Breaking Into GRC Engineering: Insights, Automation, and Careers

WEBVTT
00:00.031 --> 00:02.174
[SPEAKER_01]: Because man, I'm studying for security plus, I felt.
00:02.615 --> 00:03.917
[SPEAKER_01]: Don't be afraid to say you fell the cert.
00:04.057 --> 00:04.999
[SPEAKER_01]: I fell the certs.
00:05.019 --> 00:08.144
[SPEAKER_01]: Like I was the AWS security guy at this company.
00:08.364 --> 00:09.807
[SPEAKER_01]: And I felt AWS security specialty.
00:09.827 --> 00:16.237
[SPEAKER_01]: So yeah, that RMS professionals, GRC professionals, we take ourselves too seriously.
00:16.277 --> 00:18.481
[SPEAKER_01]: We think other people actually care about what we do.
00:18.861 --> 00:19.242
[SPEAKER_01]: We care.
00:19.843 --> 00:20.344
[SPEAKER_01]: We like it.
00:20.664 --> 00:21.365
[SPEAKER_01]: I like what I do.
00:21.686 --> 00:22.708
[SPEAKER_01]: The engineer does not.
00:22.908 --> 00:24.891
[SPEAKER_01]: And if you realize that
00:25.377 --> 00:26.479
[SPEAKER_01]: They're being evaluated.
00:26.499 --> 00:27.180
[SPEAKER_01]: They have a job.
00:27.300 --> 00:29.304
[SPEAKER_01]: They probably have a family that they're trying to provide for.
00:29.744 --> 00:32.869
[SPEAKER_01]: On their job description and their performance event, there's nothing about our math.
00:33.310 --> 00:34.793
[SPEAKER_01]: Every resume looks the same.
00:35.213 --> 00:36.696
[SPEAKER_01]: So I don't even, I just look at it.
00:36.916 --> 00:40.662
[SPEAKER_01]: And if I, if I see just something that's a little bit interesting, I go to their LinkedIn.
00:41.143 --> 00:43.147
[SPEAKER_01]: And when I go to their LinkedIn, I'm like, damn, nothing.
00:43.467 --> 00:43.908
[SPEAKER_01]: Nothing.
00:43.948 --> 00:44.869
[SPEAKER_01]: Nothing.
00:45.470 --> 00:46.692
[SPEAKER_01]: I'm trying to find a reason.
00:47.013 --> 00:48.716
[SPEAKER_01]: I'm trying to find a reason to continue going.
00:48.816 --> 00:50.018
[SPEAKER_01]: So learn in public.
00:53.187 --> 01:02.042
[SPEAKER_02]: Look, you probably never have a security plus maybe even a security clearance and nobody taught you how to write poems or how to test a security control or submit an ATO package.
01:02.062 --> 01:09.255
[SPEAKER_02]: I'm Chris Arkpala, I fear years ago, I was in your shoes, all the five on paper, but completely lost when it came to our map.
01:09.235 --> 01:17.263
[SPEAKER_02]: I had a degree, I had to serve, so I had to drive, and what somebody said, how to test the AT2 control, or got a date stick by this.
01:17.323 --> 01:19.225
[SPEAKER_02]: I had no clue what that actually looked like.
01:19.545 --> 01:27.213
[SPEAKER_02]: Fast 4 or 5 years, I worked across DOD and federal agencies, lead control assessments, ring ATO package, and pass orders.
01:27.613 --> 01:31.757
[SPEAKER_02]: That's why I built our North Academy to teach you the real-world execution.
01:32.098 --> 01:34.040
[SPEAKER_02]: They don't cover in certification books.
01:34.720 --> 01:36.722
[SPEAKER_02]: Inside, I'll show you how to write a poem.
01:37.022 --> 01:38.584
[SPEAKER_02]: And don't get fast back.
01:38.564 --> 01:40.307
[SPEAKER_02]: Test and validate security controls.
01:40.788 --> 01:42.050
[SPEAKER_02]: Translate tech jargent.
01:42.551 --> 01:46.878
[SPEAKER_02]: Navigating this 853 and horror map with confidence.
01:46.898 --> 01:51.686
[SPEAKER_02]: If you're in IT support in the government systems or stuck on edge of the security, this is your way.
01:52.126 --> 01:58.717
[SPEAKER_02]: The people who go through my training don't just be hired, they hit the ground running because they practice the work before they win.
01:59.158 --> 02:02.243
[SPEAKER_02]: Go to horroramaphricatomy.io and let's get the work.
02:02.223 --> 02:10.812
[SPEAKER_03]: Welcome everybody to another edition of the Tech World Podcast, I am your host Chris and today's podcast we have a very, very, very great guest.
02:11.393 --> 02:26.188
[SPEAKER_03]: His name is AJ Yon, he was a D1 basketball player, he's a GRC engineer, he's a LinkedIn instructor, sans instructor, he has done everything including writing a book for the GRC engineering for AWS and without further ado, we have AJ Yon, how you doing brother?
02:26.287 --> 02:28.233
[SPEAKER_01]: I'm good man, I'm good, appreciate you having me here.
02:28.293 --> 02:29.817
[SPEAKER_03]: Now I love having you come here today.
02:30.078 --> 02:32.525
[SPEAKER_03]: I was talking to your boy, I'll be here for you.
02:32.666 --> 02:35.012
[SPEAKER_03]: So, you know, I'm glad we came on the podcast.
02:35.033 --> 02:36.076
[SPEAKER_03]: I'm glad we're able to talk.
02:36.096 --> 02:36.938
[SPEAKER_03]: So how's your day going?
02:37.087 --> 02:37.848
[SPEAKER_01]: It's good, man.
02:37.868 --> 02:42.613
[SPEAKER_01]: You know, I was able to ride the train from New York down to DC, which was a cool experience.
02:42.653 --> 02:44.676
[SPEAKER_01]: Everybody told me, you know, the Amtrak is cool.
02:44.756 --> 02:45.717
[SPEAKER_01]: So it was smooth.
02:45.777 --> 02:50.563
[SPEAKER_01]: It was smooth, got some work done, and had a good time in New York this week, and things are well, man.
02:50.583 --> 02:51.284
[SPEAKER_01]: Things are going well.
02:51.304 --> 02:53.226
[SPEAKER_03]: I see, you signed an autograph, signed it.
02:53.246 --> 02:53.887
[SPEAKER_03]: You're the sign of baby.
02:53.907 --> 02:58.572
[SPEAKER_03]: No, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no
02:58.552 --> 03:01.495
[SPEAKER_03]: Just to talk, so pit the audience can know a little bit about your background.
03:01.515 --> 03:06.920
[SPEAKER_03]: Can you tell me about who you are, which you've done, yes, you've done the ground.
03:06.940 --> 03:08.622
[SPEAKER_03]: So just tell me a little bit about who you are.
03:09.062 --> 03:11.705
[SPEAKER_01]: Yeah, my career really started in the Army.
03:12.205 --> 03:24.137
[SPEAKER_01]: I was a signal officer, which is morally like on the communication side, cybersecurity side did that for six years on the active duty ended up earning the record captain, and learned a lot, got a lot of the military.
03:24.117 --> 03:27.964
[SPEAKER_01]: And then I got out, I was like, I want to deploy them more, you know, it's cool.
03:28.445 --> 03:33.734
[SPEAKER_01]: And I landed at a great company co-fire when I joined, there's only about nine of us doing SOC 2.
03:34.696 --> 03:39.745
[SPEAKER_01]: Fast forward three years later, we were 130, 40 of us doing SOC 2, I so hit the health care.
03:39.765 --> 03:48.100
[SPEAKER_01]: So I was able to get exposed and grow a lot, and do a lot there, which gave me the confidence to go start a company.
03:48.080 --> 04:10.527
[SPEAKER_01]: When I started the when I quit my job to go start the company three days later the pandemic started, and I was I think I'm on a made a mistake I don't know if I was a good idea But I kept going you know is able to grow that Race and venture capital scale that up Do do some really good things and continue to build man and went and just did some stuff at a top 20 CPA firm now I'm a director GRC engineering
04:10.507 --> 04:33.595
[SPEAKER_01]: at a company with my buddy and yeah man I think for me GRC getting out of military became a passion among it was something that I was like come on military I had a sense of purpose right I was serving doing something bigger than myself but once I'd learned about GRC learn the business behind it and learn the impact that it has on the company I was like okay this is something I can get behind this is something that I can really learn and enjoy
04:33.575 --> 04:39.506
[SPEAKER_03]: No, so can you break down to the audience and the people that are watching, can you break down like what is DRC?
04:39.706 --> 04:41.970
[SPEAKER_03]: Can you break it down like, absolutely, maybe steps?
04:42.150 --> 04:44.595
[SPEAKER_01]: Yeah, it's one is a three-letter acronym.
04:44.615 --> 04:53.170
[SPEAKER_01]: So I want people to know that the C gets a lot of attention to compliance, but governance and risk in the front are also very important.
04:53.150 --> 04:56.095
[SPEAKER_01]: I'll go back to what I was just saying around purpose.
04:56.215 --> 04:59.841
[SPEAKER_01]: I think the reason why I really enjoy GRC is because it matters.
05:00.542 --> 05:06.211
[SPEAKER_01]: Matters from a security perspective, the G helps us say, what do we need to do to ensure that we do the right things?
05:06.231 --> 05:11.520
[SPEAKER_01]: The R is about risk, what risk does the company face, what risk does an agency face, whatever it may be that you're working at.
05:11.780 --> 05:13.123
[SPEAKER_01]: And then the C is the compliance, right?
05:13.143 --> 05:18.972
[SPEAKER_01]: It's going to help us figure out how to go grow our business, that the thing about compliance that's really interesting, there's dollars behind it.
05:18.952 --> 05:24.464
[SPEAKER_01]: There's a lot of big dollars, big dollars, like, you know, you think about things like FedRAMP, think about things like ISO.
05:24.704 --> 05:31.479
[SPEAKER_01]: There's a million dollar contracts that are prevented from you being able to touch if you don't have these things.
05:31.499 --> 05:38.935
[SPEAKER_01]: So it's a really important aspect, but for me, it's an aspect of security that gets overlooked.
05:38.915 --> 05:42.280
[SPEAKER_01]: people I've thought about is kind of like the boring part of security, but to me it's not.
05:42.641 --> 05:48.069
[SPEAKER_01]: If you talk to any CSO, anybody at a higher level leadership position, guess what they're dealing with all the time?
05:48.149 --> 05:48.469
[SPEAKER_01]: GRC.
05:48.810 --> 05:50.412
[SPEAKER_01]: That's how you communicate to the board.
05:50.893 --> 05:53.817
[SPEAKER_01]: That's how you communicate to leadership to get budget.
05:53.837 --> 05:55.600
[SPEAKER_01]: You have to talk in terms of GRC.
05:55.620 --> 05:59.145
[SPEAKER_01]: You're not talking in terms of what the socks are or it ones in zeros.
05:59.165 --> 06:00.006
[SPEAKER_01]: You're talking GRC.
06:00.026 --> 06:01.108
[SPEAKER_01]: That's the way to communicate it.
06:01.128 --> 06:05.935
[SPEAKER_01]: So it's all about making sure the governance is, hey, what are we supposed to do?
06:05.915 --> 06:09.143
[SPEAKER_01]: as a company that operates in the financial space or the federal space.
06:09.163 --> 06:09.864
[SPEAKER_01]: What are we supposed to do?
06:10.466 --> 06:15.097
[SPEAKER_01]: Are what are the things that are facing our organization that could cause some problems and see what we got to comply with and how do we prove it?
06:15.718 --> 06:24.278
[SPEAKER_01]: And it's an aspect of cybersecurity that, like I said, has been overlooked but I think it's becoming more and more important and elevated, which is an exciting time.
06:24.376 --> 06:25.037
[SPEAKER_03]: Not loving him.
06:25.057 --> 06:26.220
[SPEAKER_03]: We live in a same time.
06:26.240 --> 06:32.132
[SPEAKER_03]: We know with the GRC trends, you got AI, you know, I know you taught AI so all these compliance.
06:32.874 --> 06:36.462
[SPEAKER_03]: And a lot of things I've noticed, like, working in the field, a lot of people don't want to follow it.
06:36.642 --> 06:38.546
[SPEAKER_03]: Like, I feel like we're a police sometimes.
06:38.666 --> 06:39.448
[SPEAKER_03]: I hear a felt that.
06:39.428 --> 06:55.362
[SPEAKER_01]: Yeah, yeah, and I think that's the bad rap we get and that's not what we are you know If you think about what happened with like dev set-ups and and how dev set-ups was all about having a Allow developers to go faster right and not and not and not
06:55.342 --> 07:03.634
[SPEAKER_01]: If you have not, not let security slow them down, GRC's the same thing, GRC showed a lot people to go faster to do things faster and then allowed them to accelerate and grow the business.
07:03.654 --> 07:06.058
[SPEAKER_01]: So, yeah, we shouldn't be the police.
07:06.078 --> 07:18.717
[SPEAKER_01]: I think we have because we've created this adversarial relationship with either users or auditors or assessors coming in and it's like, I want to make sure I don't say nothing, I got to get coached up before I talk to the assessor, but it doesn't need to be that relationship, and I think
07:19.068 --> 07:29.199
[SPEAKER_01]: the GRC engineering stuff, getting more technical, and then also all the push right now and across the board on the commercial end of the government side for automated compliance stuff is going to allow us.
07:29.360 --> 07:33.264
[SPEAKER_01]: I think the best part about GRC for me, I get to touch every part of your organization.
07:33.825 --> 07:38.130
[SPEAKER_01]: I get to talk to HR, I get to talk to legal, I get to talk to security.
07:38.670 --> 07:42.455
[SPEAKER_01]: But if we get too caught up in the sea, we get to up in the menu efforts, we're not doing that.
