answered the security origin story question in a previous episode, one of our, our new questions that we'd like to, to start with is, what do you do that takes you away from computers and technology? What do you like to do?

3:46Robert HurlbutYeah, so that's actually an easy question for me because the way I line up my schedule on a daily basis is I allow time in the morning to do 2 things. Number one, I have some, an exercise routine that I do largely 'cause I've had in the past back problems and this solves that. So I do that.

4:05Jim RouthAnd the second is play pickleball.

4:08Robert HurlbutAnd it's not that I'm like really good at pickleball, I just love to play it. I could play it every day. And if I'm not, you know, doing cybersecurity stuff, chances are I'm pretty good. I'm playing pickleball either competitively or socially, either way. So I do that quite a bit. I'm fortunate I live in a warm climate both in the winter and the summer because I move. And so lots of pickleball in both locations. So all is good.

4:35Chris RomeoVery good.

4:37Jim RouthI'm still struggling with my third shot drop.

4:41Robert HurlbutAnd pickleballers will know exactly what that is, cuz that's kind of a line of demarcation between being social and being halfway good at pickleball.

4:49Chris RomeoYeah, I was recently, I was introduced to pickleball this past summer and I had a blast playing it. Did not realize how active pickleball actually is. Like it's, people think about, oh, pickleball is like tennis, but you don't have to run as much. Like, you gotta run just as much. Like, even play, you know, we played doubles and because we had some people that were new to it and, and I was, I had a ball and I was pretty tired at the end of, of the game. I'm like, okay, who's got next? Because I think I'm gonna sit down on the bench over here and take a little break. So pretty active game.

5:24Robert HurlbutYeah.

5:24Jim RouthYou're running a lot less than tennis, but it's more, it's more, I guess, quicker, quicker response.

5:33Robert HurlbutYou're moving faster and, and so you move, you feel like you're moving a lot more. It's actually not, not as big, not along a distance, but it's, but it is quick.

5:45Chris RomeoYeah. And I did, I did get taught a few lessons in that the person I was, that was on the other team was an ex or a previous college tennis player. And so he was, he, he was, he was taking it easy on us to some degree, but He could, he could throw, he could put some shots where we just couldn't get it if he wanted to. And so, but, but he had mercy on us throughout the game and kept it competitive, but it was a, it was a lot of fun.

6:11Robert HurlbutNice.

6:11Chris RomeoSo the reason that I reached out, Jim, was I read this article back in November, it was actually November 27th, 2024, and we'll put a link to this in the show notes on LinkedIn. You wrote this article on CISO transition. And it, it just, it was impactful for me. It was, as somebody who's in this stage of life where I'm like, you know, what do I want to be when I grow up? And, you know, what do I want to do with my life and how am I prioritizing my time? It was really hard-hitting. So I'm really excited to unpack that with you. But I think it'd be good just for you to take us through a quick career trajectory so that folks have some context on where some of what's influenced your ultimate way that you approach life now. I think it's helpful for people that may not know that background story. So if you could just take us through that, it'd be really, really good.

7:06Jim RouthYeah, I've been opportunistic in that I never studied cybersecurity.

7:12Robert HurlbutOf course, it wasn't offered in school when I went to school as an undergrad. I never studied computer science. I was a history major because I loved history. I still do a lot of history reading today, but I was opportunistic in that my wife insisted that we were to move back to the East Coast after spending 3 winters in Minnesota, and I realized that I didn't have a lot of choice here. And so I called up my boss, I said, you got to get me out of here, you know, what's available? And at the time I was working for American Express, and he was wonderful to me. And he said, "Yeah, we'll take care of you." But the role that we that you could play is not in IT, which is what I was in at the time. I said, "I'll do anything." Sweet, of course. So I came back.

8:05Jim RouthI ended up leading a 500-person team that were econometricians.

8:10Robert HurlbutNow, I didn't really know what an econometrician was, and so, but I it's like I took the job accepted. You know. Bar none, I was like gonna do it 'cause I need the relocation. What I learned is econometricians are really statistics majors that typically get an advanced either graduate degree or a PhD in statistics.

8:34Jim RouthNow today, what do we call those people?

8:36Robert HurlbutWe call them data scientists, but back then we called them econometricians.

8:40Jim RouthAnd American Express did a lot of modeling of banking. Behavior, primarily buying behavior, to try to see if we could understand certain market segments, what prompted or triggered additional buying behavior. And so you might say, well, what does that have to do with cybersecurity?

