Episode 4: Culture beats resources – Team Talk podcast

What does it really take to take a football club into the Football League for the first time in its history?

In this episode of Team Talk, Matt Hall, Head of Football Operations and Administration at Bromley Football Club, shares the club’s journey from non-league football to promotion in 2024, and what it means to be part of the “team behind the team”.

This conversation reveals powerful lessons about leadership, alignment and culture – particularly in organisations with limited resources but big ambition.

Listen to the episode here:

Episode 4: Culture beats resources

Guest: Matt Hall, Bromley Football Club

Sherry Bevan: Hello and welcome to the Team Talk podcast. This is a show where we discover how to build high performing teams, using lessons learned from the world of sport. I’m your host, Sherry Bevan, and in today’s episode I’m delighted to be talking to Matt Hall from Bromley Football Club. Welcome, Matt.

Matt Hall: Thank you very much for having me.

I’m especially excited to speak to you because Bromley is my most local football club. For anyone not so familiar with the club, could you share a bit of background – where Bromley sits in the Football League and some of the exciting things that have been happening recently?

This is Bromley Football Club. You can see the crest behind me – we were formed in 1892, so we’ve been around a long time. We’ve made real strides over the years, particularly in the last handful.

We’re a fully professional club based in the London Borough of Bromley – though some might prefer to say North West Kent, and I’ll leave that debate there. It’s the largest borough in London and Bromley deserves a football club it can truly be proud of. I think over the past few years we’ve shown that we can be exactly that.

We play at Hayes Lane Stadium, we’ve got a fantastic group of players, and this season we’re in the Football League for the first time in our history. That’s a huge moment for us. We’ve spent our entire existence in non-league football, most recently in the National League, and last May [2024] we were promoted to the Football League for the very first time.

It was a groundbreaking achievement – not just for the club, but for the borough as a whole. To have witnessed that journey, and to have played even a small part in it, is incredibly special for me, especially as a Bromley supporter. It makes it all the more meaningful.

Are you local? Were you born and brought up in the area?

I was – an Orpington boy. I grew up there and lived there very happily with my family. A couple of years ago I moved to North Kent with my partner, but I still work in Bromley, still spend a lot of time with my family in Orpington, and I’ll always consider myself an Orpington and Bromley boy wherever I am.

I really bought into everything the club was doing in the community early on, and Bromley and Orpington will always feel like home to me. Being a local person involved in this journey means a great deal.

You’ve set the scene brilliantly. Tell us a bit about you now – your background, your role, and how you ended up here.

I first started watching Bromley when I was about 15 or 16. This was before social media, so I’d read match reports in the back of newspapers and think, I’ve got to go down there. Eventually, in 2011, I did. My first game was against Eastbourne Borough.

We lost 3–1. The players were part-time, there were probably about 250 people in the ground – but something about the place just grabbed me. I was hooked.

It felt more real to me than top-level football. You could relate to the players; they weren’t earning millions. It felt accessible. My support grew and grew, even though it took three or four months before I saw us win a game. That tested my patience – but I loved it regardless.

Eventually I became programme editor for a season, editing the matchday magazine. Around the same time, I got the opportunity to take over stadium announcing as a teenager. That was a huge moment for me. I fell completely in love with the club.

I got to know the Commercial Manager, became more involved, started commentating for what was then a small club radio station, which has grown significantly since. In 2018, I was offered a full-time role while finishing a university degree in education. I spent two years teaching before moving fully into this role.

It’s been an incredible journey. I’ve done almost every job at the club – everything except pulling pints behind the bar. Nothing really phases me anymore.

You haven’t been called up to play on the pitch yet, then?

If that happens, we’re in serious trouble.

You’re very much running the team behind the team. What does that involve?

I report into our CEO, Mark [Hammond], who’s been here a similar length of time to me. We’ve also got a chairman and owner who’s a Bromley boy himself. When I first became full-time, we were working out of a portacabin. Before that, it was literally a bar.

Now we’re in a state-of-the-art facility, which is a huge credit to the leadership of the club.

My role is Head of Football Operations and Administration. Everything that happens off the pitch for the players and coaching staff comes through me – administratively and operationally. That includes player registrations, contracts, compliance with league regulations, and ensuring we’re operating within the rules.

Since promotion to the Football League, the learning curve has been steep. The regulations are completely different. I manage player eligibility, transfers, travel logistics, matchday operations, audits, kit compliance – you name it.

I’m essentially the main conduit between the footballing authorities and the club. If you hear from me publicly, it’s usually because something’s gone wrong somewhere.

It’s a wide-ranging role. Hundreds of emails a day. But it’s also incredibly rewarding. Out of 72 Football League clubs, we’re the only one who’s never been here before. The workload has been immense, but making sure we meet every requirement is my responsibility.

I also support the integration of academy players, sit on the board of the Community Trust, and previously led it for several years. In short, I do a bit of everything – and I do it because I love the club. No job too big, no job too small.

How does what happens off the pitch affect performance on it?

Our manager, Andy Woodman, is brilliant at reinforcing this. There has to be mutual respect. The players can’t do their jobs without us, and we can’t do ours without them.

The goal is simple: remove distractions. Players should only be thinking about football – not travel, kit, logistics, or admin. Every department works together – sports science, medical, coaching, analysis, kit, operations – so players can perform at their best.

Andy has created a culture where everyone understands their role. That alignment is why we’re where we are today.

What have you learned about high-performing teams?

Culture is everything. Andy brought Premier League-level professionalism with him, and we’re very deliberate about recruiting people who fit our culture. He talks about a team “DNA” – looking after each other, working for the team, being punctual, respectful, and representing the club properly.

That clarity matters. People know what’s expected. Andy is exceptional at understanding individuals and motivating them differently. He’s also very good at spotting characters who might disrupt the group – and we’ve never signed a bad egg.

We’re a small club with limited resources, but we’re incredibly tight-knit. Everyone gets stuck in. “That’s not my remit” doesn’t exist here. That mindset is mirrored on and off the pitch.

How has the community embraced Bromley as the club has grown?

The change has been remarkable. Years ago, only a handful of kids recognised the badge. Now, you hear people say, “That’s Bromley FC – Michael Cheek’s my favourite player.”

The real penny-drop moments were our FA Trophy win in 2022 and our promotion. The open-top bus parades were unforgettable. As we came over the hill into Bromley High Street, the bus went silent. Streets were lined with people. Some of us were genuinely emotional.

When we arrived at The Glades and I stepped onto the stage, the crowd just kept going – floor after floor of people. That outpouring of support was overwhelming. It showed what the club truly means to the community.

Community is at the heart of everything we do. The Trust runs projects for everyone – from toddlers to people in their 90s, including dementia support. That matters deeply to us.

How have you grown through all of this?

Massively. I was incredibly shy growing up. I never imagined speaking in front of thousands of people. This club has helped me find confidence, resilience, and purpose.

It’s broadened my skills, strengthened my character, and given me something I truly care about. I’ve learned how to deal with complex personalities and professional footballers – who, despite stereotypes, are some of the most grounded people you’ll meet.

Players like Carl Jenkinson, a former Premier League and England international, are incredibly humble. Others like Michael Cheek – our record goalscorer – prove that talent and mindset transcend levels. When he told me, “The goal never moves,” that really stayed with me.

My aim is simple: to be the best possible ambassador for what this club represents. I’m incredibly proud of that responsibility.

Finally – your favourite sporting moment?

It has to be Bromley. That winning penalty at Wembley in 2024. Byron Webster – our captain – stepped up. A centre-back, not a striker. The composure, the confidence, the smirk. It was iconic.

What that moment meant to the club, the borough, and everyone involved is impossible to describe. He went down in history that day. I don’t know if anything will ever top it – unless we reach the Premier League one day.

What a moment. And what a story – not just about the team on the pitch, but the team behind it too.

Thank you so much for joining me today, Matt. I’ve really enjoyed talking to you.

Important Links

About Matt Hall

Matt Hall is Head of Football Operations and Administration at Bromley Football Club. A lifelong supporter and local to the area, Matt has grown with the club – moving from volunteer roles and matchday announcing to leading football operations at League level.

He is responsible for all off-pitch operations supporting players and coaching staff, including compliance, logistics, registrations, and league relations. Matt also sits on the board of the Bromley FC Community Trust and is a passionate ambassador for the club’s values and its role in the borough.

About your host: Sherry Bevan

Sherry Bevan helps teams in transition perform at their best – without the fluff. A former Global Head of IT Service in an international law firm, she now works across technology, professional services and the charity sector. Through her Team Kickoff Accelerator, Sherry supports new and changing teams to build trust, strengthen collaboration and set the foundations for high performance. A former grassroots cyclist and still a runner, Sherry is fascinated by what sport can teach us about teamwork, leadership and sustainable performance – and it’s these ideas she explores with leaders and experts on Team Talk.

Connect with Sherry

Episode 2: High-performing teams – Team Talk podcast

This episode explores what it really takes to lead performance when the spotlight is unforgiving and results matter.

If you care about culture, leadership and sustainable high performance, this episode is for you.

Listen to the episode here:

Episode 2 High-performing teams

Guest: Scott Drawer, INEOS Grenadiers

Sherry Bevan: Hello and welcome to the Team Talk podcast. This is the show where we discover how to build high performing teams, using lessons learned in the world of sport. I’m your host, Sherry Bevan.

In today’s episode I’m delighted to be talking to Scott Drawer, who is the Performance Director at INEOS Grenadiers, A very warm welcome to you, Scott.

Scott Drawer: Thank you for the invitation to speak.

You’re very welcome. For context and for our listeners, it would be nice to hear about your background and how you came to be in your current role.

In my current role, I’m the Performance Director for INEOS Grenadiers. We’re a professional cycling team, formerly called Team Sky. If you don’t know the sport well, it’s a professional cycling team.

We’re part of the World Tour Circuit. We compete in all the biggest races that people know, such as the Tour de France, which is the biggest. It’s the second highest viewed sporting event behind the FIFA World Cup. As well as events like the Giro d’Italia and la Vuelta a España. Then there’s a series of races in the Spring that are called the Classics: Paris-Roubaix, Strade Bianche. These are really artistic, historical races that people can connect to.

The team is made up of around 30 bike riders Overall, 128 staff and that includes everything from marketing to HR. My job is Performance Director. I am fundamentally responsible for winning races and helping achieve our race targets. That covers everything from managing a coaching team: we have 5 specialist technical coaches who train and prepare our riders to go and win bike races and the demands of that. We have a team of sport directors – sport directors are typically former bike riders. They’re the tacticians. They own races. They organise and are responsible on a race for making decisions about the strategy and tactics. It’s like taking a head coach in a football team and splitting the role into two. They would maybe do all the training in the week and then pass it over to somebody else on game day. That doesn’t happen in cycling because of the nuances of it. The coaches look after the riders holistically and are preparing them for racing, but they speak with the sport directors. The sport director goes into the race with a particular team. He understands where that rider’s capabilities are at and then calls the tactics and strategy for the race.

We also have a large technical team which is predominantly science and medicine. A really important part of what we do involves technology, engineering, physiology, nutrition, therapy, physical therapy, physiotherapy and our doctors. They are really important and they attend races.

I’m also responsible for rider recruitment and our rider performance management. There’s a big remit. I report into our CEO who has big oversight of the whole team, particularly the business side of it.

I’ve been with the team since March [2024]. I had a former stint with the team in a very a technical role. All my career, I’ve been involved in high performance sports in some remit whether that’s at youth sport level, through to the extreme that we’re now at. It’s genuinely high performance in the sense that it’s the highest level you can go relative to your ability level.

I have a multi-sport background. I spent a lot of my career in Olympic sport right up to London Olympics [in 2012). I worked in professional rugby. I then did a stint with the team initially and then went to work in one of Europe’s leading schools for sport called Millfield in Somerset. You need to make a different life decision around family and balance and travel before the opportunity came to come back to the team.

I’ve had breadth and depth of experiences. My background is science so I think very logically. I’m intrigued by science and research which often drives my general approach. It’s been a pleasure to come back to the team.

The team’s not where it would like to be. It dominated the sport. Primarily, I think because it was the 1st sport that it spun out of British cycling, which was hugely successful prior to the Olympics. I think the sport was probably lazy. I think Sir Dave Brailsford brought in significant number of professional concepts to take the sport on, and that’s why it was super successful.

COVID hit new owners, and I think that the landscape of the sport changed dramatically, faster than any other sport – and it hasn’t kept up to pace with that. We’ve just been through a significant change process in an attempt to get back to where we are. It’s an exciting time for us.

It does sound like a really exciting time for you to come back into the team. Under Team Sky, it was hugely successful and very much THE dominant team. I imagine that you would love to get back to being the dominant team in in the sport. Coming back into the team last year, what have been the biggest challenges for you?

The biggest challenges when coming back is getting back to grips of understanding the landscape of the sport. You invariably had a preconceived idea. I had a bias from being part of the team in the past in a very different role, not as close front line, but very much in a technical role supporting in the background. The landscape of the sport had changed significantly. I think it’s the ability and pace to get back up to speed. It sounds quite simple, but you have to fully immerse yourself. There’s a lot of travel even on races across Europe; you spend a lot of time trying to get to know people. Whenever you go into any industry or any business in a new role, the faster you can do that the better.

That takes time. The nature of this sport means that it’s quite dispersed across Europe. You don’t come into an office every day. Your coaching team, your rider team, live in different places. They only come together for races and camps which makes it really difficult to create connection and trust with those around you and really understand them.

It’s the nature of the sport and the time it takes to get yourself back up to speed. It’s important to try not to come in with any preconceived ideas or cognitive biases. We want to get back to where the team were [in the past]. It’s not that the team’s gone backwards. The team has plateaued. Everyone else has moved on at a faster rate. The nature of the sport and the nature of this team means there isn’t a natural environment to see things on a day-to-day basis. I had to spend time on bike races, observe, and get to know the riders, get to know staff that were there before making any conclusions in my head.

You talk about the importance of having that connection and trust between the different teams behind the team on the road. How did you do that? How do you build connection and trust?

We’ve got to remember that we’re quite simple creatures. Evolutionary biology and psychology hasn’t changed that much. Society changes a lot because of technology. But I think the fundamental needs of individuals are to connect with humans. You need to be part of a clan and part of your tribe. I’m really influenced by the work of Owen Eastwood and Robin Dunbar, anthropologists who really studied and understood that importance of being part of something, part of a community, because it’s how you survive.

Even nowadays you will read that loneliness is one of the strongest predictors of an early death. You can’t escape some of these fundamental evolutionary concepts around human connection with others and that takes time.

Being around people, the social element of it, you’ve got to be very empathetic, you have got to understand where people have come from. Coming back into the team, there is a tremendous legacy with what the team’s done, but the sport has changed. How do you look forward and not take that baggage with you? You want to take the good stuff. I don’t think there’s a shortcut. You have to get into the trenches – it’s the best way. And really connect with people to listen and to understand.

Lots of people that I work with had lots of things to tell me about why things weren’t working. That’s helpful and sometimes that’s not helpful because I think you have to experience it. I always felt like I needed to experience it and see it, and observe it, to believe it. Eventually, you see those themes and trends. Only by spending time, does it start coming to the surface. I’ve seen that two times, three times, four times – now that’s interesting. Those patterns and themes begin to emerge. Because of the dispersed nature of what goes on, you can’t get away from the idea of human connection. It’s taken time to get that right.

You’ve not come from a professional cycling background. I know many in the sport have that background. Do you find that gives you advantages or disadvantages when working with the teams?

There’s two sides to that. I certainly came to the sport late in life. in the early part of my career, I was really fortunate to work with Olympic track cycling. That was my 1st immersion. It’s a sport that I fell in love with. I don’t know why, I can’t explain. My background is in football and cricket. I think it was the nature of what that sport was doing at the time.

