Many Stumble Into Cybersecurity, But Leadership is By Design

Today, while cybersecurity is a highly sought-after field, most of its current leaders and executives stumbled upon it. Their paths range from curiosity about how technology works to public service in the military or even self-taught coding to sell merch as a rock artist. Traditional higher education pathways were not the norm, regardless of our endless certification options today.

Many people may have stumbled into InfoSec and cybersecurity, but the leaders who have emerged over the past decade have done so intentionally. These leaders are not only highly technical but also possess soft skills, exhibit creativity and strategic thinking, and confidently hold their seats in the boardroom.

During RSA Conference 2024, Synack hosted its annual Women in Cyber Breakfast panel. The panel featured four cybersecurity leaders with significantly different backgrounds and representing just as varied organizations, but their leadership styles offered many common themes. Those themes ranged from building teams that last (reduced turnover), preventing burnout and accepting the do more with less fate, managing the bad days, and the role diversity plays amidst each of these components.

These narratives underscored that there is no single pathway into the field, and they highlighted the value of diverse experiences and backgrounds. Another prominent theme was the importance of continuous learning and curiosity in cybersecurity. The field is ever-evolving, and staying ahead of potential threats requires an ongoing commitment to education and skill development.

The panelists also discussed the challenges of retaining women and other underrepresented groups in cybersecurity. And, finally, the role of threat intelligence in staying ahead of potential threats was a key topic of discussion.

At the panel, I also caught up with a friend and former colleague, Lindsey Haven, who expressed the following:

“Having been in cybersecurity for the last decade, I’ve witnessed firsthand the transformative impact that diversity brings to cybersecurity. We’ve seen women’s participation in cybersecurity climb to about 24%, a clear sign of progress in an industry that greatly benefits from varied perspectives. Diversity isn’t just about filling quotas—it’s about enriching our field, driving innovation, and building resilient systems that reflect the diverse society we protect.”

The Panel

Axios Cybersecurity Reporter and Codebook newsletter author Sam Sabin moderated the panel that consisted of:

• Kirsten Davies, CISO, Unilever

• Melissa Vice, Vulnerability Disclosure Program (VDP) Director, Department of Defense Cyber Crime Center (DC3)

• Swathi Joshi, VP SaaS Cloud Security, Oracle

• Vasu Jakkal, CVP Microsoft Security, Compliance and Identity

Intentional Pathways to Leadership in Cybersecurity

Throughout the discussion, the panelists shared their unique paths to leadership in cybersecurity. Joshi emphasized the importance of both specialization and generalization in her career path. She began as a SOC analyst and then spent six years specializing in defense operations. However, to lead an overall security program, she had to reorient her career to become a generalist again.

In a similar vein, Vice highlighted the value of curiosity and continuous learning. Despite starting her career in advertising and design, her passion for technology led her to the cybersecurity field.

“I feel like I’m the poster child of not belonging in cybersecurity. I was a singer-songwriter. I toured as a rock artist. I learned how to code from a friend at the time. I was doing all my own swag. I was designing my own website and my t-shirts,” said Davies. I fell in love with technology, and I fell out of love with touring with sweaty guys on buses and vans that were like drinking Jack like it was no tomorrow. Now I drink with tech guys, but at least they shower, right?”

Jokes aside, this journey of self-exploration and risk-taking has led many into the world of tech and cybersecurity. After being a rock star, Davies moved across the world, adapted to new career fields, and built her skills as a leader.

“I took decisions that other people thought were just too risky for their careers. And, and look what’s happened, right? Look what’s happened,” said Davies”

The panelists also emphasized the importance of seeking out sponsors who advocate for your decisions and work and mentors who can guide you through shoes they’ve previously worn.

These diverse experiences highlight that there’s no uniform approach to entering and progressing in the industry. A few key skills and traits beneficial for leadership in cybersecurity include a learning mindset, adaptability, and a willingness to take calculated risks.

Different Perspectives, Different Narrative

Cybersecurity originated with a heavy-handed emphasis on fear of the unknown. Even today, media literacy has a ways to go, as often, the largest headlines focus on breaches and incidents. What started as a rare event has now become the norm, and citizens are numb to the idea of their PII and credentials being leaked yet again. Without different perspectives, how can we shift from the idea of cybersecurity being part of an endless war and move towards something more proactive?

