The human element of cybersecurity careers

Chris Sienko: Hello, and welcome to another episode of the Cyber Work with InfoSec podcast. Each week, I sit down with a different industry thought leader to discuss the latest cybersecurity trends and how those trends are affecting the work of infosec professionals, as well as tips for those trying to break in or move up the ladder in the cybersecurity industry.

Cheryl Kerrigan is the Vice President of People at BlueCat. She has a long history of helping people in tech and security to find their best selves on the job and to make the right moves when trying to move up the ladder in the company or the industry. We're going to talk today about some of the soft skills that cybersecurity professionals should have in their tool belts, to ensure that their ideas aren't just heard, they're understood.

Cheryl Kerrigan is the Vice President of People for BlueCat where she is responsible for the overall people strategy focusing on attracting, retaining and inspiring top talent. She's most passionate about creating a culture of employee success, where employees feel recognized and valued for the contributions they make.

With close to 20 years of experience in global human resources, Cheryl is a seasoned HR executive, who began her career as a recruiter focused on discovering exceptional talent. She then moved into several HR leadership roles as the initial HR resource in fast emerging global technology companies, where she was responsible for building out the people function and strategy.

Cheryl, thank you for joining us today.

Cheryl Kerrigan: Thanks for having me.

Chris: I guess my first question was to ask a little bit about your career journey. I spoke about it a bit in the intro there, but how did you move from more standard HR position to this more sort of tech focused strategy that you're in now?

Cheryl: Yeah, great question. So I started my career as you read as a recruiter and I was always recruiting for tech professionals. So not to date myself, but a while ago, that's what I started doing. And just to go back further from that, I did my undergrad in psychology and sociology. And then I did my postgrad and an HR diploma and really what I loved from that time spent in school, I didn't love the traditional HR with compliance policies, and this is going back 20 years ago. But what I did love was thinking about how to bring in talent and how to recruit the best people to the organization.

So, when I started my career, I thought, you know what, I'm just going to be a recruiter, and that's what I'm going to do. And so I spent about five years doing that. And very quickly, what happened is, recruitment is very sales focused, and it always you're only as good as your last hire.

I moved out of an agency. So I was in a traditional recruitment agency, and I moved out of an agency into an organization, to help them set up their first recruitment team. And what quickly started to happen is I was faced with, once you bring in people, you want to make sure that they're having a great experience. I found myself just morphing into more of an HR role, in addition to recruiting.

So, that's kind of where I got started. I didn't think I was going to go into more of the traditional HR, but once I got into an organization, my conscience couldn't allow me or I couldn't help myself, because I'm bringing in talent. So then I want to give them the type of environment that I promised them. So that's what happened.

And I spent all of my time, with an exception of, I kind of deked into a property management company for about five years, but most of my time in my career has been spent in high growth technology companies. So companies, kind of as they're growing, they're going through a large stage of growth. They get to maybe 100, 150 people, and they're like, oh, okay, I need to build out the HR, the people practice.

So that's essentially what I've done my last three positions. And that's how I've ended up at BlueCat.

Chris: So basically you're saying, you were doing recruiting, but then there was a disconnect in the sense that once you got them there, you didn't have any further connection with them. And so you wanted to sort of stay in their corner, basically. That's kind of uncommon for recruiters, I imagine.

Cheryl: You know what, it depends. I think it depends on the size of the organization. So for me, it was by need, because people would come in, they would know me as kind of the first person they talked to from an HR perspective, and they'd kind of come back to me. I felt that I could do a lot more. I had the opportunity in a smaller company to be able to explore and build it out as I saw fit.

Chris: I've never heard that job title before. I'll ask now, what is vice president of people? You talked a little bit about recruitment versus human resources, but how does VP of people differ from a human resources position? And what are your primary responsibilities, requirements? And how are they different from an HR position?

