In Their Own Words — The 2016 Women in Cyber Security Conference

Dave Bittner: [00:00:03] In this Special Edition of the CyberWire, in their own words, the Women in Cybersecurity conference - challenges, mentors, inspiration and advice.

Dave Bittner: [00:00:15] This CyberWire podcast is made possible by the Johns Hopkins University Information Security Institute, providing the technical foundation and knowledge needed to meet our nation's growing demand for highly skilled professionals in the field of information security, assurance and privacy. Learn more online at isi.jhu.edu.

Dave Bittner: [00:00:42] The people we spoke to at the 2016 Women in Cybersecurity conference had a remarkable diversity of career and academic backgrounds, as well as life experiences. Many themes emerged from our conversations, including the importance of mentorship, willingness to try new things and take risks and the importance of flexibility and communication skills. They also dispelled some myths, including the notion that you need to have a technical background for a career in cybersecurity. We sat down with a range of women, from students to industry leaders, for candid conversations about their personal journeys, their experiences as women in a male-dominated field and their advice to women considering a career in cybersecurity.

Dave Bittner: [00:01:25] We begin with introductions, giving our participants the opportunity to share a bit about themselves in their own words. Shelley Westman is vice president of operations and strategic initiatives in cybersecurity at IBM.

Shelley Westman: [00:01:37] I have a very unique pathway into security. I call myself a recovering lawyer. I practiced law for five years before I came to IBM. And just this April, I'll be 17 years at IBM. And I came in in the contracts group and really loved that but decided I didn't want to be on the legal side of things anymore. So I moved around a lot into different parts of the business. I didn't know anything about security. I didn't know what a DDoS attack was. I didn't know what a phishing scheme was - nothing. I had to self-teach myself all of that and really, really fell in love with the space.

Dave Bittner: [00:02:13] Kathy Jordan is vice president of enterprise cybersecurity at Fidelity Investments.

Kathy Jordan: [00:02:18] I took what is called the lattice career path, and so I took a lot of career-lateral moves throughout my career to get where I am. So what I looked for was - my next opportunity had to have growth potential. So I would look for an opportunity that had capabilities and skills required that I didn't necessarily have so that I would see those as development opportunities. I would take advantage of those development opportunities to broaden and deepen my skill set.

Dave Bittner: [00:02:47] Tina Hampton is assistant vice president of the cybersecurity group at AT&T, where she focuses on strategy and innovation.

Tina Hampton: [00:02:54] I came to AT&T by way of Silicon Valley. I spent 13 years in Silicon Valley, actually. I have an engineering background, both electrical science and engineering, mathematical and computational mathematical and engineering.

Dave Bittner: [00:03:11] Alicia Clock (ph) is a security engineer in privacy at Google.

Alicia Clock: [00:03:15] I started out when I was in high school. I was going to be a screenwriter. I was - that was the thing; I was going to write for movies. And actually, I have a screenwriting degree, which is not what you'd expect to hear from a security engineer at Google. But when I graduated with the screenwriting degree, that was around the time that Hollywood decided that it was only going to do remakes and adaptations, and they didn't really have much use for a whole bunch of new screenwriters.

Dave Bittner: [00:03:40] Alicia went on to get a degree in computer forensics, and after impressing some Boeing executives at the Collegiate Cyber Defense Competition, was offered a job there in their cybersecurity division.

Alicia Clock: [00:03:51] From there, I end up applying to Google. Honestly, it was mostly on a whim. I saw the job posting, and I was like, you know what? I'm curious. I sent it out and didn't hear anything for a while. And then kind out of the blue, I got a call, and they were like, hey, we want you to work at Google.

Dave Bittner: [00:04:05] Alka Gupta is a program manager at Cisco Systems.

Alka Gupta: [00:04:09] When I got into the job arena, there was a lot of automation going on, programming, database around it. So I got into scripting - was scripting Unix, Linux. And I started to code, even though in my engineering, I did not do much on the programming side of things, so I learned pretty much on the job. Somebody said, oh, you're good at management of things so you can do program management, and that's when I took my PMP certification - got into the program management side of things. And once I was a program manager, my mentor hired me to - for this role of security engagement manager, and I have been pursuing that for the last three years.

