Uniting Women in Cyber Podcast: Breaking Barriers in Cybersecurity with Cybersecurity Girl.

Dave Bittner: I'm Dave Bittner with this Cyberwire "Special Edition." At a time when cybersecurity faces a growing talent gap, conversations about who belongs in the industry and how people find their way into it have never been more important. In this episode, recorded live at the Cyber Guild's Uniting Women in Cyber event, I sit down with Caitlin Sarian, better known to many as "Cybersecurity Girl." Caitlin has built a large following by making cybersecurity more approachable, more relatable, and more human. We talk about her unconventional journey into the field, the power of storytelling, and why authenticity and community matter when it comes to building a stronger cybersecurity workforce. We also explore how breaking down technical barriers can create new opportunities for people from non-traditional backgrounds who may not have seen a place for themselves in cybersecurity before. That's ahead on this Cyberwire "Special Edition." [ Music ] Well, thank you all for having us here today. I am super excited to be here. And most exciting of all is the opportunity to interview Caitlin. So welcome and thank you for taking the time for us today.

Caitlin Sarian: Thanks for having me. I'm so honored to be in a room with all of you guys. I can't even believe I'm here, so thank you for having me.

Dave Bittner: Yes, yes [laughs]. [ Applause ] So let's start out by giving our audience an opportunity to get to know more about you. Can you take us through your professional career? Where did you get your start and what led you to where you are today?

Caitlin Sarian: Yes, so my career has kind of taking crazy turns. And I started as an elementary education major in college 20 something years ago, and I changed to aerospace engineering when I found out how cool it could be. And I got my master's in aerospace engineering. And when I was applying to jobs, I decided I'm going to do tech consulting because I wanted to try different things. And when I was applying to Ernst & Young, they were like, Are you interested in cyber? And in my head, I said, Absolutely not. I do not code, I am not a man, and I'm pretty social so I don't think it's going to work. But -- really, like in my head. But as, you know, during the interview like, Sure, it sounds great. Doing anything to get the job, right? So I said, yes sure. I would be interested. I don't really know that much about it, but I'll learn. I'm a fast learner. And I got different job opportunities at other Big Four, Accenture; and I was really intrigued with cybersecurity, so I decided to go into Ernst & Young or UI and I learned literally everything on the job. So I started in cyber transformation. Worked at large companies after data breaches. I helped companies with, you know, protecting themselves and really assess companies on the 20 kind of key domains in cyber, and that's really what got my foot in the door. And I started realizing oh, I don't have to code. This is great, because I did MATLAB in college, and I don't know if you guys know what MATLAB is. It's pretty useless language, but that was like -- MATLAB and physics were like the two worst classes I had throughout my college career, and I barely scraped by. I think I got C minuses. In everything else I got A's, but terrible MATLAB. So I had never thought I'd get into cyber, and I also thought, you know, I'm going to try this cyber. It's probably not going to work out, but at least I get the job and I can transfer into something else. And then I ended up loving it, and I got really excited about data protection and privacy. And then I had the opportunity to actually move to the UK for two years to help EY build out their data protection and privacy arm before GDPR came into play. So I was absolutely loving every second of it, and I moved back just in time for CCPA. Who here is privacy people? Anyone? Okay, a few. So you know it's really fun. Great. CCPA, yes, all of the stuff. But I did privacy, and during Covid I got to slow down a little bit and start re-thinking my life. And I kind of worked so hard. I was grinding, I was climbing that corporate ladder. I got to the top and I'm like okay, why -- what am I doing? Like this is good, but this isn't what I'm supposed to do. And so I really started thinking about how I could give back to the community. Like I said, I started as an elementary education major. I love teaching kids. And I was really, really passionate about how can I get the next generation into cyber? And six years ago was when NIST came out with their kind of -- I think they had an assessment saying, you know, by 2025 we're going to have 500,000 open cyber jobs and no one to fill it. Now we can talk about how that is not true. But so I was like okay, we need to get to the next generation and teach the next generation, like, what a career in cyber looks like. It doesn't technically need to be coding. You can be any type of person and succeed as long as you're excited. So I actually started doing all my stuff on TikTok only, under the alias of Cybersecurity Girl, because I was mortified of what people would think about me. Again, I was a director level at a large global law firm. And I was like if these people find out that I'm on TikTok, like doing little dances trying to try to get people into a career in cyber, like I don't know what's going to happen. Found out I didn't really care because it worked. But yes, so I started like five years ago. And again there was Cybersecurity Girl alias was like so no one would find me. I was again really embarrassed and then it just kind of grew. So started Cybersecurity Girl with three main pillars, and it's still the three main pillars. To get more women into STEM fields as a whole, because I also had the wrong impression of cyber, and the wrong impression of what an engineer looked like. And then to get more people interested in a career in cyber as a whole to kind of fill that that 2025 gap. And then to just educate the public on how to be safe online. And I found out that that piece is like the piece that I'm really passionate about. And I can thank my mom about that, because pretty much all of my inspiration had came from my the questions that my mom asked me. And then I was like I should just make a video about this. So those videos just kind of blew up, and now I'm honored to be able to work with, you know, NATO and NIST and you know, I collaborate with ABC and Good Morning America. And I just want to educate the public, because I truly believe, like, this group is amazing. Like, we are all so passionate about cybersecurity. But at the end of the day, we probably aren't the weakest link, and the people that are in this room are the ones that need to kind of understand how important cybersecurity is. So that's kind of I would say a short version of my journey, but that was pretty long.