9:00Robert HurlbutAnd it's a great question.

9:03Jim RouthIt taught me how to use the fundamentals of data science, and it was in a business context. And so I ended up being— I reported to—

9:15Robert Hurlbutthey merged that group with a risk management group. I reported to the chief risk officer, uh, and for whatever reason found myself as the candidate to, uh, start a cybersecurity program.

9:27Jim RouthThis was, uh, around the, uh, implementation of the Gramm-Leach-Bliley Act, which required financial service firms to have a CISO. So that's really why I got—

9:36Robert HurlbutAs a matter of fact, I don't think my boss wanted to meet with the OCC, the Office of the Comptroller of the Currency, so he stuck me with this. So that's how I got into security.

9:46Jim RouthNow, why is that relevant? I fundamentally believe that data science is foundational for cybersecurity, and it's really in 2 kinds of approaches.

9:59Robert HurlbutOne is just to make data quality a lot better as you prepare key performance indicators that measure the health of your cybersecurity resilience across the enterprise.

10:08Jim RouthThe second is that you can design controls to use behavior deviation to trigger automated workflow and manage cybersecurity a lot more effectively at scale across large enterprises using data science as that foundation.

10:25Robert HurlbutNow, the the majority of opportunities to do that in terms of control design are in identity access management, which is a pretty traditional conventional function in a cybersecurity organization or embedded in the IT organization.

10:42Jim RouthBut it turns out you can fundamentally change and evolve the control capability in identity access management that makes it easier for the users and makes it lower cost. an operational perspective, and better security. All 3 at the same time. And you can't do all 3 of those things without using some fundamentals of data science. So it turns out that that opportunistic move for me in embedding myself in data science had tremendous implications in how I approached cybersecurity as a CISO, and it's what got me involved in software security, application security, as Robert said, in that I had a development background. I then had some data science foundation, and I put the two together to, you know, kind of evolve thinking around software security and design some new control capability that wasn't conventional, that's more innovative.

11:47Robert HurlbutAnd I still, you know, today look for innovation in control design as technology changes, as we're moving into generative AI and large language models.

11:59Jim RouthThere's a lot of technology that can drive control capability that we never would've imagined, you know, 10 years ago, but it's available to us today. So information security professionals were trained in a notion of understanding what the control objectives are and applying those control objectives effectively across the enterprise. And I subscribe to a notion that in addition to that, on top of that, we should design controls, new controls, specifically for emerging technologies. Now designing a control is a different skill set than implementing an existing control capability to align with a control objective.

12:49Robert HurlbutAnd so the skill requirement is a little bit different as a result of that.

12:55Jim RouthAnd my observation is not every cybersecurity professional is comfortable in the design of skill, but if— design of a control. But if you have that foundation in data science, It actually equips you to do that more effectively.

13:12Robert HurlbutSo hopefully that answers your question. Yeah.

13:20Chris RomeoSo Jim, what does the word retirement mean to you?

13:22Jim RouthI'll tell you, Robert, what it doesn't mean.

13:28Robert HurlbutIt doesn't mean the definition of retirement that was passed down to me from my parents' generation and their parents' generation.

13:36Jim RouthAnd that definition of retirement was a binary. You worked and then you stopped work. When you stopped work, you did other things, but it was binary. When you retired, you know, you didn't work anymore.

13:53Robert HurlbutSo, um, so that's really what, um, what my initial introduction in the whole notion of retirement was about.

14:01Jim RouthAnd it was probably maybe 4 or 5 years before I retired that I realized a couple of things.

14:10Robert HurlbutI said—

14:10Jim RouthI realized, number one, that I could probably afford the luxury of doing work without the criteria of I have to earn a living or I have to earn a lot of money to, you know, support my lifestyle. And that's, that's a real A feeling of kind of breaking out and being no longer dependent on, you know, your salary plus your bonus plus your equity gains for compensation. And what that opens the door is for fulfilling work. Now, what's fulfilling work? Well, people get different types of fulfillment based on different types of work. Nobody's the same, but If you can remove the need for driving economic gain for yourself as an individual on behalf of your family, it opens up the opportunities to choose work based on what you like to do and frankly who you work with.

15:12Robert HurlbutSo, as an example, when you work in a big enterprise, and I'm talking, you know, 100,000 employees plus, You're forced to work with some very talented people, which is rewarding and beneficial and fulfilling.