Cheryl: Yeah, great question. So I don't know if you remember the term personnel. I don't know if you ever heard that term. So HR, the term human resources replaced the term personnel. And what you're seeing in the industry right now is that modern HR professionals, so we're still doing the job of an HR professional, but modern HR professionals think a lot more about culture and the employee experience.

So there's been kind of an evolution. We don't call ourselves VPs of HR anymore. We're more moving in, you'll see titles like people and culture or people operations or people strategy. It's more evolving to fit what we care about, especially in tech companies.

Again, the notion of an HR person, I'm sure, like when you hear HR, you think about compliance and firing people. So we're rebranding ourselves because of what's been happening in modern companies. And that's all about building a great culture to attract great talent, to give employees the best experience. And it matches more what we're trying to focus on, if that makes sense.

Chris: It does. Now, do you feel that this is necessary? Because some of what you're saying with regards to retaining talent and giving them what they need in terms of culture, would that not previously have been provided by a good manager say?

Cheryl: You know what, you'd hope. But I'm sure there's been lots of research on the fact that people join companies, but they leave managers. So I think, yes, absolutely. It's not the people team plays the only role in attracting and retaining talent.

But what I've seen in my career is there's a big push, like it's really about building culture, it's really about how are we connecting with employees? How are we trying to figure out what motivates them? And sometimes that doesn't always come naturally to managers, because they've got so many other things that they're thinking about, depending on the role that they're in.

So I think from a VP of people, what I'm focused on is really providing that culture where managers can do their best work, and they're enabled to think about what their employees need, and that doesn't always come naturally.

Chris: Okay, can you give me some concrete examples of the sorts of things you do on a day-to-day basis with regards to the culture and the retaining of talent and so forth?

Cheryl: Yeah, so as far as what I'm responsible for at BlueCat, so first off is, true to my roots, I'm still very, very involved in recruitment. So a team of recruiters report into me. And that's really critical, especially in our industry, because we're in a huge war for talent right now. So not enough people that have the required skillsets. I'm sure I don't have to go into that.

Chris: Oh, yeah. We talk about those skills quite a bit on the show.

Cheryl: Yeah, exactly. So all your listeners know about that. So that's really important is really providing that environment, where people are attracted to your company. So it's a little bit of marketing involved with what we do from a recruitment perspective. How are we showcasing who we are?

We look to Glassdoor and Instagram and social media really to showcase some of the cool things that we're focused on. So recruitment is a large part.

Secondary is... not secondary, in addition to, we look at once we bring people in, how do we onboard them? How do we get them up to speed? How do we get them productive? So there's people on my team that are responsible for onboarding new employees, because we're hiring a lot of people in a three month period. So we want to make sure that they're given that great employee experience from the get go.

Because again, research shows that if an employee doesn't feel connected to what you're doing in that first 90 days, they're evaluating whether they made the right decision, and it's harder to keep them. So onboarding, big piece.

And then there's the whole talent management piece. So, working with managers to make sure that employees are being given consistent feedback, that they're getting feedback on where they can grow their career within our company. Just making sure that, again, they're connected to what we're doing as an organization, that they understand what they're responsible for.

And then kind of the fourth big area is all about learning and development. So, in these high growth technology companies, and especially what I'm used to, people want to continually learn. So we have a whole team focused on learning and development. And that's been a real game changer for us.

Chris: That sounds like a very good concrete strategy to keep people sort of invested in your organization.

Cheryl: Yeah, you got it.

Chris: So walk me through your average day as VP people at BlueCat, what time do you get into work? What's your optimal routine, how long into your average day until your various crises set fire to your meticulously crafted to-do list?

Cheryl: I think that last question is probably the most relevant. Yeah, that's kind of what happens on a daily basis. But to try and give you an overview, I'm usually in about 8:30 in the morning. A lot of my day consists of, again, that whole focus on meeting with my team, making sure that I understand what's going on from a recruitment perspective, from an L&D perspective. So a lot of time spent just making sure my team's set up. And then there's a ton of time spent with my peers on the executive team, just helping them with their talent management, anything that kind of comes up, career development conversations, all of that.

