Full Transcript for Andy Tosh: From British Army to Global Security Executive | Ep 09

security infrastructure at all. So totally it was like a blank template, so to speak. and it was, do what you need to do to support our business So the military was a very good foundation to move me into the private circuit then using that knowledge was sort of transferring it which was a little bit different, certainly from a military environment coming into the corporate world. There's a lot of different things that you need to consider and the customer that you're looking after and working for. And then it was a natural progression. I've been very fortunate over the years. I've had some fantastic leaders, great mentors, and it continues to be a learning experience as I continue with Baker Hughes. So nearly 20 years with Baker Hughes. 18 years as a full time employee. And during that time, I've looked after the Middle East, Asia, Pacific, Europe, Africa, Russia, Caspian. and then I developed and built a sort of center of excellence based here in Houston. then just by natural sort of transition, development, growth, I've been able to move into, the position that I'm in now, the enterprise security function for Baker Hughes. So it's been an interesting journey. and very, very fortunate to be where I am today. Michael Collins: That's fantastic. Thank you, Andy. I hear that it could be a difficult transition to the private sector. can you tell us a little bit more of what that journey was like if there was a learning curve? Andrew Tosh: Yeah, there definitely was. coming into Baker Hughes, which it's a corporate environment, as I say, there was a very small security team here, predominantly ex-military, ex-intelligence, and having myself literally come from the military into the private private sector. My sort of soft skills were completely different to what the corporate environment were. So I was very direct, very we need to get this done. Why haven't you got it done? that was a real steep learning experience was, these are your customers, these are who you're here to provide support to and to gain their confidence and show value. so the soft skills and how to Interact your interpersonal skills with some of the senior leadership that have been with the organization for 10-20 years, and I'm coming in at a very short period of time saying, no, you can't do that, you can do this. so it was a very steep learning experience with that The other aspect was it's a different tolerance to risk. You know, the military is sort of, we go in, we know the risk, and we're just going to get on with it. Whereas With organizations such as Baker Hughes, it's really what is the risk that we're facing? what is the business trying to achieve? And how are we going to ensure that we are adopting a safe, secure program for all of our employees across the globe? So looking at risk in a totally different lens was really interesting. I think working for many different people on many different levels at various positions of their career. And also my career. So it's really learning from them, understanding more of what's trying to be achieved, and ultimately trying to adapt to that. it took me probably a good two to three years to really hone my soft skills. I'm not saying I'm perfect today by any means. I know I can still be quite direct. But I I took a year's 360 evaluation as part of that growth and development within Baker Hughes. which was a really interesting experience to sort of not only look at your professional aspirations and how you manage things on a day-to-day basis, but how does your personal life build into that and how can you sort of make it all work together? So it's been a great experience, a lot of learning. A lot of growth, and as I said earlier, just very fortunate to have the right people at the right place helping me along the journey. Michael Collins: How important are soft skills, interpersonal skills, and what else do you feel is essential for leading a security organization? Andrew Tosh: I think soft skills is very important. we're actually a very small team, our sort of bandwidth across the organization is phenomenal. We have to interact with different business leaders. different functional leaders, employees right across the organization. So we have to be able to move our dialogue and our way of speaking with different people at different levels to make sure that we're getting the best out of people. without being disrespectful, people that work in workshop Manufacturing facility that are on shift work, So when you're trying to interact with them, it's really trying understand where their challenges are, what are they seeing, what are they hearing? And then it's sort of being able to sort of articulate that, but at a much higher level at an executive level. if there's issues going on at a local level or ground level, how do you then put that to an executive So I think soft skills not only for that level of interaction or bandwidth right across the organization, but it's also for your own team. to Work with different careers, different experiences. Different ages, different aspirations, different thoughts on how things are, and being able to hopefully, articulate yourself in a way that comes across as, yes, I understand, but we also need to think about this. in a way and I think it worked extremely well. Michael Collins: Yes. How important is the global experience? You've lived and worked in many places and the military background. How important is law enforcement and military backgrounds for corporate security and having that global experience? Andrew Tosh: I think years ago, and when I was sort of moving into the private sector, came into Baker Hughes, and I did work for some other service companies for a while, so I got a little bit of flavor of how they were structured and how the security teams were being managed. And I think traditionally there was a real impetus for former military, former intelligence, former police to be know the sort of foundation for that security because we