15:28Jim RouthYou're also forced to work with other people that are talented, but maybe they act like assholes.

15:34Robert HurlbutI don't know if I can say that on a podcast, but you know, it's they do.

15:38Jim RouthYou guys, you've all seen it.

15:40Robert HurlbutIt's you know what you run into sometimes.

15:42Jim RouthThey just don't necessarily. They either have their their own best interests in mind 100% of the time.

15:48Robert Hurlbutand they're not thinking about anybody else, or they just act maliciously and in an unprofessional way to their— to other employees.

15:59Jim RouthWell, I can choose not to work with them.

16:01Robert HurlbutWhy?

16:01Jim RouthBecause I can choose what work I do and when. So choosing work with people I love is my first filter.

16:10Robert HurlbutPeople that I admire, I respect, that I learned something from, you know, present company included.

16:15Jim Rouththat it's a worthwhile engagement. So that's kind of number one. Number 2 is I only do the kind of work I like to do. Now here's another throwback to large enterprise work. In a large enterprise, you spend 30, maybe 40% of your time pushing transactions through a system designed for saying no. And And so you have to be the exception that pushes through, and you have to do a lot of work and effort to do that.

16:46Robert HurlbutAnd you know what?

16:46Jim RouthThat work is tedious and it's not rewarding. It's a means to an end. It's something you have to tackle and do if you want results.

16:58Robert HurlbutThere's a lot of inertia dealing with that resistance, and that's built into the decision-making process to make it difficult to innovate and difficult to change and difficult to implement. your agenda, right?

17:10Jim RouthSo, so I choose to choose work that doesn't involve any of that, and it's more pure, if that's a, a meaning, uh, for, uh, for your audience. But it's pure in that it gives me fulfillment, uh, because I'm creating and developing something that benefits others, uh, and that's a really powerful motivator and It turns out that when you do work that gives you fulfillment, it's not work anymore. It doesn't feel like work. You love doing it and you want to wake up every day and do it. And you're looking for more opportunities to do that. So choosing the type of work that you get fulfillment from is a really important filter And it's really hard, and I'll be happy to share with you later that there are some things that I learned along the way post-retirement that I really didn't know beforehand and have really helped me define what work I won't do going forward. The third thing is I only want work when I want to work, and so I have a Calendly link that I share with everybody who wants to meet with me. And I meet with anybody. I meet with companies that have new products in cybersecurity.

18:34Robert HurlbutI meet with early-stage professionals. I'll meet with anybody. And I never say no to somebody who wants to meet.

18:43Jim RouthHowever, behind Calendly is my availability.

18:47Robert HurlbutAnd I control that availability to make sure I have time for pickleball, as an example, and other things. Right.

18:53Jim RouthAnd so what I say to anybody and everyone, hey, Schedule time on calendar anytime you like, as much time as you want.

19:02Robert HurlbutAnd so working when you want to work and controlling that is the third filter.

19:08Jim RouthSo those are the three filters that really for me answer the question of well, what does retirement mean? Retirement doesn't mean stopping work. Retirement means I'm going to work only in things that fulfill me, that give me fulfillment. And that's a subset of all the things I could do. And I'm going to tightly control that using this filtering system.

19:33Chris RomeoYeah, that's very helpful just to get this kind of your philosophy. I'll call it your philosophy of work now after retiring from a 9 to 5 or you were a CISO. Who am I kidding? 9 to 5. It's a 24/7, 360, 4.5 style environment there. I guess it makes me think though, is this something that's attainable? So when I think about the field of work that we've all landed in, you know, at this stage of our careers, right? We're focused on the, we're in the general cybersecurity world where people tend to be paid fairly well in the grand scheme of jobs that are available for you. I guess, what are your thoughts on the attainability of this type of a philosophy? Like, is this something that anybody could do? Is this something that an early-stage career person can be kind of planning for and dreaming about in the future? Or is this something that was kind of the result of just the career trajectory that you were on or kind of where you landed?

20:41Robert HurlbutYeah, Chris, that's a great question.