But then generally what happens is that I'll have my day blocked off as you alluded to, and what's exciting about my job, it's really never the same day twice. Because you have to respond to people and people are not predictable. So it can be anything from, there could be a problem where people are not clear on something or helping to coach people or working with my CEO to figure out where we're going as an organization.

It really depends on the day, and that's what's exciting about it. I don't know if everyone thinks about an HR person or a people person being really fundamental to the strategy of the business, but I get pulled in a whole bunch of business conversations. Just to make sure we have the right talent, because really it's all about our employees being able to deliver on our goals. And that's what I spend a lot of time thinking about. Do we have the right people in the right positions to get to where we need to go?

Chris: What type of tasks do you do every day? What are common tasks in your position? Also, do you take work home? And what are some of your favorite and least favorite parts of your job?

Cheryl: Yeah, so every day I'm in meetings, there's not a day that goes by that I sit in my office by myself. So I'm connecting and talking and having tons of conversations every day. Do I take work home all the time? Because what happens, because I'm spending so much time talking to people that in order to actually get done what I've committed to-

Chris: The actual task.

Cheryl: I'm spending time at home for sure doing... and that's just always been the way it is, even from a recruiter, you talk to people in the day, but then you'd spend your time at night sourcing resumes, to make sure that you had... So you're just kind of in that role and if you talk to any people person, it's just what we're used to.

And then, oh, favorite part of my job is, you know what I love is when I can see growth within someone. Someone that either figures out a problem that will help the business move forward. And just that collaboration, when you see like employees and teams really functioning together really well, that's so rewarding to me. Just because you know that you're doing something right to build that culture of collaboration. I light up about that for sure.

The worst part is when I have to performance management people, it's awful. No one likes to do that. And no one likes to... I always want our employees to be the most successful they can, and probably the worst part is when you get to the point where you have to make that tough decision that this person is no longer going to work out for the organization and that's just the worst because no one likes to do that.

Chris: What can you do about it?

Cheryl: And no matter how many times you have to do it, it never gets easy.

Chris: So in our conversations previous to this episode, we talked about issues of communication skills that aren't necessarily common, but are necessary to advance one's career in security and tech, specifically cybersecurity. Based on your experience in this role and in previous ones with similar terrain, what are some of the most common skill deficiencies that cybersecurity professionals are lacking?

Cheryl: That's a great question, one that I've thought about a lot, because I think, to your point, soft skills being, things like being vulnerable. I don't think that that vulnerability piece, it's not something that they teach you in school. It's not something that is necessarily modeled, especially when you're in these type of high pressure roles where you have to know all the answers and solve complex problems.

Chris: There's that kind of shark tank element of, if I don't solve every problem, I'm out the door.

Cheryl: Yeah, or you're just not as relevant. Or the ability to ask for help, the ability to say, you know what, I don't know this, but I'm going to figure it out. That is not something that I see often. I think it's something that really could be helpful if people could just kind of explore that a little bit.

The second is collaboration. I think that, again, that whole notion of, I have to solve the problem by myself right now without asking anyone, because I've got to be the person that knows it. I think the whole idea of teamwork, collaboration, trying to solve these really complex problems together, it's just, again, it's something that you don't always see. Just because there's that lone wolf syndrome, if that makes sense.

Chris: Oh, absolutely. When I talk to candidates for my department and stuff, that's one of the great, when I ask what's you're failing and it's always like, I just take the whole world on my shoulders and I have it myself as well. But we've got this sort of work, especially in tech and security, but you have this sort of pressure cooker element where it's like, you are sort of praised for your ability to take on more work and put more on your shoulders and stuff.

But at the same time, you either burn the people out or things just don't get done, because they can't carry the weight of the world on their shoulders. There definitely needs to be some way of conveying, do as much as you can, but you have to be willing to ask for help.