07:42.475 --> 07:47.320
[SPEAKER_01]: We're not being an advisor the way we
07:47.300 --> 08:15.906
[SPEAKER_03]: did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this, did you do this,
08:15.886 --> 08:24.338
[SPEAKER_01]: Yeah, I mean, back in like 2017, I think, maybe late 2017, early 2018, I wrote an article about automating compliance.
08:24.658 --> 08:28.464
[SPEAKER_01]: It's my first every time publishing an article, I do not go read that for the audience.
08:28.504 --> 08:34.392
[SPEAKER_01]: Don't go find that article as terrible, but I was like, we got in the house, I mean, there has to be a better way.
08:34.973 --> 08:35.854
[SPEAKER_01]: There has to be a better way.
08:35.874 --> 08:40.240
[SPEAKER_01]: There's no way we're grabbing screenshots of things that have technical, like I can validate technically.
08:40.220 --> 08:42.103
[SPEAKER_01]: So I just came really addicted to that.
08:42.123 --> 08:44.146
[SPEAKER_01]: I was like, I got to, and then I started the company around the idea.
08:44.686 --> 08:49.594
[SPEAKER_01]: And now there's this movement happening where you know I'm in a role of GRC engineer and I lead a bunch of GRC engineers.
08:49.694 --> 09:02.572
[SPEAKER_01]: And all of this is taking that engineering mentality of iteration, slow quick feedback loops, automating things, a lot of the DevSecOps concepts, and applying it to GRC because we need that.
09:02.873 --> 09:05.477
[SPEAKER_01]: And it's rethinking how we're doing things.
09:05.497 --> 09:09.282
[SPEAKER_01]: The first chapter of the book is talk about first principles, thank you for GRC engineer.
09:09.262 --> 09:11.447
[SPEAKER_01]: And instead of asking, like, what do I got to do?
09:11.527 --> 09:12.970
[SPEAKER_01]: What evidence do I need for this control?
09:13.030 --> 09:14.333
[SPEAKER_01]: It's what are we protected?
09:14.773 --> 09:15.214
[SPEAKER_01]: And why?
09:15.615 --> 09:16.938
[SPEAKER_01]: Why is this important to the business?
09:16.978 --> 09:17.800
[SPEAKER_01]: What data is there?
09:17.820 --> 09:19.102
[SPEAKER_01]: And that, to me, is about Jared.
09:19.122 --> 09:20.866
[SPEAKER_01]: Because now I can work backwards from the problem.
09:21.447 --> 09:25.195
[SPEAKER_01]: I built products, either as a founder, and then in my last job before this current job.
09:25.563 --> 09:27.905
[SPEAKER_01]: When you're building a product, you're trying to solve a problem.
09:28.046 --> 09:31.629
[SPEAKER_01]: Every app we use on our phone, it's trying to solve a problem for us.
09:32.110 --> 09:35.954
[SPEAKER_01]: GRC Engineering goes back to the core of what problem are we trying to solve?
09:36.334 --> 09:40.799
[SPEAKER_01]: Okay, we are supposed to comply with this FedRAMP requirement that says you're supposed to do X, Y, and Z.
09:41.180 --> 09:42.261
[SPEAKER_01]: What problem does that solve?
09:42.321 --> 09:43.102
[SPEAKER_01]: How does that help us?
09:43.182 --> 09:47.366
[SPEAKER_01]: And then how can we eliminate the need for grey area?
09:47.386 --> 09:49.208
[SPEAKER_01]: How do we eliminate the need for...
09:49.188 --> 09:59.241
[SPEAKER_01]: 30, 40 minutes, a bunch of people taking a bunch of time during the audit and those folks, you know, engineers are expensive, as expensive resources.
09:59.342 --> 10:02.586
[SPEAKER_01]: A lot of money, so that hour they're spending collecting evidence for you?
10:03.227 --> 10:03.968
[SPEAKER_01]: That's a lot of money.
10:04.028 --> 10:10.697
[SPEAKER_01]: They're taking that taken away from the business, so GRC engineering gives us an opportunity to say, we don't need a screenshot of that.
10:11.218 --> 10:16.765
[SPEAKER_01]: We're going to go and get the evidence directly from the source, which then produces better results and allows us to be better advisors.
10:16.812 --> 10:18.494
[SPEAKER_03]: OK, OK, I hear what you're saying.
10:19.054 --> 10:21.577
[SPEAKER_03]: So how do you implement that in an organization?
10:21.637 --> 10:22.758
[SPEAKER_03]: How would you go about that?
10:22.879 --> 10:30.567
[SPEAKER_01]: Yeah, I think first things first, you, one of the mistakes a lot of folks make in this field, they go, and they try to be very prescriptive.
10:30.587 --> 10:31.588
[SPEAKER_01]: OK, you got to go implement this too.
10:31.608 --> 10:32.709
[SPEAKER_01]: I bought this new GRC tool.
10:32.729 --> 10:33.630
[SPEAKER_01]: You got to go do X1, Z.
10:33.951 --> 10:34.992
[SPEAKER_01]: That's the worst way to go about it.
10:35.452 --> 10:37.254
[SPEAKER_01]: You got to go at the Sands Institute.
10:37.274 --> 10:38.476
[SPEAKER_01]: You mentioned a Sands instructor.
10:38.916 --> 10:40.778
[SPEAKER_01]: We used to teach about living off the land.
10:40.758 --> 10:46.552
[SPEAKER_01]: Go find what tools your people use and help and figure out how to use those tools.
10:46.913 --> 10:56.235
[SPEAKER_01]: I'll give a very simple example and most audits you have to evaluate change management, SDLC processes, how to develop or ship code and get it to production.
10:56.215 --> 10:57.980
[SPEAKER_01]: auditors go about this so wrong.
10:58.721 --> 10:59.945
[SPEAKER_01]: They're asking for list of changes.
10:59.965 --> 11:05.719
[SPEAKER_01]: They're asking for screenshots, but modern software development, we're shipping thousands of times a day.
11:06.301 --> 11:08.266
[SPEAKER_01]: And it's using CICD pipelines.
11:08.286 --> 11:12.216
[SPEAKER_01]: We're doing our SaaS scans, our static scans, our dynamic scans in the pipeline.
11:12.196 --> 11:14.981
[SPEAKER_01]: Why are we not as GRC professionals going and getting that data?
11:15.602 --> 11:24.359
[SPEAKER_01]: In chapter 9 of the book, there's a case study where I talk about, we wrote a script, we grabbed all of this data, we piped it into AWS, and now the engineers don't even have to think about GRC.
11:24.399 --> 11:28.146
[SPEAKER_01]: It's kind of going back to the concept we talked about with DevSecOps allowed us to go faster.
11:28.126 --> 11:33.253
[SPEAKER_01]: Now, the engineers can go, they don't have to worry about FedRAMP, they don't have to worry about SOC2, they're just shipping code, which is what they need to do.
11:33.653 --> 11:40.182
[SPEAKER_01]: If I put my founder had again, I don't want my engineers doing anything about writing code and shipping out new features.
11:40.322 --> 11:42.385
[SPEAKER_01]: If they're doing anything else, it's costing me money.
11:42.806 --> 11:46.130
[SPEAKER_01]: And as a GRC engineer, what you're doing is you're bringing value back to the organization.
11:46.170 --> 11:52.919
[SPEAKER_01]: So I advise in the book and just in general, don't try to implement GRC engineering at the whole organization.
11:53.320 --> 11:54.201
[SPEAKER_01]: Find one control.
11:54.873 --> 11:59.038
[SPEAKER_01]: pick one thing, one process, go learn what tools are used.
11:59.138 --> 12:02.022
[SPEAKER_01]: Before you make any request, hey, what tools you use?
12:02.082 --> 12:05.206
[SPEAKER_01]: Okay, you use GitLab, use this, all right, but I'm gonna go do some research.
12:05.226 --> 12:10.472
[SPEAKER_01]: I'm gonna go talk to chat to PT about this, figure out what these tools are, and then I'm gonna come back with some questions for you.
12:10.492 --> 12:13.816
[SPEAKER_01]: Before, because a lot of times what we do is we say, oh, you use GitLab, give me this, this and that.
12:14.157 --> 12:16.840
[SPEAKER_01]: And they look and she like, that doesn't even make sense with your asking.
12:16.980 --> 12:18.702
[SPEAKER_01]: And you've already ruined the relationship.
12:19.023 --> 12:21.606
[SPEAKER_01]: So now, the engineers have to say,
12:21.586 --> 12:26.070
[SPEAKER_01]: Do I waste time educating this dude who knows nothing about what he's talking about?
12:26.230 --> 12:29.133
[SPEAKER_01]: Or do I just make up some evidence, give it to him and let him go on as well?
12:29.533 --> 12:32.356
[SPEAKER_01]: And we're losing the plot there because this is supposed to be about security, right?
12:32.416 --> 12:37.440
[SPEAKER_01]: So I think it's pick one control, find one process, one control, start small.
12:37.460 --> 12:38.682
[SPEAKER_01]: And that's the engineering mentality.
12:39.062 --> 12:44.267
[SPEAKER_01]: If you think about building the product, it's about going small, short sprints, quit feedback looks.
12:44.287 --> 12:47.269
[SPEAKER_01]: It's not about, oh we're going to build the most crazy product every.
12:47.289 --> 12:51.373
[SPEAKER_01]: If you think about every product you've ever used, the new apps, they suck at first.
12:51.353 --> 13:08.535
[SPEAKER_01]: They're really bad and then they get better and better and better and you have to be able to embrace that failure mentality Which engineers do that product mindset that engineering and that's why I like this I love the fact that this term and this movement has grown this GRC engineering stuff because if we really embrace cheat engineering principles
13:08.515 --> 13:11.718
[SPEAKER_01]: the failure aspect goes away, the what about this goes away.
13:11.738 --> 13:12.959
[SPEAKER_01]: It's like, no, I'm just doing one control.
13:13.440 --> 13:14.581
[SPEAKER_01]: And it's not failure.
13:14.601 --> 13:15.322
[SPEAKER_01]: It's information.
13:15.342 --> 13:17.143
[SPEAKER_01]: It's data to help me do better in the future.
13:17.424 --> 13:19.025
[SPEAKER_03]: Now, Lehigh, you said I just picked one control.
13:19.045 --> 13:20.427
[SPEAKER_03]: And I even, like, I'm going to say, open AI.
13:20.567 --> 13:22.248
[SPEAKER_03]: Open AI wasn't what it was today.
13:22.308 --> 13:24.411
[SPEAKER_03]: Open AI, you couldn't even use it.
13:24.511 --> 13:24.751
[SPEAKER_03]: Right.
13:24.891 --> 13:25.552
[SPEAKER_03]: It was garbage.
13:25.592 --> 13:25.832
[SPEAKER_03]: Right.
13:26.092 --> 13:27.934
[SPEAKER_03]: So you just got to pick one control slowly.
13:27.974 --> 13:33.579
[SPEAKER_03]: Because the thing that did you brought up to me, we just try to see, we get a control.
13:33.780 --> 13:34.921
[SPEAKER_03]: We just try to make it compliant.
13:35.161 --> 13:36.642
[SPEAKER_03]: They can just make up some BS.
13:36.703 --> 13:37.223
[SPEAKER_01]: Exactly.
13:37.203 --> 13:38.946
[SPEAKER_03]: And we don't know if it's getting done, and didn't like you said.
13:39.067 --> 13:40.830
[SPEAKER_03]: We're not trying to take them away.
13:40.890 --> 13:41.972
[SPEAKER_03]: We need them to work.
13:41.992 --> 13:44.958
[SPEAKER_03]: I don't want to take them an hour of a time, just to talk about some of our work.
13:44.998 --> 13:45.840
[SPEAKER_03]: Just do your job.
13:45.940 --> 13:47.583
[SPEAKER_03]: If it's not compliant, it's not compliant.
13:47.663 --> 13:48.265
[SPEAKER_03]: Keep your question.
13:48.325 --> 13:48.505
[SPEAKER_01]: Yep.
13:48.806 --> 13:49.868
[SPEAKER_03]: So, yeah, that's the best thing.
13:49.888 --> 13:57.743
[SPEAKER_01]: And I think the thing there too is that people, especially our profession, I think, our MF professionals, GRC professionals, we take ourselves too seriously.
13:58.128 --> 14:00.857
[SPEAKER_01]: We think other people actually care about what we do.
14:01.238 --> 14:01.639
[SPEAKER_01]: We care.
14:02.241 --> 14:02.743
[SPEAKER_01]: We like it.
14:03.044 --> 14:03.746
[SPEAKER_01]: I like what I do.
14:04.087 --> 14:05.090
[SPEAKER_01]: The engineer does not.
14:05.291 --> 14:07.277
[SPEAKER_01]: And if you realize that
14:07.797 --> 14:08.878
[SPEAKER_01]: They're being evaluated.
14:08.898 --> 14:09.559
[SPEAKER_01]: They have a job.
14:09.699 --> 14:11.701
[SPEAKER_01]: They probably have a family that they're trying to provide for.
14:12.161 --> 14:15.264
[SPEAKER_01]: On their job description, on their performance event, there's nothing about our math.
14:15.524 --> 14:16.505
[SPEAKER_01]: There's nothing about GRC.
14:16.545 --> 14:17.727
[SPEAKER_01]: There's nothing about collecting evidence.
14:18.067 --> 14:21.851
[SPEAKER_01]: So if you think about it and tap into their selfish motivations, what do they want to do?
14:22.011 --> 14:22.751
[SPEAKER_01]: They want to work harder.
14:22.771 --> 14:23.472
[SPEAKER_01]: They want to ship features.
14:23.492 --> 14:24.453
[SPEAKER_01]: They're going to evaluate it on that.
14:24.493 --> 14:26.775
[SPEAKER_01]: How do I help them do their job and help me do my job?
14:27.196 --> 14:28.477
[SPEAKER_01]: I think one way to do that.
14:28.497 --> 14:31.320
[SPEAKER_01]: And again, I think I talk a lot about treating GRC like a product.
