Empower Women in Cybersecurity: Include Women at Every Level of Organization

Transcript

Mike Krass 0:10

Hello everybody and welcome to What's the problem the show where we dive into different cyber and data security topics with our guests. During each episode, we are joined by an expert guest who will share their insights their takeaways, their experiences in the world of cyber and data security. The show brings a lot of valuable info some strategies to get your organisation moving up into the right. So join us as we explore the ever evolving landscape of cybersecurity. This is what's the problem. I am your host, Mike crass. Let's get started. Today we are joined by Jane Franklin, Jane say hello to our viewers. Hi. Now, Jane, talk to us a little bit here. How are you qualified to talk about security? What's your background?

Speaker 2 0:55

Well, the thing is cyber cybersecurity for 25 years, over 25 years. I came into the industry originally by building a security consultancy, which then became a penetration testing firm and I ended up for about 16 years. And then I've continued to work in leadership positions throughout my career. I'm also I'm also referenced by wiki by LinkedIn as a top voices, and UNESCO has called me a trailblazing women in tech. And I'm also regarded as an influencer. So I'm featured in the press every now and again. I speak all over the world, I'm a best selling author. And yeah, kind of that's who I am and why I'm qualified to talk about what we're going to talk about.

Mike Krass 1:44

I love it, I love it. And today, the topic of the show is how to get women into every level of the cybersecurity organisation. Right, so not just onto the board or into the executive levels, but entry levels, moving individual contributor roles, manager level roles, and then, you know, up through the org chart, so to speak. The first thing that I think is really, a great segue into that topic is talking about attracting, developing and retaining women in the world of cybersecurity. For those who have been living under a rock for a while, let's just assume there's a few listeners and viewers who have is this a problem? Like do we do we have an issue here with people coming in the boat and leaking out the different holes and not staying in cybersecurity?

Speaker 2 2:30

We do, we definitely do. So we we have about 25% of women in security at the moment that that comes from IC squared. They've provided us with that and they've been tracking it for absolute years, which is fantastic. What we know is that women in tech are leaving the industry at a fast rate. So they're leaving before the age of 35. We don't know the extent as to the attrition for women in cybersecurity, but we know that it goes on. And for me, having written my best selling book insecurity why failure to attract and retain women in cybersecurity is causing us all to be less safe. That's one of the things that we looked at.

Mike Krass 3:16

So after hearing about your your background, all of your experience, all of your travels on behalf of you know talking about cybersecurity and information security, Jane, really the topic that we're going to dive into today is how to get women into every single level of a cybersecurity organisation or function. So not just talking about placing board members, but all the way from entry level. And by entry level, I mean, zero years of experience required from entry level to being an individual contributor with little to no oversight, managing a team becoming an executive within this organisation or department. And obviously, you know, going into the world of maybe starting the business in the cyberspace or being on the board of directors for a security business. That's really the topic of today. And I think a great segue is talking about some three key themes, right, attracting, developing and retaining women in a cybersecurity organisation. So before we talk about developing and retention, development and retention, let's talk about attract. Do we have an issue in in the world, the royal we do we have an issue attracting women into cybersecurity roles?

Speaker 2 4:29

Yes, we do. We have an issue with women being in the industry. So we don't have a breakdown of exactly what the what the figures are in terms of attracting and retaining or attrition. Sadly, but we know that we have round about 20 to 25% of women in cybersecurity. You in the world right right now. And that's not, that's not great. That's not where we want. We're not at a tipping tipping point. So we've got to do a better job at all of those levels. also attracting women into the industry developing them and retaining them the development leads to retaining along with a few, a few other things. So yeah, we do.

Mike Krass 5:12

Now let's talk about the first point of attracting women into what started at the entry level or the individual contributor level. What's your experience tell you? What can you share with our listeners and our viewers about attracting women to the cybersecurity what works?

Speaker 2 5:28

It's really, really knowing your audience. So there are two things kind of going on. One is coming from companies. So the companies need to do a better job of how they're approaching women coming into the industry. So they need to understand the market so much better. You're in marketing. So we could talk about personas, you know, avatars and personas. So they've got to really understand what exactly that they want, where they're hanging out. For women, the issue that they have is not that there aren't enough for them to come into the industry, there are plenty of women for them to come into the industry. But the issue is actually getting into the industry. So it's more of a hiring issue for them. And I continually speak to women who struggle to get into the industry, and that it could actually take them between one to two years to actually come into the industry. And you can

Mike Krass 6:23

when you say just to be clear, to get into the industry, like can you tell us more about that? What do you mean by getting? What's What's two years?