Cheryl: Yeah, that whole self-awareness piece too. Just really being able to tap in, what you can do and where are the things, what are you what your strengths are, and where you maybe need some development. I think that just being able to recognize that would make people so much stronger in getting stuff done.

And the third really is about business acumen. Why are you doing these things, what's the business needs that you're solving? You're not just solving like these problems, but how do you play into the wider organization? I don't know if that... I think that that, just really trying to figure out like, where do I fit? Why am I doing this? Am I spending time on the right areas? Or am I doing this because this is what I'm really interested in?

I think that that, just trying to connect to what the business goals are, I think that that just is helpful. Again, I think, for anyone in an organization, it kind of goes to that collaboration piece, why are we all here? What are we all doing together? What's our role?

Chris: So to just make that more clear in my head here, what you're basically saying is that there's a disconnect of people doing their job, because the job is in front of them versus how do I do the job to sort of advance the interests of the company? Is that it?

Cheryl: Yeah, and just what are you spending time on? Is this really moving the goals of the organization forward or is this something that you just know how to do and you like doing?

Chris: You're hiding in a spreadsheet, because it's easier than making the cold calls or something like that.

Cheryl: Yeah. Are you pushing yourself out of your comfort zone, I guess, is another way to say it. Are you really connecting... Again, that whole idea of that you're not in this alone, I'm touching on it again, you're part of a team, what's your role in the team and not just your immediate team, but the organization as a whole? I don't know. Go ahead.

Chris: So, next, sort of move from these prescriptive things, we should be doing more of this, we should be doing this. How does one go about learning these types of soft skills? It's one thing to say learn to be more communicative or learn how to collaborate better or explain complicated technical problems to non-technical people. But what are some practical ways that people working in these types of positions can acquire, learn and reinforce these skills in their day-to-day life? What do you recommend when you-

Cheryl: So I think the first question is, do you want to learn them? Are you ready to learn them? Because I often see, having a learning and development team underneath me, we go off and prescribe things and we wonder why people don't show up. Or we say, okay, come to this training class, and then they come, but then it's not really adopted.

So, what I've been thinking a lot about is, are they open to learning? Are they open to feedback? That whole vulnerability piece. Are they vulnerable enough to admit that this is not maybe a problem or something that they want to work on. If that's not the case, it's really hard to change someone, because it has to come from within.

I think that that first conversation, whether you're a manager giving feedback to employees or even just an individual that maybe has been given the feedback that you need to be more communicative or explain technical problems to non-technical people is do you care? Do you want to change?

So if they're vulnerable enough to admit that they don't have the required skills, I think that really the way to do that is practice. What I've seen really something successful that's happened in our organization is that there was a group of employees that wanted to do Toastmasters, which is a presentation skills.

And so that was not a mandated thing from my team or from the business. They said, hey, we're interested in this and they take their lunch hour and we've given them a little bit of funding in order to do that, but it's all employee run And I find that wherever you can get people to kind of self-select for things and take it upon themselves, there's more of an interest to do that. So that it's a safe environment, they're with people that want to be there. Their manager is not sitting in the room listening to them, they're doing it out of interest.

So what I suggest is, wherever possible, make sure it's a safe environment where they can practice and if it's not at work, then what I really believe in is mentors and coaches, whether internal in the business or external. So someone that you can learn from, someone that you can model behavior and ask the question. So you're not necessarily in a classroom setting where it's somewhat intimidating, but really having that ability to practice and be vulnerable in a really safe environment.

Chris: So one concept you mentioned in our pre-game conversations here was the idea of the sort of brilliant security or tech expert with difficult people skills. Someone who knows they're the smartest person in the room and lets everyone else know it as well.

How do you get this type of tech or security personality sort of to come down out of the clouds and learn how to talk to the rest of us mere mortals?

Cheryl: Yeah, you know what, I don't know if I've necessarily been successful about that. But here's some tips. What I find is really important is figuring out what you will tolerate as a hiring manager. I feel like the work upfront, so here at BlueCat, we've defined what our values are and we've defined what our culture is. And we had a lot of information.