14:31.340 --> 14:34.783
[SPEAKER_01]: Treating our math like a product, not like a one-time-a-year thing.
14:34.763 --> 14:38.408
[SPEAKER_01]: We call those people that we do with stakeholders and I hate that.
14:38.889 --> 14:39.249
[SPEAKER_01]: I hate it.
14:39.269 --> 14:39.950
[SPEAKER_01]: They're not stakeholders.
14:39.970 --> 14:40.892
[SPEAKER_01]: They're users.
14:41.132 --> 14:42.434
[SPEAKER_01]: They're users with needs.
14:42.934 --> 14:47.301
[SPEAKER_01]: And, you know, when you're building a product, you create these user personas.
14:47.321 --> 14:50.986
[SPEAKER_01]: You'll be like, Sally the scientist, age 35, she does these things.
14:51.286 --> 14:52.788
[SPEAKER_01]: And you really lay out what are her needs.
14:52.888 --> 14:55.572
[SPEAKER_01]: Not what are her needs for the product because you're trying to learn who they are.
14:55.933 --> 14:59.117
[SPEAKER_01]: And then you can build a product around who they are.
14:59.097 --> 15:13.461
[SPEAKER_01]: And I think if we think about the people we interact with like users and not people that have to do something for me, and they're going to care so much about my GRCRRMF requests, you now can tap into again, live enough the land, figuring out what tools are they using, and then you tell them hey man.
15:14.285 --> 15:16.427
[SPEAKER_01]: If you do this with me, it's gonna hurt a little bit at first.
15:16.467 --> 15:18.609
[SPEAKER_01]: These next two week, two, three weeks are gonna be a little bit of work.
15:19.069 --> 15:21.171
[SPEAKER_01]: But after this, you'll never have to deal with me again.
15:21.552 --> 15:22.252
[SPEAKER_01]: We'll never talk again.
15:22.272 --> 15:28.898
[SPEAKER_01]: The only time you talk if you want to take me out for a drink or something, but we're not gonna have to ever talk again because I'm gonna set this automation up that I collect evidence.
15:28.978 --> 15:30.500
[SPEAKER_01]: I'm only gonna highlight you if something goes wrong.
15:30.920 --> 15:36.285
[SPEAKER_01]: But if we understand the process, we're gonna build this to where you get everything that you need to do and I get everything that I need to do.
15:36.305 --> 15:36.945
[SPEAKER_01]: And they're gonna love it.
15:36.965 --> 15:41.029
[SPEAKER_01]: You're gonna have a better relationship because you're not coming at them as you must do this for me.
15:41.169 --> 15:42.030
[SPEAKER_01]: And I know I don't.
15:42.010 --> 15:43.114
[SPEAKER_01]: That's not my job.
15:43.154 --> 15:44.459
[SPEAKER_01]: That's your job, right?
15:44.519 --> 15:50.721
[SPEAKER_01]: And I think the other aspect is because we haven't as a, you know, GRCRMF when I say we I'm talking about our community.
15:51.224 --> 15:53.207
[SPEAKER_01]: We haven't really invested in our technical skills.
15:53.508 --> 15:56.673
[SPEAKER_01]: We've kind of been able to hide and say, oh, I'm not technical.
15:56.834 --> 15:57.875
[SPEAKER_01]: I'm not a technical person.
15:58.236 --> 16:00.500
[SPEAKER_01]: And I think that's hindered us.
16:00.520 --> 16:10.116
[SPEAKER_01]: I think that's hindered us because the relationships that you can have by having a little bit more technical skills to learn what they're doing would be a lot stronger if you had those technical skills.
16:10.457 --> 16:11.679
[SPEAKER_01]: And we can talk about this.
16:11.719 --> 16:12.640
[SPEAKER_01]: I think it's a risk, right?
16:12.660 --> 16:16.607
[SPEAKER_01]: I think it's a risk, especially with that AI and automation and we're CEOs and everybody's hearing.
16:16.587 --> 16:17.791
[SPEAKER_03]: because I'm going to challenge you on that.
16:17.811 --> 16:18.674
[SPEAKER_03]: We get a pushback.
16:18.694 --> 16:20.440
[SPEAKER_03]: Nobody wants to become technical.
16:20.460 --> 16:20.561
[SPEAKER_03]: Yeah.
16:20.581 --> 16:25.537
[SPEAKER_03]: I'd rather just sit here and just read, so what do you say for people that don't want to become technical?
16:25.778 --> 16:27.725
[SPEAKER_01]: Yeah, I'm very glad you asked that.
16:27.865 --> 16:29.230
[SPEAKER_01]: Because...
16:30.138 --> 16:35.851
[SPEAKER_01]: Every CEO, every board member right now, and you think about the headlines, they're all being told the same thing.
16:36.472 --> 16:37.354
[SPEAKER_01]: Do more with less.
16:38.256 --> 16:43.629
[SPEAKER_01]: AI's changing whatever, whatever you believe it or not, that's what the CEOs and the board members are being told.
16:44.030 --> 16:45.112
[SPEAKER_01]: So you know what that means.
16:45.132 --> 16:47.337
[SPEAKER_01]: They're now going down to their number two.
16:47.317 --> 16:49.221
[SPEAKER_01]: And we've seen what happened in HR.
16:49.661 --> 16:51.445
[SPEAKER_01]: We've seen what's going on in marketing departments.
16:51.525 --> 16:53.609
[SPEAKER_01]: We've seen what's going on in sales departments.
16:53.629 --> 16:56.174
[SPEAKER_01]: We're seeing Microsoft laid off 7,000 people.
16:56.194 --> 16:56.574
[SPEAKER_01]: I've seen it.
16:56.895 --> 16:58.638
[SPEAKER_01]: And they see, I don't know, people saw this.
16:58.758 --> 17:00.762
[SPEAKER_01]: Like, I was listening to the earnings.
17:01.564 --> 17:02.365
[SPEAKER_01]: Sat, sat here.
17:02.385 --> 17:05.511
[SPEAKER_01]: The CEO said, the head counts going to stay flat.
17:05.896 --> 17:10.002
[SPEAKER_01]: The cost, we're still hiring at a high-scale AI engineers.
17:11.004 --> 17:13.147
[SPEAKER_01]: So we know we can do more with AI.
17:13.207 --> 17:17.914
[SPEAKER_01]: So my thing that I keep telling people, eventually the spotlight's coming to security.
17:19.216 --> 17:20.158
[SPEAKER_01]: It's coming to security.
17:20.258 --> 17:32.697
[SPEAKER_01]: And if you're in security, and that spotlight comes into security, and you're looking across the landscape, they're going to immediately look at GRC or RMS, because that's an area that is like Hold On.
17:33.301 --> 17:35.643
[SPEAKER_01]: the one thing that AI can do very well is read.
17:36.624 --> 17:37.285
[SPEAKER_00]: You can do very well.
17:37.325 --> 17:38.446
[SPEAKER_00]: And spit information out.
17:38.466 --> 17:40.287
[SPEAKER_01]: We can say all the things that they think it can do.
17:40.728 --> 17:42.750
[SPEAKER_01]: It can read and spit some information out.
17:42.770 --> 17:48.975
[SPEAKER_01]: So if only thing you're doing is reading and spitting information out, selfishly, you should fill a little bit of pressure.
17:49.756 --> 17:55.561
[SPEAKER_01]: You should be like, I might want to know more because what I've told people is, you know, a lot of GRCRMF professionals, right?
17:55.601 --> 17:56.362
[SPEAKER_01]: Now you're middleware.
17:56.942 --> 18:01.606
[SPEAKER_01]: You are just passing information between a technical person and an assessor.
18:01.627 --> 18:03.308
[SPEAKER_01]: That's all you're doing.
18:03.288 --> 18:26.038
[SPEAKER_01]: Hey, I can do that and then I'll talk into somebody earlier just in this room and again I put I have an interesting perspective because of my career right I was fortunate enough to be an auditor I was fortunate enough to be an executive at an audit company I was fortunate enough to run a company and scale that company I was fortunate enough to be a partner at top 20 CPA firm So I've been in a lot of business conversations
18:26.018 --> 18:28.121
[SPEAKER_01]: And if I'm thinking about a team I have, right?
18:28.542 --> 18:41.340
[SPEAKER_01]: And I got these cloud security folks that don't know anything about GRCRRMF, but they know the cloud, they know some Python, they can script, I got the GRCRMF person over here, they know GRCRRMF, but they don't know the cloud, they don't know Python.
18:41.760 --> 18:48.149
[SPEAKER_01]: A lot easier for me to teach the cloud and Python folks, the GRCRRMF stuff, than the non-technical guy, the technical stuff.
18:48.730 --> 18:54.338
[SPEAKER_01]: And if I'm being told, I got to go from 10 people to 5 people, and I still need to get the same outcomes.
18:55.398 --> 19:08.604
[SPEAKER_01]: it's a tough position to be and if you're not having something that's tangibly adding value to the organization and bringing the money back, which GRC engineering to me as we're talking about the time people are spending, you can bring money back to the organization and now you're an asset versus a liability.
19:08.624 --> 19:09.526
[SPEAKER_03]: Well, let me challenge you on now.
19:09.546 --> 19:09.727
[SPEAKER_03]: Yeah.
19:10.067 --> 19:13.474
[SPEAKER_03]: Okay, so somebody just, they don't want to,
19:13.454 --> 19:21.353
[SPEAKER_03]: From what I've experienced from talking to different people, you've got software engineers, you've got technical people, compliance is a whole different beast.
19:21.373 --> 19:23.959
[SPEAKER_03]: You don't, you don't, you think they can understand the compliance that quickly?
19:24.080 --> 19:28.651
[SPEAKER_03]: I would think I would trust the compliance person to try and them up to become a GRC engineer.
19:28.671 --> 19:29.573
[SPEAKER_03]: What'd you think on that?
19:29.620 --> 19:36.678
[SPEAKER_01]: I think, so I was at a conference in Denver a few weeks ago and I give a talk on GRC engineer.
19:37.500 --> 19:44.878
[SPEAKER_01]: After the talk, I had so many security engineers and class security engineers come up to me and say, hey, I think I do that.
19:44.858 --> 19:49.884
[SPEAKER_01]: I think I already do that GRC engine, and they're like, should I be, should I be looking at jobs?
19:50.125 --> 19:53.769
[SPEAKER_01]: And I part of my talk had a bunch of job descriptions up there, and they saw the salaries.
19:54.570 --> 19:55.812
[SPEAKER_01]: They're like, should I be doing that?
19:55.972 --> 19:56.673
[SPEAKER_01]: Should I go over there?
19:56.733 --> 19:58.696
[SPEAKER_01]: And I was like, damn, that's not what I was trying to do.
19:58.976 --> 20:02.220
[SPEAKER_01]: I wasn't trying to encourage y'all to come over here, but it happened.
20:02.580 --> 20:07.727
[SPEAKER_01]: And I think, again, like, if I put whether it's true or not, if I put my founder head on,
20:08.399 --> 20:11.946
[SPEAKER_01]: learning some of the technical stuff is going to take a little bit longer.
20:12.046 --> 20:16.134
[SPEAKER_01]: And then with the AI, I can empower this dude that knows Python with AI.
20:16.194 --> 20:19.461
[SPEAKER_01]: That can tell him what A.C.2 means in this 853.
20:20.142 --> 20:23.448
[SPEAKER_01]: Versus telling this dude, A.D. that never wrote a Python script in your life.
20:23.489 --> 20:25.252
[SPEAKER_01]: I need the automation script real quick.
20:25.512 --> 20:27.336
[SPEAKER_01]: He's going to look at me like I'm crazy.
20:27.316 --> 20:34.264
[SPEAKER_01]: At the same time, though, I think a lot of people when they hear me talk about GRC RMEs that level up technically, they think, oh, I got to become a software engineer.
20:34.545 --> 20:36.187
[SPEAKER_01]: I got to become the best at Python.
20:36.207 --> 20:36.647
[SPEAKER_01]: No, you don't.
20:37.168 --> 20:45.458
[SPEAKER_01]: What I'm asking you to do is be a little bit smarter about the technologies that you're assessing and that you're working with to have better conversations.
20:46.058 --> 20:50.944
[SPEAKER_01]: And I talked about this recently this week, the skill is curiosity.
20:51.346 --> 20:55.633
[SPEAKER_01]: Everything that I've been able to do that I've been able to grow in my career has been about curiosity.
20:56.054 --> 21:00.101
[SPEAKER_01]: It's been about being curious about the technology that I'm working with that I'm evaluating.
21:00.442 --> 21:05.010
[SPEAKER_01]: And if you're curious, you're going to get a little bit deeper than what somebody that's not curious.
21:05.370 --> 21:12.603
[SPEAKER_01]: And I think the technical skills on the flip side is kind of like a little bit of doom and gloom, like you better level up or it's over.
21:13.164 --> 21:14.907
[SPEAKER_01]: On the flip side, there's an opportunity.
21:15.646 --> 21:20.241
[SPEAKER_01]: because there's not a lot of people in this GRCRMF stuff with those skills.
21:20.261 --> 21:21.144
[SPEAKER_01]: Like we were talking about early.
21:21.545 --> 21:28.187
[SPEAKER_01]: So if you're one of the early ones with the skills, you're like back in 0607, the first cloud security engineer.
21:28.454 --> 21:33.544
[SPEAKER_01]: If I was the first class of K&G, imagine, they're living great right now.
21:33.564 --> 21:35.027
[SPEAKER_01]: They're living great right now.
21:35.188 --> 21:36.671
[SPEAKER_01]: They're doing real, and they're leading.
21:36.711 --> 21:37.252
[SPEAKER_01]: They're leaders.
21:37.272 --> 21:38.254
[SPEAKER_01]: They've been doing it for years.
21:38.314 --> 21:41.320
[SPEAKER_01]: So right now we're in that same moment where we got about a two to three year window.
21:41.741 --> 21:43.785
[SPEAKER_01]: If you're early on this GRC engineering thing.