Unknown Speaker 6:31

Yeah, getting getting a first roll.

Mike Krass 6:34

Okay,

Speaker 2 6:35

some of them are, I mean, they're studying, you know, they're going the extra mile. And some of them are satisfying, as well, some of them are, are taking in internships, but they're still not necessarily penetrating into the organisation landing those first jobs, it's a struggle for them. And there are many, many of them. I mean, there are many people trying to get those first roles, but especially when, you know, we hear from the media that we have a shortage of skills, you know, we want to get more women into the industry. And then when you perpetually hear from women, entry level women that they are struggling, that they can't get in, there is really hard on them. So companies can do a better job they can, they can make their websites so much easier to navigate. So for example, you know, I was looking at some internship opportunities, or first level, you know, first roles for, for people, human beings, you know, not just women, because they're not advertised as for women. And, and it's difficult, you know, the the information is hard to find, if it exists, if it exists. So that's instantly one of the things they can do. They spend companies spend so much money on recruitments, especially the large companies, you know, they spend so much money on it. So it's just really about going back to basics, looking at what is the issue for the company? Is it that they're not attracting enough women? Or is it that they can't retain them? Or is it both? You know, so they've got to really understand what the problem is, do they have a hiring problem, you know, in a fact and a hiring problem? You know, or is it a retention problem? Or both?

Mike Krass 8:19

Well, those are two very different issues. Combined in an and statement, they make one big issue, but you know, getting getting the the Attract equation, I don't want to say solve, but at least worked on and making progress there. Talk to me about developments. You know, are there ways that you see businesses and different corporate corporate entities could support the development of women in cybersecurity, how do they go from that entry level, that first position to be into that NIC or a manager down the line? Yeah,

Speaker 2 8:51

so So for, for women, it really is about, first of all, getting clear on what they want, you know, and then and then a lot of them don't know, you know, so it's really take that time to get clear. And if you're not clear on it, then just take the first step, because you will figure it out as you go. So don't overcomplicate it, and don't worry too much. I get speak to so many women who are so scared, you know, to make a wrong move, and it's just like, there are no wrong moves, you know, what steps would you take, if you knew that there were no wrong moves that you're gonna get there? You know, so just reframing it in their heads can really help and supporting them. Ideally, they they would they, you know, as an ideal they would want a mentor, or barrister or sponsor. So someone who can actually work with them and advocate for them, you know, help them get into those companies. That's like, that's the ideal. And then of course, when when they're in those companies, you know, having a mentor someone who can help them, you know, that could be someone internally, or it could be someone externally or it could be both, you know, said that's really, really helpful. So getting really clear on what they want. Asking for To help moving forward with things, networking, building relationships, you know, so valuing the people that they're connected to, and really building those relationships, asking for help asking questions, you know, they don't need to be working at twice the speed as men, and often that that's what happens, you know, with women, they, they go out to prove themselves and capable of this job, I'm hungry for it, I want her and they work so frickin hard. They really do. And it's not that guys aren't working hard at all. But women just intrinsically, in order to belong, feel like they belong, do that they feel that they have to, and that was being told a lot of the time by other women that they have to, if you want this, then you're going to have to work damn hard, you know, extra hard to prove yourself. And I think that's really dangerous. Because burnout in cyber is absolutely horrific at the moment for everyone. It's higher than frontline health care workers. It's dangerously high, it's awful. And if women are working at this speed, you know, when they come in, then it's no wonder that they're leaving ahead of time, it's no wonder that they're getting exhausted. It's no wonder that they're getting fed up. Now, is it?

Mike Krass 11:19

Yeah, a couple things you said that I just wanted to repeat for the viewers because we're always trying to make sure they walk with takeaways. So as a, as a corporation, you can focus on sponsorship to get people in, and mentorship while while in the organisation. Right, that could potentially be the same or different people acting as sponsor or, and or mentor. The other thing is that I heard you say at the very beginning, the question was, effectively, if I were to summarise it, it was Don't overthink it. Right? There are no wrong moves. I think it's exact way you said it, like there are no wrong moves, there is only forward progress. And there's only only moves forward.