I think where you need to start is, what's your baseline? Are you going to accept these type of people? Is that something that you're comfortable with? Here, we're not, we screen that out. Because honestly, I really feel like trying to change someone's DNA is almost impossible. You can maybe move them a little bit, but again, what I was talking about before, they have to have that self-awareness, they have to have the want to do it.

And if they don't have that, then that's really hard to change. I think that starting off with asking those questions, are you collaborative, who do you go to for help? Tell me about a time when you didn't know the answer and had to get the answer. So it's kind of starting off right in the interview process, about those baseline things that you just aren't going to flex on.

If they're already here, here's what I've done. Having the courage as employees and leaders to call that behavior out. Really say, you know what, you are exceptionally brilliant. But the way you come across doesn't allow for anyone to hear your opinion, because you aren't able to bring anyone along with you. You may have all the answers, but the way an environment works, and especially a work environment, it's all about learning how to communicate within a team.

So not having the fear to have those direct conversations. People inherently don't want to be jerks. Maybe they've just never been given the feedback. Maybe they don't understand how it's coming across. Maybe they're frustrated about something else. Maybe they're having a bad day.

But I think not allowing that behavior to continue and having the courage and the voice, whether you're their peer or their manager, it becomes a thing about the culture that you're trying to maintain. And giving people the ability to empower themselves to call that behavior out and say, that's not cool. That's not acceptable and I don't really like working with you is really important.

The way you do that is really by being clear on what your culture is. And what we've done at BlueCat is we actually have a culture code, things like you win as a team, have the courage to act, be vulnerable, listen to and guide customers and be approachable and responsive. That was something that we crowdsourced the entire organization.

So that now they have the ability to be like, that's not the behavior, that's not what we said we wanted. And having those direct conversations I think is really the only way to kind of curb some of that type of behavior.

Chris: So if you find yourself that you are that person and you don't want to be and you're willing to learn, what are some practical things you can do to kind of reel it back and be the person you want to be?

Cheryl: I think really, this sounds like such a basic thing, but just being really aware of how you come across. And if that's not easy for you, then ask someone that you trust, say, or pause and think about, if someone said this to me, how would I react? It's that age old principle, treat others like you want to be treated. It's not that hard, but it is hard when you're under pressure, you've got deadlines, people aren't understanding what you're trying to say. All of that creates a pressure cooker where... and when you're stressed about something, you kind of become depleted in how to really draw on that emotional intelligence.

So, maybe practicing or thinking about just being a little bit more mindful, doing some self-reflection, thinking about you know what, the meetings that I had, why weren't people understanding me? Or being really aware of what those triggers are and working on them, it's kind of like doing therapy on yourself.

I really, really think, just reflection and taking some time going for a walk and thinking about, okay, now I'm going into a meeting, this is what I want to get done. What's going to trigger me? And you just have to do it, like be mindful, do some reflection, I don't know, do some yoga. Just work on yourself to be a better human. I honestly think that some of those things will just start to change, but you have to want to do the work.

Chris: You have to want to change, for sure. So one of the things that you have as a specialty is that you mentioned is helping tech and cyber professionals move from their current roles into managerial positions. And part of the issue we talked about before the show isn't just getting better at your job or getting the promotion. You noted that a lot of tech and cyber professionals might be reluctant to move into a management position, because it means losing the ability to do the day-to-day work, zapping the bugs or getting the bad guys, which can be the fun part. Versus, being in meetings and telling people things they don't want to hear.

So since management is still a vital part of any security endeavor, what is your recommended strategy for people who might be a good candidate for these things, but not particularly hot on the idea of managing others? And how do you get them into that particular type of job transition?