Dave Bittner: No, that's good. That's good. What I'm hearing from you, a common thread through your journey, is a type of fearlessness. You weren't afraid to take on the next thing or try the new thing. Is that an appropriate way to label it?

Caitlin Sarian: Yes. I was afraid to an extent, because again I didn't want my co-workers to find out I was on TikTok. So I found a way around the fear and I kind of did it anyways. But you're right, I was told a long time ago that I like to be in uncomfortable situations, and put myself in uncomfortable situations. And to me, that's the only way I learn. So I do have a kind of fearlessness in that sense, I guess.

Dave Bittner: Are there any examples from your career where that did not serve you well, where you found yourself up against a wall or a speed bump?

Caitlin Sarian: So I think one of my superpowers is kind of blocking out any of the negative, especially being on social media. So like honestly, I don't have any specific ones that come to mind, but I guarantee you there's been many times where that was a bad idea. But I think I'm a firm believer in the fact that nothing's wasted in your career. So -- and in your life in general. Like again, now I kind of find it funny that I am teaching the public because I started as an elementary education major, and I absolutely love teaching. But every single thing that you do kind of navigates you the right way in where you're supposed to be. And again, even if there was something really negative, it's gotten me here. And I'm like so grateful to be here and so I'm kind of tunnel visioned, and if something negative happens, like, I mourn it for a day, and then I'm like alright, move on. Because that's not the right thing. But yes, I'll keep it in the back of my head if I remember an example.

Dave Bittner: Just jump in.

Caitlin Sarian: Yes. Yes. One time --

Dave Bittner: Right. Well, you mentioned learning on the job when you first entered the cyber realm of things. You already had your master's degree in another field. What was that on-the-job training like? Did you feel welcomed?

Caitlin Sarian: Yes. Yes. So I feel I felt extremely welcomed I had amazing mentor named Danielle and also Patrick, and they were kind of director level at Ernst & Young, and they kind of took me around to all these conferences and were introducing me to people and were just explaining how cybersecurity really fits into every aspect. Because when you're not in it, you don't realize that it's everywhere. Like and now it's even more prominent, because again we have, you know, smart cell phones. Like, we are constantly in and connected in everyday life, that it is literally in every aspect of our life unless you're living under a rock. And so those mentors really taught me everything. And I'm also like annoying about questions. I constantly like, if I don't understand it, I'm just going to ask you. And so they had to field all of my probably very annoying questions, but I just love being able to kind of just like push myself in and learn and take that time.

Dave Bittner: You spent some time at TikTok is that correct?

Caitlin Sarian: Yes. Yes.

Dave Bittner: Tell us about that experience.