Yes, there are pluses and minuses. The nature of this sport means I’ll come with very different perspectives. Having worked in a number of sports, I think there are some consistent principles and design factors that if you went into any sport, you’d expect to see if they were successful. It doesn’t matter whether it’s cycling, rowing, football – there are key characteristics which shape it. If you went in as a consultant, there’d be things that you look at if somebody said “come in and review my sport”.  It wouldn’t matter what sport. You start with the right talent. I think that’s fundamental.

There’s lots of things that are a critical part of that. I think that’s an advantage if all you’ve ever known is that sport, you will have a particular bias. That’s not a good or bad thing. But you have a view of how that sport operates and what it should do. Again, that’s dangerous in some elements. I think there’s a balance point.

I don’t have the depth of knowledge of a former bike rider. But we’ll employ former bike riders who know, and they’re better than me. They have better knowledge and know how. It’s about the collaboration and the marriage of those ideas that help you move forward. You need the right culture and environment for that to happen.

If you go back to Team Sky, that was the essence of where they started. Professional cycling at that time was probably lazy. Olympic track cycling, and the work Sir Dave Brailsford did with his team was so far on the edge in terms of real fundamental understanding about what you need to do: planning, periodisation, science, medicine, and all those elements. Team Sky could bring that across. The team had this big aspiration to win the Tour within 5 years; they had done it within 3. It really changed the nature of it. There’s no right or wrong to it. But I think you can’t do one or the other. If you’re going to be successful, you need to really understand the business you’re in. In this case, high performance sport. There are some common principles, whatever sport it is. Having a breadth of experience, is of value. But you need that depth as well. That’s why the team needs to be a bit of both. We have a lot of sport directors and coaches who’ve been immersed in the sport. They know it that really, really well and I would bow to their expertise. I listened and I’d ask lots of questions. They ask me lots of questions as well. If you got the right environment, it can work.

What about the teams that aren’t involved in the cycling directly? Your HR, marketing, partnerships team? How much of an impact do those teams have with what happens on the road or on the track?

Massively. Only once a year, there’s a whole team get together when our back office staff come together with riders and performance staff. That happens usually in November each year. This is a celebration. But it’s also about connection and riders connecting with those that organise their travel and sort out their contract, etc.

They’re not as frontline but you have to create opportunities for that group to connect as much as possible. We’ve spent time doing a lot more of that this year. The business doesn’t operate without them and vice versa. At times of course, riders are on the pitch competing and the staff may be up in Row Z, but that doesn’t demean what they’re doing. They’re playing a valuable part of enabling those riders to succeed and perform. We’re really fortunate that our riders recognise that.

They’ll know that somebody sorting out travel has made their life really easy for the rest of the year so they get to spend more time with the family, e.g. they go on a later flight. There’s lots of things which make a difference that often you don’t see in the way things are logistically organised. They’re appreciated – they may not be at a race, but the job they do in the background is equally as important in terms of promoting the sport and supporting riders to help achieve what they need to do.

The riders are not going to be able to turn up to the right race at the right time with the right kit, unless there are these back room cogs turning.

As a sport, people recognize we’re like a traveling circus. Just imagine a Grand Tour. There are 21 stages at different locations in the country. When a rider gets up in the morning to take part in his race; he has his breakfast, and there’s a big kitchen truck. He gets fed. He then goes and gets ready for his race. Off he goes to the race with a performance team. All the logistics are already moving to the next hotel.

There’s an advanced party going to get the next hotel ready. The kitchen truck is moving. By the time they finish the stage and jump on the bus to go to the next hotel, all their bedrooms are prepared, blackout blinds are in, dehumidifiers, the kitchen truck is ready, the massage team is ready. That’s moving around the country every day. It gives you a feel of the scale of it.

Those guys are on race others maybe not on race. They could be in the back office. But everything they do plays a role in giving the riders the best opportunity to achieve their potential. That’s fundamentally what we’re trying to do.

What are the team’s big goals for this current season in 2025?

Last season wasn’t as successful as we wanted it to be in terms of the number of bike races we won. It’s probably the least successful since the team started which gives you a feeling of the landscape. Without a doubt we need to get back to winning bike races. We’ve targeted what that may look like from a very specific KPI and objectives perspective, but also more building to win a Grand Tour again.

We have got some talented riders, without a doubt. Lots of circumstances played against us last year. That’s what happens when you’re not winning.

We spent a lot of time trying to reshape and rebuild the culture. The mood is strong. The hunger is back in the bike riders and the staff. There’s a much more open, collaborative, engaging culture which is enabling the right challenge and the right support to happen at the right time.

We’re really optimistic. We’ve always had the talent. We didn’t punch where we should have done last year. If we do, we certainly should be back as one of the top three teams. That gives us a great platform to build on. You can’t control the outcome, but I think the process that we have put in place in terms of planning, riders we signed, our advanced recruitment strategy, some very particular technical strategies that are big priority for us that we identified last year; for example the use of altitude. We’ve got a plan. We’re working really hard. We have lots of new staff who are transitioning as quickly as possible to get up to speed as the season starts. We’re really optimistic and I think the team feels different. We just need to get back winning. It’s that momentum which carries you through. A real positive vibe, positive atmosphere. But ultimately, we’re going to be judged by what happens on the road. We’ve got to get one in quickly.

Was it a big job to get everybody re motivated because 2024 wasn’t a great season for the team as a whole. How did that affect morale? What have you had to do to bring morale back up?

It’s a thing that’s most difficult to do when mood isn’t good. How do you change that culture and feel the mood in the camp. It’s really hard. It’s an intangible around it. We had to change our staffing structures, and the way we’re set up. We’ve had some brilliant people in the organisation. But they had stagnated in some ways and were becoming obstacles to progress.

We had to make some tough decisions around some people that had given a huge amount for the team. That was the first decisions we needed to make about which direction we’re going and who wants to come on the bus. There are always difficult decisions through that change process.

What you find at this level is that people move on very, very quickly. Sometimes there’d be shock about a change that’s been made. But within the next few minutes it’s “Right, where are we going and what are we doing”.

There’s a quick transition process. Then it’s about building belief. It’s difficult to know if you’re going to get it right. We had two significant camp opportunities in November and December. We worked really hard to talk about what was important as part of this group. I invited Owen Eastwood, whose book I really recommend – some brilliant work around culture. That was a really good stimulus for the group, to think about how important it is for us to get connected, to back one another, and what that feels and looks like. We didn’t over-engineer those opportunities when we were together. We enabled people to have a lot of social time. We had 4 days in Manchester. Everyone was there from the back office and the riders. We went bowling. We had dinner together. We created lots of social opportunities to get people connected. People responded to that in the right way. Then our 1st work camp happened in December. Lots of change. The riders were calling for change. The content, the location – all of those things helped us to continue to take that story forward. Riders were enthused by that opportunity and super motivated also by realising we underperformed last year. They wanted to put it right and they have the capability. They’re out firing. Typically, every year, you have new riders as well, who are not influenced by the past. And they’re on their own personal mission. That really helps.

Did I know it was going to feel like this? Absolutely not. I think lots of dialogue about what we believe would have created the right environment to enable people to move forward. Acknowledge the past but move on from it. It’s about now – what we can do now, and what we can do going forward to try to be the best we can. I was nervous about that. If we were to do it again, were there things I’d change? Of course, but it’s put us in the right place to go and compete this year.

What you’re saying about not over engineering. Those opportunities when you’re bringing everybody together are important. Every time I run a team day or a team workshop, everybody always says, “We needed more networking time, we wanted more time to connect as human beings and get to know each other”. I think that’s a really sound approach.

I’d really recommend any of the audience to read Owen Eastwood’s book. We did some real simple things with the team, inspired by his work. Owen’s done some brilliant work: South African cricket, All Blacks, England Football. He’s done stuff with the Ryder Cup, where you get different people coming together to compete. We spent some time trying to understand where people come from. It’s a conversation people hadn’t had. They understood a bit more about individuals – where they were from, heritage, history, what it meant to them – that started creating connection. It’s simple, evolutionary concepts that maybe we’ve forgotten during Covid in some ways. If we reflect back on that time and how important it is to create high performing teams. I think the foundations and the glue that hold you together are really important, for when you have to go and perform. If somebody has got your back when it really matters, if they’re critiquing you or giving you feedback, how’s that going to land and respond for you? But if you trust them because you understand them a bit more, it gives you the right platform to progress. We did simple things like that. I’ve really been influenced by Owen’s work, and Professor Robin Dunbar, who’s written some amazing stuff about culture and connection.

It really resonates with me because it’s got a scientific edge to it. But when you see it in real life, it’s been really helpful.

It resonates because it’s true, because it’s right. At the end of the day we are all human beings and humans want that connection We can all work towards a goal. But we need to understand why we’re working towards that goal and what’s the point of it. Understanding where each individual is coming from, and why that goal is important to them, it makes a huge difference.

Conversations are different then and it’s more authentic. You understand more about someone that’s got children for example; you’re able to have a very different dialogue. It creates balance and balance in high performance is critical because when it’s full on, it’s intense. You can’t manage that 365 days a year. You genuinely need a way of being able to step away from it to rest, recover, and go again. It’s more important than it ever has been.

What about learnings for you since you came back to INEOS Grenadiers?

I’m learning every day, it’s the best thing about managing. We have a very multicultural, multilingual community. On a very practical level, I’m learning Spanish again, which is helpful because we have a big Spanish cohort in the team. That’s an everyday challenge. Duolingo’s doing me good, as I can currently see. My prior experience before coming back to the team, something particularly clicked for me, post Covid, around this importance of being together – connection – culture. I practiced a lot of things in this. I was at Milfield School as Director of Sport; you have teachers, and coaches all around you, but in some ways, it was the perfect training ground.

I had lots of observations and ideas that we were trying and refined to the point where I could then take them forward in this environment. You’re learning every day about how to bring people together. Clarity, simplicity, and message – clarity on the vision. The way you work with people in terms of understanding them, your messaging as a leader.  I’m typically very reflective anyway, as an individual. Every engagement I have I’m always spending time thinking about what I’ve said, how I’ve said it. To try to be a real consistent leader in my style and approach.

The nature of this sport and high performance sport means you can’t stand still. That’s an environment I love to be in. I see so much opportunity. We’re trying so many things to push ourselves forward. If anything, I’m learning, we’re probably doing too much. There’s a time and a point where you can’t do that as well. Every day is a learning day. It’s like being back at school but I’m loving it – loving the challenge, loving the people I’m working with. Equally I realise we’re going to be judged by the results that come as a consequence of that. We spent a lot of time trying to get our processes right and improve them. And you never really know until you get bike racing.

Ultimately, we’re getting into that environment now where we’ll begin to see if some of the cultural changes and approaches we’ve taken, are going to stand up to the pressure of trying to win bike races.

What are you most proud of since you’ve been back in the team?

I’m more proud of the individuals, the riders and the staff around. I don’t know if this is the right word, we hear the word resilience a lot. Steve Peters is our lead psychologist. He wrote the Chimp Paradox. He’s got a different view and perception on that. I’m more proud about the pace at which people have been willing to recognise and adapt to change. It’s their willingness to embrace that and go with it.  That’s not me. That’s what I’m most proud of. The organisation was crying out for change. In some senses, sometimes people are unsure that they could change. When that opportunity arose, the riders and the staff embraced that really quickly. They saw the opportunity and are running with it as fast as they can. It’s not about what I’ve done. I’ve been the catalyst for something that was ready to go. I tried to support those staff who also recognised it. Ultimately, I’m the one that had to make the decisions as Performance Director. They fully backed those and now they’re running with it. It works on both sides.

Sounds like you’ve got a real energy in the team; that they were waiting for someone to come to light the touch paper, to go again, and to do things afresh. It was the right time.

Often that’s life, isn’t it? Serendipity. Timing. Sometimes the best ideas don’t land immediately. That was definitely was part of it. Sir Dave Brailsford had this great simple formula. He used to talk about balance plus hunger plus belief, minus distractions is what gives high performance. We have talented staff, talented riders and they had lost some of that hunger and belief in themselves. We managed to rekindle that. It’s back, and they’re highly motivated to go and prove themselves as individuals. Nobody liked the stinging criticisms we were getting. Ultimately, that’s down to us to change.

The job of the programme is to remove distractions so that the bike riders can concentrate on high quality training, high quality fuelling, sleep and repeat, and be given the best possible. We tightened up that part of it. I’ve always liked the simplicity of that. Talent plus hunger plus belief, minus distractions and you’ve got a high-performance environment. What underpins the culture, that culture of exploration, experimentation, collaboration, the nature of very technical based environments where you have a lot of different skills, our job is to act as the bridge that brings them all together and enable people to shine when they need to shine. Sometimes you’re in the dugout. Sometimes you’re in row Z. Knowing when those opportunities are there is really important. Yes, the energy is there. It’s showing through the hunger and the belief that people have that they can take on the best in the world.

I’ve always been a huge fan of the team, I wish the team every success in the coming season, in the Classics and in the Grand Tours. What are you most looking forward to over the next 6 months?

Just getting racing.

People want to get racing, because that’s ultimately why they do it. They love competing. Being back in that environment, knowing that the riders have done the work, and to see how it plays itself out. Not everything’s going to work, we know that. We’re going to have to tweak, iterate and change as we go along. That’s the dynamic nature of human performance. The guys are working super hard. We’ve got some talented riders. I can’t wait to see it explode where it really matters.

Let’s get into the chamber now and into the racecourse, in the parcours. Let’s see what we can do. That’s where we’re really going to learn. We’ve done all this work. We’ve had lots of deep conversations, lots of planning, lots of decisions have been made. Riders have been training a bit differently, trying new things. We’ve got a much clearer philosophy about how we’re going to race and compete. Let’s see how it plays out. I think we’re really looking forward to the test, is the best way of describing it for the next 6 months.

Is there a particular race that you’re looking forward to personally?

The Tour de France is always another level. But this year I’ll spend a lot more time in and around the Classics. We have a really good group there that I want to spend a bit of time with. We believe Filippo Ganna’s going to be really strong in Milan-San Remo.

I’ll spend a bit more time around some of those, and that’s just a lot of history and heritage of the sport. The Giro’s interesting this year – it starts in Albania.

The Grand Tours are always fantastic. But you can’t get away from the Tour de France. It’s another level, the pressure bubble that comes with it. The best racers in the world, day in, day out, really. The parcours this year, and the design of the course in and around France, it’s going to be pretty spectacular in that first week. Then it gets really hard at the back end. But the Classics is where I’m going to spend a lot more time. They are the most demanding races – based on everything we measure and assess.

We are not a traditional Classics team. But we’re going there to try to compete. And we’ve got some talented bike riders. We’d love to see how they’re going to do. The racing is brutal, but they love it. It’s unbelievable. They love the fact that it’s brutal, which is what they thrive off.

I’m excited to see what happens. Not just cycling, but sport generally, what’s been your favourite sporting moment for you personally?

I spent a lot of my early career in Olympic sport with Team GB in my role as Head of Research Innovation. I spent a huge amount of time exploring and experimenting, but the culmination of what was more than a 10-year journey was London in 2012.  I’ve still got great memories of that event. It was one hell of a journey personally in terms of career, development and engagement, and I learned so much from that. That’s stood me to the point I am today. That whole experience at Olympic sport was phenomenal. It was a time when the sport was quite entrepreneurial. Yes, government backed, but not so bureaucratic and fast-moving. Lots of chance to try things. Of course you make lots of mistakes. But the pace of movement often was faster than many high-performance professional sports. That will always have an indelible mark in my memory for me. But I think the experiences I’m having now are equally like that.

Maybe it’s come full circle. This is an environment I love being in. I’m naturally competitive on a very quiet scale. At this level, you’re against the best in the world. There’s nothing better to test yourself than in that cauldron.

Thank you so much for joining me today. If people want to find out more about the team, where would you suggest they go?

Go to our social channels. I’m on LinkedIn, search for Scott Drawer. If people want some direct contact and want to explore or share ideas, or they’ve got things they can bring to the table, we’re open minded. Otherwise, go to INEOS Grenadiers website. There’s so much great content and social to follow. we’re always happy to get feedback on what people think about that too.