Cheryl: Yeah, you know what, and I've thought a lot about this. And I think it's, again, it's that are you interested? Is it something you want to do? Because I think often what happens is that people fall into the trap of thinking that the only way to advance is to become a manager. And my take on this is a little bit different than what you asked, meaning that I think it's absolutely critical that if you are not interested in managing people, if it's just not your thing, but you think it's the only way to advance your career, again, really think about how you're going to be... like what a manager is.

And to your point, it's sitting in meetings, it's sometimes having difficult conversations, you're maybe not solving problems through others and not being the person on the forefront. I would prefer that people just say, you know what, it's not my thing. And what we've done at BlueCat is we've actually just revamped some of our career path for our technical folk. And what we've done is, it's all about if you want to hone your craft, you can still be very relevant. Go and be the best technical resource and the technical SME and we will all go to you for your technical ability. But that doesn't mean you have to manage people.

Giving people a different path, I think traditionally what companies have done, it's really easy to be like, hey, go manage a team and that's how you get promoted and that's how you become more relevant.

Chris: Or the org chart already has all these five things. So you can be one of these five things.

Cheryl: Again, having the courage as an organization to really look at like what are the things you're trying to get done? And having the courage as an individual to say, you know what, maybe I'm not suited for a manager role because I don't want to spend my time doing that, because it's just not me. I would rather hire people that are, again, a little less technical if they value the art of leadership, and then put the technical resources around that group.

So it's like a shared responsibility. So you can have a technical expert to learn how to do all those really critical technical skills, but then you have almost like a coach for a manager that helps with those soft skills that we've been talking about, that aren't necessarily there. So kind of a two pronged approach and both are relevant and both are as critical to the organization.

Chris: Okay, so the other side of that, assuming you do find yourself in management or interested in being a manager, but not quite convinced yet. How do you look for new forms of satisfaction now that you're kind of off the frontline?

Cheryl: I think you have to, again, get really comfortable with being valued through others. So getting comfortable with your team having the recognition, that maybe it's someone... that's so important. I think going from an individual contributor to a manager role, that's probably one of the hardest things for people to do. Because think about when you get recognized as an individual contributor, it's for solving hard problems or being the person there that was saving the day.

And as a manager, you actually need to lead through your people and how you can get satisfaction is by being that coach, by saying, here are the things that I did in my career that helped me and really getting satisfaction with growing and developing others. That's not your interest, and it's going to be hard to find satisfaction.

And I think also, really just mentoring others and showing them and leading them, teaching them, that's all something that a manager has to do. If that's something that you're interested in, then I think that you can find satisfaction, but it is definitely different than being the person, the go to person. It's all about making your team the go to team.

Chris: And getting the reflected sort of glory. So based on what you've worked with tech professionals, what roles do you think that certification and cert training play in professional development?

Cheryl: So I think any type of learning is important, because what I want to assess is, are people willing to continually educate themselves and if they have that, I think that that's so important. A lot of times, people get into their day-to-day they're like, I know it, and that's not the way, gosh, that's not the way our organizations work. We're constantly faced with new challenges, new problems, complexity.

So I think certification and showing that you can follow through and accomplish something and have that ability to be accountable and have ownership on completing something, super important. I think that lifelong learning is something we all should be doing. Whether it's a certification or anything that makes you better.

Chris: If given a magic gavel to change the world, would you create or require a tech cyber cert that focused on communication, writing and soft skills? And if so, what would your curriculum look like?

Cheryl: I love this question. I think that this is, if I could have my way, this is what I would spend all my time doing. I really think it would be focused on how to communicate with empathy, really getting an understanding of how to deeply connect with others and build trust.

I just don't think it's something we as tech professionals just spend that much time doing. I just think it's something that's always kind of seen as like, oh, it's squishy or-

Chris: It doesn't help the bottom line.

Cheryl: Or it doesn't help the bottom line or that's not cool. You don't need that because these are deep technical problems that we need to solve.