20:44Jim RouthAnd it's a great question because it makes me think, stop and think whether I could have understood all of this while I was a CISO. And here's why. When you're a CISO and really in a senior role in cybersecurity for any kind of enterprise of scale, What happens is you process information through this lens, and this lens says, does this information have anything to do with protecting the enterprise? And if yes, is it something I need to do something about now, later today, next week? or sometime in the future. And that lens is inherent in any senior cybersecurity executive because you're always making trade-off decisions in the allocation of your time and the time of all the resources with the enterprise. And hopefully you get it right as many as you can, but you don't always get it right. But, but you're going through that thought process. Well, here's what happens. Like, I used to schedule time with my family thinking and believing that I was in the moment, present for them at that time. And in some cases I was, but as soon as I got a stimuli of something, it could have been a notion of a new technology impacting the enterprise.

22:26Robert HurlbutI'll give an example.

22:27Jim RouthFake technology creating a synthetic voice, uh, a voice object that can be used to do authentication in a call center. Now, every major big call center does some sort of voice authentication, uh, and it's in the background.

22:45Robert HurlbutA lot of times the consumer, digital consumer, is not aware of it, but every, uh, every shop has this in some level of sophistication.

22:54Jim RouthWell, today With the deepfake technology, a large language model and several of them can create, and actually there'd be a multimodal model, create an audio fingerprint, if you will, an audio print of your voice. And then that voice can be used for— so that now changes the control capability and the impact to the enterprise. So if I And literally at a, you know, some sort of social event and somebody said, oh, what do you think about deepfake technology? The first thing I hit is, oh geez, what does this mean?

23:30Robert HurlbutYeah, good point.

23:31Jim RouthYou know, is this something I have to do? I have to process this information in some way today at this moment in time. Can it wait till tomorrow or maybe, you know, next, next week? But that I'm going through that kind of triage process based on any kind of stimuli That hits me, even if I'm not at work, even if I'm not in a work mode, even if I'm in a family mode and trying to get my best to my family and meet their needs, I'm still using that lens to process information. Now, I didn't know the lens was there when you and I first met and started working together, which is a long time ago, but I didn't know the lens was there.

24:13Robert HurlbutSo to me, that was just, I was saying, I was thinking to myself, oh yeah, I can compartmentalize and make sure I have carved out time for my family and my personal needs and so forth.

24:24Jim RouthAnd yeah, I got it, I got it nailed, no problem. Well, not really. In the background, this is, you know, what's doing it. And the more you're a CISO, the more it becomes reinforced because you recognize that, and this is kind of bottom line oriented, you're gonna get fired if there's a cybersecurity breach of significance on your watch.

24:43Chris RomeoYeah.

24:44Jim RouthAnd nobody explicitly says that, but history is riddled with evidence to support that. And so, that causes you to kind of react in almost a survival mode to use this lens. And the question is, and getting back to your question, can anyone effectively plan for a future of work fulfillment? Exclusively, with with having that lens in place, because that lens tends to color how you allocate your time. And and and so anyway, I I think I went through the process thinking that retirement was stopping work. And what I learned, and before I retired, I kind of figured out that it meant doing work. that you like to do that has, you know, fulfillment. What I didn't realize, what I do realize today, is that not all types of opportunities that come to a cybersecurity professional post-retirement, quotes, uh, is actually fulfilling. And you, you might not necessarily know what's fulfilling or not.

25:59Robert HurlbutSo I'll give you a specific example.

26:02Jim RouthWhen I retired, I got a lot of phone calls for something called fractional CISO, which is a CISO that kind of jumps in on an interim basis and kind of sticks fingers in dikes and holds things together for a period of time just to kind of help the business at that time.

26:22Robert HurlbutFor whatever reason, the business didn't have an appetite to hire a full-time CISO. The fractional CISO does, et cetera. Yeah.

26:28Jim RouthSo I used to think, oh well, that's a natural for me, right? It turns out that I hate that kind of work, and here's why. When you can plan long term, you can build a talented team and focus on maturity, achieving resilience across the enterprise.

26:48Robert HurlbutWell, that takes multiple years, certainly, and the larger the enterprise, the longer it takes.

26:52Jim RouthAnd so, um, that's what I was accustomed to. And frankly, I was motivated and interested in doing that. But when you're a fractional CISO, you're basically a babysitter, and there's not a lot of change that you can introduce. Now, it turns out I really like being a transformative CISO, a leader that focuses on transformational change.

27:15Robert HurlbutI like a lot of the people aspects of that change because if developed education.