Caitlin Sarian: Yes. So I actually got my job at TikTok from TikTok. A lot of people will get very confused about it. They're like oh, you started to TikTok because you worked at TikTok, and it was actually the opposite way around. So I got a job at the privacy department in TikTok, and then I started speaking to another lady that was there and she wanted me to speak, and she's like oh my gosh, you're trying to find a new job? Like, we want you to lead the training and awareness piece globally at TikTok. And I was like oh, okay. And so I never did training and awareness before, but because my content was basically training and awareness, she was like, you would be perfect for this. So I ended up going into TikTok as a global advocacy for cybersecurity and culture. And so I basically did training awareness at TikTok globally, and I also advocated for TikTok. Now I was there during the time where, you know, our CEO was on the hill. We were lobbying. We were trying to basically answer everyone's questions. So I was kind of working with the engineers, bringing them questions, and then trying to filter out what they were saying to an understandable, digestible kind of summary. Because obviously, we have the technical piece, but if we go to normal people, they're going to just be like what are you talking about? So that honestly ended being the main part of my job was trying to work with PR, work with marketing, work with legal, to try to really communicate what we were doing at TikTok, and how it was secure. And this was -- by the way, I started my TikTok after they had already partnered with Oracle, and when they were moving over. So once that happened, that's when I opened my TikTok. I did not open it when they were still based in China. I just want to preface that. But and then I also, yes, I started working at TikTok back in 2023 or 2024. So TikTok actually has two arms they have a US arm, and then they have the global arm, which is everything outside of the US. So I wasn't in the US arm. I had a lot of incredible friends, ex-FBI, ex-CIA agents that were working the US arm. So knowledgeable. Obviously Oracle was auditing us every day, pretty much on the floor. And only certain people could go into the US arm. Like, I wasn't allowed to even go in. So it was very strict with what was happening, and that's why I also felt very comfortable. Again, I knew a lot of people that were working at the US arm, and then also being able to see global and what was happening globally. So yes, it was incredible.

Dave Bittner: Given your time there, do you have any insights or thoughts on the present situation that TikTok finds itself in?

Caitlin Sarian: So when TikTok was trying to get or was about to be banned, I thought it was putting a Band-Aid on a wound that probably needed 25 stitches or something. Like way larger. I think there's a lot of larger of an issue than just TikTok, like surveillance. I think there were a few main issues, right? One was how do we keep our kids safe? Is TikTok pushing our kids or our children like, you know, really bad content? I firmly believe that is not true. The algorithm gives you what you want to see, and I think there's a parenting kind of role that needs to be played in that as well. Like, if you want technology to parent your children, then you shouldn't be upset with what they're going to get shown. Because you know, they're going to get shown what they want to get shown. Unless you intervene in some way, it's not going to happen. So that was really interesting. I thought there needs to be a mix with technology and parenting. And I still think there should be, of course. By the way, if anyone's looking to you know start their influencer journey or like, just think of new creative ways to help out the public, I think a parenting-technology intersection would be really helpful for people. I always try to help parents with kids and technology. I think the other thing was, you know, the surveillance is trying to have access to it. And again, our team was global, but no one was in China. So it's very interesting. You know, there's also companies around the world that are also in China, too. So everyone has like, you know, Chinese counterparts as well. And then I understand that this is a huge issue in the cybersecurity community. A lot of cyber professionals do not have TikTok. I believe it can be a force for good if you use it correctly. Would I be on TikTok if I wasn't trying to reach the next generation? Probably not, but that is where the next generation is sitting, whether we like it or not. So we can't just continue to avoid it or I mean we know -- obviously there's now a new way that we're kind of having Oracle do its thing with it, and we sold it off. But I think there's a lot of issues with social media as a whole. And I felt like they were pinpointing on TikTok when Instagram, Snapchat, YouTube are all doing a lot of the same things. But because TikTok was, you know, Chinese-based, they were really trying to put the nail in the coffin and try to prove a point when I think that there is a lot larger of an issue. What do you think?

Dave Bittner: I agree. Was being an influencer something that you set out to do?

Caitlin Sarian: No. Never.

Dave Bittner: Was there a moment when you said whoa, wait. People are paying attention to what I'm saying?

Caitlin Sarian: It's still like that every day. Like sometimes -- I like to say I don't have imposter syndrome, but every day I'm like, how did I get here? Like how did I get on the stage in front of you guys that are, you know, in my opinion just incredible humans? I don't know. But I'm honored, and every day I take it day by day. I never thought I'd be an influencer. I mean "influencer" wasn't a thing when I grew up, so.