I think that really just, again, how to focus on change management. All of us are faced with change in tech companies, it's the constant. So how do you manage through change and do it with a positive attitude? How do you not get strung up on yourself that you know everything and this is the way and no one else can tell us because we've already tried that? Just really having that ability to continually grow and learn.

I think also, learning what motivates others, like really having an understanding of maybe that's not something that's important to me. But what's important to that person? I'm bringing back that empathy piece again, like how to connect and build trust.

The other thing I think a lot about is how to spot burnout. When are your colleagues or you, even just you're too flat out and you're not doing your best work? How do you really just think about how to slow down, take a breath and recharge? Because I think again, as tech and cybersecurity professionals, we're always in the pressure cooker.

And really, it sounds kind of like a psychology degree if I think about it, but just really that other side of how to connect with yourself and how to connect with others.

Chris: So for our listeners who might not be involved at all in cybersecurity or tech right now and are considering starting at the beginning, say they're maybe still in college or whatever, what skills or experiences do you recommend that they get involved in now while they're still on the ground floor, pertaining to the sort of communication and collaboration elements that you're talking about? What are some things that new cyber and tech professionals can learn right out of the gate that will curtail these bad habits at the start?

Cheryl: For sure, how to work in teams. Honestly, if you're still in school, again, that team collaboration, my son's 13 and it's being taught in his school. Just again, how to work with others that may not have the same skills as you, how to get the best out of them. How to, again, not have to do everything yourself. Because that's never going to be the way it is in a professional environment, it just doesn't work that way.

Practice communication, again, I mentioned Toastmasters. If that's not your comfort zone, it's so critically important, especially with what's happening today with the way young professionals communicate. They don't come into the work environment having ever spoken on a phone, they're texting, they're using emojis. I watch my children do this all the time. And really like practicing the art of communication, whether it's verbal or written.

Again, it kind of sounds really old fashioned, but we are losing that ability to really read people's faces, to look at someone's face and see their body language, just connecting that way I think is so important. So it's not necessarily about the technical skills. I actually would prefer to hire someone that actively listens, that seeks to understand and not just respond. It's all those soft skills, because that's the stuff that is so hard to unwind from.

So maybe putting yourself out of your comfort zone, maybe you go and do something that's not necessarily in your interest, but makes you a bit uncomfortable, because that's what you're going to be faced in, in your day-to-day work environment. There'll be situations where without practice or without exposure, it's really hard to know how to act in that type of environment.

Chris: Okay, flipping around to the other side of that, what recommendations do you have for cybersecurity organizations or other security focused tech companies, in terms of professional development for their cyber professionals? What types of tools or techniques might be available out there that aren't being used?

Cheryl: Yeah, great question. So I was just recently certified on something called the Enneagram, spelled, I'm not sure if you're aware of it, but what it is, it's spelled E-N-N-E-A-G-R-A-M for the listeners. What it is, it's a tool that helps with assessing what your motivators are. So there's nine different personality types. And this sounds a little bit like, it's not Myers-Briggs or anything like that.

It's honestly, it's probably one of the best tools that I've seen that helps you become more self-aware of your communication style, what your triggers are, what motivates you. And what the other people that you will encounter, what their motivators are, what they're triggered by.

So again, learning how to work within teams, learning how to connect, I think that this seems to be a really practical tool. We actually used it with some of the teams here at BlueCat and it's been very well received. So just again, whatever you can do to become more self-aware of who you are, I think is going to benefit. I don't know if that's always something that people think about when they're thinking about their career.

You're going through, you're getting your education, you're coming up within an organization, but there's a theme here today that we're talking about, but just taking that time to reflect on what are you actually motivated by, what gives you joy? What are the things that you just hate doing? And really being aware of that.

And so that's a really practical way and I think, again, that whole connection piece, the whole learning how to present, learning how to talk about complex problems to non-technical people in the organization to get their buy-in, is super critical. So again, finding either a mentor or someone senior in the organization that has done that, super critical.