Dave Bittner: [00:04:54] Dr. Ann Cox is a mathematician program manager for the Department of Homeland Security, in the Science and Technology Directorate Cyber Security Division.

Ann Cox: [00:05:03] I'm from the backwoods of California, up in the far northern part of the state.

Dave Bittner: [00:05:08] Dr. Cox went from learning grade-school math in a two-room schoolhouse to earning her Ph.D. and becoming a college instructor, but that wasn't her original plan.

Ann Cox: [00:05:17] Well, I have six children. And it was very difficult for me to leave my children and to go to school or to go to work. My plan had been to be a stay-at-home mom. You know, that just didn't work. My husband got sick. We had to have money to live on, and so I looked at the government. And while I was an instructor, I'd had somebody from the National Security Agency come in to my classroom and talk about career possibilities. So I applied to NSA and went back and interviewed and was hired. So I was there for, like, 16 years.

Dave Bittner: [00:05:56] Yael Kalai is a senior researcher at Microsoft.

Yael Kalai: [00:05:59] I went to terrible schools. I grew up in Israel. I got no education. I didn't know anything about math until I went to college, like, zero. But so I never went to, like, math camps or, you know - and now my students, they all did Math Olympiad; my daughter, my son - they do Math Olympiads. You know, I never did anything like that. But personally, deep down, I knew I loved math, and I knew I wanted to do math.

Dave Bittner: [00:06:26] Jessica Vallejo is a master's degree student at the Johns Hopkins University Information Security Institute.

Jessica Vallejo: [00:06:33] I've always liked computer science and learning the mathematics and the programming. And I took a network security course up at Mendoza College of Business within Notre Dame, which is where I did my undergraduate degree, and I really liked it. I saw that - a different side of technology. I really like it because it's a little bit of everything. It's really broad, so you're not going to be just in one thing; you can easily jump to another area, or if you really fall in love with one aspect, go through it.

Dave Bittner: [00:07:03] Michele Myauo is director of cybersecurity at Microsoft.

Michele Myauo: [00:07:07] I was a psychology major. My parents - I was the first in my family to go to college. And they said, you know, we don't care what you go for, just go. You have to go. We're paying. So I went for psychology because I was really passionate about that. I thought I wanted to be a clinical psychologist. And then I went and decided that maybe clinical psychology wasn't my path, but I wanted to be a business psychologist, you know, do management consulting, things like that - work for McKinsey's or Boston Consulting Group. So I got my master's in IO psychology.

Dave Bittner: [00:07:36] That led her to the D.C. area and eventually to Booz Allen and government contracting.

Michele Myauo: [00:07:41] And then when I moved over to IBM, I started doing a lot of systems engineering work. So that really brought me to systems engineering. And now I have my Ph.D. in systems engineering, as well as teach at GW.

Dave Bittner: [00:07:53] Andrea Little Limbago is principal social scientist at Endgame.

Andrea Little: [00:07:57] I was into math. So math is sort of my foothold into this area. I have a quantitative background - quantitative social science. So I do a range of things; I actually started off in academia, teaching about international relations and conflict and so forth at the international level and foreign policy and those kind of things, and then I went into government and started working a lot with engineers and helping build some of the applications that the analysts used in that domain. And then from there I branched out, and I do a lot with engineers who ensure that what they do actually sort of has - addresses the human dimension as well, as far as user experience, user interfacing and so forth.

Andrea Little: [00:08:33] But I also have a quantitative background, and so some of the data visualization and quantitative analytics - making sure that some of things that they do more on the back end and - both in the back end and front end are actually applicable for what the analyst community needs and operators need in that area.

Dave Bittner: [00:08:48] Ambareen Siraj is director of the Cybersecurity Education and Outreach Center at Tennessee Tech University and also a professor in their computer science department.

Ambareen Siraj: [00:08:58] I am originally from Bangladesh. I came to United States because at that time we didn't have Ph.D. in computer science there. So for me to do advanced study in computer science, I had to come here to do that. So that's what I did. And you know, it was a coincidence that, you know, I took a course with this wonderful professor, Dr. Rayford Vaughn, and I really, really liked that course and the security concepts, and then it just - then I never looked back, you know. That was it for me. So here I am.