“I also feel like we need to change the dialogue in security,” said Jakkal. “When I joined security, it was about FUD and fear and darkness.”

That dialogue was shaped by an exclusive circle of people with significant gatekeeping.

“I just thought it needed to change. You know, we need to lead with optimism and hope, and a team and collaboration and look at abundance. That’s what keeps me in cybersecurity. I think we all get the privilege to build a safer world, and that’s worth fighting for.”

Today, that gatekeeping still exists. While many try to engineer different perspectives into their teams, strategies, and boardrooms, others will do everything they can to build a facade. Some may even use AI to create fake women for their developer conference.

Teams That Last: Importance of Diversity and Leadership in Cybersecurity

To improve retention rates, organizations need to create an environment where everyone feels valued and included. They also need to provide opportunities for continuous learning and growth. As the panelists’ experiences show, a career in cybersecurity is often marked by changes and switches, and organizations need to support their employees through these transitions.

You need to lead with empathy, said Vice.

“I really do try to find out what my team’s about; what’s important to them. And I love what Swathe said because I think a lot of times the old guard does not think about what makes it not inclusive,” said Vice. Holding your meetings at 4:30 – 5:30 when we have to go pick up kids, not inclusive. Deciding we’re gonna have a golf outing? Probably not inclusive.”

Building upon Vice’s comments, Jakkal reaffirmed her assessment by saying that while people think you can’t be empathetic and a strong leader, the two elements go hand in hand.

Others expressed a more strategic and analytical approach to understanding the strengths and values of the teams they inherit. For example, Davies will conduct a four-year look back that consists of employee growth, promotions, and pay increases. “We need to be very specific if we want to change the course. A team of 3 or 5000, course correct. Look back and find where inclusion stopped.

Looking toward the future, the next generation of cybersecurity practitioners also have a wildly different perspective.

“Gen Zs and Gen Gen Alpha are coming into the mix; what they want is very different from what we wanted,” said Joshi. “I think as leaders, it’s our responsibility to figure out 10 years from now, we are going to be recruiting these people into our teams and we are going to be leading them. What they want is definitely different from how we grew up.”

Joshi goes on to say that regardless of today’s outlook, leaders must determine how they can shape the industry to match this while opening doors to others.

Navigating Bad Days

Every cybersecurity professional knows that the role comes with its fair share of tough days. During an incident? That goes beyond bad, but day in and day out, it’s a constant battle to reduce risk, prevent burnout, and educate the board about the value of this critical function. There are many ways to manage the bad days, and the panel offered several suggestions.

For one, Jakkal recommends anchoring yourself in gratitude and how it can help put things in perspective. She was the first woman to work outside of the home and reflects on how far she has come to find optimism in the grand scheme of things. It’s beneficial to step back and remember the bigger picture, taking into account global issues such as wars and refugees.

Joshi and Davies recommend balancing adding structure and exercising your crisis management muscle. Processes create well-worn paths, which can guide you on challenging days. It’s a gift to be able to switch from the unknown to the analysis of what we know. This is where you learn when to take a leap of logic and when to take a leap of faith.

Cybersecurity, especially threat intelligence, requires constant context switching. Learning to juggle multiple tasks and find balance is essential for managing the workload. Conducting retrospectives can also be a valuable tool for reflecting on and learning from the past.

Lastly, Vice, who works for the federal government is in a slightly different tax bracket of stress.

“Our job is to stay left of boom. So we ingest all of the vulnerability reporting for joint force headquarters, DoD, and US Cyber Command, and get to help remediate those hopefully before something bad does happen,” said Vice. ”I remember asking my boss when I came on as the chief operations officer. I’m like, ‘how do you sleep at night? How do you turn it off? And how do you actually sleep at night?’ Because there’s always something, and there’s usually really something right before a holiday weekend.”

Like many, Vice had plans for the holidays, but in December of 2021, Log4j said otherwise. It dropped right as she had put in leave. In these situations, Vice says you must be resilient. ”I just try to slow down time. I try to ask the questions. I try to go and find the answers to the questions one at a time,” said Vice. Don’t get ahead of yourself, don’t jump to conclusions, and just work the problem.”

*** This is a Security Bloggers Network syndicated blog from Adopting Zero Trust authored by Elliot Volkman. Read the original post at: https://www.adoptingzerotrust.com/p/cybersecurity-leadership-by-design