21:43.805 --> 21:47.593
[SPEAKER_01]: If you're an early GRC professional with technical skills.
21:47.573 --> 21:50.437
[SPEAKER_01]: You've now really separated yourself.
21:50.958 --> 21:52.420
[SPEAKER_01]: You've really separated yourself.
21:52.480 --> 21:54.924
[SPEAKER_01]: And now you potentially can carve out your own path.
21:55.325 --> 21:57.829
[SPEAKER_01]: My job title right now is Director of GRC Engineering.
21:58.409 --> 22:00.573
[SPEAKER_01]: That job didn't exist at this company.
22:00.593 --> 22:03.397
[SPEAKER_01]: It didn't exist at this company until they wanted to bring me on.
22:03.738 --> 22:12.331
[SPEAKER_01]: So it was brought up because of just then my skill set, what I knew, and they're like, we got to figure out a way to get you over here.
22:12.751 --> 22:15.235
[SPEAKER_01]: And now I'm leading the team, and we're just
22:15.215 --> 22:16.216
[SPEAKER_01]: We're just doing stuff.
22:17.298 --> 22:19.201
[SPEAKER_01]: A lot of what we're doing is just doing stuff.
22:19.902 --> 22:23.347
[SPEAKER_01]: And it's cool because it's so early, it's innovative.
22:23.387 --> 22:24.649
[SPEAKER_01]: We're innovating all the time.
22:24.669 --> 22:25.871
[SPEAKER_01]: We're just making up things.
22:25.891 --> 22:31.199
[SPEAKER_01]: And when I say that, I work at a company that we do some stuff for a lot of federal agencies.
22:31.219 --> 22:36.487
[SPEAKER_01]: I'm doing a project for the US Patent and Trade Office, the VA, and we're innovating because it's early.
22:36.847 --> 22:39.671
[SPEAKER_01]: So yes, I think there's a window here.
22:40.332 --> 22:42.235
[SPEAKER_01]: And once that window closes,
22:42.755 --> 22:49.124
[SPEAKER_01]: A lot of cloud security engineers, a lot of security engineers going to be looking over here at this GRC engineering thing, and they're going to be like, hey, that looks interesting.
22:49.144 --> 22:49.767
[SPEAKER_01]: I want to piece of that.
22:49.908 --> 22:50.470
[SPEAKER_04]: So, so.
23:08.725 --> 23:11.289
[SPEAKER_03]: So like, it is some risk with GRC engineering.
23:11.309 --> 23:13.652
[SPEAKER_03]: For example, you're trying to create an automation for the cloud.
23:13.732 --> 23:16.256
[SPEAKER_03]: It can send data is not supposed to be sending it.
23:16.276 --> 23:21.864
[SPEAKER_03]: Or you can, when you're doing a GRC engineering code or something, or how are you putting it in a container?
23:21.964 --> 23:23.727
[SPEAKER_03]: Like, how are you making it seemless?
23:23.747 --> 23:24.808
[SPEAKER_01]: How are you making it seemless?
23:25.569 --> 23:26.751
[SPEAKER_01]: Yeah, so I'm, um,
23:26.731 --> 23:29.156
[SPEAKER_01]: I'm happy on serverless architectures.
23:29.176 --> 23:29.277
[SPEAKER_01]: Okay.
23:29.297 --> 23:33.265
[SPEAKER_01]: One because just like if you think about all this time about automation, X, Y, and Z.
23:33.386 --> 23:34.749
[SPEAKER_01]: It's just laziness.
23:34.869 --> 23:36.352
[SPEAKER_01]: It's just disguised as laziness.
23:36.372 --> 23:37.615
[SPEAKER_01]: I just want to automate everything.
23:38.196 --> 23:43.187
[SPEAKER_01]: And when you have servers, you got to manage them, you got to patch them, and you know, container's got like a lot of container security stuff.
23:43.167 --> 23:44.149
[SPEAKER_01]: I'm not doing that in that.
23:44.529 --> 23:50.919
[SPEAKER_01]: So there's a chapter in the book called Event Driven Architecture, where it's a lot of Lambda functions and code just running into Cloud.
23:51.039 --> 23:52.481
[SPEAKER_01]: Azure has on the called Azure Functions.
23:52.501 --> 23:58.270
[SPEAKER_01]: I don't know what they're called on GCP, but it's just code running into the Cloud, which helps you a lot with security.
23:58.591 --> 24:02.036
[SPEAKER_01]: It helps you a lot with security, and it's only running when an Event Trigger.
24:02.056 --> 24:04.500
[SPEAKER_01]: So I'll give an example.
24:04.480 --> 24:11.330
[SPEAKER_01]: We have a set up in one of the agencies we work with, it's like 120 plus AWS accounts.
24:11.951 --> 24:25.091
[SPEAKER_01]: Every week, Friday morning, a Lambda function triggers goes into Audit Manager Security Hub grabs a bunch of data and sends out emails to ISSOs to an ISSOs, and what we did was we wrote this Lambda function.
24:25.632 --> 24:27.054
[SPEAKER_01]: I took all this data, it's a lot of data.
24:27.234 --> 24:29.998
[SPEAKER_01]: A lot of stuff, I Audit Manager, lots of FESC Security Hub config.
24:29.978 --> 24:33.065
[SPEAKER_01]: And I piped it into Amazon Bedrock, which is their managed AI service.
24:33.425 --> 24:37.755
[SPEAKER_01]: It's a, hey, you're a professional 20-year government RMF employee.
24:38.296 --> 24:39.799
[SPEAKER_01]: And you're going to review this.
24:39.859 --> 24:44.950
[SPEAKER_01]: And now you're going to send an email out to this person, this person, this person, and take all the data, sends it out every Friday morning.
24:45.200 --> 24:45.861
[SPEAKER_01]: They're loving it.
24:46.222 --> 24:46.723
[SPEAKER_01]: They love it.
24:46.803 --> 24:47.464
[SPEAKER_03]: They love it.
24:47.784 --> 24:48.125
[SPEAKER_01]: Yeah.
24:48.646 --> 24:49.307
[SPEAKER_01]: And it's simple.
24:49.888 --> 24:50.990
[SPEAKER_01]: And there's a way to do it in the book.
24:51.070 --> 24:55.177
[SPEAKER_03]: Make sure you don't make sure you don't check out that book because that's creating yourself a job right there.
24:55.738 --> 24:58.883
[SPEAKER_03]: If you literally, you saw what a problem right there.
24:58.943 --> 24:59.264
[SPEAKER_03]: Right there.
24:59.744 --> 25:10.262
[SPEAKER_01]: And to me, that's an advantage of using AI and this stuff, too, because one of the challenges in GRC is how do I translate all of this data, all of this security stuff,
25:10.242 --> 25:14.087
[SPEAKER_01]: into words and communication that people are going to care about.
25:14.588 --> 25:16.691
[SPEAKER_01]: And with GRC, it's not just one audience.
25:17.212 --> 25:19.615
[SPEAKER_01]: You're going to talk to the ISSO and they have this perspective.
25:19.635 --> 25:21.618
[SPEAKER_01]: You're going to talk to the CSO, they have this perspective.
25:21.638 --> 25:25.123
[SPEAKER_01]: You're going to talk to the tech lead on the product team who does, you don't care about compliance.
25:25.203 --> 25:26.405
[SPEAKER_01]: He just wants to know, what do I got to fix?
25:26.805 --> 25:27.726
[SPEAKER_01]: What are the things I got to fix?
25:28.227 --> 25:30.510
[SPEAKER_01]: And if you use AI, you now can take all that same data.
25:30.651 --> 25:32.493
[SPEAKER_01]: And in a second, every week, it's automated.
25:32.713 --> 25:33.595
[SPEAKER_01]: I'll give another example.
25:33.635 --> 25:34.736
[SPEAKER_01]: There's a lab I have.
25:34.796 --> 25:35.818
[SPEAKER_01]: It's public out there.
25:35.838 --> 25:36.799
[SPEAKER_01]: Anybody can go grab it.
25:37.280 --> 25:39.523
[SPEAKER_01]: Automated Access Review on AWS.
25:40.010 --> 25:44.015
[SPEAKER_01]: in most compliance frameworks, there's a requirement to review access on a regular basis.
25:44.455 --> 25:46.017
[SPEAKER_01]: Most assessors do this very backward.
25:46.217 --> 25:49.881
[SPEAKER_01]: Let me get a list of users from AWS, and that doesn't tell you anything, because you need to know about the permissions and whatnot.
25:50.362 --> 25:59.632
[SPEAKER_01]: So there's this program I wrote every month, Lambda function, goes out, gets all this data, sends an email, and a spreadsheet that reads out, your access review and lays it out.
25:59.712 --> 26:01.174
[SPEAKER_01]: And again, event driven architecture.
26:01.194 --> 26:05.919
[SPEAKER_01]: It's like, I know that I have to do this quarterly or monthly review, why am I going to wait to do it?
26:05.939 --> 26:07.401
[SPEAKER_01]: And then why am I going to try to do it manually?
26:07.904 --> 26:15.314
[SPEAKER_01]: If you think about the amount of data and modern products and modern cloud systems, I don't know how you can do a good job manually.
26:15.874 --> 26:16.696
[SPEAKER_01]: You're going to miss things.
26:17.056 --> 26:26.989
[SPEAKER_01]: So to me, it's also a risk mitigation to try to automate this stuff, to do a better job, because you're getting better data, because I think if you're doing a lot of this stuff manually right now, you're missing things.
26:27.329 --> 26:32.336
[SPEAKER_01]: It's too much data, too much systems, and a lot of stuff is a firm rule, a lot of stuff is spinning up and spinning down.
26:32.676 --> 26:35.380
[SPEAKER_01]: So you're checking to see if,
26:35.579 --> 26:38.484
[SPEAKER_01]: you patched or you had the right software on this EC2 instance.
26:38.745 --> 26:40.969
[SPEAKER_01]: That EC2 instance didn't exist two days ago.
26:41.450 --> 26:46.879
[SPEAKER_01]: What about the one that existed three days ago that was wide open and has some bad stuff going on and now they're in your system?
26:47.420 --> 26:49.805
[SPEAKER_01]: And that's where we got to get into this more continuous.
26:49.845 --> 26:51.428
[SPEAKER_01]: And you know that you work in this space.
26:51.648 --> 26:53.331
[SPEAKER_01]: Everybody's talking about continuous money.
26:53.351 --> 26:55.655
[SPEAKER_01]: Everybody wants continuous authority to operate.
26:55.695 --> 26:57.739
[SPEAKER_01]: It's just the nature of where the brains are.
26:57.719 --> 27:01.263
[SPEAKER_01]: Again, there's like this market pressure, and then there's a gap.
27:01.523 --> 27:05.367
[SPEAKER_01]: There's not people that don't have these skills, so it's an opportunity.
27:05.767 --> 27:19.502
[SPEAKER_01]: If you do it, and then you create things like like you said, some of these things that I talk about in the book or just just on LinkedIn or whatever, if you just do one of them, you're going to be set up for success because nobody's doing it.
27:19.842 --> 27:24.006
[SPEAKER_01]: Some of my posts recently was like, oh, hey, your book, it's good, but this seems common.
27:24.066 --> 27:24.647
[SPEAKER_01]: That sounds like one.
27:24.907 --> 27:25.548
[SPEAKER_01]: Yeah, that's like a thing.
27:25.788 --> 27:26.629
[SPEAKER_03]: You would think it would think.
27:26.609 --> 27:30.214
[SPEAKER_01]: You know, I said, yeah, man, like you would think, but nobody's doing that.
27:30.314 --> 27:33.439
[SPEAKER_01]: So again, if you do it, you're setting yourself up, you're setting yourself apart.
27:33.860 --> 27:37.044
[SPEAKER_03]: So in a way, you kind of created a 200,000.
27:37.104 --> 27:39.708
[SPEAKER_03]: I saw you reposted on LinkedIn about GNRC role, like, yeah.
27:39.928 --> 27:42.332
[SPEAKER_03]: When you just did, just now, that's a 200,000 dollar job.
27:42.352 --> 27:43.413
[SPEAKER_03]: You just created for yourself.
27:43.634 --> 27:44.936
[SPEAKER_03]: And like you said, you created your own role.
27:44.956 --> 27:46.558
[SPEAKER_01]: Yeah, yeah, I'll say,
27:46.538 --> 28:02.800
[SPEAKER_01]: I mean, personally speaking a little bit more a little bit more and a lot more to it, but they're all rolled out there You know say like I posted one I think it was like Anthropic was higher in Two fifty like three twenty five or something and it was a risk analyst.
28:02.820 --> 28:10.470
[SPEAKER_01]: Yeah, I'm like there that's analyst rolls And if you look at the job description is all GRC engineering because again This is a professional that is a unicorn
28:10.855 --> 28:14.926
[SPEAKER_01]: Is this somebody that you are a rare creature out here?
28:14.987 --> 28:21.766
[SPEAKER_01]: So if you can get in early, you now set yourself up to really carve out a path and some generation of wealth there.
28:22.086 --> 28:25.877
[SPEAKER_03]: Okay, so, so, okay, I'm here in this.
28:25.857 --> 28:27.701
[SPEAKER_03]: So I get what you're saying.
28:27.721 --> 28:29.805
[SPEAKER_03]: There's no risk associated with GRO sensor.
28:29.825 --> 28:31.709
[SPEAKER_03]: You're just automating just making sure it's not so good.
28:31.729 --> 28:32.391
[SPEAKER_01]: You're doing the same.
28:32.511 --> 28:33.974
[SPEAKER_01]: You're doing the same thing you're doing manually.
28:33.994 --> 28:34.094
[SPEAKER_01]: Okay.
28:34.114 --> 28:43.815
[SPEAKER_01]: You're not, you're not, you're, you're, you're not, you're, you're, you're not, you're, you're, you're not, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're
28:43.795 --> 28:47.879
[SPEAKER_01]: When you're in the pipeline, the CICD pipeline, you're not touching it.