Dave Bittner: Yes.

Caitlin Sarian: No.

Dave Bittner: Me neither.

Caitlin Sarian: I'm aging myself now, but it is such a cool concept to think that you can change and impact the world by just posting every day. Like, I think we underestimate the value that we bring to the world. And everyone has such a unique perspective. And I actually constantly like, nudge people and say hey, you have a really cool like, perspective life story that other people are going to benefit from hearing about. And I think it's a real -- again, it's very uncomfortable like even to this day, sounds really weird, I film most of my videos in a closet. Because if anyone's in my house, I'm like, I'm not filming in front of you, but I have to post every day. And I'm so uncomfortable. I don't like hearing my voice after it's edited. It's like it's off. And the one thing I say is as long as I help one person, that's all I care about. So I encourage you guys to kind of take that step, and be your biggest advocate. Especially in a crazy, like, job world right now where a lot of jobs are either disappearing for no reason, or no one's hiring. I think a lot of people should be their biggest advocate and start kind of posting and sharing your experience, and I promise you, you're going to help one person, and just keep going. So I never thought I'd be an influencer, though. It's still very weird.

Dave Bittner: You mentioned that you had good mentors along the way. How important is that to you now to be a good mentor? There's this notion of when you've made your way up, to not pull the ladder up behind you?

Caitlin Sarian: Yes. Mentorship in cyber is everything. And I find it very interesting that everyone wants to get certifications, or go to college, and get you know, a cybersecurity degree. If you don't have mentors in this space, I don't think you're going to go. I mean I would say show of hands, but people clap if you agree with that. [ Scattered applause ] I say that because we're on a podcast, so they're not going to see your hands. But I strongly believe that you can't get anywhere in this field without at least one mentor, like, kind of teaching and guiding. And that's why I created Cyber Career Club, which is a community, but it's mentor-based. And it's, you know, I have office hours every week. I bring in guest speakers. Because just no one knows how to navigate. There's so many different areas of cyber, and I think cybersecurity now, you could be a little bit more niche because -- I mean you can do the general stock analyst role, but you know, there's privacy, there's -- I mean there's so many areas of cyber like access management. Now you can specialize in AI kind of cyber. And I think in order to even get to that point, you have to have some type of mentor. Especially entry-level, right? Like, they have no -- they come to me like, I want to get into cyber; what certification do I need? And I'm like well, what do you want to get into? Like, what are you interested in cyber? It's like saying that you want to get into science, and then trying to go be like a chemistry professor. Like, you have to study the certain area that you want. So to me, mentorship is everything. And I never stop having mentors or being a mentee, because you're constantly learning.

Dave Bittner: Yes, you can applaud. Go for it [laughs]. [ Applause ] When you are mentoring folks who are just coming up, as you say on that entry level, what's your advice? In this moment, what do you think is the most applicable way to come at this career path?

Caitlin Sarian: Yes. In my opinion, it's understanding the area that you want to get into, finding people in that area, and connecting with them on LinkedIn, finding a few mentors. Advocating for yourself on what you learn every day on LinkedIn. And then also figuring out the tech stacks behind it. So we're all talking about certifications, but my issue is certifications is like a degree, right? It's kind of like very general, and that's not really applicable when you get into the job role. But if you're understanding the tech stacks that are sitting in every company, and like, you know that when they put you into that job you can automatically start without having, you know, a long processing time or a long training time, I think that's way more beneficial. So for example like, if you're in privacy -- I know this because see, I do privacy stuff -- like OneTrust is a technology stack that sits behind tons and tons of companies. And I'm like, why don't you learn to use OneTrust? Or like, Palo Alto Networks is like, in a lot of different companies. If you know how to work some of the stack behind Palo Alto Networks, you can literally just be plugged in. And I think it's a lot more important than a, you know, general certification. Now there's good certifications that are more specific. But I always say like, get more of an understanding of the tech stack behind the area that you want to work. Network like crazy. Show up to in-person meetings and events like this. Follow up. I remember when I was in college, people thought I was crazy. I'd go to career fairs every semester. I'd collect everyone's cards. I wrote like, specific details about what I talked about. Halfway through the semester, I would email them asking them how they were doing, and then I'd see them at the end of the semester. So I did that for the entire time I was in college. And I pretty much -- I mean, this sounds bad, but -- I pretty much got every job I applied for, because it's about -- like, people want to work with you. Obviously, I did really well in school, but people want to work with you because you can communicate, and you're a good leader, or you're a good person. There's a lot of soft skills that you learn from just starting to network in person. So I really encourage people to do that as well. I think that's the best bet. I always like to know what you think, but -- unless you're going to say you agree, but.