27:19Jim RouthBut you don't do that as a fractional CISO. So it turns out that that whole type of work opportunity that's available to me, I'm not interested in. And it turns out that consulting in general— now, I was a consultant, um, for 12 years, uh, 3 different companies, had a lot of consulting experience.

27:38Robert HurlbutI love consulting, learned a ton.

27:40Jim RouthI gave it up because of the family needs of travel.

27:43Robert Hurlbutand, you know, triggering the change.

27:46Jim RouthUm, but I love consulting. Well, I don't love it today. As a matter of fact, I don't want to do it today. I've done several consulting engagements that I've kind of dragged in by people that I'm friendly with and have a relationship with, and they said, no, no, we need you, Jim.

28:02Robert HurlbutWe, we just need you. And so I've, I've kind of, uh, succumbed to the pressure and did that on a number of occasions.

28:08Jim RouthBut I'll tell you, it's not for fulfilling work. And it's not fulfilling work largely because I'm solving the same problem I've solved before. And I'm doing that, solving that problem that I've solved before, in the constraint or with the constraints set by the customer, the client. And in some cases, I would never have used those constraints, um, or I would have found a way to get around those constraints to do the right thing from a long-term perspective, not necessarily from the short-term perspective. Right.

28:40Robert Hurlbutperspective. But when you're a consultant, you don't have that luxury. So you're operating really within the short-term perspective and you're constrained by that.

28:49Jim RouthIt turns out that solving problems that I've already solved just to earn, uh, you know, a couple bucks an hour, uh, uh, in terms of a services engagement, um, it wasn't worth it. It wasn't fulfilling.

29:03Robert HurlbutIt didn't—

29:04Jim RouthI didn't walk away, learn anything from it. So I'll never do that type of work.

29:08Robert HurlbutYeah.

29:09Jim RouthI got drawn into being an expert witness on a couple of high-visibility cases involving cybersecurity, and I said, oh, this is a natural.

29:22Robert HurlbutOh, I know a lot about cybersecurity as a practitioner perspective.

29:26Jim RouthThis will be great. Well, it wasn't.

29:28Robert HurlbutIt wasn't a great experience. As a matter of fact, you know, a couple of examples.

29:32Jim RouthIn one case, I was not—I was asked not to testify, nor did I do produce any kind of artifact or document supporting a position.

29:45Robert HurlbutThe legal team involved did all of that, and they just kind of picked my brain over a period of time—months, months—but I was kind of in the background. And this is for Asiso, who's a buddy of mine, you know, a friend.

29:58Jim RouthUh, and I want to do everything possible on his behalf. Well, the, the, the, uh, they lost. The legal team lost.

30:06Robert HurlbutIt had a significant impact on the industry, uh, in terms of Cecil's responsibility and obligation. And, um, and, and I felt frustrated. So even though, you know, I got paid, I did, you know, I paid pretty good hourly wage and, uh, did work to help the defense team, It was very much of an unrewarding result.

30:29Jim RouthI got recently a legal team asked me to produce a document that would have taken about 75 hours to produce, and I was asked on December 18th to do this.

30:43Robert HurlbutAnd so the next day, like, my kids are coming down and, you know, joining me and visiting for the holidays and so forth, and I wanted to take time off and Spent it with them in the holidays.

30:53Jim RouthAnd I was, you know, up against this deadline that was pretty much of an artificial deadline. And, uh, I had to work like, you know, a lot of hours to try to do this. Once again, not fulfilling.

31:06Robert HurlbutAnd, and, and I've learned—

31:09Jim Routhand this is a positive side of that— is I've learned what work to say no to right out of the gate and not to do, even though It looks kind of attractive, and it's a way to you know you know get some cash. But it just it's not worth it to me anymore. I've changed my entire way of thinking about defining fulfillment from work. And so the real interesting question which you asked is: Could I could I have done that five years before I retired, and then set up those kind of opportunities in preparation for when I retired?

31:47Robert Hurlbutyou know, using our definition of retirement.

31:50Jim RouthAnd I don't know the answer to that, Chris. I don't know because I had that lens, you know, in place then.

31:55Chris RomeoYeah.

31:55Jim RouthAnd I didn't realize it was in place there then. I just realize it now post-working. So, so it's a great question.

32:04Robert HurlbutI'd actually like to learn from your audience, you know, what their perspective is because, um, yeah, I'm not sure I could have, you know, Understood what work fulfillment really was, meant to me.