28:47.899 --> 28:50.462
[SPEAKER_01]: You're not saying, if this doesn't happen, don't do this.
28:50.502 --> 28:51.963
[SPEAKER_01]: That's the security engineering job.
28:51.983 --> 28:53.084
[SPEAKER_01]: That's DevSecOps job.
28:53.485 --> 28:55.647
[SPEAKER_01]: But you are going to go say, like, hey, did you do it?
28:56.007 --> 28:58.170
[SPEAKER_01]: And get that information and bring it in to send it somewhere else.
28:58.530 --> 28:59.631
[SPEAKER_01]: And make sure people can see it.
28:59.711 --> 29:00.972
[SPEAKER_01]: And then elevate it into it.
29:00.992 --> 29:06.458
[SPEAKER_01]: And one of the things that's happening at some of the agencies we're working at, you have these big, big cloud environments.
29:06.478 --> 29:10.562
[SPEAKER_01]: So they have security teams, central security teams, a lot of cloud security engineers, DevSecOps folks.
29:10.694 --> 29:13.399
[SPEAKER_01]: They're telling us, man, none of the product teams listened to us.
29:13.940 --> 29:15.202
[SPEAKER_01]: We have security hub dashboards.
29:15.222 --> 29:16.284
[SPEAKER_01]: We got quick site dashboards.
29:16.324 --> 29:17.206
[SPEAKER_01]: Nobody cares about it.
29:17.666 --> 29:26.242
[SPEAKER_01]: Now that we started to bring some GRC engineering stuff in, and they can see, oh, if I follow that security stuff, I get this CATL, all right, I'll do it.
29:26.542 --> 29:27.664
[SPEAKER_01]: And the security team's happy.
29:27.905 --> 29:30.289
[SPEAKER_01]: They're like, hell, you finally, they're listening to us.
29:30.269 --> 29:44.165
[SPEAKER_01]: Finally, they're going to actually do the things that we want them to do, and to me, that's again, you're adding significant value, because now you've got friends on the security side, you've got friends on the product side, and everybody's happy because they're getting their outcomes that they need.
29:44.185 --> 29:46.050
[SPEAKER_03]: So, Angel, you've been jobbing these bombs.
29:46.030 --> 29:49.516
[SPEAKER_03]: You talk about GSM engineering, help automate systems.
29:49.536 --> 29:51.500
[SPEAKER_03]: You talk use some use cases for AI.
29:51.900 --> 29:54.264
[SPEAKER_03]: You also talked about some of the money you can make slightly.
29:54.645 --> 29:59.694
[SPEAKER_03]: You know, in this podcast, we're not really about the money, but I'm glad you kind of emphasize you can make some good money in this field.
30:00.175 --> 30:02.439
[SPEAKER_03]: So there's a lot of people that will be listening to this.
30:02.479 --> 30:05.304
[SPEAKER_03]: Can you explain how do you get into this space?
30:05.324 --> 30:06.426
[SPEAKER_03]: How do you start learning coding?
30:06.446 --> 30:09.912
[SPEAKER_03]: And I know you talked about it, but look, but we're kind of touching on it for the audience kind of stuff.
30:09.892 --> 30:14.398
[SPEAKER_01]: Yeah, I mean, I think embrace the curiosity mindset.
30:14.779 --> 30:15.560
[SPEAKER_01]: You got to be curious.
30:15.660 --> 30:24.232
[SPEAKER_01]: You got to try to just be open to being very uncomfortable, being this being, you know, I think, and you're on this journey of trying to learn new skills.
30:24.692 --> 30:27.316
[SPEAKER_01]: This comfort is a feature, it's not a bug.
30:27.376 --> 30:28.297
[SPEAKER_01]: That's intentional.
30:28.478 --> 30:31.802
[SPEAKER_01]: You should be uncomfortable trying to learn new skills.
30:31.822 --> 30:33.505
[SPEAKER_01]: That's, it's going to be guaranteed.
30:33.945 --> 30:36.709
[SPEAKER_01]: And I want to be clear like, and,
30:36.689 --> 30:40.115
[SPEAKER_01]: There is good money to be made in this field, but it's a transaction.
30:40.235 --> 30:41.758
[SPEAKER_01]: This is a capitalist economy.
30:41.798 --> 30:45.825
[SPEAKER_01]: Like the business is expecting value if there's especially if they're paying these salaries, right?
30:46.186 --> 30:47.328
[SPEAKER_01]: So you're gonna have to have some skills.
30:47.788 --> 30:50.373
[SPEAKER_01]: What I would say is we talked a lot about there's an opportunity right now.
30:50.974 --> 31:01.212
[SPEAKER_01]: The opportunity is when I open up a new job, I'm getting within an hour, hundreds of resumes, hundreds of applicants, 99% of them look the same.
31:10.675 --> 31:12.658
[SPEAKER_01]: And I can go look at a project and see how they think.
31:13.199 --> 31:13.880
[SPEAKER_01]: See what they know.
31:14.221 --> 31:16.004
[SPEAKER_01]: I was just talking to a few folks over here about that.
31:16.084 --> 31:23.557
[SPEAKER_01]: That I think that's the best way right now, especially because this is a new field, especially because a lot of employers don't know what they want from this field.
31:24.137 --> 31:26.181
[SPEAKER_01]: That's a great way to stand out.
31:26.602 --> 31:27.864
[SPEAKER_01]: It's to have projects.
31:27.924 --> 31:32.852
[SPEAKER_01]: But I would also encourage folks to use these AI tools to learn.
31:33.541 --> 31:38.248
[SPEAKER_01]: the best part about using these AI tools to learn is you get to ask stupid questions without filling in secure.
31:38.888 --> 31:40.571
[SPEAKER_01]: You can say, I don't know what you're saying.
31:40.611 --> 31:41.973
[SPEAKER_01]: Explain to me like I'm a five-year-old.
31:42.053 --> 31:43.034
[SPEAKER_01]: I know basketball.
31:43.054 --> 31:44.957
[SPEAKER_01]: Explain to me like I'm basketball.
31:44.977 --> 31:45.878
[SPEAKER_01]: Explain to me like this.
31:45.938 --> 31:48.822
[SPEAKER_01]: So use these tools to accelerate your learning.
31:48.943 --> 31:51.086
[SPEAKER_01]: I'm learning so much at a rapid rate right now.
31:51.126 --> 31:55.572
[SPEAKER_01]: I'm having the time of my life doing it because I'm using these AI tools and I'm asking stupid questions all the time.
31:56.012 --> 31:57.655
[SPEAKER_01]: And I'm able to get through all this learning.
31:57.675 --> 31:58.536
[SPEAKER_01]: So,
31:58.516 --> 32:00.101
[SPEAKER_01]: I think like embrace that curiosity.
32:00.121 --> 32:04.697
[SPEAKER_01]: I talked to a lot of people, I said computer science, back in college and I hated it.
32:05.038 --> 32:05.620
[SPEAKER_01]: I hated coding.
32:05.640 --> 32:06.202
[SPEAKER_01]: I couldn't learn it.
32:06.303 --> 32:07.487
[SPEAKER_01]: I was the same way.
32:07.507 --> 32:09.353
[SPEAKER_01]: I didn't like it.
32:09.670 --> 32:13.195
[SPEAKER_01]: As these tools have advanced, it's become a lot easier to learn it.
32:13.775 --> 32:15.498
[SPEAKER_01]: And then you start to feel really powerful.
32:15.918 --> 32:18.381
[SPEAKER_01]: You start to understand the power of having these skills.
32:18.762 --> 32:21.125
[SPEAKER_01]: So I think it's a mindset shift.
32:21.165 --> 32:27.113
[SPEAKER_01]: Like the book has a lot of examples, but the first chapter is about first principles thinking for GRC engineering.
32:27.133 --> 32:30.417
[SPEAKER_01]: Because nothing we can do, you can't enter this field.
32:30.437 --> 32:34.362
[SPEAKER_01]: You can't change it if you're not thinking about things differently and to learn this stuff.
32:34.342 --> 32:37.427
[SPEAKER_01]: you have to be prepared, it's going to be tough.
32:38.268 --> 32:43.696
[SPEAKER_01]: But what matters is, all right, I put 20 minutes in this day, do I show up the next day?
32:44.277 --> 32:45.398
[SPEAKER_01]: I'll put up another 20 minutes.
32:45.478 --> 32:50.686
[SPEAKER_01]: I'll put up another, and it compounds, just like everything in life, whether investing, whether working out, whatever, it compounds.
32:50.706 --> 32:52.789
[SPEAKER_01]: And I think too often,
32:52.769 --> 32:57.455
[SPEAKER_01]: especially when we're trying to go on these journeys that are life-changing opportunities.
32:57.676 --> 32:59.799
[SPEAKER_01]: Like, this is in life-changing opportunity.
33:00.279 --> 33:06.388
[SPEAKER_01]: If someone told you you could change your life in the next 12 months by just putting 20 minutes in a day, I bet you you'd be willing to do it.
33:06.688 --> 33:08.691
[SPEAKER_01]: But we get into it, and it's like this stuff's too hard.
33:08.711 --> 33:09.692
[SPEAKER_01]: I don't understand it.
33:10.574 --> 33:11.955
[SPEAKER_01]: It's supposed to be hard.
33:12.056 --> 33:12.997
[SPEAKER_01]: That's it.
33:13.317 --> 33:18.945
[SPEAKER_01]: So I've really embraced this in this field, and I know you probably feel the same way,
33:19.381 --> 33:24.989
[SPEAKER_01]: It's stuff moves too fast, so I never feel comfortable that I know everything, and that's fine.
33:25.831 --> 33:39.010
[SPEAKER_01]: I know that, and as a former athlete, we used to talk about this when I, in practice, when I was at Florida State, like if I'm not, you know, go nose, if we're not losing the ball, if we're not making mistakes, we're not going hard enough.
33:38.990 --> 33:43.237
[SPEAKER_01]: So, now, days when I'm doing stuff, if I'm not filling uncomfortable, I'm not going hard enough.
33:43.257 --> 33:47.203
[SPEAKER_01]: I'm not trying hard enough to actually learn the material because I'm staying in my comfort zone.
33:47.224 --> 33:53.674
[SPEAKER_01]: And again, if you're trying to do something that's going to change your life, to change future generations, it's going to be hard.
33:53.754 --> 33:54.535
[SPEAKER_01]: And you've got to embrace that.
33:54.576 --> 34:05.233
[SPEAKER_01]: I have a principle that I tell anybody that's trying to do anything, whether that's build your brand on LinkedIn, whether that's learning to new technical skill, whether that's anything, any goal for the first 90 days ignore the results.
34:05.332 --> 34:06.535
[SPEAKER_01]: do not care about results.
34:06.755 --> 34:09.361
[SPEAKER_01]: Don't care about what's going on, just focus on consistency.
34:09.602 --> 34:13.892
[SPEAKER_01]: Focus on the habits, because way too often people start, get really excited.
34:14.052 --> 34:17.160
[SPEAKER_01]: I'm gonna crush this isn't gonna be amazing, and then you hit that point in your life.
34:17.340 --> 34:18.122
[SPEAKER_01]: What am I doing?
34:19.064 --> 34:20.387
[SPEAKER_01]: And I don't wanna do this no more.
34:20.367 --> 34:21.952
[SPEAKER_01]: But you got to push past that.
34:22.152 --> 34:23.315
[SPEAKER_01]: You got to push past that.
34:23.356 --> 34:25.963
[SPEAKER_01]: The first 90 days ignore the results.
34:26.103 --> 34:31.118
[SPEAKER_01]: Just focus on consistency, focus on showing up, and not worrying about am I getting this?
34:31.238 --> 34:34.146
[SPEAKER_01]: Because the secret is you're never getting it.
34:34.166 --> 34:35.811
[SPEAKER_01]: The more you know, the less you know.
34:35.791 --> 34:51.657
[SPEAKER_01]: especially in cyber security because it's moving so fast everything moves so fast so I think it's a mindset like obviously there's a ton of resources out there there's a lot of things that you can do to learn this stuff but the first thing is how you're thinking about it you got to understand that this is going to be a journey it's going to be tough but it's going to be worth it
34:51.755 --> 34:59.006
[SPEAKER_03]: and get the GRC engineering for AWS, but by AJ on too, that would help out a little bit.
34:59.647 --> 35:02.912
[SPEAKER_03]: But what I will say is like the same thing you got to ignore the results.
35:02.932 --> 35:05.475
[SPEAKER_03]: When I first got into types of carers, make a 75K.
35:05.716 --> 35:07.578
[SPEAKER_03]: Everybody was telling me, I'm making 130, 120.
35:07.619 --> 35:09.682
[SPEAKER_03]: And I'm like, I'm getting mad.
35:09.762 --> 35:12.005
[SPEAKER_03]: And the person just told me, the money will come.
35:12.225 --> 35:12.666
[SPEAKER_01]: Exactly.
35:12.646 --> 35:16.129
[SPEAKER_03]: You just got to put it in the work now and it's going to take probably a year, maybe two.
35:16.430 --> 35:19.373
[SPEAKER_03]: And then I say the same thing with LinkedIn, post your projects online.
35:19.753 --> 35:23.356
[SPEAKER_03]: I started off LinkedIn without with like 2,000 followers, right?
35:23.737 --> 35:25.258
[SPEAKER_03]: And I'm just posting stuff I'm learning.
35:25.298 --> 35:27.641
[SPEAKER_03]: So me from the results of me posting what I've learned.
35:27.661 --> 35:29.282
[SPEAKER_03]: I get job offers every day.
35:29.302 --> 35:36.149
[SPEAKER_03]: I get big companies that reach out to me to, you know, talking about things to grow their company and the R&M for GRC space.
35:36.169 --> 35:38.451
[SPEAKER_03]: So you've got to make sure that you're posting an
35:38.431 --> 35:41.756
[SPEAKER_03]: Even going live on LinkedIn just go live because we're the point now.