Dave Bittner: Well, I do agree. But -- well, what strikes me about your answer, and in general talking with you, is that you're very humble in the things that you have achieved. You say, and then I was promoted to such-and-such. Eh. But you put in the work.

Caitlin Sarian: Yes.

Dave Bittner: Like going to every career fair, collecting every business card. Engaging with mentors. You put in the work. And in my opinion, never underestimate the value of putting in the work.

Caitlin Sarian: Yes for sure. Exactly right. If you're going to just do a random resume drop on LinkedIn that has no affiliation, or you're not going to cater your resume, or you're not going to cater a cover letter, then there's not really a point of even applying, in my opinion. There's also some fun tricks that you can do to get around the AI bot that is resume scanning.

Dave Bittner: Go on [laughs].

Caitlin Sarian: Well, so what I used to do, like, four years ago is, there's -- obviously a lot of times, there's an AI bot on LinkedIn. Many times. And it scans your resume for keywords that are also in the job description. So what I used to do is copied most of the job description. Not the whole thing, because then it would be weird if it was 100% match. But I'd copy most of the job description, put it in my resume, in white font, very small. You can't see it, even if you printed it out. But when the AI's scanning your resume, it's hitting still all those words, and then it will bring it to a person to actually review. And then you can get --

Dave Bittner: Yes. Yes. Whatever it takes, right? Whatever it takes. Whatever it takes to get in front of a real live human being.

Caitlin Sarian: Yes. I didn't feel bad about it, because it's not like the AI person immediately gives you, you know, the first-round interview. It just pulls your resume to the top of the pile for people to actually review.

Dave Bittner: Yes.

Caitlin Sarian: Yes.

Dave Bittner: You and I were talking, and you mentioned something that's really important to you is for people in cyber to get out of their bubble.

Caitlin Sarian: Yes.

Dave Bittner: Can you describe what you mean by that?

Caitlin Sarian: So who here thinks that cybersecurity operates mostly in a silo, like all cybersecurity teams, not like, each team in cyber, but like, cybersecurity as a whole? Anyone? Yes. Okay. Few people. Obviously, all of us really want everyone to care about cyber. But the fact of the matter is, no one really cares about cyber unless they're in cyber. And I think we're really good at collaborating in cyber teams, and across cyber organizations, or organizations as a whole. But what my concern is, everyday people that are not in cyber, like, that work in critical infrastructure, all they have to do is click on a phishing link, and then it doesn't matter what tech stack you put behind it, they're already in. And so my concern is always, how do we educate the public and get the public excited about kind of learning these basic tips? And I'm like well, we have to teach them how to protect themselves at home. Because in my opinion, cybersecurity starts at home. It does not start in the corporate environment, even though that's how it originally started in the 1980s. But cybersecurity now is, like I said, in everyone's pocket. So yes, we can continue to, like, beef up our training and awareness and our cyber kind of resilience across teams and across companies. But at the end of the day, it's the general public that are also just as weak of a link. And so I always feel like it's my duty to help with that. But I think there's other things to think about outside of, like, just people and cyber.

Dave Bittner: Do you think we all have that responsibility to be kind of shepherds for that information?