Thank you so much. I’ve really enjoyed talking to you today and hearing about how culture is important – that human-to-human connection. On television, we see the likes of Geraint Thomas, or Filippo Ganna on screen. There are so many people in the background to make the whole thing work. It’s the team behind the team that fascinates me. If you are listening to this and wondering how your team could be more effective, please do get in touch. I help teams perform at the highest levels so that the team on the road or on the pitch makes winning headlines. Book a call with me today sherry@sherrybevan.co.uk.

Important links

About Scott Drawer

Scott Drawer is the Performance Director for INEOS Grenadiers, responsible for race performance, coaching strategy, rider development, recruitment and the integration of science, medicine and technology across the team.

With a background spanning Olympic sport (including London 2012), professional rugby and elite education, Scott brings both scientific rigour and human insight to high-performance environments.

About your host: Sherry Bevan

Sherry Bevan helps teams in transition perform at their best – without the fluff. A former Global Head of IT Service in an international law firm, she now works across technology, professional services and the charity sector. Through her Team Kickoff Accelerator, Sherry supports new and changing teams to build trust, strengthen collaboration and set the foundations for high performance. A former grassroots cyclist and still a runner, Sherry is fascinated by what sport can teach us about teamwork, leadership and sustainable performance – and it’s these ideas she explores with leaders and experts on Team Talk.

Connect with Sherry

Episode 3: Values-led leadership – Team Talk podcast

What does it take to build – lose – and rebuild a high-performance team without losing belief or values?

In this episode of Team Talk, Sherry Bevan speaks with Doug Ryder about leadership, resilience and community in professional cycling. Doug shares the journey from an “impossible” Olympic-era dream to leading the first African team at the Tour de France – and how Q36.5 Pro Cycling rebuilt after losing all sponsorship during Covid.

This is a candid conversation about belief, trust and what really sustains performance when results disappear.

Listen to the episode here:

Episode 3: Values-led leadership

Guest: Doug Ryder, Q36.5 Pro Cycling Team

Sherry Bevan: Welcome to the Team Talk podcast. This is the show where we discover how to build high performing teams using lessons learned in the world of sport. I’m your host, Sherry Bevan and in today’s episode I’m absolutely delighted to be talking to Doug Ryder, who’s the General Manager at Q36.5, the Pro Cycling team. Welcome, Doug, a very warm welcome to you.

Doug Ryder: Thank you very much Sherry.

Not everyone listening to this podcast is a big cycling fan. Could you start by telling me a bit more about your personal background in the world of cycling as a professional.

Thank you. I was a professional cyclist and rode for South Africa. I was very lucky. I rode at a time when Mandela had just come out of prison. It was a beautiful time to be a sportsperson in South Africa, because we were banned from international sports for a time. When Mandela came into power, that whole “sport has the power to change the world”, that empathy, that purpose, that came through with him as a leader. It was an inspirational time to be a person from South Africa, particularly in the sporting world.

I was fortunate enough to go to the 1996 Atlanta Olympic Games and represent South Africa. That’s where the dream of this team started – to take an African team to the Tour de France. We were a special and small group of athletes that competed together at the highest levels in sport. The cycling was amazing in Atlanta. It was the first professional amateur race at the Olympic Games for cyclists. Previously the Olympics was just for amateurs. We had all the big guns from cycling there, including Lance Armstrong.

I didn’t make it as a pro ultimately. In the late nineties and early 2000s the sport was in a different place; it was like racing motorbikes.

My dream was to take an African team to the Tour de France. I went into the corporate world and worked in IT for 11 years, which helped me plan, strategise, understand business, and putting big deals together.

In 2012, I went to the ASO, the owners of the Tour de France, and I put a plan together to take an African team to the Tour within three years.

They thought I was completely mad. I raised some backing, and I had some riders that believed that they could do it, too. Three years later we were at the Tour de France as the first African team in 2015. It was epic. They made history. It was a remarkable time. It was a beautiful Tour de France.

Wow – that’s so inspirational. When I speak to people in sport, I often hear the same story: “Everyone thought I was mad” or “It was an impossible dream.” I love hearing that, because it proves that impossible dreams aren’t impossible. You just have to set your mind to it.

In the modern world, people sometimes think that if a dream hasn’t happened yet, it never will – that everything’s already been done. That’s simply not true. There are still opportunities to do something uniquely different, something that’s never been done before. If you stick with it and truly believe in it, anything is possible.

I talk about this a lot, and people often say, “Wow, that gives me hope.” It’s inspiring – but it’s not easy. It took me 15 years to make this happen. It didn’t happen overnight, but it was absolutely worth it.

1996 in Atlanta feels like a long time ago now. How does performing at the Olympics in a cycling team compare to racing on the road, not in a national team but in a professional one?

There’s always incredible national pride. Riders love representing their countries – that’s a huge motivator. Going to the Olympics is an absolute privilege. That’s the one percent of the one percent.

Wearing your national colours at a World Championship is special, but working in a professional team environment is different. You’re building something together. You’re on the road 200 days a year. It becomes a family.

Endurance sport isn’t a job – it’s a lifestyle. Everything you do, everyone around you, has to believe and sacrifice for you to exist at this level. When you succeed, the celebration belongs to everyone – from the bus driver to the chef to every single person on the team.

With national teams, those moments are rare. In professional cycling, we lose far more than we win. There are 180 riders on the start line – you have a one-in-180 chance. I always tell my kids to play tennis. They ask why, and I say, “You’ve got a 50% chance of winning.” In cycling, you’ve got weather, crashes, traffic, mechanicals – everything working against you.

That’s why the team becomes your second family. And that’s incredibly special.

Especially because you travel constantly. You’re not all based in one place – you’re moving around the world together.

That’s one of the beautiful things about cycling. Our stadiums are the open roads of the world – the Pyrenees, the Alps, the Netherlands, everywhere. But there’s also loneliness. Riders train alone a lot. They make huge sacrifices, each with very specific roles.

When they come together at races, connection becomes essential. Understanding each other, trusting each other – that’s what makes the sport unique.

Tell me about the team you’re working with now – both on the road and behind the scenes.

We have 25 riders and about 50 staff – roughly 70 people in total. Around 55 of them are travelling ten months a year, across 220 race days in more than 20 countries. It’s a moving billboard, a moving circus.

We run double programmes for most of the year, with separate infrastructure, vehicles, and staff.

It’s amazing – and it’s incredibly complex. Getting everyone to the right place, on time, healthy, in form, with the right equipment, is a logistical nightmare.

And the team is relatively young compared to others?

We’ve got history. We started as MTN-Qhubeka in 2010, grew into a WorldTour team, and then Covid hit. We lost all our sponsorship and didn’t exist in 2022. That was devastating.

But we fought back. Q36.5 is now in its third year. We restarted in the ProTeam division, with incredible partners – UBS, Scott, Q36.5. Our legacy helped us rise again.

Signing Tom Pidcock was a game-changer. He’s a double Olympic champion with global presence. For him to choose us showed that our values, organisation, and support structure are real.

Like many British fans, when Tom joined, I paid much closer attention.

Many people thought he was mad. But it was a calculated risk. He knew our history. He knew we’d support him fully and let him race the way he wants.

And you can see it – he’s enjoying it.

When we’re recording this, you’ve just received a wildcard for the 2025 Giro d’Italia.

It’s huge. So much work went into that. We haven’t ridden a Grand Tour since 2021, and not in our new colours.

I’m thrilled – especially for Tom’s UK supporters. I asked him if he likes pink. He looked at me strangely. I said, “Well, let’s go for pink.”

How do you keep such a large, distributed team aligned?

We rely on experience. Heads of Performance, Racing, Logistics. We plan weekly. Technology is critical – software platforms, messaging tools. Things change constantly: crashes, injuries, last-minute swaps.

People work incredibly long hours. It’s tough. Communication is everything. We trust decision-makers. When decisions are made, we move – no debate in the moment. We review later.

We don’t work in silos. Everything is connected. That makes us fast and resilient.

How do you build trust in the first place?

Loyalty. Honesty. Respect. Understanding people as humans.

Someone once told me: “Your staff are more important than your riders.” At first, I didn’t believe it. But it’s true. Staff drive culture. Riders feed off it.

Cyclists live on a knife edge emotionally. The support system matters more than people realise.

With such long seasons, how do you prevent burnout?

It’s hard. People care deeply, sometimes too deeply. I constantly remind them to protect themselves.

We hold monthly all-team calls – 70 people on Zoom, just talking. Family, life, direction. During Covid, we even did full weekends like that.

This isn’t my team. It’s our team. People feel heard, valued, respected. That sense of belonging keeps people going.

Your website talks about Ubuntu. Tell me more.

Ubuntu means “I am because we are.” It’s at the heart of everything we do.

There’s a sign at our service course in the Netherlands that says it. It reminds us to care – on the road, in our work, with each other.

It’s not marketing. It’s behaviour. That value system has attracted incredible talent and held us together when times were hard.

What have you learned over the past few years?

We failed – hard. But we didn’t change our values. We focused on impact, not ego.

Coming back with the same principles mattered. Partners believed in us because of that.

In a world that became very individualistic during Covid, we doubled down on community. That gave us energy to rise again.

What are your ambitions for the next few years?

Big ones. Bringing Tom in shows that.

He’s 25 – not winding down, just getting started. His leadership, detail, and professionalism lift everyone. Other riders are noticing. That’s exciting.

We want to return to the top – sustainably, credibly.

Many leaders in cycling are very young. What are your reflections on that?

Experience can’t be bought – it’s earned. We balance young talent with experienced riders who can guide them.

Tom is extraordinary. Riders like him come once a decade. Our job is to maximise everyone’s potential – not turn people into roles.

I don’t want a “climber” or a “domestique.” I want a human being with a dream.

That probably makes cycling more fun to watch.

Exactly. Big teams can buy talent. Smaller teams back belief. Tom chose freedom over security – and that matters.

Before we finish, what’s your favourite sporting moment?

I have two but one leads into the other. In 1996, Josia Thugwane winning Olympic gold in the marathon – that sparked my belief that Africa could produce world-class cyclists.

Then, nearly 20 years later, Steve Cummings winning on Mandela Day in our first Tour de France in 2015. That was the dream realised.

Where can people follow the team?

Instagram: @Q36.5_procycling. Our website at https://www.q36-5procycling.com/  and you can follow me on LinkedIn as well. It’s a pretty special journey we’re on.

It’s been brilliant to talk to you Doug. Thank you so much for joining me today.

If you’re listening to this and wondering how your team could be more effective, please get in touch. I work with the teams behind the sports teams to perform at the highest level so the team on the road or on the pitch makes winning headlines. Thank you for tuning in today, and please do join me for future episodes.

Important links

About Doug Ryder

Doug Ryder is the General Manager of Q36.5 Pro Cycling and a former Olympic cyclist who represented South Africa at the 1996 Atlanta Games.

Doug is best known for founding the team that became the first African squad to compete in the Tour de France in 2015. After the team collapsed during Covid, he led its return to professional cycling with Q36.5, grounded in the principle of Ubuntu – “I am because we are.”

Doug is widely respected for his values-led approach to leadership and his belief that sustainable high performance is built through community, trust and shared purpose.

About your host: Sherry Bevan

Sherry Bevan helps teams in transition perform at their best – without the fluff. A former Global Head of IT Service in an international law firm, she now works across technology, professional services and the charity sector. Through her Team Kickoff Accelerator, Sherry supports new and changing teams to build trust, strengthen collaboration and set the foundations for high performance. A former grassroots cyclist and still a runner, Sherry is fascinated by what sport can teach us about teamwork, leadership and sustainable performance – and it’s these ideas she explores with leaders and experts on Team Talk.

Connect with Sherry

Episode 1: Introduction – Team Talk podcast

This episode is an introduction to the Team Talk podcast in which I explore what really makes teams perform at their best, using lessons learned from the world of sport.

Listen to the podcast here:

Episode 1: Introduction

Hi, my name is Sherry Bevan, and I’m the host of Team Talk.

Team Talk is a podcast I’m incredibly excited to create. It’s where we explore what makes high-performing teams work – what leaders, athletes, and sports teams do differently – and how we can apply those lessons to our own teams.

I’ll be talking to people who’ve been there and done it, so that we can learn from the best in sport and leadership.

I created this podcast because I want to share stories of teamwork, leadership, resilience, and human connection. But before I tell you more about that, let me give you a little of my own sporting background.

I’ve been a lifelong Spurs fan. It wasn’t inherited – my dad doesn’t even watch football – but I’ve always supported Spurs, and I’m not entirely sure why. Maybe, as a child, there was a favourite player who struck a chord with me.

My biggest passion in sport, though, is cycling. At one point, I was completely obsessed with Laurent Jalabert. Bizarrely, I felt like I had a personal connection with him. Some of you may remember the horrific sprinter’s crash at Armentières in the Tour de France in 1994. Just a couple of weeks earlier, I’d had my own crash at Eastway while racing, which resulted in a serious head injury. Watching his recovery pulled me in, and that’s where the obsession really grew.

My current cycling heroes are Wout van Aert, Remco Evenepoel, and Mathieu van der Poel – all incredible cyclists.

I raced for Catford Cycling Club for several years and even became its president. I don’t belong to a cycling club anymore, and if I’m honest, I don’t get on my bike as much as I used to. But I still run regularly with my running club, Petts Wood Runners.

Alongside sport, I’ve spent years helping teams perform at their best — in businesses, charities, and sports organisations. And I’ve seen one thing again and again: culture matters.

Watching athletes and coaches operate at the highest level has taught me lessons you simply can’t learn from a book. That’s why I wanted to create this podcast — a space to share those stories. Because the things that make elite teams work can help all of us, whatever size or type of team we lead.

I’ve already spoken to some incredible guests, and I can’t wait to share their stories with you — including Scott Drawer from INEOS Grenadiers, Doug Ryder from Q36.5, and Matt Hall from Bromley Football Club, with many more to come.

A bit more about my background: I work with leaders and teams across multiple sectors to help them perform at their best, particularly when they’re forming new teams or navigating change. I deliver workshops, coaching, and team development programmes. Before that, I spent over 20 years working in technology and law firms, and I’ve also worked extensively in the charity sector. I’ve seen teams at every stage of development.

I love being outdoors. I love cycling. I love watching football and athletics. And I try to bring that same curiosity and energy into my work every day. This podcast is really an extension of that curiosity — learning from the best and sharing it with you.

So what can you expect from Team Talk? Honest, practical insights. Not theory. Not buzzwords. We’ll explore culture, leadership, communication, resilience, and performance through real stories.

Every episode is a chance to get inside the minds of people who make teams thrive at the highest level — and to pick up lessons you can apply straight away. It’s about learning from those who’ve made mistakes, who’ve succeeded, and who’ve built something remarkable.

I’ve already had the chance to spend time with Doug Ryder, whose story of building the first African team and taking them to the Tour de France is extraordinary. Matt Hall shares the journey of Bromley Football Club from non-league to the Football League, with powerful insights into leadership, culture, and community. And Scott Drawer talks about the importance of culture and creating a true sense of belonging.

There’s much more to come.

This podcast isn’t just about winning – on the pitch, on the road, or on the scoreboard. It’s about what happens in the teams behind the team. Trust. Relationships. Shared values. And how small actions can make a big difference. That human-to-human connection really matters when we’re building strong teams, and that’s what this podcast is about.

If you like what you hear, please subscribe on Apple Podcasts, Spotify, or wherever you get your podcasts. I’d love to hear from you – connect with me on LinkedIn, send me your thoughts or questions, or let me know who you’d like me to interview or what topics you’d like me to cover.

As I sign off, I’m genuinely excited to start this journey with you. I’ve got some amazing stories lined up, and I can’t wait to share them.

Thank you so much for listening, and I hope you’ll join me for the next episode.