35:41.856 --> 35:50.329
[SPEAKER_03]: And I could tell like somebody's supposed me roll body, man You see the emoji is the M-dash But go live it's plain and what you do.
35:50.369 --> 35:51.271
[SPEAKER_03]: I know you have done it.
35:51.331 --> 35:55.377
[SPEAKER_03]: I've seen you all over you So we know we know what you do Yeah, I'm a big advocate of learning in public.
35:55.457 --> 36:00.865
[SPEAKER_01]: Yeah, like learning public because a lot of people try to show up as a full version like oh I got all these certs.
36:01.206 --> 36:02.768
[SPEAKER_01]: I want to know about the journey
36:02.748 --> 36:19.525
[SPEAKER_01]: I want to know about when you were confused because that tells me more about what type of person I'm going to be working with than the fact that you got and again, I'm telling you, every resume looks the same so I don't even, I just look at it and if I, if I see just something that's a little bit interesting, I go to their LinkedIn and when I go to their LinkedIn, I'm like, damn,
36:19.505 --> 36:20.006
[SPEAKER_01]: I'm nothing.
36:20.326 --> 36:20.607
[SPEAKER_01]: Nothing.
36:20.627 --> 36:21.167
[SPEAKER_01]: Nothing.
36:22.309 --> 36:23.531
[SPEAKER_01]: I'm trying to find a reason.
36:23.851 --> 36:28.758
[SPEAKER_01]: I'm trying to find a reason to continue going, so learn in public, share the down, share when you're confused.
36:28.778 --> 36:29.900
[SPEAKER_01]: Man, I'm studying for security plus.
36:30.240 --> 36:30.761
[SPEAKER_01]: I failed.
36:31.182 --> 36:32.503
[SPEAKER_01]: Don't be afraid to say you failed the cert.
36:32.624 --> 36:33.305
[SPEAKER_01]: I failed certs.
36:33.585 --> 36:38.392
[SPEAKER_01]: Like, I was the AWS security guy at this company, and I failed AWS security specialty.
36:39.293 --> 36:39.994
[SPEAKER_01]: Yeah, that.
36:39.974 --> 36:41.015
[SPEAKER_01]: I look too good.
36:41.155 --> 36:42.677
[SPEAKER_01]: I went back and took it, like it doesn't matter.
36:42.777 --> 36:44.519
[SPEAKER_01]: Like there's no scoreboard out here.
36:44.539 --> 36:45.259
[SPEAKER_01]: There's nobody keep it.
36:45.279 --> 36:48.423
[SPEAKER_01]: It's just like, but learning in public shows what you're thinking.
36:48.523 --> 36:50.325
[SPEAKER_01]: And you show the journey that you went on.
36:50.545 --> 36:52.186
[SPEAKER_01]: You show, and they're seeing the perseverance.
36:52.206 --> 36:53.928
[SPEAKER_01]: You're showing, you're documenting that.
36:54.429 --> 36:59.394
[SPEAKER_01]: And I think too many people treat LinkedIn is just like a digital version of their resume, wrong way to do it.
36:59.894 --> 37:03.077
[SPEAKER_01]: LinkedIn is an opportunity to grow your network.
37:03.318 --> 37:08.563
[SPEAKER_01]: And I'm going to talk to my current job that I have, didn't exist, and I didn't interview for it.
37:09.674 --> 37:12.358
[SPEAKER_01]: And the numbers high, we won't, the numbers high.
37:13.259 --> 37:14.581
[SPEAKER_01]: And it's all because of a brand.
37:14.861 --> 37:17.384
[SPEAKER_01]: It's all because I had relationships and networking.
37:17.404 --> 37:18.446
[SPEAKER_01]: I was telling some folks just now.
37:18.886 --> 37:20.408
[SPEAKER_01]: A lot of people talk about networking, right?
37:20.809 --> 37:21.710
[SPEAKER_01]: It's all about who you know.
37:22.111 --> 37:23.693
[SPEAKER_01]: I 100% disagree.
37:23.893 --> 37:24.273
[SPEAKER_01]: It is not.
37:24.674 --> 37:29.961
[SPEAKER_01]: Because I think it's about who knows you and what do they know that you know?
37:29.941 --> 37:30.763
[SPEAKER_01]: I know you.
37:30.843 --> 37:31.925
[SPEAKER_01]: I know that you know our math.
37:31.945 --> 37:33.208
[SPEAKER_01]: I know that you're deep in that space.
37:33.228 --> 37:38.378
[SPEAKER_01]: So if an opportunity comes up Immediately on pattern matching our brains are just constantly pattern matching.
37:38.398 --> 37:40.743
[SPEAKER_01]: Okay, Chris our math boom Let me give him this opportunity.
37:40.763 --> 37:41.845
[SPEAKER_01]: Oh, I know Eric who's in here.
37:41.865 --> 37:42.386
[SPEAKER_01]: You got the business.
37:42.406 --> 37:42.546
[SPEAKER_01]: Okay.
37:42.566 --> 37:43.167
[SPEAKER_01]: I'm gonna help him out.
37:43.428 --> 37:48.017
[SPEAKER_01]: I got this it's pattern matching So you how am I gonna know what you know
37:47.997 --> 37:51.141
[SPEAKER_01]: if I go to your link in or if I go to your resume and I don't see anything.
37:51.801 --> 37:54.044
[SPEAKER_01]: I just see the same thing that I see on 30 other resumes.
37:54.064 --> 37:54.885
[SPEAKER_01]: It's not standing out.
37:54.965 --> 37:58.369
[SPEAKER_01]: But if I start to see you, I'm like, oh, they're security plus.
37:58.469 --> 37:58.790
[SPEAKER_01]: Oh, wow.
37:58.870 --> 38:01.613
[SPEAKER_01]: Now it's just, oh, AWS, this person's grinding.
38:01.633 --> 38:04.957
[SPEAKER_01]: Okay, I see somebody that went from help desk to this to that.
38:05.057 --> 38:06.979
[SPEAKER_01]: Okay, now I know there's certain skills there.
38:07.259 --> 38:10.343
[SPEAKER_01]: There's certain skills I was talking to a gentleman earlier who's a network engineer.
38:10.323 --> 38:14.950
[SPEAKER_01]: Again like now just because I'm pattern matching if something comes up.
38:14.970 --> 38:17.734
[SPEAKER_01]: I'm surprised what was that dude's name again Stacey right here.
38:17.894 --> 38:31.234
[SPEAKER_01]: Oh, let me Like like you can you connect me with him because I need a network engineer who wants to do this GRC stuff because I know him and I know what he knows But too often we're trying to hide that we're trying to hide and present again this perfect picture
38:31.619 --> 38:32.440
[SPEAKER_01]: I hire a lot of people.
38:32.460 --> 38:33.361
[SPEAKER_01]: I don't want a perfect picture.
38:33.641 --> 38:36.664
[SPEAKER_01]: I want somebody who, again, because I know you're going to get confused.
38:37.445 --> 38:38.325
[SPEAKER_01]: I know you're going to get lost.
38:38.345 --> 38:40.007
[SPEAKER_01]: I'm going to go tell you to go do something for the customer.
38:40.387 --> 38:42.209
[SPEAKER_01]: I'm going to be busy, busy.
38:42.449 --> 38:44.271
[SPEAKER_01]: I'm going to be on the beach away from my computer.
38:44.331 --> 38:46.654
[SPEAKER_01]: And you're not going to be able to reach me.
38:47.434 --> 38:48.475
[SPEAKER_01]: And you've got to figure that out.
38:48.515 --> 38:51.358
[SPEAKER_01]: And I want to know that that person could figure it out.
38:51.378 --> 38:51.979
[SPEAKER_01]: You know what I mean?
38:52.239 --> 38:57.524
[SPEAKER_01]: And if I don't see that when I'm hiring you, if I don't hear that during the interview process, it puts you at risk.
38:57.644 --> 39:00.647
[SPEAKER_01]: And I think it's an opportunity
39:01.623 --> 39:03.886
[SPEAKER_01]: is an underutilized resource.
39:03.907 --> 39:06.250
[SPEAKER_01]: Very underlivers, extremely underutilized resources.
39:06.591 --> 39:08.474
[SPEAKER_01]: You talked about, you know, I'm a LinkedIn learning instructor.
39:08.494 --> 39:11.618
[SPEAKER_01]: I've been a LinkedIn top voice, I was in the creator accelerator program.
39:12.740 --> 39:13.802
[SPEAKER_01]: LinkedIn has been great to me.
39:14.142 --> 39:17.587
[SPEAKER_01]: LinkedIn has been great to me and I started building my brand out in necessity.
39:18.108 --> 39:24.458
[SPEAKER_01]: I started my company in March of 2020 and every book you read about starting the company says, get out the building, go talk to customers.
39:24.438 --> 39:25.741
[SPEAKER_01]: Pandemic starts three days later.
39:25.901 --> 39:27.985
[SPEAKER_01]: There's no building to get out of there's nobody to go talk to you.
39:28.005 --> 39:30.190
[SPEAKER_01]: Nobody wants to talk So I got to do something.
39:30.210 --> 39:31.412
[SPEAKER_01]: I had like 900 connections.
39:31.452 --> 39:32.254
[SPEAKER_01]: I think I'll make them.
39:32.274 --> 39:39.949
[SPEAKER_01]: I got to build the brand when I'm started learning it And it just opened up all these opportunities and and I'll tell you one of the ways that I built my brand early
39:39.929 --> 39:42.151
[SPEAKER_01]: I just regurgitated information.
39:42.451 --> 39:44.113
[SPEAKER_01]: I wasn't sure anything new.
39:44.654 --> 39:48.177
[SPEAKER_01]: I found an article, I would read it, I was summarized it, because most people are lazy.
39:48.597 --> 39:49.719
[SPEAKER_01]: They're not gonna read the article.
39:49.959 --> 39:51.380
[SPEAKER_01]: So they started treating me as the source.
39:51.921 --> 39:53.102
[SPEAKER_01]: Okay, cool, all right, great.
39:53.122 --> 39:54.123
[SPEAKER_01]: I'm gonna be the source now.
39:54.143 --> 39:58.087
[SPEAKER_01]: I'm gonna be known as the class security compliance guy by just regurgitating articles I'm reading.
39:58.507 --> 40:00.189
[SPEAKER_01]: It's so easy and it's right there.
40:00.669 --> 40:07.496
[SPEAKER_01]: And I think because it's LinkedIn, it feels a little stuffy, it's like LinkedIn's just known for I got a promotion, I got a new job.
40:07.756 --> 40:08.637
[SPEAKER_01]: Don't use it that way.
40:08.617 --> 40:13.644
[SPEAKER_01]: uses to build your brand, and it opens up opportunities, and it's not about the vanity metrics for me.
40:14.405 --> 40:17.088
[SPEAKER_01]: People are like, oh, you got to follow whatever, whatever, it's not about vanity metrics.
40:17.108 --> 40:20.232
[SPEAKER_01]: To me, you know your linkedin's working, when opportunities are showing up in your inbox.
40:20.853 --> 40:28.623
[SPEAKER_01]: Where people are recognizing you for what you know, again, like, and I was in New York, that this conference this past week, somebody was telling me, like, man, it's crazy.
40:29.284 --> 40:32.548
[SPEAKER_01]: They kind of followed this, like, little brand-builder course that I put together.
40:32.528 --> 40:55.498
[SPEAKER_01]: And like some of my chemistry was I see from I know you from LinkedIn you're always talking about X and you just I didn't know people were paying attention because nobody likes those posts ignore the results they're seeing you and now they know what you know and their pattern matching and I think LinkedIn's an opportunity to stand out to showcase those projects to your point I'm glad you brought this up learn in public share the wins share the losses you're currently studying for security plus you go through a chapter
40:55.478 --> 40:56.560
[SPEAKER_01]: Talk about it.
40:57.362 --> 40:57.843
[SPEAKER_01]: Talk about it.
40:57.944 --> 40:59.788
[SPEAKER_01]: It's a great way to reinforce your learning as well.
41:00.269 --> 41:05.601
[SPEAKER_01]: Because you're now, you know, it's talk about in the book like one of the ways to prove that you really know what you're doing.
41:05.941 --> 41:06.763
[SPEAKER_01]: Do the grandma tests.
41:07.304 --> 41:08.928
[SPEAKER_01]: Go highlight your grandma and tell her what you're talking about.
41:09.269 --> 41:11.614
[SPEAKER_01]: See if she can use slaves to carry plus to your grandma.
41:11.594 --> 41:14.958
[SPEAKER_01]: If you can't do that, you might want to go back a little bit deeper in the book and figure that out, right?
41:15.479 --> 41:19.784
[SPEAKER_01]: And you do that by sharing, as you're on the journey, not waiting until the end.
41:19.824 --> 41:31.038
[SPEAKER_01]: You've got to be, I think we live in a society where everybody wants to paint this perfect highlight real, and that's just not how the real world works, and that's not how it's going to work when you're working in a company because this stuff's hard.
41:31.319 --> 41:35.644
[SPEAKER_01]: You're going to get confused, and I want to know you're going to be okay being confused.
41:35.624 --> 41:36.325
[SPEAKER_03]: Yeah, that's what I do.
41:36.345 --> 41:37.006
[SPEAKER_03]: I'm learning.
41:37.086 --> 41:39.149
[SPEAKER_03]: I would go linked in live, talk about what I'm doing.
41:39.169 --> 41:40.171
[SPEAKER_03]: It's somebody saying, I'm wrong.
41:40.431 --> 41:40.992
[SPEAKER_03]: I'm wrong.
41:41.173 --> 41:47.663
[SPEAKER_03]: I mean, I'm not perfect, but I get a bunch of people that's highly recognized in the field that like what you're doing over time.
41:47.703 --> 41:49.726
[SPEAKER_03]: If you're saying something right, they're going to say it's right if it's wrong.