Dave Bittner: [00:09:37] Kathleen Smith is the chief marketing officer at ClearedJobs.net.

Kathleen Smith: [00:09:42] I've joked with several of my colleagues that, you know, I wish there was a club for us old-timers, people who have been in their careers for 30 years or more. I have a degree in biochemistry, a law and society degree, a master's degree in marketing, postgraduate degree in nonprofit, development and executive director. And I get bored, so I move around very quickly.

Dave Bittner: [00:10:11] This CyberWire podcast is made possible by the generous support of Cylance, offering revolutionary cybersecurity products and services that proactively prevent, rather than reactively detect, the execution of advanced persistent threats and malware. Learn more at cylance.com.

Dave Bittner: [00:10:33] So we've got a broad spectrum of backgrounds, education and experience. In our conversations, some common themes emerged. Some felt they had faced specific challenges along the way because they were women. Here's Alicia Clock from Google.

Alicia Clock: [00:10:47] You do it long enough and you stop noticing, but there's a sort of sense that nobody in the room looks like me. I didn't really think about it all that much, but it's always there. It's always - there's that sense that I am the woman, and there's - sometimes that carries, like, a certain expectation. Like, you know, it's not as, like, "Mad Men" as, hey, Alicia, go make the coffee or that kind of thing.

Alicia Clock: [00:11:10] But sometimes, you know - it's hard to say sometimes whether I was projecting that because I was aware that I was the only girl in the room, and that if I didn't do it, it wasn't going to get done, whether or not they were actively expecting me to. That was always the biggest thing, was that awareness that I was the only girl in the room.

Dave Bittner: [00:11:27] Alka Gupta.

Alka Gupta: [00:11:29] I mean, when I was a kid, I was very shy, and I had the challenge of talking to guys. And I grew up - I went to a girls school only, so it was a challenge for me. But then once I was in this role, it really kind of opened me up and helped me, you know, to grow.

Dave Bittner: [00:11:48] Andrea Little Limbago.

Andrea Little: [00:11:50] It's really refreshing being at something like this, but - and then go to RSA and Black Hat and all the cons and so forth, and you're treated very differently at those. And so you kind of have to deal with the putting aside some of the comments of what people assume as far as what your position is or comments like, why are you even there?

Andrea Little: [00:12:06] So you kind of just have to push aside the haters, focus on the people who are there supporting you and who are mentoring you or - and support your position in a variety of different ways and focusing on that. Yeah, generally, when you go to some of these industry conferences, there's usually one experience during it that, you know, you wish you didn't have.

Dave Bittner: [00:12:22] Dr. Ann Cox.

Ann Cox: [00:12:23] I did my master's degree, and then I taught full time three years before I went to do the Ph.D. During that time that I was teaching, I was also a student. I was assigned an advisor who actually told me to go home and raise my children, that I didn't belong there. At the time I did not understand that that was sexual harassment and that I needed to report it. And by the time I understood that, it was the period - the time period had passed.

Ann Cox: [00:12:52] At the same time, when that happened, there was another faculty member at that school who stepped forward, who would work with me and encourage me, teach me how to do a little research and so on. And so although part of that was a bad experience, part of it was actually a very good experience. I'm still friends with that faculty member. He's a wonderful man, has done some great things research-wise, has mentored a lot of students.

Dave Bittner: [00:13:20] Kathleen Smith.

Kathleen Smith: [00:13:22] I have been challenged at many different times as to, why aren't you being more feminine, why are you being so forceful with your ideas? You - you know, you are being, you know, very difficult. And I think that that has excluded me from several roles over my life.

Kathleen Smith: [00:13:42] I remember very clearly, one time I was working for one of the large insurance companies, and there were four men on the team and three women. And we were all given different contracts and accounts to follow up with, even though I had just brought in one of the largest contracts that the company had sold. And I said, you know, wait a minute; why are all the men being given these large contracts, and the women are being given these smaller ones? And you know, the response was, well, of course, you're going to get married and have kids soon.