About your host: Sherry Bevan

Sherry Bevan helps teams in transition perform at their best – without the fluff. A former Global Head of IT Service in an international law firm, she now works across technology, professional services and the charity sector. Through her Team Kickoff Accelerator, Sherry supports new and changing teams to build trust, strengthen collaboration and set the foundations for high performance. A former grassroots cyclist and still a runner, Sherry is fascinated by what sport can teach us about teamwork, leadership and sustainable performance – and it’s these ideas she explores with leaders and experts on Team Talk.

Connect with Sherry

CGP 21 | Cyber Knowledge

Delivering Trusted, Clean, And Accessible Knowledge With Rebecca Taylor Of Secureworks To Celebrate National Cybersecurity Awareness Month

 

Trusted information is crucial in an industry where one wrong move stands between being protected and attacked. This is the heart of Rebecca Taylor’s position as the Threat Intelligence Knowledge Manager at Secureworks. In this episode, she sits down with Sherry Bevan to tell us more about her role, along with the interesting career journey that took her from studying English and Creative Writing to the cybersecurity space. Rebecca talks about the importance of having trusted and clean knowledge accessible to the right teams. What is more, she also shares some of the challenges she faced as a woman in the industry, offering advice for others as they step into their career in a male-dominated space.

Listen to the podcast here

 

Delivering Trusted, Clean, And Accessible Knowledge With Rebecca Taylor Of Secureworks To Celebrate National Cybersecurity Awareness Month

Let’s get into our episode. In this mini-series to celebrate National Cybersecurity Awareness Month, I’m talking to women about their careers in cybersecurity. I’m delighted to be talking to Rebecca Taylor from Secureworks. Welcome, Rebecca. Thank you so much for joining me.

Thank you so much for inviting me.

I’m delighted to talk to you. Rebecca is the Threat Intelligence Knowledge Manager at Secureworks. Let’s find out a bit more about her career journey. Perhaps to set it into context, could you start by telling us a bit more about Secureworks and what they do?

Secureworks is a cybersecurity leader. We focus on enabling customers and partners to out space and outmaneuver adversaries in a more precise way so they can respond to cyber threats and risks. It is achieved in lots of different ways by using things like cloud-native, security platforms and different intelligence-driven security solutions. That’s backed up with lots of threat intelligence and research. We’ve got a lot of large teams that are equipped with the best people in the world to help protect customers.

How did you get started in an IT or cybersecurity career?

The biggest thing about knowledge is that it has to be trusted.

For me, it was very much by chance. When I was 24, I was working in kitchen goods dealing with kitchen insurance for appliances. I didn’t know what my calling was. I’d studied English and Creative Writing at the University of Portsmouth. I was finding my feet. At that time, I received a phone call from Secureworks Talent Acquisition asking if I would be interested in interviewing for a personal assistant role. I jumped at the chance.

When I’m walking through that door the first time, I knew very much that I’d found an organization and an entity that could give me a great platform for growth and development but also an industry that was always going to keep evolving, one that was never going to go away. Over the last few years, I’ve focused on studying, getting as much exposure to the organization, IT and cyber as possible, making a footprint and working hard. I’m in this fabulous position where I’m their Threat Intelligence Knowledge Manager and counter-threat unit.

What exactly is it that you do on a day-to-day basis?

From a high level, what it means is that I’m responsible for ensuring that we ingest all threat intelligence to the best of our ability and that it’s standardized, maintained and accessible for those who need it. On a day-to-day basis, my role can vary quite a lot. It depends on what we’re seeing, what we’re hearing and what we need to ingest and work on but ultimately, I need to make sure that what we have is accessible, our knowledge is clean and it can be used by whoever needs it.

When you say that our knowledge is clean, what does that mean?

CGP 21 | Cyber Knowledge
Cyber Knowledge: It isn’t necessarily about having these huge qualifications. It’s very much about just being open to listening and learning as things change around you.

 

It’s been put in the correct format that’s accessible to the right teams, stored in the appropriate ways and can be trusted because the biggest thing about knowledge is that it has to be trusted. If you start letting knowledge seep through that maybe isn’t accurate, it can not only affect us internally. It could be as simple as a threat researcher is misinformed or it could go the whole hog and end up being that a customer ends up misinformed. That’s the one thing we don’t want to happen. To make it clean means to make sure that it’s accurate and trustworthy.

Thinking about your career, what’s been your biggest challenge?

For me, it’s been a mixture of things. Like a lot of people, my biggest one has always been self-doubt. I knew for a long time that I wanted to progress and do more but it took me a very long time to get in the headspace to believe I could and that I could do it. I relied on quite a lot of mentors in my organization to help get me into that correct and good head space. The second real challenge for me has been a lot about gender stereotypes.

I am a mum. I do have that label and I carry that label as a woman but I also want to have a career. I do have my goals and ambitions. I found that I do work in cybersecurity but I didn’t want to necessarily be in the gender stereotypical role in the cyber field. Breaking through that, being able to become more technical and hopefully, in time, become a specialist has been a journey for me but also breaking down gender stereotypes that maybe friends or family have held of what I should be like and what I should do has been a challenge as I’ve pushed through with my career.

There’s that stereotype of people who work in cybersecurity being geeky and very introverted people. It is the stereotype that we often see but to be successful in cybersecurity, you need to have strong interpersonal and communication skills.

The real beauty of cyber security is that it’s not going away and that it’s very present.

It’s a mixture of assumptions of what a person in cyber is or should be. There’s the weight or the vision that we carry of what a woman or a mum should be. It’s taken me time to bring those all together and decide, “I don’t have to fit with any of them. I can be myself. I can have a footprint that is made by me in the way that I want it to be.” It took time for me to own that and be confident with that. Also, to know that I was doing the right thing by me.

When we realize that we can go to work, be ourselves and bring our whole selves to work is when we start to make progress in our careers and have the biggest success. It’s getting to that point and that can be challenging sometimes. You mentioned the mindset and referenced Imposter syndrome. What was the biggest thing that helped you get over that?

For me, I started to explore not only mentoring but training opportunities. I joined this Releasing Female Potential Program that was run by one of our sister companies. By doing that, I changed my perspective of I can do more and that it is okay to want more, regardless of the fact at that point in time, I didn’t necessarily have any technical qualifications. It’s all about what you make it. I knew that I wanted to do more, could do more and needed to get to do more.

I bounced off of that program and found myself a good mentor. I’ve got three because they all offer me very different perspectives, opinions and support. Finding the right mentor for me that could help drive me, help connect me with people that maybe were more like me or that could appreciate what I was trying to accomplish. It all helped me to get to that point.

Thinking about cybersecurity, there are training and qualifications. I imagine that to be successful in cybersecurity, you’ve got to constantly be training and learning new stuff.

CGP 21 | Cyber Knowledge
Cyber Knowledge: Finding the right mentor for you can open up so many more opportunities and give you that platform to excel and find the career you’re looking for.

 

The real beauty of cybersecurity is that it’s not going away and it’s very present. Keeping abreast of what’s happening in the media, making sure that you’re reading up and seeing what’s happening in itself is a way for you to learn and develop. You can begin to see new ways like what may be threats are behaving, new risks changes, evolutions and all these kinds of things.

At least at Secureworks, you do get to learn a lot on the job. By having that exposure, seeing the threat landscape change and evolve and having access to the latest threat intelligence and metrics, you can learn as you go along. It isn’t necessarily about having these huge qualifications. It’s very much about being open to listening and learning as things change around you. Technical qualifications can support. I did English and creative writing so I had in no way any kind of technical background.

You can pick up stuff as you learn and it doesn’t have to cost you a fortune. There are so many free courses available. You’ll probably find as well if you have a mentor that you can do lots of training through them. If you pick the right ones, at least they can teach you what they know and share that knowledge. Whilst there is sometimes the need for training qualifications, it isn’t the be-all and end-all.

Thank you for explaining a bit more about that. It’s quite interesting that 2 or 3 people that I’ve spoken to have studied English or History and then have gone on to have a career in cybersecurity. I find that quite fascinating. I’m wondering. What’s been your proudest achievement in your career?

I have a few. I spoke about that Releasing Female Potential Program. That was a big achievement at a time when I needed it to flick that switch and get that drive to progress in my career. I’m also very proud of the fact that I have pushed myself. I have got 2 amazing points in my career but I also have 2 children and like a lot of us, I have gone through the pandemic too.

The cybersecurity industry worldwide is facing a talent shortage.

Having that career, having that identity that fulfills me, owning my ambition and having that drive is something I’m super proud of. If I suppose, take it back to my career, being the first Instant Response Knowledge Manager and the first Threat Intelligence Knowledge Manager is a real pat on the back for my organization that they do believe and trust in me.

What is it that you enjoy about the work that you do?

I’m in a lovely position where I confidently know that I am making a difference and that I am contributing to the cybersecurity community. That’s something that does mean a lot to me and is something I enjoy. I’m able to do conferences, write blogs and mentor. I feel like I’m leaving a solid footprint and a good legacy, which is important to me. I’m lucky as well that Secureworks is a remote-first employer. That means that 90% of us are remote workers. That is something I enjoy about what I do because I don’t have the pressure of having to commute or make sacrifices in terms of being there for my family. I can have the best of both and be as involved in my career and with my colleagues as I can be with my family.

What do you see are some of the potential barriers for women in cybersecurity or perhaps aren’t in cybersecurity yet but would like to move into that area?

The biggest barrier was the lack of women in high-ranking cyber positions. Sitting there knowing that I wanted more but not seeing necessarily that inspirational figure, I didn’t know whom I could look up to who maybe had a similar path or a family like me. Also, similar ceilings like we have. That is improving. There is more representation but I do think for younger people or those who may be looking to progress into STEM, it’s hard if there is that continued lack of representation.

CGP 21 | Cyber Knowledge
Cyber Knowledge: There are so many different facets to cybersecurity. You don’t have to fit a mold that maybe you’ve built into your own head.

 

I still think there’s a lot that needs to be done from a diversity and inclusion perspective. As a woman, I do have different needs from my counterparts. I do face different adversities and have different stereotypes and external demands, potentially to some of my other colleagues. There’s this whole space that needs to be explored to make cyber more inclusive but until a lot of these larger cybersecurity organizations start pushing and changing their D&I initiatives, there’ll continue to be that gap and barrier for people wanting to have a cybersecurity career.

Having role models in more senior positions, you often hear people saying you can’t be what you can’t see. We’re starting to see change but sometimes it’s slower than I want it to be. It’s good to see that things are starting to change. You’ve talked about potential barriers. What about opportunities for women in the sector?

There are a lot of opportunities. The cybersecurity industry worldwide is facing a talent shortage. It is something we talk about quite often. We need millions more people so the opportunities are very real. There are lots of roles out there. We only need to apply for them and believe in ourselves to make that application. In the same way within our organizations, there are ways we can be advocating and promote opportunities for women, things such as via our employee resource groups, newsletters, reward and recognition. There are lots of different ways to help women rise.

Another huge opportunity is all these sub-security courses that are available. There are loads of free ones that I have used like FutureLearn, which I massively recommend. For me, mentorship was a real game changer. Finding the right mentor for you can open up so many more opportunities and give you that platform to excel and find the career you’re looking for.

Something occurred to me while you were talking. There are certainly lots of opportunities. It’s for us to go and reach out to those opportunities. If women are reading this who are thinking about a career in cybersecurity, what would you say are the skills that they need?

It does depend. When people think about cybersecurity, they think it’s sitting behind a computer, knowing technical skills, knowing how to hack or code and all these things but that isn’t it. There are so many different types of roles in cybersecurity. There are marketing teams, finance, design and speaking opportunities. There are so many different facets to cybersecurity so you don’t have to fit a mould that maybe you’ve built into your head. If you want to apply, think about what you enjoy doing and find the cyber role that fits that. You don’t have to change yourself just because you want to work in cybersecurity.

Rebecca, thank you so much. I enjoyed talking to you. If people want to get in touch with you, you’re on LinkedIn, aren’t you?

I am, indeed. I’m happy to take any questions or help where I can.

Thank you so much to my guest, Rebecca Taylor from Secureworks. I’ve enjoyed hearing about Rebecca’s career and her thoughts about being a woman in cybersecurity. If it sparked a thought in your mind, let’s talk. An exploratory call with me gives you the opportunity to ask any questions you have about the work that I do with cybersecurity companies on attracting, developing and retaining your female talent. Get in touch with me by email at Sherry@SherryBevan.co.uk to book your call.

 

Important Links

 

About Rebecca Taylor

CGP 21 | Cyber KnowledgeRebecca joined Secureworks in 2014, where she developed an immediate passion for cybersecurity. Rebecca quickly expanded her cyber acumen, moving into Secureworks first Threat Intelligence Knowledge Manager role in 2022.

Rebecca is primarily focused on the implementation of knowledge management processes and procedures for the Counter Threat Unit, the ingestion and management of Secureworks Threat Intelligence knowledge, and its associated quality, storage and maintenance.

CGP 20 | Sophos

Taking On More Complex Projects In The Cyber Industry With Chloe Acebes Of Sophos To Celebrate National Cybersecurity Awareness Month

Going to the next level in your career means having to take on more complex projects. And our guest in this episode has done that while coaching and mentoring women in technology. Sherry Bevan interviews Chloe Acebes, the Director of Software Engineering at Sophos, with 20+ years’ experience in the cybersecurity industry. Chloe leads teams of Engineers who develop next-generation endpoint security products.

In this conversation, Chloe shares her career in cybersecurity, taking us along to both the challenging and proudest moments in her career thus far. She also talks about coping with the pandemic, the barriers for women working in the sector, and the future of her career balancing politics and technology.

Listen to the podcast here

 

Taking On More Complex Projects In The Cyber Industry With Chloe Acebes Of Sophos To Celebrate National Cybersecurity Awareness Month

In this episode, I’m talking to Chloe Acebes of Sophos about her career in cybersecurity. A very warm welcome to you, Chloe. Chloe is the Director of Software Engineering at Sophos. She’s going to be talking to us about her career in cybersecurity. Let’s get started. Perhaps you could tell me how you got started in IT or in cybersecurity.

I studied Physics and Astronomy at university. In my final project at uni, we did a little bit of C programming. I learned a little bit of C there and to say that I liked that and thought I might be interested in a career more towards IT. When I was finishing university, I applied for various different jobs in technology and in science. I applied for a job at Sophos, where they had a graduate program where they took people on from different disciplines. We got basic training on the job. We learned about coding, various aspects of technology and security. Basically, I’ve been at Sophos ever since.

That sounds amazing that you’ve been there ever since. It proves that those graduate programs, when you get them right, they do work and you get good staff. How did you get into cybersecurity more specifically?

It came to me by chance. As I said, I was interested in IT and technology. I applied for several different roles. When I came to interview at Sophos, they talked a lot about protecting customers and protecting small businesses. Sophos focused a lot on small and medium businesses, which means that we make the difference between a business doing well and a business being attacked and potentially losing money. That aspect of talking about helping people was what drove me into the industry. That’s what still gives me job satisfaction.

In thinking about your career overall, what has been your biggest challenge?

I think there are two that come to mind. The first one is starting the job. I came from a Physics and Astronomy background. I didn’t know a lot about computers. I didn’t know a lot about programming and hadn’t done computer science. There’s that foundation that you’re missing. That was a bit intimidating coming online and starting off the job, but that strong ramp up to start off with is a big challenge.

It’s a fast-moving world. You’re always trying to keep up with the bad guys, which means there’s always lots of stuff to learn.

The second one I could think of is during the pandemic. I was leading a project at Sophos to deliver a project where we had to coordinate with many different teams and many different business units, different time zones. I have led projects before, but this was the biggest and most complex one that I had ever done. That was the biggest but also more satisfying challenge I’ve had because we delivered what we were asked of on time and coordinated across many different teams, and it was a success.

At that time, you were doing it in lockdown when we were still getting used to the ways of remote working and hybrid working.