32:16Chris RomeoWell, I think this conversation is something that should be helpful for a lot of folks because people just don't think about this. Like most people have that classic definition that you described, your parents passed on to you of retirement is this event where I no longer have to work anymore and then I try to figure it out. And so the thing I love about this philosophy that you're sharing here is that people can hear about it, learn about it, and that could be a goal for some people to say, hey, I want to reach a point. Because, because, you know, like we, like I said before, I mean, we tend to be pretty well paid in the world of cybersecurity. You don't have to be 65 years old to modify your approach to work. You know, people go through that cyclical nature of life, right? You get married, you have kids, those kids grow up, they go to college. The nest is empty and so you could kind of be, some people could transition to this earlier than either any of us for the stage of life we're in. Like you could be planning for this and getting to it if you're thinking about it, if you're being strategic about it, which I can't say that I was like, I've been head down. Let's, let's get this, whatever I'm working on, let's get it done. And never really spent a lot of time in my career thinking strategically about the future. But my hope is that this will, this will open the conversations up. Some people will go, ah, I never thought about that before. And maybe it runs in a background thread somewhere for some period of time for them.

33:55Robert HurlbutYeah. There are, there are some steps that you could take that professionals can take prior to retirement, like years before retirement, that I highly recommend to get you ready and prepared to some degree. And that is, number one, the pursuit of identifying what your fulfillment is from different types of work activities is probably paramount. Is that— if you think, really think through what kinds of attributes and characteristics you want to use to evaluate work opportunities for you?

34:31Jim RouthBecause I've shared mine, but I think everybody has slightly different perspective and they need to go through that definition process.

34:39Robert HurlbutFor instance, I wanted to serve on boards. Why?

34:43Jim RouthWell, as a CISO for a public company, I worked with board members all the time and I worked with some really impressive people just as human beings. And as professionals, and I admire them. So in the back of my mind, I said, "I want to be a board member." Well, turns out it's easy to become a board member.

35:03Robert HurlbutYou just have to start with a not-for-profit because they're always looking for board members and you know looking for everything else as well. So so that's the place to start. And then secondarily, as a cybersecurity professional, you can go to either a venture capital fund or a private equity group that specializes in, you know, mid-sized businesses and above, uh, and, uh, or even some cases early-stage, uh, you know, cybersecurity companies.

35:35Jim RouthAnd they'll introduce you to their portfolio companies or companies that they're betting for potential investment, and you can pick and choose and say, hey, I'd like to be an advisor and then a board member.

35:46Robert Hurlbutyou know, when you grow up big enough, I want to be a board member.

35:50Jim RouthAnd you can get board seats that way pretty effectively and easily.

35:55Robert HurlbutNow, in some CISO roles, you can have that either a board seat or an advisor, and it's allowed and, you know, satisfies the compliance requirements while you're a CISO.

36:09Jim RouthAnd so you're building up your talent in investing from a professional development standpoint in how to be a more effective board member. Now, there's nothing to say that you should wait until you retire or leave your operational job in order to do that. There's a lot you can do to get ready for that on your own, just within the parameters and constraints that you have.

36:34Robert HurlbutAnd I highly recommend people do that. I served on a board member from from different ISACs, and you really couldn't be an advisor to a cybersecurity company simply because there's this perception of conflict of interest. I think it's legitimate in that case. And so when I was serving as a board member for the Health ISAC— another great way to be a board member, by the way, and build up your competency, skill, and resume—

37:05Jim Routhbut I really couldn't do any other advisory and board work outside of that in cybersecurity because there was, you know, this conflict of interest. So I retired from the health ISAC in this case, and the driver for that was primarily so I could do more board advisory work and get prepared for my next stage in my professional, you know, career. And I encourage people to think, you know, of ways to Get ready for whatever you, your definition of retirement is.

37:37Robert HurlbutGet ready before you have to do that because it, if you're going to do your own type of work and have flexibility, you're going to create an LLC to protect your liability.

37:47Jim RouthAnd you're going to do that relatively early on, even before the transition. And you're going to try to get some, you know, like prime the pump, like get some clients, customers, whatever you want to call them as companies that can hire you as an advisor and/or a board member, if that's your path you want to take, line that up before you announce your retirement.

38:15Robert HurlbutYeah.