Dave Bittner: [00:14:15] Kathy Jordan.

Kathy Jordan: [00:14:17] The reason I started working at Fidelity was - a manager that I had had at my prior company - it was a gentleman that I worked for - was very discounting to me, and I felt very much so that it was because I was a woman, and the way he treated me was not the same way he treated the men on the team. And at first you just kind of accept it, and you don't realize what's happening, and then the offenses build in, and all of a sudden you realize, wait a minute - I'm not comfortable. I don't like what's happening here.

Kathy Jordan: [00:14:49] And kind of what pushed me over the edge was - I had done an extensive amount of work to do research. And after I did all that work and I had sent it to him for final review before I mailed it out to the executives, he says, oh, this is excellent, fabulous work; I just want you to change one thing - put my name on it. Two weeks later, I gave my notice. Two weeks later, I was working at Fidelity Investments, and I've been there ever since.

Dave Bittner: [00:15:17] Jessica Vallejo.

Jessica Vallejo: [00:15:19] It definitely is a struggle, but one has to have that strong core. It's that - yes, I am a woman; that's just one aspect of what I am. And it's an aspect that I can leverage because I can bring a different perspective to the table. If somebody brings that up, it's like, that has nothing to do with that series; you're derailing the conversation. Let's bring it back to where we are, to not get into something that's outside of the scope that we were discussing.

Dave Bittner: [00:15:46] Tina Hampton.

Tina Hampton: [00:15:48] There were times I'd be in meetings, and I'm expected to take notes, or I'm expected to get coffee, just because I'm a woman in the room. And I think that has been - early on, that was a struggle to kind of overcome. I am an equal. I am a peer. I'm here to contribute as you are. I am happy to get coffee if I'm getting it, you know, for myself every now and then, but I didn't want it to become something that was expected.

Dave Bittner: [00:16:21] Ambareen Siraj.

Ambareen Siraj: [00:16:23] You know, when I was a student, I was in a class where there was my male counterpart, who just disliked the fact that I was a female and I did better than him, and he was always there to make things challenging for me, you know. But, you know, that just drove me more. That just - you know, I didn't think of that as an obstacle; I thought of that - that's something I just have to deal with. It's part of life, and I just move on, and I just be aware of existence of such people out there and, you know, just have an experience in tackling them.

Dave Bittner: [00:17:06] Shelley Westman.

Shelley Westman: [00:17:08] I am very aggressive, I would say. And I tend to be very neh (ph), and I think that has a lot to do with my law school training. And I have had people actually tell me, you need to soften your emails a little bit. And one of the things I've also discovered is that, when you've got to take that sort of advice and figure out which advice you're going to listen to and which advice you're not, you can't please everybody all of the time.

Shelley Westman: [00:17:30] There's only so much that you can change about yourself, and I think that's really where a lot of women tend to go wrong, by trying to make everybody happy; you can't do that. So you have to soften your style somewhat. You have to take into account feedback. But you have to stay true to yourself. Only when you're true to yourself and your own capabilities will you succeed.

Dave Bittner: [00:17:55] This CyberWire podcast is made possible by the generous support of ITProTV - the resource to keep your cybersecurity skills up to date, with engaging and informative videos. For a free seven-day trial and to save 30 percent, visit itpro.tv/cyber, and use the code cyber30.

Dave Bittner: [00:18:23] Another recurring theme was the importance of mentorship and providing support for each other. Alicia Clock.

Alicia Clock: [00:18:30] I'd say my biggest inspiration was the - at the time, the head of the computer forensics program at my university. Like, she - when I was in her classes, like, that was the only time that I wasn't the only girl in the room. Having her as a teacher and seeing that, you know, she was respected and, you know, highly sought after in the field, like, that was a - that's somebody that looks like me, and she's doing what I want to do.

Dave Bittner: [00:18:54] Alka Gupta.