had experience of conflicts whether it's different risks different appetites and just different experiences so I think traditionally it was very very important I think today it's not so important. I feel that within my team we've got a vast experience of people. We've got all walks of life. Some are very academic, some are police, some are none of that. And we've brought them in and we've seen that they have attributes that we want within our team. They can bring a certain skill set. they have certain knowledge and experience. And we feel that's so much more beneficial than trying to keep with this traditional sort of you've got to be a military guy. you've got to serve ten years within the military to be able to cut the grade and make it to the team. That's not how it is today. I certainly don't see it that way. There's probably some organizations that still look at it in that format and that's fine if that's how they want to operate and build their teams. But I've certainly looked at it in a different lens. And we have such a very diverse team that I think it brings so much more which ultimately is enabling the business and making the business much more successful. Michael Collins: Are there any unconventional backgrounds that you've seen or sort of a pipeline of skills or titles, functions that do well in a modern corporate security environment? Andrew Tosh: I hate to say it, but there's definitely, from an intelligence background, I'm gonna say the reason is some of our programs have become much more intelligence led. we portray ourselves as being intelligence led and risk-based. That's what how we manage our things. And I think when we see some of the people that we brought on. I'm trying to think how we can how we can sort of tell you what the perception is of security to what we actually deliver. Michael Collins: Yeah, that's funny. That was actually my next question is maybe some misconceptions among peers or others in a corporate Andrew Tosh: Yeah, so Michael Collins: environment. Andrew Tosh: when I, used to travel back to Scotland, my neighbours, they'd say, What is it you do? and I'd say, I work in security or I work for, an energy company and and they'd say, do you wear a uniform? are you standing on gates and opening bars and things? So, I think that in the very onset of baker hughes probably that was where the focus was. We need to have security people to come in, we need physical security locations, we need to have cameras, we need to have card readers, we need to control people's access, etc. and I think that's where there's been a real misconception about what security is. and when we look at what we do for our organization, it's so much more than gates and guards. We have physical security, which is the perimeters, the guards, etc. That's a prime focus for some of our team. But then we have the intelligence piece. We have the analysts that sit on a 24-7, in 365 and they're looking at events that are going on across the globe and they tell us what's happening, where the trends are, where they're seeing things. And that allows us to then go to our business and say, are you aware of this? this is our assessment of what's going on. So there's crisis management, there's business continuity, there's executive protection, there's investigations, there's compliance, it's a very broad scope of what we do. And I think this is where, we like to be very clear, particularly even sometimes when we travel to some of our countries of operation, you know, when we say we're secure, they think that we're there to look after the guards or make sure the guards are doing their job, etc. And we will, we'll go and pay a visit But we are delivering so much more to our business than just the gates and guards. Michael Collins: Absolutely. How do strong security leaders give clear, useful recommendations in corporate environments where people are maybe cautious about overstatement, liability, and the ownership that comes with it? Andrew Tosh: when I go back to my sort of 360, that was one of the things about, how do you articulate risk? How do you convey to your business that you're gonna have to invest some money? when I first started with Baker Hughes in Nigeria, there had been some challenges within the country. And I had articulated you're gonna have to invest some money. and there was never any question about that because there'd been some challenges. But when you come to, let's say, North America or Europe, where the risk is really different, It's being able to articulate to the business: hey, we see some challenges here, some risk, some vulnerabilities, we think that you need to invest X amount to put these mitigations in place. And when the business is you know trying to create profit, revenue, market share, etc. sometimes they don't want to invest or it's a challenge for them to see it so it's really trying to understand yes the business is there to make money but also we are there To ensure that they can do that safely and securely. when I talk about my 360, it was something. That I'd not had a lot of experience with. I'd only been with the company about three or four years. the more that I saw what was happening up the the chain of the leadership in the business, I knew that it had to be a different approach to how we showed the business this is what we can do for you, but also there's an aspect where you have to invest in that so that we can continue to support you. it's got easier with time. And I think, with risk across the globe. things that we see, different landscapes, complexities of geopolitical risk and physical risk, personal risk. I think the investment piece is easier to articulate than maybe it was, 20 years ago. and I think if I talk about some experiences, I think the Arab Spring, during in sort of 2011, 2012, I'd only been in the Middle East a couple of years, and this was a real test for the business, but also for me. So it's really trying to gauge what is the