38:15Chris RomeoSo just listening to you as we've kind of gone through this conversation, it made me think of a kind of a slightly different angle, but I'm curious to know what your answer is to this. So if you could send yourself an email in the past, you know, we had a DeLorean that could deliver emails or something. Let's say, I'm just going to pick a random, I'm just going to say your 30, you could send your 30-year-old self an email with some, just some wisdom that you have accumulated up to today that you just wish you had when you were 30 years old? Like what, what would you, I guess, what would be the 3 bullet points in that email that you would send?

39:07Jim RouthYeah. Uh, great question.

39:10Robert HurlbutThe, my start in cybersecurity, which happened as we talked, you know, kind of serendipity-wise, uh, as, uh, something I bumped into. forced me or gave me the opportunity to learn from a guy named Steve Katz. You know Steve well, he's the first CISO. And Steve was my mentor because Steve had retired by that point in time. And what he taught me, and this happened the first day I was the CISO, I realized at American Express, I realized that we had an MOU, a memorandum of understanding that basically said that You gotta have a cybersecurity program, you gotta put it in place. So I literally, on my first day as the CISO, I had to prepare this strategic plan.

39:56Jim RouthIt was due the second day, right? And so there was a calendar invite to a meeting at 2 o'clock presenting the information security strategy for American Express to the OCC.

40:10Robert HurlbutAnd the OCC is pretty, you know, talented regulator that, uh, that that, you know, you don't mess with. They know what they're doing.

40:16Jim RouthSo I, I called Steve cuz somebody gave me his name.

40:20Robert HurlbutI didn't know who he was. I called him. I said, Steve, you gotta help me.

40:22Jim RouthWell, he dropped everything, got 2 other CISOs from 2 other organizations that were competing, relatively speaking, with American Express. They dropped everything they do and the 3 of them came and prepared the presentation for me, had me deliver the presentation that they created to them, role-playing it. Yeah.

40:43Robert HurlbutTo get me ready for the presentation the next day, which I did, and it went you know perfectly well.

40:49Jim RouthOCC sets good MOU satisfied. So what that taught me was that I had to serve others, that I had to help others in cybersecurity because that's what you did. It didn't dawn on me at that time that that would be one of the fulfilling work activities that I would do for the rest of my life. Um, and I didn't know it. So if I, I would have liked to have sent a memo back to me at that point in time that said, this is more important than any other work you're doing today, treat it that way. Um, that would have been really— because I learned that over the years, that it is really important work. But I now look at it differently because it's probably the most fulfilling work that I have. So there's 90 people that I mentor whenever they want. And I never say no if somebody asks me for mentoring help because it was so valuable and important to me early in my career. But it's also, it's so fulfilling to me at this point in my career. So I would have liked to have known what I know now.

42:03Robert Hurlbutback when I was 30 or so.

42:05Chris RomeoYeah, that's helpful. Unfortunately, no one has invented this time machine that can send us emails from the future to help us understand. Before we go to Robert's lightning round, I'll throw one more question at you. Do you see this criteria changing over the next 10 years for you personally? Like, is there a ramping down or is this going to be Jim what Jim does forever until as long as he's on this earth?

42:36Jim RouthI think it's the latter in that I think this is the—

42:43Robert HurlbutI don't think the filters are going to change.

42:47Jim RouthAnd the reason I say that is because what I'm doing today, I think, is as long as I have my health, it's sustainable. And so I fully intend to do it You know, my mentor Steve, he told me before he passed away that he's going to mentor me and everyone else.

43:05Robert HurlbutAnd he had, you know, probably over 100 people that he was mentoring.

43:08Jim RouthHe said he's going to do that from the afterlife.

43:10Robert HurlbutNow, Steve can get away with that, but I'm pretty sure I'm going to be doing that to the end of my life to the best of my ability. But you know what, to give you a true answer, I changed my perspective of retirement as I got into retirement. And I think it will withstand the test of time for the rest of my life, but who knows? So I could be absolutely wrong and misguided. So we'll see. It'll be an interesting journey, but we'll see.

43:46Chris RomeoYeah. Very cool. This is It's been really helpful just to unpack this philosophy that you're living out now. I know it's, I've already taken away some things from it that I'm going to apply to my life and my professional career where I sit right now. So this has been really good. Well, before we wrap up the conversation, Jim, I definitely want to give you a chance to just share a key takeaway or a call to action, something you want to leave our audience with here.