Alka Gupta: [00:18:55] In Cisco, I was working for six to seven years. I was really struggling to go up the ladder, you know. I would ask for raises, I would ask for a promotion - didn't get much traction on that. But the moment I started to mentor with two or three folks in my - but this particular mentor who really helped me - so she was kind of guiding me through, and then she herself started the security team and offered - security team needed managers. It was a benefit because I knew her, she knew me because she was - I was mentoring with her for a few years. She knew my plus (ph), and she said, yeah, come join my team.

Dave Bittner: [00:19:38] Dr. Ann Cox.

Ann Cox: [00:19:39] I also, professionally, when I was at National Security Agency, I went into the office of weapons and space. I did not know anything about celestial mechanics. I had the math background, I had the willingness to learn, but I had no skills. However, there was a person on the modeling team there who's - who was my mentor and taught me a lot. And I did a lot of models for them; I think they're still using some of them, 10 years later.

Dave Bittner: [00:20:05] Kathy Jordan.

Kathy Jordan: [00:20:07] What I find is some of the best mentors I've had were when I was in a very difficult situation, when I was having conflict on the job. And I'd go in, and I'd be either angry about how this person bad me - you know, dissed me. And there was - you know, this person did something to me, and I'm the victim. And you know, or I would I would be upset that maybe I did something wrong, and so - but those kinds of conflict situations, it was good to have that objective third party to talk to.

Kathy Jordan: [00:20:41] And often I found that I was making a mountain out of a molehill, and I was really letting my perception of a situation boil over into something that it really wasn't, and I was making a much bigger deal out of the situation. So I found that what I really enjoyed with that was that reality check, you know, and so that, I found, was a really valuable thing that I got out of my mentor.

Dave Bittner: [00:21:10] Tina Hampton.

Tina Hampton: [00:21:11] I've always gone out to seek a mentor. I think it's important that the mentor have certain attributes that you're looking for at the time, whether it's to advance your career, whether it's to learn more about the company - whatever you're trying to learn about the company, that you pick a mentor that has some expertise in that area, is willing to share, and that has always worked for me, having a mentor, at every company I've worked.

Dave Bittner: [00:21:38] Yael Kalai.

Yael Kalai: [00:21:40] I think having mentors is extremely important. I got so much out of my mentors. I - really, I feel so endowed, grateful, to my mentors. And still, it's not just as a Ph.D. student, I had mentors; I still have mentors. And every single point in my career or my personal life by now - any difficult moment, whatever it is, I - you know, I use this resource, so to speak, or this friendship that I have, and it's very useful for me. It's extremely important. I feel it's so beneficial for me.

Alicia Clock: [00:22:20] The fact that I learned to write, and I learned to speak, as part of being a screenwriter, has really helped me in my career because presenting to people, presenting my ideas to people, being able to write down things in a way that other people can understand, is a hugely valuable and dramatically underestimated part of being an engineer. I think women are going to really step up and become a much, much more - a much bigger part of the privacy and security industry. It's there. We're here. There's so many jobs that need filling, and we can do it.

Alka Gupta: [00:22:57] No matter where you are, whether it's cybersecurity or program management or anywhere at all, speaking skills, communication skills is really important. Another tip is to record yourself. Have a speech ready on any topic - maybe two minutes, three minutes. Record yourself and then watch yourself, and see how good you did.

Ambareen Siraj: [00:23:16] One very good thing I learned from my adviser is the power of encouragement; that has been a big part of who I am. You know, that's something I learned from him; that a little pat on the back goes a long way.

Jessica Vallejo: [00:23:31] I feel that if anybody really just wants to be a woman in cyber, they can totally do it because once you get at least a little bit of experience, especially if you're an American citizen and can get the SFS, a scholarship for service. Most of the big universities that have cybersecurity degrees have them.

Andrea Little: [00:23:49] Very highly encourage them to find that balance between the technical and also the communications. And so one of the biggest challenges I've seen, on both sides, is, on the technical side, not necessarily being able to communicate what it is that they're doing, what their research has done or what - the implications of what they've done. On the other side, the people who have more of the business or legal or policy backgrounds don't get the technology at all. Being able to, you know, major in one of those areas - but take a few courses outside of that, so you have either the communication or the writing skills. Those go a very long way in the workplace.