In a weird way, it was beneficial at some points because some of the teams we were working with were based in the US. We would have been on Zoom with them anyway. Sometimes when you’re in a call in the office and some people are in the office in the room and some people are on Zoom, it’s actually hard to engage both sites. Having everyone be on Zoom was a level playing field.

I think that’s been one of the advantages that we see now with more hybrid working. People are more understanding of the disadvantages of having a mixed group of people working in the office and from home. Being on Zoom and in the office all at the same time, it adds an extra layer of challenge to the way that communication works.

You have to be careful with things like drawing on the board. The meeting I was in right before this one actually, we had one person on Zoom, the rest were all in the office, and I wanted to draw on the board. We’re lucky enough that where I work, the cameras move around. You can point the camera at the board, not the people on the call, and have the person on Zoom still engaged with what’s going on in the call. You’re right, it’s an interesting challenge having people come back to hybrid, partly in the office and partly online.

I’ve seen that work well. I’ve also seen it work badly. You mentioned there about your biggest challenge and it sounded like a very complex project. I’m wondering, what about your proudest achievements in the work that you’ve done or that you do?

CGP 20 | Sophos
Sophos: We can work very hard to try and make the balances as good as we can, but if a few people are applying, it’s like fighting a lost battle.

 

There are a couple of things. I do some coaching and mentoring at Sophos. Some of it is around women in technology. I’m part of the Women in Technology Group at Sophos. We have a coaching scheme and a mentoring scheme as part of that. I have a mentor and I mentor other people. I also run a Women in Engineering Group where we try and get people together. We started that in the pandemic. New people would start during the pandemic, they didn’t have that natural meet the peers in the coffee area and find people around. I’m not at all saying that because there’s another female in the office, you should be friends with them because you’re females together, but you maybe have more in common with them.

Meeting people in the office is more natural. We couldn’t do that in the pandemic, so we started this Women in Engineering Group. We went out for dinner one night. We have an online teams thing where you have new starters join and realize there’s a community of other women at Sophos that they can meet up with. I’m quite working with the mentoring scheme. The project I mentioned was a big complex thing, and I’m proud of delivering that project. It set me up for more complex things in my career.

Obviously, you work in cybersecurity, and we know that the gender balance between men and women in technology as a whole is not great, but it’s even more marked in cybersecurity. What do you see as some of the potential barriers for women working in this sector?

I think part of it is fear of the unknown. I’m not seeing role models that are similar to yourself. The thing I struggled with the most is it’s quite difficult to fix having more people to apply because the pipeline isn’t big enough. It doesn’t have a strong enough pipeline of females. You have to go back to university or school, and change the attitude there so that they’re more likely to do science and technology subjects, and be more passionate about those so that when you get later on in life and you start to look for a job, there are more women looking for that. It’s almost a bit of a catch-22. We can work as hard, and we do work very hard to try and make the balance as good as we can and make cyber at Sophos more appealing to women. If there are fewer people applying, it’s like fighting a losing battle.

We know there’s a skill shortage generally in the cybersecurity sector. That does make it even harder.

There are fewer people, in general, doing degrees, never mind women.

The more diverse your workforce, the better the solutions you come to.

What about the opportunities for women in the sector? If you were to go and do a marketing piece and come and join the sector, what would you say to women?

This may sound weird, but I almost wouldn’t want to say that there’s anything specific to women that appeals to women in cyber. It’s just a good career for anyone. There isn’t anything specific to women or men. There are lots of challenges. It’s a fast-moving world. You’re always trying to keep up with the bad guys, which means there’s always lots of stuff to learn. There are always new challenges coming, and I think that should be exciting for anyone.

It sounds like that’s what you enjoy about the work that you do.

That’s part of the reason I’ve been in one company for so long. I think if I had been here and done the same thing for many years, I would be bored. I’ve moved around different teams. The challenges move on all the time. The bad guys are always doing different stuff, so the whole industry has to move along to keep up with that. There are always new things to look at, new techniques that you have to worry about. It keeps you on your toes.

In the role that you do, can you tell us a bit more about what you do on a day-to-day basis?

As a Director of Engineering, that means I basically manage multiple teams in one functional area. My role has transitioned a little bit. It was at first that I was the director of the endpoint detections for our endpoint software, which covers some Windows devices and Linux devices. I’ve shifted a little bit, and I now focus more on protecting Linux devices. I have 3 or 4 teams now that work on various aspects of our products, which protects Linux servers.

CGP 20 | Sophos
Sophos: The further up you go, the more removed you are from technology and the more of the politics game you have to play.

 

We help to work on strategy with product management to identify the roadmap and the areas that we want to deliver. I also work then with the teams to work on how we deliver those things, what technical choices we want to make, how we split the projects up, how we are using resources for the projects, what the timelines for those look like. How do we coordinate across the teams? How do we make sure we deliver it with quality?

A lot of your role at the level you’re at now is managing the teams to do the development and the delivery of those products.

I still have one team who reports directly. Maybe I do like day-to-day management with them and what tickets are we working on and what are we doing? I would like to hire a person to take on that role so that I can be exactly as you described, a slightly higher level. You’re worrying more about what direction the teams are going in and what direction the product itself is going and more strategic.

What do you see in the future for you and your career?

I think I would like to weigh in the scope of my responsibility and the area that I’m in. As I said, I’m responsible for taking care of the Linux product, which covers a lot of cloud workloads. A lot of customers have machines running in the cloud, AWS or Azure, and that’s a specific type of customer. That type of customer may use other tools and leverage other security tools to manage their cloud workloads. I’d like to extend my functional responsibility to cover those areas and have the responsibility within the department.

I don’t know how much further I would like to go up the ladder. The further up you go, the more removed you are from technology, the more of the politics game you have to play. I’m in the middle of that now, but I still have reasonable ideas about what technology the team is using and having a hand in the strategy. I still have to do some politics, but I’m not far enough up the ladder that that’s what I do day-to-day. That’s probably the next decision I have to make if I’m able to go farther up and do more of the politics and less of the technology, if that makes sense.

The cyber industry is looking for many passionate people who want to solve problems.

Thinking back to your original degree, I think you said it was Physics and Astronomy. Is there anything from what you studied in your degree that you’re actually using in your work?

No. I think the main thing is ability to solve problems. Anyone who does a Science degree learns how to have a logical approach and how to approach solving problems. That is invaluable. You’ve proven that you can understand the problem and that there are various ways to approach it, and that absolutely applies in software engineering. That’s one of the main things we look for when we get graduates to join.

These days, many more people will do Computer Science degrees than back when I was at university. We always look for people who have a Computer Science degree because they have that foundation that I mentioned earlier, but they also have shown that ability to solve problems. We do also sometimes consider people from other backgrounds if they’ve shown that ability to do the problem-solving.

What other skills are you looking for apart from problem-solving and that kind of foundation in Computer Science?

Definitely communication. That’s something that’s changed in the time that I’ve worked in the industry. When I first joined Sophos, there were lots of people who would be handed a little bit of work to do. They would sit in their corner. They’d write their code and then they pass it back and they almost would avoid talking to other people. The industry has gone through quite an epic change where the focus is much more on Agile programming and collaboration.

That’s important to know that when we solve problems, we often do it as a team. You have to be able to stand up in front of a whiteboard, draw a picture, explain the problem and what your approach should be, and then collect information from other people and come to some consensus about, “Let’s take a little bit from everyone’s solution.” Come to a consensus, something common. To be able to do that, you have to communicate. You have to actively listen. Those are the two other key things that we look for.

CGP 20 | Sophos
Sophos: When we solve problems, we often do it as a team. You have to be able to stand up in front of a whiteboard, draw a picture and explain the problem and your approach, and then collect information from other people to come to a consensus.

 

At the end of the day, that means that you’re going to end up with a better product because it’s not just one person’s thoughts or ideas on how to deliver or how to develop that product.

That’s where the diversity comes in. The more diverse your workforce, the better the solutions you come to.

Before we finish, Chloe, any tips for people thinking about working in cybersecurity or thinking about going into that as their career after university?

Just apply. The cyber industry is looking for lots of people who are passionate and want to solve problems. You don’t need previous cyber experience to do well. You just need someone who’s passionate, able to communicate well, can sell yourself and can solve problems. Those are the things we’re looking for. I’d recommend that you read up a little bit about, in general, what cyber is about, but just go for it. We’re desperate for new blood.

I hear that all the time from lots of the companies I’ve been talking to. The skill shortage is very real. I was talking to someone else who was saying, “We don’t mind whether they’re male or female. They could come from planet Mars, as long as they have got communication skills and problem-solving skills because we’re so short on good talent.” It sounds like it’s a brilliant sector to work in with the future of technology, isn’t it?

Yes. For me, the thing I mentioned earlier about the fact that you’re helping people, you don’t get that in many other technology industries. You could work in finance, doing fintech, or you could work in IT, building computers for people, but you don’t get the same satisfaction. You’re helping protect people. You’re helping keeping their assets secure. For the small businesses, you’re basically helping keeping them going. If they had a ransomware attack, they could potentially go out of business.

It’s that sense of purpose that you get working in that sector. Thank you so much for joining me. I do appreciate it. Thank you, everyone, for reading. I’ve been talking to Chloe Acebes from Sophos. She’s a Director of Engineering there. I enjoyed hearing about Chloe’s career as a woman in cybersecurity, but also her journey from coming from a Physics and Astronomy degree, and then finding out about coding and then eventually joining Sophos as a graduate.

You can find out about more episodes at SherryBevan.co.uk. If it sparked a thought in your mind about how to attract more talent to your organization, particularly if you’re looking at attracting female talent, then please do get in touch. An exploratory call with me will give you the opportunity to ask any questions you have about the work I do with cybersecurity companies on attracting, developing, and retaining your female talents. You just need to get in touch with me by email, Sherry@SherryBevan.co.uk. Thank you again, Chloe. It’s been great talking to you. Enjoy the rest of your day.

Thank you very much.

 

Important Links

CGP 22 | Cybersecurity

Cultural Change, Continuous Learning, And Cybersecurity With Dora Ross For National Cybersecurity Awareness Month

There’s always something to learn. You don’t have to know everything, but you should look for innovative ways to acquire new knowledge every day to achieve the success you are meant to have. This interview is one of a series of interviews with women in cybersecurity. The series is published in October 2022 to celebrate National Cybersecurity Awareness Month. Our guest, Dora Ross, shares her knowledge of the barriers and challenges of cybersecurity. Dora is a security culture transformation specialist. She works with organizations to define and implement risk-based, human-centered security culture and training strategies enabling positive behavioral change. In this episode, she emphasizes that there are so many different areas in Security, and the landscape is constantly changing. Tune in to learn more about what people do daily in cybersecurity, the importance of communication skills, and shaping cultural change.

Listen to the podcast here

 

Cultural Change, Continuous Learning, And Cybersecurity With Dora Ross For National Cybersecurity Awareness Month

In this mini-series to celebrate National Cybersecurity Awareness Month, I’m talking to a range of women about their careers in cybersecurity. I’m delighted to be talking to Dora Ross. Welcome, Dora. Thank you so much for joining me.

Thank you so much for having me.

She is a security culture transformation specialist. We’re going to find out what that involves and hear about Dora’s career journey. Perhaps you could start off by telling us how you got started in IT and how you made that move over into the role you do now.

My first several years weren’t in IT or cybersecurity at all. I was working in marketing, communications, and business change management. I transitioned into IT unintentionally. When I was a business change manager working for a social and housing organization, I needed to understand work processes and ways of working for different departments. That is in compatible systems in IT as of products used. That was my way into the world of IT.

It’s quite a different career, but you got those transferable skills. What do you find is different about working in IT compared to the roles you had before?

It is different compared to what I have done before. I feel like I need to understand a bit more because IT is a wide spectrum of topics and systems that are used. I constantly feel like I need to understand more and learn more, and it can be technical. Sometimes, I feel like I need to research a lot more to be able to understand what people do and how they do it, especially with engineering teams. They are so different and technologically advanced people that I feel sometimes I get a little bit of impostor syndrome with them because I might not be able to understand as much as they are.

To be applying for something that’s completely out of your comfort zone is a really big thing.

However, in my world and in business change management, it’s number one to be able to ask questions. It doesn’t matter, even if I don’t understand something. It is being able to ask questions. There might be some complex topics that I need to translate into an easily digestible format for the rest of the organization. Although I used to have impostor syndrome, and sometimes I still have that, I have to be okay with knowing that it’s okay not to know everything.

That is one of the traps that some women tend to fall into wanting to know everything, needing to be the expert, and having all the detail on everything. The more you move up in an organization, the less feasible that is practically to have the time in the day to know the detail about everything. I’m glad you have talked about that. That is positive that you have taken that learning on board. Tell us a bit more about what you do because your job title is a bit different than some of the other women in this area. You’re a security cultural change specialist. What does that mean? What is it that you do on a day-to-day basis?

As the title said, it is not heavily technically involved at all. It’s more of a softer side, people side, and psychology and behavioral side of elements. I am responsible for embedding secular behaviors into that corporate culture. That means I work with all different parts of the business, different functions, and departments to understand what they do and how they do it. I help them during the workforce in more secular ways.

They’re able to protect the company data, but besides that, it’s not just the company, customer data, and employee data that are important. What I enjoy about this is that people can learn tips and techniques and best practices on how to protect themselves in their own personal lives, their families, when they do banking, or even on social media, and how much they share.

It’s an interesting role to be able to help the organization build up cyber resilience and also help people on a personal level. My role could be different on another day. I could be writing blogs or user guides, preparing for some training or workshops, working on creating cyber secretary training and culture strategies, or some incident communications that could happen any day. It’s varied in terms of the role.

What about the skills that you need for that particular role?

CGP 22 | Cybersecurity
Cybersecurity: Be motivated and have that hunger for knowledge, so you continuously learn and expand your horizon.

 

My career started doing marketing communication and business change, especially for this work, this cultural change. Change management is important to know how people go through change cycles and how to influence behaviors. Also, the marketing side is quite good to have so that you know how to write communication and business training materials. It captures people’s attention. You can help them learn new skills in an easily digestible format.

Once I started being interested more in security, I went on a couple of courses at Open University. There are free courses out there that can be taken. You can go on a different learning journey. I have qualified by SANS, which is a paid five-year course. You need to learn about how to manage and measure secondary awareness practices and interventions. There are different ways you can go about it, and you can learn on the job. I do find some qualifications help you to be better at this role.

That qualification gives you a certain level of authority and credibility in what you do.

Exactly. However, there are some rules. Sometimes, there are too many qualifications that may be asked. People are not going to apply for those because they don’t have them. They might have the skills and experience but not the qualification for various reasons. Qualification might not always be the most important thing. However, there are certain ones that are worthwhile to see.

I remember years ago, I was hiring a network administrator. We interviewed some people who had the qualification, and some of them didn’t have the qualification that we were looking for. Some of those people without certificates were fantastic, knowledgeable, and experienced. Some of the ones with the certificate didn’t know what they were doing. There is an element of that. It’s a mixture of having the qualification and the experience, but those qualifications certainly give you that credibility. In your career, what’s been your proudest achievement?

I can mention a couple. I will bring down the two main ones. When I was working at a social housing association back in 2012, I was still in my marketing role. PWC came in to look at our target operating model or the stigma that we can get some savings. I applied for a role, besides my marketing role, to help PWC with this big piece of work and be marvelous for six months.

To be able to collaborate with people, having good communication and social skills are the keys.

I was fortunate enough to be accepted for this program. That completely changed the course of my career life. That’s where I learned about business change management, organizations, and different departments and got to know the business and how they operate. That was mind-blowing to learn all of these things. That was one of my proudest moments because I was in marketing. To be applying for something that’s completely out of my comfort zone was a big thing for me. It changed the course of my life.

The other one I would mention was before COVID hit. It was in February 2020. We had the ties in International Security Summit. I was one of the speakers, and that was the last live event before we stopped the live conferences. I was able to speak about security culture and education among many credible and amazing speakers. That was one of my biggest highlights. To be able to be on stage with those people, commenting and giving advice on best practices, and imparting my knowledge around security culture was an incredible moment.