44:18Robert HurlbutYes, um, number one, um, top-of-mind topic for me, and I published a paper just recently on this, uh, is that all individuals, all professionals, are accountable and responsible for their own professional development. That wasn't always the case when I started in my professional career. That was back in the days where the company that you worked for told you what you were going to learn. They told you what classes you were going to take, and they gave you a career path.

44:49Jim RouthAnd they made the assumption that the employment agreement was for life.

44:53Robert HurlbutLike, you, as long as you, you know, performed well, you could remain in company and they'd see you through to that retirement, which was stopping work, right?

45:03Jim RouthUh, and to—

45:04Robert Hurlbutand of course, that notion is absolutely absurd today.

45:06Jim RouthToday, the employment model is the employee has responsibility and accountability for their own professional development.

45:13Robert HurlbutAnd the organization and the leader behind it is a bit of an enabler that can support that development and make some adjustments to facilitate it. But nonetheless, you own your own professional development, both in the definition of the objectives and also the development activities.

45:35Jim RouthAnd so I think it's a really valuable exercise to, on an annual basis, to understand what 2 skills— and not 10 skills, just 2— what 2 skills do I want to invest my time in learning and/or mastering for whatever reason?

45:56Robert HurlbutAnd in other words, it could be your own.

45:58Jim RouthLike, you could say, I'm getting ready to be a CISO. That could be a valid reason. Or I'm getting ready not to be a CISO. to do something else, and that could be a valid reason. So the reason is not important, but the— at least not important to anyone else other than you, but the definition of what skill at a granular level you wish to invest your time in developing and mastering gives you an opportunity to identify then the development activities that can enable that learning experience and give you a chance to practice and develop that skill. So you can demonstrate it. And that's something that you should use as a criteria for deciding when it's time to change your job. So I get asked a lot by early-in-career professionals specifically, I've been at this company for 3 years, I think it's time to move.

46:53Robert HurlbutAnd I'll say to them, well, why do you think it's time to move?

46:55Jim RouthAnd they'll say, well, I've been here 3 years.

46:58Robert HurlbutWell, tenure is not the right way of defining when it's time to move from either one company to another or one job within a company to another job. As a matter of fact, tenure is the least important variable.

47:13Jim RouthWhat's important is that if you can learn the skills you choose, then you should take advantage of that opportunity and the leader behind that opportunity.

47:24Robert Hurlbutopportunity that's helping you, enabling you to learn the skills you want to choose?

47:28Jim RouthAnd if you can't, if you're blocked from that, then it's time to find a new leader. That doesn't mean outside the organization. It could, but that's the time.

47:40Robert HurlbutIt's not when you've been here 3 years, 5 years, 10 years, 8 years, whatever it is, or how long you've been in your role.

47:47Jim RouthIt's, can I learn the skills that I choose to learn?

47:51Robert HurlbutCan I learn the skills that I think will make me most marketable? And this is by my choice.

47:56Jim RouthAnd if the answer is yes, then don't leave the company.

47:59Chris RomeoYeah.

48:01Jim RouthAnd don't consider that and don't even factor in tenure.

48:06Robert HurlbutFactor in whether you can learn the skills you wanna learn and you're supported in that.

48:12Jim RouthAnd the day that you're not supported in learning the skills that you learn, that's the day that you decide to leave.

48:19Robert HurlbutFind a new opportunity and find a leader that will give you that opportunity to learn the skills that you wish to learn.

48:24Chris RomeoYeah, that's more wise advice to share with folks, especially for those that are, I know, early stage. A lot of people like to bounce around and they feel like if they're not in motion, they're not growing their career. And I love that. It's, they should be, you should be stopping and using that criteria. Like if I don't have somebody who's enabling me to better, then that's when I need a new leader. Not just because all my friends are bouncing around to different companies and I feel like I'm behind if I haven't worked at 3 companies by the time I'm 22 years old. Right?

48:58Robert HurlbutExactly.

48:59Chris RomeoWell, Jim, thank you so much for sharing just your experiences, your philosophy of work now. And so it's always a joy to get a chance to talk to you and just pick your brain for an hour at a time. I always, I always will come away with lots of things to think about and lots of things that I've learned. So really appreciate you, appreciate your support of the podcast here. So thank you. We look forward to the next conversation.

49:24Robert HurlbutSounds good, Chris. And love the opportunity to work with you as we have in the past. That's the kind of fulfilling work that I like to do, and I'm sure you do as well. And look forward to the next opportunity.