Chris: So as we wrap up today, and you're sort of telling me all this, but push this into the future, where do you see the move toward better communication, writing, soft skills, et cetera, for cyber and tech professionals in 2019 and beyond?

Cheryl: As I was thinking about this podcast and getting prepared for it, I started to do just a little bit of research on what's happening here? And there seems to be, it's not being taught in schools yet. But there seems to be a little bit of a movement happening about, again, how do we create empathy? How do we teach emotional intelligence? How do we get those people, our employees to really think about that?

I think we're going to see a shift, and it's because of what I mentioned. I think we are in a phenomenon where people are hiding behind their phones and not really learning how to communicate. I think the pendulum is going to swing back, because it has to, and I just think that there's going to be this shift where people really start to think about like, they've lost something, they've lost that art of communication.

It's got to happen because the thing that humans need is that connection piece and that ability to relate to others. And if you don't have that, I think we're going to see, honestly, and you're starting to see a little bit of it happening in the organization right now with mental health, and the ability to really relate to others. I think what we are going to see is that there'll be a correction, and that people will either... I'm not saying that people are ever going to give up on their phones or anything like that, but that ability to really reach others.

Chris: You mean more sensibly.

Cheryl: Yeah, yeah. And really understanding and trying to relate to others. I think it's going to shift. I think it has to.

Chris: Yeah, it's due. But do you have a sense of what you think the mechanism is? Is it just going to be like this sort of mass understanding, everyone's like enough, I can't be like this anymore? Or do you think there's going to be some person or thing or whatever that's going to like, everyone's like, oh, okay, now I get it?

Cheryl: I think it's already starting to happen, quite frankly. Because if you think about people talking about the type of people they want to work with, no one says, oh, I just want someone that knows how to solve problems. There's still that ability to relate to others, there's been a lot of shift into... people want to work at a company that treats them well and that has a good culture.

You ask anyone now, there's already a shift happening. It's not about I want to make the most money or I want to be the best. I want to work in an environment where I feel a sense of belonging, I feel included, I like the people I work with. That's already happening.

Chris: Which isn't necessarily swimming pools and foosball tables and stuff. There's that shift away too.

Cheryl: No one talks about like, oh, they've got a ping pong table or free lunch anymore. If you ask and I just actually had one of... I sat down with one of our employees that's been here five weeks. What he was seeking for, what people are seeking for is the culture and that they feel comfortable and invited and able to have a voice. And he looked a long time before he came to our organization. And he said, you know what, I came because I wanted to be a part of your culture. I could see it from the minute that we started, from doing research online about who you guys are as an organization. I saw it through my interview process.

And people want that connection and a sense of belonging, and they'll forego that if they don't have it. They'll bypass organizations because they don't want toxic environments. I think it's already starting to shift and I think it's just going to become more and more about creating cultures where people feel included for who they are.

Chris: Okay, one last question. If our listeners want to know more about you or BlueCat, where can they go online?

Cheryl: So you can find me on LinkedIn, Cheryl Kerrigan and bluecat.com. Take a look. We always are looking for people, so a plug.

Chris: Great.

Cheryl: But yeah, we're happy to chat anytime.

Chris: Fantastic. Well, Cheryl, thank you for your time and insights today.

Cheryl: Thank you for having me. I really enjoyed it.

Chris: Okay, and thank you all for listening and watching. If you enjoyed today's video, you can find many more on our YouTube page. Just go to YouTube and type in Cyber Work With Infosec. Check out our collection of tutorials, interviews and past webinars.

If you'd rather have us in your ears during your work day, all of our videos are also available as audio podcasts. Just search Cyber Work With Infosec in your favorite podcast catcher. To see the current promotional offers available for broadcast listeners, podcast listeners and to learn more about our infosec pro live boot camps, infosec skills, on demand training library and infosec IQ, security awareness and training platform, go to infosecinstitute.com/podcast or click the link in the description below.

Thank you once again to Cheryl Kerrigan and thank you all again for watching and listening. We'll speak to you next week.