The opportunity to work alongside PWC, what better organization to learn from a big consultancy firm like that? I can imagine that’s given you a strong foundation in business change. I’m thinking about getting more women into cybersecurity. What do you think are the barriers or challenges to doing that?

When I transitioned from the business change adamant into more of the technological side, I mentioned impostor syndrome. You might feel you don’t have enough knowledge to get into a certain industry or tech industry. That could be a barrier. People believe in themselves, move forward, and go for those interviews or look at those opportunities. You know there was a way in.

I would encourage women to have mentors because they can be a great help to get into cybersecurity or IT. Find communities and networks that support each other in the area of interests and performance people, and they will be able to show them opportunities, skills festivals, or something like that. There are opportunities to meet future employees. You can ask them, “What do you need, or what requirements do you have?” Start the initial conversation. You will get a better chance of getting into this industry.

You sound like you love your work. Your enthusiasm and passion for it come across when you’re talking. What do you see as being the key skills that are required not just for women but for people to be successful in this industry?

CGP 22 | Cybersecurity
Cybersecurity: Working with people and getting to know the business through the different departments and what people do in different functions is really satisfying. It’s creating those relationships and actually making a difference.

 

Social skills are important. To be able to collaborate with people, you have to have good communication skills. Sometimes that’s a little bit lacking. If someone has got a lot of technological knowledge, they are not able to translate what needs to be done about the systems in an easy and clear way to people. Collaboration is one of those keys. Be motivated and have that hunger for knowledge so that you learn more and continuously learn and expand your horizon.

What is it that you love about the work that you do?

I love our security culture. It does not just work for me. I personally love this. I’m the one who can go out with friends or family. I’m giving them best practices sometimes. They don’t even want it.

You can’t help yourself. That’s what is valuable about the work that you or the people like you do. What you’re doing is protecting companies, but that information and knowledge help individuals protect themselves. In this cyber world, that is important.

Working with people and getting to know the business, different departments, and what people do in different functions are satisfying. Creating those relationships in each department depends on their needs in providing them suitable training or whatever guidance they need. Creating those relationships is amazing and you are making a difference.

When you see a communication strategy come to life, people come to you, and they’re starting the conversation. It’s a two-way conversation. That’s where the magic happens. You’re not pushing out information, but the people receiving them now ask questions about the ending in the changing behaviors because of that. That unfolds the beauty of other cyber security cultures.

When you see a communication strategy come to life and people actually come to you and start the conversation that’s really where the magic happens.

What has been your biggest challenge since you have been working in cybersecurity?

I would mention learning more about the technical side. Initially, because I’m coming from business change, plans the psychology of change, and how to communicate changes to people, but to understand and be credible on a different topic is learning about the system, the threats, and the risks a little bit more.

That was a bit of a challenge for me because I knew how to communicate about certain topics, and I found that I needed to find out. I did feel like if I knew a little bit more, I don’t always have to ask those questions because I understand what people are talking about. It’s easier to impart that knowledge to other people. It’s learning a bit more about the technical side.

Having that depth of knowledge and information makes it easier for you to communicate in ordinary English that a non-technical person can then understand. One of the hardest pieces about working in technology is doing that translation from tech speak to normal person speak.

There is so much out there, and you could get lost in the knowledge because there is much information out there. I hear a word over here about technological solutions. You instantly research, but you can get into too much research and get lost because there is more information. There has never been a stop to it. There is a lot more that you can do, and you have to know where to stop. You’re not getting overwhelmed by all the information that comes in.

Understand what you need to understand and ask questions. If you ask people, “Can you explain it a bit more because I don’t know about this? Could you demonstrate it to me?” They like to help. People are naturally quite helpful. It’s good to ask for knowledge. You need to research and stop there. If you need more, get more later.

CGP 22 | Cybersecurity
Cybersecurity: You could get lost in the knowledge of someone because there’s just so much information out there.

 

If there are women reading this who are looking to get into cybersecurity, what are your best tips for them?

If you can sign up for mentorship, you can do it within your own organization or somewhere externally. I have had mentors before, but one in particular, Deborah Haworth from the publishing company where I worked previously has been amazing to me. She has opened doors for me that I don’t think I could have opened myself in terms of getting to know people and introducing me to many people. From then on, I could learn more.

My number one advice if someone would like to get into the industry is to find a mentor who is in that industry that you would like to get into, and they will be able to help you. The second last tip is to find the community. There are many communities like the SANS or SASIG community that are helpful. The people there can help you with whatever career you would like to take. There are lots of advice on training or conferences on how to develop your skills.

With more women working in cybersecurity, finding a mentor and finding the right communities are getting easier than it was several years ago because there are that many more women now in the sector. We don’t yet have a gender balance. I don’t think that’s going to be anytime immediately soon, but we’re getting there, aren’t we?

We are getting there, but there’s no balance yet. In the last few places where I worked, my immediate team, the smaller team, had a high number of women working in the department. When you look at the widest perspective, the whole IT or security, there are more male-oriented than female. I have worked with incredible women.

Hopefully, there are more women who want to get into this industry because it’s amazing. There is so much variety in work, and you could progress into different roles. Mine is not too technical. Social skills are required, but I can digress in the future years to more technical elements and do something completely different. There is so much there and everyone can choose whatever system works for them.

Dora, if people want to get in touch with you, I’m guessing LinkedIn is the best place.

LinkedIn is the best space.

Thank you so much to my guest, Dora Ross. I have enjoyed hearing about Dora’s career as a woman in cybersecurity, particularly because she is doing a role a little bit differently, looking at the cultural transformation. For more episodes, go to SherryBevan.co.UK. If this has sparked a thought in your mind about how you can do more to attract, develop, and retain your female talent, please do get in touch. Email me at Sherry@SherryBevan.co.UK. Thank you so much, Dora.

Thank you.

 

Important Links

 

About Dora Ross

CGP 22 | CybersecurityDora is a security culture transformation specialist. She works with organisations to define and implement risk-based, human-centred security culture and training strategies enabling positive behavioural change. She has a true passion for information security, demystifying security threats and policies, so that people know what to do in certain situations to better protect themselves and their organisations from cyber threats.

CGP 23 | National Cybersecurity Awareness Month

National Cybersecurity Awareness Month Special: Navigating The Unconventional Route A Cybersecurity Career With Emma Jones

This episode offers you the senior consultant of Crowdstrike, Emma Jones, to celebrate National Cybersecurity Awareness Month. Emma shares the unintentional move of her career in cybersecurity. Given that she has no background in the role, the transferable core skills she possessed allowed her to fare pretty well in the space. She enjoyed each moment of her journey and never looked back on her previous career. Like everyone else, Emma faced some challenges along the way in her career, but how did she deal with them? What insights could she offer to anyone thinking of taking the cybersecurity route? Tune in to this episode and learn more.

Listen to the podcast here

 

National Cybersecurity Awareness Month Special: Navigating The Unconventional Route A Cybersecurity Career With Emma Jones

In this mini-series, to celebrate National Cybersecurity Awareness month, I’m talking to women about their careers in cybersecurity. I’m delighted to be talking to Emma Jones from CrowdStrike. Welcome, Emma. Thank you so much for joining me.

Thanks for having me. It’s a pleasure to be on the show. Thank you.

Emma is a Senior Consultant at CrowdStrike. She’s going to tell us a bit more what that involves. Let’s get started and find out about her career journey. To set it into context, could you start by telling us a little bit more about CrowdStrike and what they do?

CrowdStrike, for those who haven’t heard of them, we are a global cybersecurity technology company. Our mission is ultimately to stop breaches. Essentially, they work with a whole range of products and services and strategies to protect customers and clients from the cyber threat and from the adversity that we face in that space. That’s a little bit about CrowdStrike. My role with them is based in the services part of the business. Essentially, I work with organizations across the UK, Europe, Middle East and Africa on a huge range of cyber incident response and readiness activities to help them prepare for the threat and increase their security posture and readiness.

Tell me how you got started in your IT career.

Overcome the imposter syndrome because otherwise, it would impact you personally and professionally.

Completely unintentional move into IT/cybersecurity. Actually, I went straight into cybersecurity. My previous occupation was in UK Law Enforcement. I was in a National Law Enforcement Organization working on a whole range of crime types, different threats, different teams, non-related to technology or cyber.

What happened was I went through a promotion process and they’re quite huge campaigns, I should say, where you apply for the rank or for the grade or the position rather than a specific role. You go through a campaign, they will assess and determine who’s suitable for that particular level, then at that point they will appoint individuals into the role across the organization and across the UK.

I went through a campaign and was successful in that campaign and was really pleased to hear that. It was at that point, I found out which role I was being posted into. Honestly, I expected it would be a role that I had done before with EMA, or had exposure to a crime type I was more familiar with. No one was as surprised as me to find out that I was posted to the National Cyber Crime Unit. I had a moment where I thought, “What on earth has happened here? There must have been a mistake. Why am I going into cyber? That’s not my background. I don’t have an IT skillset.”

I wondered what had happened in the process, but actually people had recognized transferable skills as being incredibly important in cybersecurity, not least of course because the industry is still fairly new compared to many of the areas of work and disciplines, but actually very fortunately the panel who decided recognized that I had some experience that would benefit the cyber side of the team. I found myself in a position there, which entailed creating and delivering and establishing a brand new unit for all UK Law Enforcement. It was all focused on prepared activities.

I had to start from scratch, learn about the threat, and then develop a team which would do a range of different projects from exercise and through operational learning all focused on cyber incidents. It was completely unexpected, but I’ve never looked back. I enjoy every moment of it. Here I am now in CrowdStrike in the private sector.

CGP 23 | National Cybersecurity Awareness Month
National Cybersecurity Awareness Month: Familiarity and awareness increase the effectiveness and the speed of your ability to respond.

 

I love hearing stories of people who have had an unconventional route into cybersecurity. I think it’s a very positive and powerful message to hear. You mentioned there that your campaign is you’re applying for a rank rather than for a specific role, and that somebody had obviously spotted specific transferable skills that you had. Would you mind sharing a bit more about what you believe those transferable skills were or are?

I would describe them best as core skills. Some people say soft skills, I’m not a huge fan of that. I think it can really imply that you are lesser than or it’s not as important. I like to say core skills. Essentially, I would say there are probably three areas. The first is communication. With that, obviously running a team that had a national unit, you would need to work with people in many different sectors, many different organizations, both public sector and private sector, and at different levels, operational levels, all the way through to senior leaders and strategic forum.

Communication absolutely was the top skill that mattered most in this space, so that you could essentially translate a conversation or a topic and achieve what you needed to achieve in that role. The second skill I would say is probably the leadership skills and strategic thinking. Many conversations I’ve had throughout my career, people have said, “Leaders and leadership skills are saved for the senior roles.” I think anyone can be a leader in your space. If you are developing something, if you were doing something novel or creative, or you have simply taken a step forward to help bring people together, then that absolutely means you are a leader, regardless of your role.

Whilst I was in a management and leadership position, I think those skills were deemed pivotal to be able to take an idea and a vision forward, and get people to understand why you were doing some and what the outcome and benefit for everybody would be in that space. Definitely communication and leadership. Finally, and I suppose it’s an element of communication, but it’s about listening skills and the ability to understand the situation that’s presented to you, and tailor and flex your style and ability and approach.

Obviously, there are many different views and ideas that you can take forward in your space that you need to be tuned in to what the actual requirement may be. Attention to detail and that listening ability, and then translating it into the next project. I certainly think those are some top skills I had to draw upon to my journey in that role specifically.

Comparison is the thief of joy.

As you described, they are definitely core skills that anybody needs in any industry and sector, but I think particularly so in the way that cybersecurity space is evolving at the moment, then those skills are in high demand. Tell us a bit more about what you do on a day-to-day basis in your role at CrowdStrike.

No two days are the same, as cliché as it may be. There are themes and similarities but lots of different conversations. There are a few paths on my role. The first is around working with our organization to enhance the incident response readiness. What I mean by that is getting prepared ahead of an incident to be able to deal and respond to that particular situation that they face. There’s a whole range of benefits in doing that. Not least familiarity and awareness, increase in the effectiveness and the speed of your ability to respond, given that time is always of the essence in these circumstances. That’s a huge focus for me is that preparedness initiative drilling down on some key aspects, whether that’s how you seek support in responding to an incident, what barriers you may potentially face, and how can we overcome them proactively.

The other aspect of my work is more strategic in the sense of supporting organizations in their broader security programs. Working with them to understand what keeps them up at night, what’s the biggest concern, what’s the priority, and how we can help them address those concerns and priorities. Security programs are always changing. They’re always evolving, very dynamic, and you can never do everything all at once.

It’s about having conversations with our clients across this region about what matters to them, and how best we support their effort so that they increase their resilience and readiness in that space. That’s broadly speaking of the day job. I’m really fortunate to have a couple of extra pieces of work that I can do in CrowdStrike relating to inclusion and thought leadership as well, which is fantastic. I’m very fortunate to have the time and opportunity in that perspective.

It sounds like you really enjoy the work that you do, which is brilliant. When you enjoy your work, it makes it so much easier. Since you’ve moved into the IT or the cybersecurity sector, what has been your biggest challenge in your career so far?

CGP 23 | National Cybersecurity Awareness Month
National Cybersecurity Awareness Month: To be inclusive with others, we can have thematic and strategic conversations around diversity and inclusion.

 

I would certainly say it’s around building confidence. We talked about how many people find themselves in cyber in unconventional ways, different routes and paths. I think that contributes to things like Imposter syndrome. Many people, if not everyone, suffer that, and it comes in peaks and troughs, but that was an area that I struggled with to begin with.

What comes hand-in-hand with that is building confidence and having faith and belief in my skillset and my abilities. That was quite difficult to begin with because when you would look around in cyber, it’s still fairly male-dominated. There’s still quite a technical focus rather than a core skill focused certainly at the time that I came into the industry. That sometimes can make you feel like, “I’m not quite like person X, I don’t have that knowledge of person Y, and I wouldn’t take that approach.”

Sometimes, you can then doubt your abilities and whether you’re in the right space and doing the right thing. For me, I had to overcome that because otherwise, you would be impacted both personally and professionally, and suffer in terms of not being able to really do and be who you wanted to be. I had to take the time to reflect and realize that I was in a position I was because of the skills and experience I had. They may have been different for other people, a different perspective, a different mindset or a different approach. I had to remind myself of that on a regular basis.

There’s a quote, “Comparison is the thief of joy.” That’s absolutely true. Remember the skills that you do have, and it’s not necessarily all about certifications. I came into the industry without anything like that. It was about lived experience and ability to apply knowledge. Realizing that position was fundamental to overcome that challenge. Don’t get me wrong, it can still be a challenge now, but it’s much more in check. I also have a wonderful mentor who I met through a Women in Technology program, who supports me create the safe space and has honest conversations, and helps me understand more about my potential and current value as well. That’s certainly been the biggest barrier that I’ve had to overcome.

It’s interesting you talked about a mentor because one of the other women in this mini-series talked about having a mentor as well, and how helpful that had been for her to believe in herself and to apply for the next role and to develop her career. It’s good to hear you talking about that as well. What about your proudest achievement? What’s that been?

If you wait until you feel ready, it’s usually too late.

This is always difficult to talk about. It’s not a question people ask one another so often. For me, I was nominated for a Global Women In Tech Award. That means a lot to me because it focused not just on my work in cyber incident response, but also predominantly about the work I’ve done for inclusion and inclusive practices with incidents.

I would say I’m probably most proud of it because it was the results of the work that I did a few months ago with the forum of incident response and security team. I was selected to speak at their conference. I thought about what we can do to be inclusive with them. For me, a lot of conversations and a lot of narrative, quite rightly, is always about thematic and strategic conversations around diversity and inclusion. Sometimes, those in teams and every individual every day might not feel that relates to them directly.