Caitlin Sarian: Yes. I mean, I think again, it starts at home. So just teaching your parents, your kids, your loved ones, like, hey this just happened. Did you know that? Maybe we should -- like this is why we should do X, Y, and Z. And I think just having those communications where it's not some scary thing, it's just, like, matter of fact. Here it is. Like, this is how it relates to us, and here's what we need to do about it. It makes it, again, understandable, relatable, and digestible because cybersecurity, if you said "cyber" to anyone, it's like most people that aren't in cyber, they're not even going to think about it. It's just going to go through one ear and out the other. Just like if I don't know, if an astrophysicist comes and talks to me about astrophysics, I'd just be like, "Yeah, cool." I wouldn't know what he's talking about. And it's the same thing. That's what people think about cyber; they think it's like extremely -- and it is very technical. We are all very smart people, but we have to break it down to them in a way that they can understand, and it's not -- that it is not scary, because then, if it's scary to them, they're not going to want to try.

Dave Bittner: Before we run out of time, there is a, what I believe is, a disconnect between the reports that I see coming at a regular interval that say we have this big cybersecurity skills gap on one side. And on the other side I hear all of the young people who are trying to get into the industry saying, "I can't get hired." First of all, do you agree that there's a disconnect there, and what's your insights on that?

Caitlin Sarian: There is, for sure, a disconnect. It makes me sad, because there are so many people that are really trying to get into cyber, and I'm not sure if we just decided that we don't want to mentor people anymore. We decided that they're not going to learn on the job. I think there's a few disconnects. I actually think the main disconnect is we're not teaching soft skills anymore, or they're not getting soft skills in certain areas. And what I've heard from a lot of recruiters that are still like, "Oh, I'm recruiting, and I just don't find anyone." I'm like, "How is that possible?" because I know so many people applying. The recruiters are saying, you know, they don't really have the communication skills they need. They don't really have -- like, it's more of the soft skills that are missing. And they can't communicate what they are able to do. And on the other side, I feel like there might be some issues with, okay, we want these people that are entry-level, but we expect them to have certain experience. And it's like, well, if you're hiring entry-level, their experience is entry, which is nothing. So I think there's this very weird gap where we just need to start hiring people based off of, like, their drive, their skills, all that, like, and teach them on the job, because there are so many eager people right now that are looking to find a job, and it's just very hard. I also think cybersecurity has never really fully been defined correctly. And I think there's a lot of, like, we need to set, like, a standard. I was talking to NIST NICE about this about a year ago. We need to set a standard, like, here are the 10 entry-level roles, what they're going to be called, and the skills that are needed. One, that will help the college board understand how to prepare the kids, because I'm sorry, but every college right now, with the universities, they're all over the place. Like, they have completely different things for what is needed in cyber. And if we're able to say, hey, we need these 10 basic entry-level roles, like a stock analyst or you know, penetration tester or whatever it is, and write those skills down and say here's what we need, colleges can align, certification projects can align. But I think it's so different right now and everyone's like, oh well, our stock analyst does X, Y, and Z, and then you look at it and it's something else, like our stock analyst says X, Y, and Z. So it's very disconnected. And so I think it'd be a lot easier if there was kind of one set way of -- at least for the larger companies. I know it's different for small companies.

Dave Bittner: Yes. Yes. Personally I don't like the term "soft skills." I wish we called them "essential skills."

Caitlin Sarian: That's true.

Dave Bittner: Because I think they're important.

Caitlin Sarian: Yes. [ Applause ] Which skill do you think is, like, which soft skills or essential skills -- which I should admit I'm going to steal that, I'm going to start calling it that -- is, like, the most important to you? If you were to recruit, who would you like, [inaudible 00:29:13].

Dave Bittner: Oh, communications, second to none. Yes. And I'd say, yes, to everyone coming up, take a theater class, take an improvisational comedy class, so that you are comfortable standing up in front of a group of people and presenting your ideas. That is the way you're going to be heard; that's the way you're going to demonstrate your confidence and your abilities and make a difference. So. Alright. Well, we are out of time. How about joining me and thanking Caitlin for being our guest today? [ Applause ] [ Music ] Our thanks to Caitlin Sarian, known to many as Cybersecurity Girl, for speaking with me at the Cyber Guild's Uniting Women in Cyber event. Conversations like this remind us that the future of cybersecurity isn't just about technology; it's also about the people who bring new ideas, experiences, and perspectives into the field. Thanks to you for listening to this Cyberwire "Special Edition." I'm Dave Bittner. We'll see you back here next time. [ Music ]