41:50.207 --> 41:54.653
[SPEAKER_03]: I made a post recently about a security class, and they had, they would have on me.
41:54.994 --> 41:56.316
[SPEAKER_03]: I'm my dang.
41:56.296 --> 42:00.463
[SPEAKER_03]: But, so, and just to the audience that you know, I have one cert.
42:00.483 --> 42:02.447
[SPEAKER_03]: I know very well for myself, but one cert.
42:02.507 --> 42:04.791
[SPEAKER_03]: It's not about the certs, it's about what you know.
42:04.931 --> 42:07.997
[SPEAKER_03]: And even if you can know one thing, but it's always got to learn over time.
42:08.037 --> 42:08.638
[SPEAKER_03]: That's what AJ's.
42:08.898 --> 42:10.261
[SPEAKER_01]: I had a lot of certs.
42:10.281 --> 42:11.503
[SPEAKER_01]: None of them were active anymore.
42:11.483 --> 42:36.124
[SPEAKER_01]: And I have zero intention to ever take a certification test again and I'm not going to And I don't have to now, I've been able to elevate to that point, but and I was telling folks like search are great because it's going to help you speak the language projects, portfolios are what it's going to stand out and the reason I have this concept of portfolios as a founder, I hired a bunch of software engineers, I hired some UI UX designers that came from non-technical fields.
42:36.104 --> 42:39.450
[SPEAKER_01]: They were chefs, they were nannies, whatever, they built portfolios.
42:39.670 --> 42:42.916
[SPEAKER_01]: So now when we're hiring, we're looking at somebody with a graphic, this U.I.U.X.
42:42.936 --> 42:43.677
[SPEAKER_01]: designed the Greek.
42:44.098 --> 42:48.045
[SPEAKER_01]: Five years of experience, coming from a tech company, and we actually our first U.I.U.X.
42:48.065 --> 42:51.952
[SPEAKER_01]: designer in my company was a young lady who was a chef and a nanny.
42:52.132 --> 42:52.914
[SPEAKER_01]: Oh, dang.
42:52.934 --> 42:55.378
[SPEAKER_01]: But her portfolio was crazy.
42:55.358 --> 42:56.561
[SPEAKER_01]: It was crazy.
42:56.661 --> 42:59.047
[SPEAKER_01]: I was like, I don't care about the education over here.
42:59.428 --> 43:02.235
[SPEAKER_01]: That's what we need that type of thinking in that style.
43:02.255 --> 43:05.965
[SPEAKER_01]: If she didn't build a portfolio and just assumed, oh, I went to a bootcamp.
43:05.985 --> 43:06.887
[SPEAKER_01]: I'm gonna get hired.
43:07.643 --> 43:08.424
[SPEAKER_01]: She still be lucky.
43:08.444 --> 43:09.005
[SPEAKER_01]: She still be lucky.
43:09.045 --> 43:09.687
[SPEAKER_01]: She still be lucky.
43:09.727 --> 43:15.837
[SPEAKER_01]: And she's still now a gainfully employed U.S. designer because she built a portfolio that had louder to stand out and compete.
43:15.877 --> 43:18.722
[SPEAKER_01]: I think portfolios level the playing ground.
43:18.742 --> 43:22.088
[SPEAKER_01]: It levels the field because I don't care about experience if I can see what you do.
43:22.148 --> 43:23.050
[SPEAKER_01]: And I can see how you're thinking.
43:23.070 --> 43:26.676
[SPEAKER_01]: And I think in GRC opportunity, nobody's building portfolios.
43:26.696 --> 43:32.807
[SPEAKER_01]: Again, well, I'm telling you, I open up a role hundreds within the first hour, thousands within the first day.
43:34.036 --> 43:38.563
[SPEAKER_01]: single-digit projects, though every single one that has a project that gets an interview.
43:38.583 --> 43:44.572
[SPEAKER_01]: And I told my HR folks, if they have projects, if you see a GitHub link, let me talk to them.
43:44.592 --> 43:47.296
[SPEAKER_01]: That's your sign, that's your signal, because everything else looks the same.
43:47.557 --> 43:49.139
[SPEAKER_01]: I can't tell the difference.
43:49.159 --> 43:49.980
[SPEAKER_03]: So listen to this guy.
43:50.020 --> 43:56.570
[SPEAKER_03]: It's got Harris people, make sure you create projects, post online, create videos, do what you've got to do.
43:56.811 --> 43:58.373
[SPEAKER_03]: Because if you don't love what you do,
43:58.775 --> 44:03.164
[SPEAKER_03]: I ain't gonna pay you, you know what I'm saying?
44:03.945 --> 44:05.589
[SPEAKER_03]: So AJ, tell me a little bit about your book.
44:05.829 --> 44:07.533
[SPEAKER_03]: Tell me why did you create the book?
44:07.633 --> 44:09.156
[SPEAKER_03]: Tell people where they can find the book.
44:09.216 --> 44:10.438
[SPEAKER_03]: Talk about in-depth about your book.
44:10.899 --> 44:16.170
[SPEAKER_01]: Yeah, so the whole GRC engineering concept has just been a passion in mind.
44:16.210 --> 44:20.158
[SPEAKER_01]: Since I got in the field, like I said, I just felt like there had to be a better way.
44:20.510 --> 44:25.838
[SPEAKER_01]: Two or three years ago, after I saw my company and I was working, I started writing the book and then I kind of put it on the shelf.
44:26.700 --> 44:34.351
[SPEAKER_01]: Earlier this year, I joined this company and talked to my boy who's the CEO and he wrote a book, he's like, I just write the book, just get it done.
44:34.371 --> 44:35.613
[SPEAKER_01]: So I started writing the book and it done.
44:35.633 --> 44:40.341
[SPEAKER_01]: But I looked out there and I'm looking at resources for GRC.
44:41.042 --> 44:46.250
[SPEAKER_01]: I'm looking at, you know, you go out, look for labs, things, and you see class security stuff, he's he's set up stuff, you don't see nothing for GRC.
44:46.270 --> 44:48.373
[SPEAKER_01]: There's no resources out there for us, like we need something.
44:48.353 --> 44:56.383
[SPEAKER_01]: I also, I love to read, I love to write, I wanted to, this is, I've always had a desire to write a book.
44:56.764 --> 45:02.871
[SPEAKER_01]: I have two kids, I've got a son that's nine and a daughter that's seven, and my son has the same name as me.
45:02.891 --> 45:08.218
[SPEAKER_01]: So I wanted him to have something, a physical thing that his dad did that he can have and something that I,
45:08.198 --> 45:18.083
[SPEAKER_01]: I wanted to get done, but I really felt like we needed a resource out here for not only for GRC professionals, just in general, but for GRC professionals, the level up and get technical skills.
45:18.103 --> 45:20.769
[SPEAKER_01]: Because often time you're like, all right, the GRC engineer stuff sounds cool, but what do I do?
45:21.190 --> 45:24.739
[SPEAKER_01]: And I really have an answer before I wrote the book, and now I have an answer.
45:24.719 --> 45:46.069
[SPEAKER_01]: The book, one, my son, and I both have ADHD, so when I read books, sometimes I got a flip around, I lose a little bit of book, and yeah, it's a barely, it's a barely, but I figured it out, and I think it's a, it becomes a superpower over time, but so the book has four sections, because I think there's a lot of people that are picking it up, starting their career, people that already know things,
45:46.049 --> 45:48.354
[SPEAKER_01]: The first section just explains what is GRC engineering.
45:48.394 --> 45:49.456
[SPEAKER_01]: It's GRC engineering 101.
45:49.757 --> 45:59.939
[SPEAKER_01]: The second section is all about AWS, what are the AWS services, event driven architecture, infrastructure as code, section three, no GRC professional, let's take a deep breath when they hear this, Python, trust me.
46:00.219 --> 46:01.121
[SPEAKER_01]: It's not that bad.
46:01.141 --> 46:02.083
[SPEAKER_03]: Let me just give me a harder time.
46:02.103 --> 46:03.606
[SPEAKER_01]: Yeah, I know, I know, it's not that bad.
46:03.627 --> 46:06.673
[SPEAKER_01]: What I'll say like, out of all the programming languages,
46:06.653 --> 46:12.300
[SPEAKER_01]: I've been a lot in the software world, Python's the easiest to learn, because it's the only one that everything's in plain English.
46:12.780 --> 46:16.145
[SPEAKER_01]: Every other program language has these weird words that you get very confused and so on.
46:16.165 --> 46:17.086
[SPEAKER_01]: What does that word mean?
46:17.106 --> 46:18.127
[SPEAKER_01]: Python's in plain English.
46:18.247 --> 46:20.069
[SPEAKER_01]: So if you can read, you can figure it out.
46:20.330 --> 46:22.893
[SPEAKER_01]: That section's all about giving you the basics just to get started.
46:23.473 --> 46:25.176
[SPEAKER_01]: And then the last section's about GRC careers.
46:25.997 --> 46:35.428
[SPEAKER_01]: And I'm giving interview tips, talk about the portfolio, talk about how to build your brand on LinkedIn, give away a lot of the secrets and tricks that I learned there.
46:35.408 --> 46:42.080
[SPEAKER_01]: Because I wanted people to have a resources that can kind of take you from zero to one that can take you from a current GRC professional I just need to know how do I interview.
46:42.601 --> 46:43.743
[SPEAKER_01]: I know AWS.
46:43.883 --> 46:49.052
[SPEAKER_01]: I know what GRC engineering is, but I need to freshen up my Python's probably where you're at you're like I learned a little bit Python.
46:49.092 --> 46:50.235
[SPEAKER_01]: You just flip right to section three.
46:50.275 --> 46:55.744
[SPEAKER_01]: You just go right there So I wanted to make it modular like that, but I really wanted it, you know, it says that hands on God.
46:55.764 --> 46:57.788
[SPEAKER_01]: I want people to pick it up
46:57.768 --> 47:02.613
[SPEAKER_01]: And that's what a lot of the feedback's been, is like, you know, I read the book and I can actually go do something with it.
47:02.753 --> 47:07.498
[SPEAKER_01]: I can actually go use it and yeah, man, it's a labor of love.
47:07.578 --> 47:11.321
[SPEAKER_01]: You know, writing the book is very difficult, especially in this field.
47:12.042 --> 47:17.828
[SPEAKER_01]: Especially, you know, I've been fortunate to build a brand, which means a lot of people that like me, a lot of people that don't like me.
47:17.848 --> 47:18.989
[SPEAKER_01]: Yeah, I'm so so there.
47:19.329 --> 47:19.790
[SPEAKER_01]: They're bad.
47:19.890 --> 47:26.256
[SPEAKER_01]: Yeah, they're gonna look, they look, fact check me, so I make sure it's, and I followed the advice of Rick Ruben, we're writing it.
47:26.236 --> 47:28.318
[SPEAKER_01]: All I cared about was being proud of what I created.
47:28.759 --> 47:33.504
[SPEAKER_01]: I didn't care about sales, I didn't care about how many, it was, am I going to be proud of it?
47:33.564 --> 47:36.207
[SPEAKER_01]: And I was, and the result had been amazing.
47:36.227 --> 47:39.831
[SPEAKER_01]: I've been really appreciative of the support from the community and folks that folks are eating in it.
47:39.851 --> 47:44.777
[SPEAKER_01]: And I think it's sparking, it's taken in this GRC engineering thing from a moment into a real movement.
47:45.498 --> 47:50.303
[SPEAKER_01]: To where, now I'm a lot of CEO friends, a lot of people that run companies are like,
47:50.283 --> 48:03.465
[SPEAKER_01]: You know any GRC engineers, and I'm trying, I mean, if any of you guys have some skills, you know, we could talk, but I'm trying to put a lot of my dogs on to get into this field, and I'm hitting them like, y'all got to go, because
48:03.817 --> 48:05.819
[SPEAKER_01]: people are looking to hire right now.
48:06.139 --> 48:13.347
[SPEAKER_01]: And I told, I was on literally the other day on a call with CEO of a pretty large audit firm, and he was like, what should I do?
48:13.407 --> 48:16.450
[SPEAKER_01]: And I said, you need to hire GRC engineers and embed them in your audit teams.
48:16.831 --> 48:17.571
[SPEAKER_01]: He's like, do you know any?
48:18.292 --> 48:19.353
[SPEAKER_01]: I said, yeah, give me a couple of weeks.
48:19.774 --> 48:20.374
[SPEAKER_01]: Give me a couple of weeks.
48:20.394 --> 48:20.915
[SPEAKER_01]: I know a few.
48:21.495 --> 48:27.542
[SPEAKER_01]: And I'm trying to put our people on people on and get people in this field, there's opportunities out there.
48:27.742 --> 48:28.663
[SPEAKER_01]: There's opportunities out there.
48:28.963 --> 48:30.685
[SPEAKER_01]: But I'm not putting my reputation on laughing.
48:30.665 --> 48:33.170
[SPEAKER_01]: I've done it, we know how to do it.
48:33.210 --> 48:33.932
[SPEAKER_01]: I've done it.
48:33.992 --> 48:39.383
[SPEAKER_01]: So again, it's about showcasing those skills so that you can get put into the right position.
48:39.723 --> 48:41.788
[SPEAKER_01]: And then from there, you know, I'll open the door.
48:41.848 --> 48:43.191
[SPEAKER_01]: You've got to handle your business from there.
48:43.251 --> 48:44.854
[SPEAKER_01]: But it's an opportunity.
48:44.974 --> 48:48.301
[SPEAKER_01]: And I think the book will be a good resource to help people get there.
48:49.323 --> 48:50.766
[SPEAKER_01]: And just,
48:50.746 --> 48:51.668
[SPEAKER_01]: do things differently.
48:51.728 --> 48:53.311
[SPEAKER_01]: Like GRC is important.
48:54.273 --> 48:55.595
[SPEAKER_01]: I really enjoy the field.
48:55.675 --> 48:56.497
[SPEAKER_01]: I enjoy what we do.