Andrea Little: [00:24:22] And then for people who are doing the other realm, take a computer science class - one or two or three even. Like, that - you're going to need to know how to do that. So if you can, you know, speak across those areas, I think that would make you a very, very strong candidate. And it would help you stay engaged and also probably help you move up the field a bit faster.

Ann Cox: [00:24:40] My personal experience in doing the Ph.D. is that you do have to have some basic ability, but it's just a lot of hard work. Many people, I think, they think that it's something magical; you have to be this genius person that can do anything, instead of just recognizing that you have to have some basic ability, and then it's a lot of hard work. The analogy I would use is it's like playing the piano. You don't sit down at the piano the first time and play the "Moonlight Sonata." You start with - you know, this is ABC. These are scales. This is - you know, and you work your way up to it. Math, computer science - it's the same way.

Ann Cox: [00:25:18] I would love for people to understand that and to know that this is a skill that can be learned. You're not born knowing it; nobody expects you to be. Find something you love. Follow your heart. Build relationships. I have discovered that it's more important for me to - the people that I work with, rather than exactly the technical tasks that I do. Now, it turns out that I have a flair for program management. I love doing it. I'm with a really great group of people right now. And so it's like fun time when I go to work. It's great.

Kathleen Smith: [00:25:55] Finding a job is a constant networking and development process. And a lot of people only think about their career when they're, you know, thinking that they're going to get the pink slip, or that they do get the pink slip, and they go through, you know, serious shock, and then they start up again. And you know, we always say, the best time to find a job is when you have a job.

Kathleen Smith: [00:26:16] One thing that I have noticed is that people earlier in their career tend to look at what is the most exciting career at that time, and then they try to create their studies and their career development based on that. Find out what you really enjoy doing and what you do well and then stick with that because that is the only way that you're truly going to be happy.

Kathy Jordan: [00:26:44] You know, one of the things I tell the people that work for me is, you can drive the train, you can ride the train, or you can get run over by the train. So change is the train, and so you have to look at what's going on around you. And do you want to be in control, or do you want to sit back and let other people determine your destiny for you?

Kathy Jordan: [00:27:03] You know, develop your skills and your knowledge, your organizational awareness, and be flexible; be willing to embrace change, not only for your own career development, but for what's best for the team and for the company because, in the long run, it'll pay off - you'll be seen as a team player, and you'll be seen as flexible and versatile. And people that are flexible and versatile - they keep you around. They need you.

Michele Myauo: [00:27:31] If there's something that you want to go after and you want to do, goal you have, do a little bit of research, practice, prepare, and then just go for it. Take a look at folks who you admire, who are in positions that you aspire to, and then go ahead and plan and prepare for it.

Shelley Westman: [00:27:49] But I think one of the myths that still perpetrates today is that you have to be technical to be in the field of security. My advice is to find something that you love to do. Also, you've got to take risks. Don't sell yourself short. If someone asks you to do something, say, yes; don't say, I'm not sure I can do that. Learn how to do it. Ask people. And my third big tip is ask for what you want. People have to know that you want to be promoted, that you want this next job. Without that, it's not going to happen. So it's OK to tell people what it is that you want to do.

Yael Kalai: [00:28:26] So my advice, my recommend - for young women, if your goal is to just become a great researcher, just focus on it, and don't let small things on the way, small politics - good, bad - just try to be blind to it and just focus on your goal.

Tina Hampton: [00:28:42] Don't sweat all of the small stuff. You know, there are going to be times when you struggle, but you got to, you know, keep through it and ask for help. I tell people, you know, be happy. Take time out - you know, not grinding all the time and studying. Take time out to read or take a walk. Balance your stress. Balance what you have to do as far as your school. And if you're working to your personal life, keep being weird. And it's OK (laughter) if you like video games, and you like being in the lab, it's OK. You know, just be true to who you are.

Dave Bittner: [00:29:25] And that's the CyberWire. Our sincere thanks to everyone who took the time out to talk with us at the Women in Cybersecurity conference. We hope to see you all there next year. Our editor is John Petrik. I'm Dave Bittner. Thanks for listening.