I wanted to take a moment to speak to those individuals within teams within the global forum to say, “This is what we can do as individuals and actually make it specific real examples, bringing it back and relate for their daily work. That was a fabulous opportunity for me to bring two topics I love together, and a wonderful moment to hear about the nomination as well. That’s where I’m at in terms of proudest achievements.

You’ve done a lot of work around inclusion and representation. What do you see are some of the potential barriers for women working in this sector?

The most prominent barrier at the moment is a lack of representation of women in two areas. The first in senior leadership roles and the second in technical roles. The industry is very vocal and passionate and supportive of having diverse representation, having women in the workforce. There are conversations about how cyber is not just technical, so women in roles that are non-technical and that are outside of the day-to-day hands-on keyboard activity, and they intersect with cyber, was certainly getting there and recognizing that and bringing women into the sector in that regard.

CGP 23 | National Cybersecurity Awareness Month
National Cybersecurity Awareness Month: Choose opportunities that you think will be best for you to support your interests in that area.

 

When it does come to senior leadership and technical hands-on keyboard positions, that is where we lack the visibility and representation. It’s important for me because we want to feel like we can have a career path and that we can do something. Everyone likes to see someone role model that opportunity. Without that can make it quite a challenge to showcase and explain to individuals and to women what a great path this career can take you on.

You’re right. There are a lot of organizations that are actively wanting to improve diversity and increase inclusion, but it’s not having those role models at the senior levels and in the technical areas. There’s that quote, “You can’t be what you can’t see.” The more we have those role models, then the more it becomes a snowball effect. Any top tips for anybody who wants to get into cybersecurity via a conventional or an unconventional route?

There are many, and I’m sure you’ll hear some fabulous tips from all of the guests on this mini-series, but I think there are two. The first is to leverage what’s out there to support women. There are amazing networks, free training programs, and I mentioned the Women In Technology mentoring program that I joined a number of years ago. There’s so much out there, so just have a look, make the most of it, choose opportunities that you think will be best for you to support your interests in that area. You don’t need to be in a cyber role to join any of those. You could just be thinking about IT and tech position. Definitely leverage those opportunities. There’s more now than there’s ever been before.

The second tip I would have is there’s no better time than doing it now. Both for those reasons around the opportunities, but also because someone once said to me that if you wait until you feel ready, it’s usually too late. I completely agree with that. Taking a moment to leap into a new opportunity or just signing up to a program or a training course. Even if it doesn’t fully fit with what you’ve got going on right now or if you think, “I need another six months and then I’ll be ready,” just do it because something will always come in the way. That’s my main tip and something which stayed with me for my entire career so far.

I love that piece of advice. I think it’s so true because so often we put off doing things because, “I’m not quite ready or I don’t quite have the right experience yet,” then you can look back later and think, “If only I had done it sooner, if only I’d just taken up that plunge.” Emma, thank you so much for joining me. It has been interesting to hear about your slightly unconventional route into cybersecurity, but I think that’s a very positive thing to hear. I’ve loved the tips that you’ve shared as well. If people want to get in touch with you, I guess LinkedIn is the best place to do that, correct?

Yes, absolutely. Please reach out. I’m always happy to provide pointers and advice on joining the sector and where to leverage those opportunities.

Thank you so much, Emma, for joining me. We’ve been reading about Emma Jones talking about her career as a woman in cybersecurity. If there’s a spot of thought in your mind, let’s talk. Let’s talk about any questions you might have about the work I do in cybersecurity companies on attracting, developing, and retaining your female talent. Just email me at Sherry@SherryBevan.co.uk to book your free consultation call. Thank you, Emma.

Thanks. It’s been a pleasure.

 

Important Links

 

About Emma Jones

CGP 23 | National Cybersecurity Awareness MonthEmma is a Senior Consultant with CrowdStrike, who works with organisations across the UK, Europe, Middle East and Africa on a range of cybersecurity incident response and readiness initiatives. Alongside her day job, she is passionate about fostering inclusion and championing diversity, and is involved in multiple associated projects.

CGP 24 | National Cybersecurity Awareness Month

National Cybersecurity Awareness Month Special: Cybersecurity Is A Mission, Not A Job With Laura Whitt-Winyard

 

Cybersecurity is a mission, not a job. Today’s guest has 20+ years of experience to prove that. As part of our National Cybersecurity Awareness Month miniseries, we talk to Laura Whitt-Winyard, CISSP, CISM, CISA, CRISC, a Fellow at the Institute for Critical Infrastructure Technology and International Advisory Board Member at HMG Strategy. Laura got herself to cybersecurity through a slightly unconventional route. Now, she is one of the industry’s respected thought leaders and a role model for women in the space. Tune in as she joins Sherry Bevan to talk about her typical day as a CISO, the challenges she had to go through in her career, what she enjoys about her work, and the wisdom she can impart to women working in the sector.

Listen to the podcast here

 

National Cybersecurity Awareness Month Special: Cybersecurity Is A Mission, Not A Job With Laura Whitt-Winyard

In this mini-series, to celebrate National Cybersecurity Awareness month, I’m talking to a range of women about their careers in cybersecurity. In this episode, I’m delighted to be talking to Laura Whitt-Winyard. A very warm welcome to you, Laura.

Thanks, Sherry. Thanks for having me.

Laura has a whole string of letters after her name. She’s got a range of qualifications. She has worked for some leading companies, including Comcast and Bloomberg. Let’s jump right in and find out more about Laura’s career in the cyber world. Laura, could you start by telling us how you started in IT and cybersecurity and how your role has evolved over time?

I have been in cybersecurity for many years. I started in IT, and it was by accident that I went into cybersecurity. One of the companies that I was working for was Allstate Insurance Company. They were doing a lot of business with CNA Insurance Company in Chicago. Having talked with the CISO of a CNA insurance company, it turned out that their security architects had sabotaged their networking.

He asked me if I thought it was something I’d be interested in trying to help him fix, so I did. That’s how I got into cybersecurity. Subsequent to that, I realized that cybersecurity was my passion. It’s always changing. You never get bored. You’re constantly learning. You have the ability to affect positive change. Subsequent to that, I moved from CNA to Bloomberg, where I worked for some amazing people. I went to Comcast and worked for even more amazing people. It was a wonderful experience. It’s always an opportunity to learn.

That was quite a start in cybersecurity, being asked to pick up where somebody else has done some real damage, by the sounds of it.

CGP 24 | National Cybersecurity Awareness Month
National Cybersecurity Awareness Month: Typically, when you start a new company as a female, they assume you understand regulations compliance, and maybe the legal aspect, but definitely not the technical aspect.

 

It was crazy. I had to learn on the fly, which is probably one of the best ways to learn.

It’s interesting that you’ve got a slightly unconventional route into cybersecurity. That seems to be a common theme in this mini-series. Quite a few of the women I’ve interviewed already have not actively looked for a career in cybersecurity but landed in it by chance, almost.

Back in the day, very few people intended to go into cybersecurity. It wasn’t a career route that most people even knew about.

It’s very true. Perhaps you could tell us a bit more about what you do on a day-to-day basis in your role.

On a day-to-day basis, you spend quite a bit of time working on strategy and vision, trying to discern where the company is going, aligning the security strategy with business objectives, as well as staying on top of the latest trends, understanding a couple of years ago nobody thought too much about quantum computing. They thought it was so far off. Now it seems it’s on our doorstep. You spent a lot of time looking at what’s advancing in security and the latest trend and factors, but then taking that and marrying it with your strategy and the company objectives.

That sounds like a lot of thinking power that goes on in that type of role because you are having to look at what’s coming and predict how that might influence or affect operations for your business.

Cybersecurity is always changing. You never get bored, you’re constantly learning and you have the ability to effect positive change.

There’s quite a bit of a prediction, and I would venture to say even guessing. You look at what’s going on and try to ascertain how it could impact your company and its customers. Sometimes you get it right. Sometimes you get it wrong. Sometimes you’re too advanced for the company or are a little bit ahead of the time, and you’re not ready for it. A good example was when I was at Bloomberg. I was exploring anomalous detection back in 2005 and 2006. The cybersecurity world wasn’t ready for it, and neither was Bloomberg. Now, everybody talks about anomaly detection.

That’s one of the interesting things about working in this sector, particularly in technology, because it’s evolving quickly. There have been quite big changes as well over the last couple of years. Nowadays, the general public has more awareness and understanding of cybersecurity in general.

It’s extremely beneficial to a CISO. There’s a saying that says, “Don’t let a breach go unutilized.” The fact that it’s become more prevalent in the news, less and less executives and companies as a whole are saying, “That happens to other people. It doesn’t happen to companies like ours. We’re too small. Nobody knows who we are.” Now they’re realizing that is not accurate.

That general awareness has increased amongst the business itself rather than just being something that IT and the technical people understood. That’s a real positive in some ways.

It helps security leadership be able to explain the ramifications of not doing certain things and the benefits of doing certain things. It makes it much more applicable to the business in their everyday life when they see what can happen to other companies.

Tell me a bit about your career. What’s been the biggest challenge that you’ve had to deal with?

CGP 24 | National Cybersecurity Awareness Month
National Cybersecurity Awareness Month: There’s not one single person in cybersecurity who knows everything. Find your niche, find what you love to do in cybersecurity and focus on it.

 

I would say probably as a female being perceived as not technical. That’s the biggest challenge. Typically, you start a new company, they see you as a female, and they assume you understand regulations, compliance, and maybe the legal aspect, but not the technical aspect. It’s always, in a way, a little bit fun once they realize how extremely technical I am and the shock on their face. That’s one of the biggest challenges.

How do you get around that challenge? What do you that makes that less of a challenge?

It takes time working with the engineers, engineering leaders, and product leaders and being able to make recommendations that aren’t so along the lines of checking a box for compliance to say, “Maybe we can’t do this, but here are some opportunities and options that we could do something else.” Security coverage is typically surprised about the technical record I make, and it takes time being able to explain that to people.

That’s true in any organization, but perhaps more so for a female entering a very technical career, which is a bit frustrating at times. Hopefully, over the next few years, we’ll start to see that changing, and it would be becoming less of an issue. What about the things you’ve been most proud of in your career so far?

Becoming a CISO. I was very excited and proud. I must admit I was a little bit too excited and in disbelief that I had made it to the pinnacle of my career. Some of the other things I’m proud of is coaching some of the folks that have reported to me into other security leadership roles. I still maintain those relationships with them to this day and ensure that they pay it forward, and then also take chances on people who have never even once worked in cybersecurity but have a security mindset. Maybe they do Capture The Flag competitions and win in their free time, but they’ve never worked in cybersecurity or been educated in taking a chance on them and watching them flourish. That is also a very proud moment for me.

That must be a real fuzzy feeling moment for you to see people you have taken a risk with and to see them flourish. In some ways, it is even more rewarding than taking someone on who’s got the experience and the qualifications, and they flourished. Taking someone on where you’ve taken a risk is something extra.

Cybersecurity is not a job. It’s a mission. You’re not just there to protect the company. You’re there to protect their customers and their employees.

I hired a grocery store manager who didn’t have a degree at all, had no cybersecurity certifications, had never worked in cybersecurity, but had a massive server environment in his basement and entered Capture The Flag competitions in his free time. These are hacking competitions and had won several. He did not apply for the job. Someone that was a friend of his said, “You should look at this guy.” In talking to him, I was amazed.

It was the fact that nobody would ever pick a chance on him. He’s now flourishing. He’s doing so well. He’s paying it forward. He’s helping bring new people into the security community, which is half the battle. As you know, we have a skills shortage, and there are not enough cybersecurity people. For him to pay it forward to every person that I help pays it forward is a wonderful thing to see.

Paying it forward is so important, particularly since there is a skills shortage in cyber. The more good people, the more good talent we can bring in. Often they can be the ones who will be perhaps better at persuading others who don’t have that cyber experience. This is a field that you can work in and can flourish. That’s good. What is it that you enjoy about the work that you do? You clearly enjoy developing people, coaching, and watching them grow, but what else is it that you enjoy about the work?

It’s the ability to affect positive change to do good. When you work in cybersecurity, it’s not a job. It’s a mission. You’re not just there to protect the company. You’re there to protect their customers and their employees. It has a ripple effect. If I saved one customer from having a security incident or losing their data, that would affect their livelihood.

That also, in turn, affects their family. That ripple effect is part of why I do this. I also love speaking about cybersecurity. I’m passionate about it. You can ask my husband, who rolls his eyes every time we’re watching a show, and I’m talking about cybersecurity. In the cybersecurity community, this mission that we’re on is much bigger than the individual and the company. It’s a global issue.

What do you see as some of the potential barriers or challenges for women, in particular, starting or getting promoted in cybersecurity?

CGP 24 | National Cybersecurity Awareness Month
National Cybersecurity Awareness Month: Get as much knowledge as you can. Anytime you read something that is not resonating, Google it, research it, YouTube it, learn as much as you can.

 

One of the barriers is that they’re afraid of not knowing something and looking like a fool. One thing I’ve always said is there’s not one single person in cybersecurity who knows everything. It’s impossible. Find your niche. Find what you love to do in cybersecurity and focus on it. Don’t let anyone tell you that you don’t have enough skills or knowledge because you will get it. Not everyone has all of it.

What do you see as being the most important skills for anybody working in cybersecurity?

It’s the ability to translate technical into business. Being bilingual is one of the hardest skills to learn to be able to explain to the business something extremely technical but in a manner in which it relates to them and their business.

It’s that communication piece. That’s true no matter what part of technology you go into, particularly cybersecurity because it has a potential impact on the business itself. You need to be able to explain things in a way that others can understand so that it makes sense to them and that they know what decisions they’re making and what the ramifications are.

I still struggle with that. Many people in cybersecurity are of a different mindset. We’re very technical, logical, literal, and to be able to go into a conversation with varying personalities, if you’re speaking to the board or someone in risk, or development even, and to be able to set aside your technical knowledge and put it into language they understand. I have trouble with it even still to this day.

That’s true, no matter what field you work in. When you’re an expert in what you do and that knowledge is part of who you are, then it’s easy enough to take for granted what other people’s knowledge and understanding are. It’s such a common thing. What are the tips that you might have for women who are thinking about getting into cybersecurity? What would you suggest they do if it’s getting into the sector or want to make progress in the sector?

It’s really important to find out what your passion is within cybersecurity – what interests you, what really drives you. Hone in on that and learn as much as you can.

Read as much as you can. By read, I don’t mean books. By the time a book is released, some of that technology is already legacy. Read cybersecurity news. Set up alerts on your phone about anything cybersecurity. If you read a news article and you’re wondering, “What does this mean?” google it. Learn it. Try and research it. There’s free cybersecurity training out there all over the place. Go to security conferences. The security community nowadays is very different from what it was several years ago.

The security community nowadays is very much a community. Whereas several years ago, it was the most knowledge wins. I’m not sharing my information with you because you’ll be as smart as I am. There are things called BSides. There are tons of security conferences. The one I go to every year is DEF CON. It’s an annual hackers convention where anywhere from 20,000 to 30,000 hackers from around the world attend. It’s a very inexpensive conference compared to the others. Get as much knowledge as you can. Anytime you read something that is not resonating, google it. Research it. YouTube it. Learn as much as you can.

I was talking to somebody on a completely different subject the other day. We’re talking about bike mechanics. I cycle. I remember her saying, “You can learn whatever you need to learn nowadays. You can just YouTube it, and you’ll find out whatever it is you need to know.” The same is true for cybersecurity because so many people now are sharing their knowledge so much more openly on the podcast, YouTube, blogs, and things like that.

How many times have you had something going on at home, like your dishwasher or something, and you go to YouTube for a video on how to fix it? The same is true with cybersecurity. There’s so much to learn. There are so many different aspects of cybersecurity as well. Like I said, it’s important for you to find out, “What is your passion within the cybersecurity arena? What interests you? What drives you?” Hone in on that and learn as much as you can.

Thank you so much for sharing those tips. That knowledge piece is helpful. Often, women tend to have a tendency to think if they don’t know all the answers, therefore, they’re not good enough, expert enough, or don’t have the relevant experience. As you say, you can research so much nowadays online that there’s no reason to feel like that.