48:56.537 --> 48:59.141
[SPEAKER_01]: I think there's an opportunity to do very well for yourself in this field.
48:59.562 --> 49:02.888
[SPEAKER_01]: But I think if we don't level up, we're seeing the shifts.
49:03.650 --> 49:05.413
[SPEAKER_01]: The tide is kind of shifting on our feet.
49:05.680 --> 49:07.986
[SPEAKER_03]: Yeah, if you're not solving the problem, you're all the problem.
49:08.006 --> 49:08.868
[SPEAKER_03]: That's how you go.
49:08.908 --> 49:11.113
[SPEAKER_03]: So you're solving the problem, you fixing it.
49:11.133 --> 49:11.875
[SPEAKER_03]: So I love what you're doing.
49:11.895 --> 49:12.617
[SPEAKER_03]: How much is this a book?
49:12.878 --> 49:13.840
[SPEAKER_01]: $20 on Amazon.
49:13.960 --> 49:14.201
[SPEAKER_01]: $10?
49:14.381 --> 49:15.344
[SPEAKER_01]: $19.99, I guess.
49:15.364 --> 49:16.887
[SPEAKER_03]: $19.99, it will tax this $20.
49:16.907 --> 49:18.892
[SPEAKER_01]: Yeah.
49:18.912 --> 49:19.013
[SPEAKER_01]: Yeah.
49:19.033 --> 49:19.815
[SPEAKER_03]: Now, I like what you're doing.
49:19.855 --> 49:21.960
[SPEAKER_03]: I have a look up to this one guy more recently.
49:22.060 --> 49:22.862
[SPEAKER_03]: Alex and Rosie.
49:22.842 --> 49:50.470
[SPEAKER_03]: He created a book that helps you get where you need to go and it provides a lot of value And I love that you're doing that to solve a solution without you know going to other routes But I'm glad so make sure if you've checked it out make sure you check out AJ's book DRC Engineering for AWS going Amazon is 1999 plus tax maybe 20 But just make sure you check out his book support this young brother He's been doing what he had to do for a long time so just follow him and pay attention to him Where can audience find you with social media?
49:50.450 --> 49:55.799
[SPEAKER_01]: LinkedIn is where I'm the most active, I don't want people to find my Twitter burner.
49:57.983 --> 50:08.221
[SPEAKER_01]: But LinkedIn, LinkedIn is where I'm the most active, and I'm constantly trying to share resources, trying to, and I try to respond to DMs sometimes, LinkedIn's DMs, it's crazy.
50:08.241 --> 50:10.065
[SPEAKER_01]: And sometimes it gets really wild right now, it's really wild.
50:10.085 --> 50:15.394
[SPEAKER_01]: But yeah, I mean, I, I mean, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I
50:15.982 --> 50:19.788
[SPEAKER_01]: I care a ton about trying to leave an impact, trying to inspire, inspire folks.
50:19.908 --> 50:26.438
[SPEAKER_01]: I've been fortunate to mentor a lot of folks, the general, the general, the general, the general man that introduced us.
50:26.799 --> 50:32.989
[SPEAKER_01]: I was one of my mentees and has been able to just accelerate and grow so much, so that's what I'm passionate about.
50:33.009 --> 50:33.950
[SPEAKER_01]: That's what I care about now.
50:34.030 --> 50:39.559
[SPEAKER_01]: I just want to leave an impact and I'm hoping the book changes just one person's life and impacts them.
50:39.539 --> 50:56.443
[SPEAKER_01]: I think again like starting of a movement and there's an opportunity and hopefully you know we look up five years from now We see a whole you know just like DevSecOps right you're seeing all these roles and they're popping up You know roles are popping up so it's exciting time And I appreciate appreciate you having me on appreciate you being here and all the folks that are here in person as well This is this is dope.
50:56.703 --> 50:57.344
[SPEAKER_03]: That's an honor.
50:57.424 --> 51:05.395
[SPEAKER_03]: So let me actually this is just two things everybody's building this podcast There are you know what I'm about to ask and if you can familiar you already know what I'm about to ask what is your goals for the next five years?
51:05.965 --> 51:09.429
[SPEAKER_01]: Um, to make a lot more money without working.
51:09.769 --> 51:10.370
[SPEAKER_03]: Okay.
51:10.390 --> 51:10.931
[SPEAKER_00]: That's good.
51:10.951 --> 51:13.654
[SPEAKER_01]: So like, I, um, I value slow mornings.
51:14.375 --> 51:17.959
[SPEAKER_01]: I value, uh, a lot of time away from the computer.
51:18.660 --> 51:20.121
[SPEAKER_01]: Um, I live in Puerto Rico on the island.
51:20.142 --> 51:20.842
[SPEAKER_01]: I'm half Puerto Rican.
51:20.882 --> 51:23.545
[SPEAKER_01]: So I'm, I'm very excited about living in my home.
51:24.106 --> 51:24.206
[SPEAKER_03]: Yeah.
51:24.226 --> 51:25.428
[SPEAKER_03]: You make snow.
51:25.448 --> 51:26.008
[SPEAKER_01]: Yeah.
51:26.028 --> 51:26.189
[SPEAKER_01]: Yeah.
51:26.209 --> 51:27.670
[SPEAKER_01]: My mom was born and raised on the island.
51:27.810 --> 51:30.554
[SPEAKER_01]: And, um, so I'm, I'm, I'm Puerto Rican.
51:30.574 --> 51:32.236
[SPEAKER_01]: Um, I was just at Bad Bunny's concert last week.
51:32.296 --> 51:34.318
[SPEAKER_01]: I had some of my life, uh,
51:34.298 --> 51:40.449
[SPEAKER_01]: You know, the beneath of the go, um, but uh, you know, I, I, I, um, I, um, I've been able to do a lot.
51:40.589 --> 51:44.095
[SPEAKER_01]: So like now I'm in the phase of my life where I kind of feel semi retired, um, life's good.
51:44.155 --> 51:52.910
[SPEAKER_01]: And I just want to keep that going honestly, and, um, uh, continue to, uh, leave an impact, continue to help folks, um, and I, and I think everything else would kind of work herself out.
51:52.930 --> 51:53.091
[SPEAKER_03]: Yeah.
51:53.131 --> 51:53.792
[SPEAKER_03]: Skin glowing.
51:53.852 --> 51:55.395
[SPEAKER_03]: So you just want to kick your feet up a lot.
51:55.415 --> 51:55.515
[SPEAKER_01]: Yeah.
51:55.535 --> 51:56.256
[SPEAKER_01]: Just think you're...
51:56.236 --> 52:01.082
[SPEAKER_01]: where some open touch on Clevthas, like I only wear really wear shoes when I get back to the mainland.
52:01.243 --> 52:04.707
[SPEAKER_01]: So I'm excited to get back to Clevthas, it could be on the beach tomorrow.
52:04.727 --> 52:05.208
[SPEAKER_03]: I love that.
52:05.348 --> 52:06.830
[SPEAKER_03]: OK, so this is one thing.
52:07.371 --> 52:09.514
[SPEAKER_03]: You know, there's a lot of beautiful people in this audience.
52:09.534 --> 52:12.077
[SPEAKER_03]: There's a lot of great people in this audience that came to support you.
52:12.558 --> 52:15.382
[SPEAKER_03]: What is one thing you want to lead an audience with?
52:16.243 --> 52:17.384
[SPEAKER_03]: That could be a statement.
52:17.404 --> 52:18.105
[SPEAKER_03]: It could be a quote.
52:18.225 --> 52:20.168
[SPEAKER_03]: Something you just want to lead an audience with to grow.
52:20.536 --> 52:24.643
[SPEAKER_01]: Yeah, I am, man, I got a lot, can I give to you?
52:24.763 --> 52:25.184
[SPEAKER_01]: You're going?
52:25.204 --> 52:26.606
[SPEAKER_01]: All right, all right.
52:27.027 --> 52:33.438
[SPEAKER_01]: I study stoic philosophy a lot, and one of my favorite books of all times is the obstacle is the way by Ryan Holliday.
52:34.079 --> 52:42.713
[SPEAKER_01]: And if I kind of think about everything that I've ever achieved in my life, there was an obstacle in the way that I made a decision just to go through it.
52:43.317 --> 52:50.352
[SPEAKER_01]: And I would encourage everybody that when you fill that obstacle, that is a signal to keep going.
52:50.372 --> 52:51.714
[SPEAKER_01]: That is not a signal to turn around.
52:52.055 --> 52:53.137
[SPEAKER_01]: The obstacle is the way.
52:53.638 --> 53:00.132
[SPEAKER_01]: Another stoic kind of saying that I follow is a morphatti, and it means a love of fate.
53:00.192 --> 53:04.060
[SPEAKER_01]: And a lot of people talk about that, or like accept your life, accept what goes on.
53:04.040 --> 53:08.870
[SPEAKER_01]: And a lot of religion, a lot of different religious kind of same thing like counter-doubt, kind of everything is joy.
53:08.890 --> 53:09.832
[SPEAKER_01]: I think it's something like that.
53:10.614 --> 53:19.332
[SPEAKER_01]: But a more FIT is really not just about accepting it, but truly loving what happens to you and shifting your mindset from life is happening to me, to life is happening for me.
53:19.312 --> 53:26.246
[SPEAKER_01]: And when you do that, every single thing that happens is an opportunity to get better because it's happening for you.
53:26.306 --> 53:28.230
[SPEAKER_01]: It's an opportunity for me to get better.
53:28.250 --> 53:31.076
[SPEAKER_01]: It's opportunity for me to think about something differently.
53:31.817 --> 53:33.380
[SPEAKER_01]: It's an opportunity for me to grow.
53:34.202 --> 53:35.585
[SPEAKER_01]: I always say either, when are you learned?
53:36.106 --> 53:37.168
[SPEAKER_01]: I've learned a lot.
53:37.148 --> 53:38.589
[SPEAKER_01]: I've learned a whole lot.
53:38.810 --> 53:42.093
[SPEAKER_01]: I'm gonna be able to win a few times, but yeah, it's just a love of fate.
53:42.333 --> 53:49.721
[SPEAKER_01]: I really believe that whenever good or bad things happen, I feel that life is not happening to me, it's happening for me.
53:50.041 --> 53:51.623
[SPEAKER_01]: So I'll encourage folks, you know, obstacles the way.
53:52.103 --> 53:53.705
[SPEAKER_01]: That's a signal, go through that obstacle.
53:54.045 --> 53:57.048
[SPEAKER_01]: And embrace the concept that life is happening for you.
53:57.349 --> 53:58.290
[SPEAKER_01]: Things are happening for you.
53:58.830 --> 54:01.533
[SPEAKER_01]: And you just gotta be consistent.
54:01.673 --> 54:02.394
[SPEAKER_01]: You gotta keep going.
54:02.534 --> 54:03.255
[SPEAKER_03]: That's a good quote.
54:03.475 --> 54:04.956
[SPEAKER_03]: And I appreciate you coming on this podcast.
54:04.976 --> 54:05.297
[SPEAKER_03]: Thank you.
54:05.317 --> 54:06.598
[SPEAKER_01]: Yes, sir.
54:07.203 --> 54:36.568
[SPEAKER_03]: So far everybody in the audience just wanted to let you know I want to give you a couple shout outs before we end this shout out to Darius there has been with me over a year Darius has created tech work to what it is all that stuff you see on YouTube it wouldn't happen because I don't know how to film so shout out to Darius if anybody needs some video videography work any event work photography makes you like you check out Darius this man has done a lot to grow this podcast to what it is today so I just want to shout
54:36.667 --> 54:39.913
[SPEAKER_03]: Um, shout out to everybody in the audience for coming out and supporting this.
54:40.093 --> 54:41.456
[SPEAKER_03]: This is hard for me to do events.
54:41.496 --> 54:42.779
[SPEAKER_03]: I'm a very introverted person.
54:42.799 --> 54:44.482
[SPEAKER_03]: I like to stay in my room and work on stuff.
54:44.502 --> 54:47.668
[SPEAKER_03]: So they knows, you know, so I just stay in the room.
54:47.688 --> 54:57.607
[SPEAKER_03]: So I appreciate you out coming out here and just so we can bind and grow and put all the nonny audience and shout out to OO of always being there for the podcast and supporting the podcast since they won.
54:57.627 --> 54:59.991
[SPEAKER_03]: He's been there for like 20, 20 times now.
54:59.971 --> 55:13.885
[SPEAKER_03]: And for anybody that needs any RML to do a cell plug too, you know, so they might want to check our RML for kind of me 20 off, 20% off the website, so if you want to check that out, check the website out.
55:14.346 --> 55:15.128
[SPEAKER_03]: So,
55:15.665 --> 55:19.332
[SPEAKER_03]: Just to end it and you already know what I'm about to say for people that's familiar with the podcast.
55:19.693 --> 55:21.957
[SPEAKER_03]: Thank you for everybody watching the Tech World Podcast.
55:21.977 --> 55:32.357
[SPEAKER_03]: Make sure you like the video, subscribe to the channel, comment down below, share the video, check out TechWorld Podcasts.com, check out some merch, support the channel, the keep growing, and get all this knowledge.
55:32.337 --> 55:38.205
[SPEAKER_03]: Check out our meffercademy.io to get any I-Busess Cyber Security Training and our Mephrers managed framework.
55:38.225 --> 55:39.127
[SPEAKER_03]: That's my specialty.
55:39.547 --> 55:43.633
[SPEAKER_03]: And remember everybody, if you're watching, get 1% better every day.
55:44.154 --> 55:44.695
[SPEAKER_03]: Peace out.
55:44.855 --> 55:45.636
[SPEAKER_03]: I'll see you on the next one.
55:46.437 --> 55:46.717
[SPEAKER_03]: Peace.
55:46.998 --> 55:50.242
[SPEAKER_03]: Thank you, everybody.
55:50.262 --> 55:50.463
[SPEAKER_03]: Thank you.
55:50.483 --> 55:50.683
[SPEAKER_03]: Thank you.