Speaker 2 12:05

No, well, there isn't a reason, sometimes you got to go back in order to go forward. So because learning learning isn't linear. So it's about progression, even if you go backwards, because that's how a lot of learning happens. And if you do go back, or if you feel like you're going back, then just prepare to, to move forward at a faster pace. And so often what happens is, due to what I mean, I often often what happens is, you go back and you think, Oh, this isn't for me, this is wrong, I'm no good. I'm a failure, I just might as well quit now. Well, but what you don't realise is that, that can be part of the learning process. It's just like, don't give up, you know, be tenacious, if you really want it if it's in your heart. And it will make sense to you, you know, then then accept that as part of the learning curve.

Mike Krass 12:58

Yeah, I'm so glad that you corrected that I now think, re think of that takeaway is more about taking shots on goal, right. So you're going to stand in front of the net, and you're going to ping a few off the posts. Now the crossbar and the posts on each side. But it's more about knowing that you're gonna have to put a few off the posts. Before you really, you're gonna have to take those steps back in and understanding that that's okay, I'm gonna put a few off the crossbar to move forward into put them past the goal and into the net, so to speak.

Speaker 2 13:30

And understanding that that happens at every stage in your career.

Mike Krass 13:36

It doesn't go away we don't.

Speaker 2 13:39

Exactly. Because when you're expanding your comfort zone, when you're stepping outside of it, you're learning learning new things. So it's just gonna repeatedly happen. So often you have to get comfortable with being uncomfortable. You know, so, yeah.

Mike Krass 13:54

You talked about, I think you used a word earlier. I think it was harsh. It was we were talking and it was about you know, cyber leads to a lot of burnout, especially women who are thinking they have to work extra hard so that they run their motor faster than their, their male colleagues potentially. And just leads have to exit the field quicker because they just get exhausted or they get they get burned out. So think about a word like harsh or even a word for cybersecurity to describe the industry as cruel sometimes. The you find that the industry of cybersecurity versus maybe technology in general, is harsher or crueller, or do you think we're all kind of on the same level of of harshness and coolness, which is an odd way to put it, but I think you know what I'm saying? Well, I

Speaker 2 14:43

believe that tech is less harsh or less cruel than than cyber only because of what people in tech have told me women in tech. You know, some of those women have come into cyber and they've just said, my god you know, this is this is this is like another fun It's taking it to another level, you know, this didn't happen in technology. And for me, you know, certainly when we were speaking before, you know, I said to you, I kind of view technology as being very innovative, very creative. And, and security being, you've got these two things that are going on in security, you've got this whole kind of attack and defend. Right, right, times the culture. So they're very, they're very different. They're very, very different. And, and security is absolutely wonderful. The people in it are absolutely great. But equally, it's cruel, and it's harsh, and it's tough. And I don't believe that technology is, is, I don't think those issues are the same in technology. I mean, you're always gonna get people are people, you know, and, and you're gonna get these different cultures that go on in any organisation, but I just believe in security, it's really quite unique. It's very different to technology, even though it's a subset of technology.

Mike Krass 16:09

You've been in cybersecurity for a while, right, as an author as an influencer, as a speaker, you mentioned owning penetration testing business. So you've been for a while? How, how have you been able to push past some of that cruelty in the harshness of that attack, protect mindset, like, what's worked for you that you think might work for others? Well,

Speaker 2 16:30

my kind of Route insecurity is very different, you know, so I came in straight as a business owner, you know, so I started my business, so I didn't have to get into those entry level positions, I had to start in my own company. And then I've led all the all the way I have, you know, been employed, you know, after selling, selling my security consultancy, I was employed by some companies, and they were large organisations. I mean, I was a managing director at Accenture for a while. Now, it's a huge organisation. And, but for me, you know, what I found that has helped Sonny in those, those leadership roles and other organisations is, again, to build their relationships to network to know, who are your supporters? You know, who aren't your supporters? What are you going to do about that? To have a really good pitch, you know, when you're introducing yourself, and, you know, to make it about, you know, not just you, you know, what you believe in, you know, you're gonna go through, you know, some of the things that you've, you've done, you know, what makes you tick, you know, your values, your beliefs and things like that. Obviously, it needs to be really short. Right, right. Yeah. You know, I mean, it really is just like your elevator pitch. But you can pack all those things in. So having a really good introductory pitch is really, really useful. And then yeah, networking, making sure that you're getting onside, you know, with people and building those relationships, and always coming to it, I was come come to things from a servant position. So certainly leadership, how can I help you is my job to help you, it's my job to help you do a better job. And so how can I be of service to you? And that's always how I would approach it, not how can you help me. And that's, that's often what I see people do. And so it's really refreshing. You know, when when you get, you get an energised pitch, and you're interested, it's just like, oh, this person sounds interesting, I want to know more about them, they, they've got great energy, you know, so, you know, how you sit your body language, your tone of voice, your eye contact, and, and then your interest in them, you know, so be interested in them find out, you know, what their problems are, what their challenges are, what their blocks are, and how you can help them to get rid of those and make their, their, their work so much better to make them successful. So that's, that's how I've, that's how I've always done it.