That happened to me early on in my career. I would not speak up. I would not say much in meetings for fear of looking like I didn’t know what I was talking about. It’s that insecurity. If I could say something to myself back then, it would be, “Don’t worry about being insecure. Almost everyone at the table is as insecure as you are. Not everybody knows everything.”

CGP 24 | National Cybersecurity Awareness Month
National Cybersecurity Awareness Month: Don’t worry about being insecure. Almost everyone at the table is just as insecure as you are and not everybody knows everything.

 

It’s such a good thing to remember. Thank you so much for your time, Laura. If people want to get in touch with you, is LinkedIn the best place to do that?

LinkedIn or Twitter, either one.

Thank you so much for joining us. I’ve enjoyed hearing about your career in cybersecurity. I love the fact that your start in cybersecurity was less than conventional, but being asked to go in and fix something that had gotten broken. That’s good to hear from that point of view how you got into cybersecurity. It’s clearly an industry that you’re passionate about and love.

Thank you so much for having me. Anyone who would like some free tips, coaching, or any websites I recommend for following the news or free cybersecurity training, can always reach out to me on LinkedIn or Twitter.

Thank you so much. If you’ve enjoyed reading about Laura’s career as a woman in cybersecurity, you can find more episodes at SherryBevan.co.uk. If this has sparked a thought in your mind about how to develop and retain your female talent in cybersecurity, please do get in touch with me, and let’s arrange an exploratory call. Thank you so much, Laura. Thank you to everyone who’s reading. See you next episode.

 

Important Links

 

About Laura Whitt-Winyard

CGP 24 | National Cybersecurity Awareness MonthLaura Whitt-Winyard is a Fellow at the Institute for Critical Infrastructure Technology and an International Advisory Board Member and Women in Technology board member at HMG Strategy. Previously, she was the CISO of Malwarebytes, Global CISO for DLL Group, Director of Security for Billtrust, and held senior leadership positions in security at Comcast and Bloomberg, LP.

CGP 25 | Crisis Management

Interview With Ashley Baich Of Accenture To Celebrate National Cybersecurity Awareness Month

Joining us for another episode of our special National Cybersecurity Awareness Month series is Ashley Baich. Ashley is the Readiness and Crisis Management Security Consultant at Accenture in their Cyber Investigation, Forensics, and Response (CIFR) practice, responsible for helping organizations flex their crisis response capabilities. She chats with host Sherry Bevan about her journey into cybersecurity and why she had her sights set on the field before even graduating. Ashley also speaks on the challenges and possible turnoffs going into such a male-dominated industry, the strides being made to close the gaps, and the opportunities for more women entering the field. Tune into this episode to learn more.

Listen to the podcast here

 

Interview With Ashley Baich Of Accenture To Celebrate National Cybersecurity Awareness Month

In this mini-series, to celebrate National Cybersecurity Awareness Month, I’m talking to several women about their careers in cybersecurity. In this episode, I’m delighted to be talking to Ashley Baich. Welcome, Ashley. Thank you so much for joining me.

Thanks for having me, Sherry.

Ashley is a readiness and crisis management security consultant and has been working for Accenture for the past two years. Let’s jump right in to find out more about Ashley’s career in cybersecurity. Ashley, I know you’re a fairly recent graduate. What did you study before you got started in your consultancy career?

I graduated from the University of North Carolina, Chapel Hill, which is on the East Coast of the United States. I graduated with a BS in Information Science and a BA in Journalism.

Information Science and Journalism are quite an interesting mix. Was there a lot of overlap between the two?

Not overlap, but they complemented each other pretty well. I always knew I wanted to go into cybersecurity in some capacity and use those four years of undergrad to decide what aspect of security I wanted to be a part of. My Journalism degree came from the desire to bridge the communication gap between IT and business. Unfortunately, my university didn’t have a degree in Cybersecurity. Information Science was the closest thing that I could major in that gave me a little glimpse into the cybersecurity world, but I still had a lot to know when I graduated in 2020.

I’m curious because I don’t know many people who go to university thinking they want to get a career in cybersecurity. What is it about cybersecurity that piqued your interest so young?

My father has been in cybersecurity for the past 30 years. It was definitely a topic at the dinner table. That’s definitely where I initially found a spark, but then I was gifted the very unique opportunity in my senior year of high school to write a white paper for a startup. I’ve always been very passionate about writing. I didn’t know what type of writing I necessarily would want to do long-term.

The startup approached me and asked if I would be interested in writing a white paper. That white paper turned into five wonderful years being on their marketing team as an independent contractor as I went through my university years. By the end, I was the longest-standing member of their marketing team. They were acquired by Symantec, which had turned into Broadcom.

It was a great experience, but that was my first exposure to cybersecurity personally, besides hearing about it. I saw the wide variety of opportunities within the field. Even if at the end of the day, I only wanted to write, it was a cool thing to write about. That passion shifted more to the incident response crisis management side of the house, but that’s how I started. It was in my senior year of high school. I was eighteen years old trying to make a little extra money and here I am now.

There’s a wide variety of opportunities within the field.

My father worked for IBM so it was almost a given that I was going to end up in technology in some shape or form, but it certainly wasn’t the career that I had planned on doing. Often, it’s those conversations around the dinner table that spark or ignite a thought of what you might want to do later in life. How did you make the move into the role that you are doing now? Tell us about what you do now.

In between my junior and senior years of college, I realized I probably should get myself an internship. I had a lot of Business major friends who were applying to consulting. I was like, “Interesting.” I didn’t know that much about it. I started looking and saw that cybersecurity is an aspect of consulting. You can consult for cybersecurity. As someone who didn’t have a lot of experience in cybersecurity besides my marketing experience and then my Information Science degree, I was like, “We can do that.”

I had the opportunity to intern for Accenture between my junior and senior years. I worked for Accenture Labs. It was internally facing. I was helping them bridge the communication gap between all the awesome research that our researchers were doing and their ability to communicate that with the consultants to then be able to share with our clients. I still got to use my journalism degree and do that, but get to touch on different aspects of cybersecurity that I didn’t have the opportunity to do on the marketing team.

I then received my return offer going into my senior year of college, which was great. I got to enjoy that senior year knowing that I had a full-time job waiting for me at the end. I joined our technology development program as a security analyst. It’s a soft line to financial services. What was great about that start was I got to touch on a wide variety of cybersecurity projects. I did policy writing, a merger of two large financial institutions, and picking and choosing the best of each security program. I got asked to be part of surge support for nine days for a client who needed more hands and more help. Nine days turned into four months. I enjoyed the crisis management and response work that I had the opportunity to do for that client.

Slowly but surely, I found my way to the CIFR team and officially joined in November of 2021. That was my journey to my current role. As part of the Cyber Investigation, Forensics and Response team, I have the opportunity to help organizations prepare for crises as a readiness consultant, but then I also have the opportunity to go in as part of the crisis management team during actual incident response to help the C-Suite manage the crisis.

That sounds like you’ve crafted your journey into cybersecurity and it sounds like you’ve landed on your feet. I can tell from your enthusiasm that you love what you do, which is always good when you’ve got work that you enjoy. Ashley, clearly you love what you do and you’re very passionate about it. What’s been your biggest challenge working in the cybersecurity world?

I think the biggest challenge that I’ve had to deal with is something that a lot of people have dealt with working through the reality of a huge organization. With Accenture, I think we are at 750,000 employees now. It’s a huge organization and what comes with that is a set of rules and procedures that must be followed. The largest challenge I have seen as it relates to that is when it comes to the promotion cycle. While I wish at the end of the day, it was solely based on performance and what you’re bringing to the cap table and what you’re capable of and the experiences that you’ve had, at the end of the day, there are rules around how long you have to stay at a level before you can be promoted.

CGP 25 | Crisis Management
Crisis Management: At the end of the day, there are rules around how long you have to stay at level before you can be promoted.

 

That can be a frustrating challenge to endure because as part of the crisis management team, I’ve had experiences where I am sitting next to the global CISO of a Fortune 100 company, working with them directly day-to-day, and have made considerable impacts on their crisis response. While that might fall under the roles and responsibilities of someone at a much higher level than myself, I am still under the pay band and roles and responsibilities of a consultant.

It’s a challenge I deal with daily, but one thing that makes it enjoyable still is the team that I work for. Having the opportunity to sit next to the CISO, even with the title of consultant is quite an honor. We run a relatively flat team, which makes me have those opportunities. While it’s still a challenge, I’m able to overcome it by thinking about it that way. At the end of the day, if I’m still able to perform the responsibilities that let’s say a manager would perform, I’m still fulfilled.

What about your proudest achievement?

I would say my proudest achievement to date was the opportunity to set foot on a client site during a major cyber crisis. I walked into their war room and see the absolute dread on some of these C-Suite faces not knowing what the week was going to hold and how they were going to recover from this incident. Sitting beside them for three months over the Christmas holiday and not leaving that project until there were smiles on their faces. We had overcome all of the challenges.

They were in recovery. They were transforming their security posture and had the buy-in from the rest of the C-Suite to do so. They were getting the money they needed from the board of directors to continue to make this transformation into a stronger security team. I can’t put into words how that makes you feel. You go in when they’re at their absolute worst and you don’t leave until they’re in a much better situation.

It gives you that warm fuzzy feeling to know that you’ve gone in when they’re in a crisis and you’ve left when they’ve got those smiles on their faces again.

You can see the impact that you’ve made. I truly feel like I’m making a difference and that’s very rewarding.

What do you see as being the most valuable skills working in this sector?

In my role, I would say that the most valuable skills are oftentimes soft skills. I have a wonderful incident response team that goes in and does the more technical responsibilities when it comes to responding to a crisis like doing the forensics, eDiscovery, and all of that. My role specifically is more soft skill driven. It’s the ability to understand what the incident response team is doing, what the findings are, and drive the business value from that. Also, be able to communicate that with my key stakeholders, but then also help my key stakeholders communicate that to the rest of the organization.

The most valuable skills are oftentimes the soft skills.

In the meantime also, the organization is a huge one. During a crisis, there are a lot of different workstreams going on. There are a lot of cooks in the kitchen and third parties that need to be considered and things of that nature. Helping the C-Suite be able to organize themselves and develop relevant tasks, prioritize those tasks, and assign them to the right individual is extremely valuable. In a high-stress “what’s going on” situation, it takes a lot of organization and the ability to step back, remove yourself from the stress, have an open mind, and think through the strategy of how you’re going to tackle the day, the hour, the next ten minutes, and things of that nature.

Those are the two key skills that have helped me be extremely successful in the crisis setting. In the readiness setting, since I don’t just do crises, those are very high intense and long day situations. When I have the opportunity to take a step back and do readiness work, go into a client and help them enhance their incident response plan or run a crisis simulation and things of that nature, communication is still important. Also, being able to think outside the box and think through the crisis situations that I’ve been a part of. Helping organizations proactively continue to improve their incident response capabilities so that they can respond the best when they do fall victim is another skill that is important in the incident response crisis management world.

Opportunities for women in the sector, I know that there seems to be a skills shortage generally, but what are the opportunities for women in the sector?

They’re endless. I’ve talked to marketing. I’ve talked to communications and the business side of things. There’s a huge technical shortage as well. For me, being a part of that technology development program to start helping me identify what niche I wanted to be a part of, and there are endless niches. You can create your own.

I don’t necessarily think that my career path is going to be just crisis management, but even crisis management as a workstream is something that is still so new. There are not many organizations that have invested in that workstream yet. The beauty of the opportunities is endless. You can have an open mind and create your own. At the end of the day, there are a lot of organizations that would love to invest in women who are interested in developing a skillset, and finding what they want their niche to be.

It’s identifying a current gap in the security program where you can use the skillset you have to provide unparalleled value. That’s a hard question to answer because there are so many different ways that I think you could. For anyone that’s interested in getting involved and doesn’t think that they have the background to make a decision on what niche they want to be a part of, to begin with, I know most organizations these days have that development program. They have the opportunity for you to start and look at cybersecurity as a whole. Pick what aspects you want to be a part of and try them out. That is extremely beneficial and a great approach to getting your feet wet.

CGP 25 | Crisis Management
Crisis Management: There’s a lot of organizations that would love to invest in women who are interested in developing a skill set, finding what they want their niche to be, and identifying a current gap in the security program where you can use the skill set you have to provide unparalleled value.

 

Ashley, you’ve talked about some of the skills that you use, but what do you think puts women off applying to work in cybersecurity?

There are two things and they go hand in hand. I’ll start with the first and that’s job postings being daunting in and of themselves. You look at the skills required or even what the description of the job is. This is not only in the cybersecurity field. Oftentimes, someone may not be super confident in the fact that they are the right fit. Typically, if I look at a job posting and I’m not sure if I’m the right fit, I would still apply and go through the interview process. That’s the whole point. You’re interviewing the company as much as they’re interviewing you so you can see if there is a good fit.

When it comes to cybersecurity and the gender gap that we already see within the field, it can be a turnoff for women. They look at the job posting. They’re unsure. Maybe they do still have the courage to apply, but then every interview that they have from that point on is by a very successful senior male figure. It’s hard for them to imagine themselves in that role as a female, knowing that they’re going into a very male-dominated environment.

It’s hard for women to imagine themselves in that role as a female, knowing that they’re going into a male-dominated environment.

I am the only female that is on the crisis management team, and one of three females on the readiness team at Accenture. I’ve had a great experience. Someone had to point out to me that I was the only female on the team, but I know everyone doesn’t have that experience. It takes a lot of courage to put yourself in those uncomfortable situations to even apply for a job you’re not fully confident in.

You add that to the mix and it can be extremely daunting and a turnoff to many. I think there’s a lot of change in the cybersecurity field these days. People are aware of the fact that it is male-dominated. I will give a shout-out to my male leaders. They pointed out and they have the conversations. They’re trying to make strides to minimize that gap. As women, we also have to apply for them to be able to minimize the gap. I don’t want to forget that part of the equation too.

Finally, what’s your top tip for anybody that wants to get into cybersecurity? What would you suggest they do?

I would go in head first. If I’m being honest, as we’ve talked a lot about here, there are so many different opportunities and skillset that you can leverage to be successful in the field. The way that I was able to find my path was going in head first trying a wide variety of things until I found my niche. I would encourage anyone who has any potential desire to be in cybersecurity to go in and give it a try. We have such a shortage. Everyone is going to be grateful that you’re there.

CGP 25 | Crisis Management
Crisis Management: For anyone who has any potential desire to be in cyber security, just go in and give it a try. We have such a shortage. Everyone’s going to be grateful that you’re there.

 

If you’re on the right team, they’re going to encourage you and teach you along the way. At the end of the day, it’ll be a great learning experience. At the very least, you might find your niche and passion, and years later, be excited to go to work every day and want to have the opportunity to be on shows like this to encourage others. I couldn’t say enough positive things about my experience thus far. I would recommend for anyone that’s potentially interested to go in head first and see how you feel a few months in.

Ashley, thank you so much. I’ve enjoyed hearing about your career, how you got started, and the skills you use. It’s fantastic to hear somebody talking about cybersecurity with such enthusiasm and passion. Thank you very much for joining me in this episode.

Thank you for the opportunity.

If this conversation has sparked or thought in your mind about how you recruit your female talent, let’s have a conversation. To give you the opportunity to ask any questions you have about the work I do with cybersecurity companies on attracting, developing, and retaining more female talent, simply email me at Sherry@SherryBevan.co.uk to book your call. Thank you and I’ll see you in the next episode.

 

Important Links

 

About Ashley Baich

CGP 25 | Crisis ManagementAshley is a security consultant whose work is focused on proactively improving organization’s resiliency to cyber threats and advising organizations through cyber crisis’. A readiness and crisis management consultant at Accenture in their Cyber Investigation, Forensics, and Response (CIFR) practice, she is responsible for helping organization’s flex their crisis response capabilities.