Mike Krass 19:10

Did you ever have any issues, finding networking opportunities are events? You know, is that was that difficult for you? Or did they? Do they seem to be a lot to choose from? And they were fairly accessible? And you could you could get in there and participate in those types of events?

Speaker 2 19:25

Yeah, I mean, when I when I went to, to when I went to some companies, because most of the time, I've had had my own company. You know, I was introduced to people, which was great. And that's what I do with with people. You know, I was talking to someone today, she's a refugee in Switzerland. And she's new to the country. She's entry level. So it's just like, Okay, right, fine. You need to meet these people. That's, that's going to help you. So, you know, for me, you know, I've got LinkedIn. So a lot of people approached me on LinkedIn. That's in the majority of the time it's people Well approaching me, rather than me going out and approaching others to network with, it's actually quite rare I do that I really should do more of that. And I will do. But most of the time, it's like people introducing me to other people, Hey, Danny, you know, let me introduce you to blah, blah, you know, that'd be a really good contact or, you know, you hold the same values or whatever, and I have conversation. And so, so I've never been sure of that. And, you know, when it comes to kind of getting out, outside, you know, so the in person events and things like that, I actually don't do a lot of that. But that's really because I speak, I speak a lot. Milissa speak a lot. But you know, since COVID, there haven't been that many speaking engagements, you know, in person, my work has kind of changed, but a lot of the time, I'd be at events. And so that's where I would know, as a speaker, that's where I would be meeting people. So I didn't really have to, I've never really had to go out and find events for for myself.

Mike Krass 21:05

Well, Jane, thank you so much. It's been a fantastic episode. You know, for our listeners and our viewers. That's a wrap on this episode of What's the problem, we hope that you found our conversation with Jane Franklin, just to be insightful to be informative. Jane, for the viewers and the listeners who might want to talk to you after they viewed this show? What are the types of things you'd like to talk about? And what's the best way for people to be in contact with how do you prefer to be contact.

Speaker 2 21:35

So best way to contact me is on LinkedIn, or they can get me on email. And then I'd say link, LinkedIn number number one. And so the types of things that I like to talk about, I like to talk about leadership. I like to talk about security, I talk a lot about security, cybersecurity, working as an influencer all different areas. And then then we're in you know, getting getting women into into the industry at all levels, you know, and particularly the retention side of things, because a lot of good work is being done, you know, to attract more to the to the industry. So I would say those, those three, those three things.

Mike Krass 22:18

I can't end the episode, after hearing what you just said. He said, there's a lot of good work being done to attract anybody or any organisation you'd like to highlight in particular that you think the viewers should know about. This is, this is a great example of somebody's doing a great job.

Speaker 2 22:33

Yes, it's, we're sure they're doing a great job, really good job, that particularly with neuro diversity, so they're doing a really good job Avanade, they're doing a really, really good job. So those are two that instantly spring spring to mind. Other companies will be doing a good job, but I might not necessarily know them so well. But those two companies I know really, really well and I can definitely vouch for them.

Mike Krass 23:01

Well, to our viewers and listeners, we're definitely going to put the links to those companies. In the show notes. We'll also put a link to Jane's LinkedIn account. That's the word linked a lot of times in a row. As we wrap up the show, I just wanted to give a quick shout out to our host MPG marketing. So mkg is focused on helping cybersecurity businesses get found drive leads and close deals. So if your cybersecurity business is struggling with any of those things, let us help you. You can learn more on our website at mkg marketing i nc.com. Thanks for listening. And don't forget to subscribe. Leave a rating for this show. Jane prefers seven ratings seven stars on a scale of five so don't let Jane down anything less than a seven. Really just letting Jane down. appreciate the support until next time, our friends Jane, wave goodbye to our viewers. Bye