business doing, what's their priorities, and how are we going to make sure that everyone's safe? How are we going to make sure everyone's secure when there's uprisings and demonstrations and protests and all sorts of things going on in some of these countries across North Africa and the Middle East? So being able to sort of show the value, articulate how you do things and why you do things, but also why their money, how their money is gonna make sure that investment is going to return, on that investment and show the value. Michael Collins: Could you talk more about demonstrating value in corporate security? How do security leaders sort of prove or demonstrate when often it can be reactionary, like incidents avoided or loss prevented or threats mitigated, things that are maybe difficult to prove? Andrew Tosh: the biggest game changer for us, Michael, over the last five or six years is data. It's as simple as that. we historically we could say to the business we've had a number of incidents in this location. What we've done is we've implemented some restrictions or we've implemented some mitigations to safeguard. and we haven't seen any incidents since. Now, that in itself is good. The business can say, fine, great, thank you for that. but what we weren't really doing was to your point, is showing the real value of how we can interpret or show that to the business. So what we did about five six years ago, is we started to pool data together. So we started to look at, as an example, what's the size of our team? how many events happened across the year? how many times did we have a crisis management team stand up as an example to respond to that? what mitigations did we put in place? What was the value of those mitigations? and how many security awareness training sessions did we deliver on an annual basis? But how many did we actually reach? How many employees did we actually deliver that training to? So when you use all of those metrics, and KPIs and over time you can start to show where the difference is, and why there's difference to what we're seeing before to what we're seeing now, then that to me shows real value. And I won't go into specifics, but we have a system that we use where we feed information in. It's on types of incidents, not necessarily what's happening within Baker, but we see across the globe. we analyze that data, and then we set a benchmark of incidents being reported into this platform per year that is actually happening across the globe and articulate to that business. when this platform was made aware to the employees, the numbers of incidents being reported was phenomenal. But what we saw was we're getting a lot of real credible information. what's happening now is we're seeing less reporting. Because our mitigations and the way that we are putting measures in place to reduce those risks is actually making a real impact. So whilst we saw a real increase and a lot of incidents happening, the more that we've sort of listened and addressed those concerns, we've actually seen it's starting to drop. which is a positive, but also when we talk about that return on investment, the money that you invested last year is actually paying, it actually showing the benefit for it. showing that value articulating that value and showing something that's tangible I think is so important. Michael Collins: That's a helpful example. So we've discussed an intelligence led organization, data driven, the importance of interpersonal and communication across the organization. What else does a mature corporate security function look like today? Andrew Tosh: that's a great question. And I think, when I go back to, my sort of growing into this role, it's really better understanding what is the business trying to do. anyone can read about Baker Hughes, we've gone through, various changes and mergers and acquisitions over the years. Baker Hughes has changed, from the traditional oil and gas company to an energy technology company. And I think the way that baker hughes is projecting continues to drive that, it's an example to others. And I think the importance is for me personally, continuing to understand what the business is doing but also for my team to understand where their priorities are. where they're operating, where there might be some new ventures, where they might have some opportunities that they're looking at. So the more that we can understand what the business is trying to achieve and their priorities and their goals, then I believe that we're in a much better place to manage risk for them. Baker Hughes has gone through lots of different changes over the years the one thing that's stayed constant is our team and how we look after the business. You can bring on ten thousand more employees, we will still provide the same duty of care. We might have to manage things a little bit differently, or we might need additional resources, but our duty of care remains the same whether it's one person or whether it's a thousand or ten thousand. And we'll be there to do that. And I think we've been very fortunate over the years that as the business changes and the business evolves and it continues on its journey, we've stayed pretty constant to what we do and how we manage it and how we better understand what the business is trying to achieve. And I think for all my team, if they don't understand how the business is operating, where they're operating, then we have a problem because we're not providing that duty of care at an effective level for the business. Michael Collins: How important are external peer relationships to corporate security? Of course, it's inherently sensitive. Is it helpful to have, be a part of outside organizations or to speak with folks in similar roles in similar organizations? Andrew Tosh: I think every, you know, every security organization has a network. I personally, have a network, my own network. we obviously engage with other agencies, government, private

sector. We're part of different forums and organizations. We subscribe to different providers for information. and we as an organization, we look at what different awards and forums that we can contribute to and hopefully get some recognition. and so I think having external relationships is very important, but I also believe it's got to be to a level that you feel it's giving importance because there are, with all due respect, there's a lot of organizations out there that say we do this and we can tell you what's happening here. And that's all well and good, but when you sit on them, I don't really understand why I'm here. you're not telling me anything different than I already know. So I think you've got to really understand what is it you're trying to get out of this sort of external source or information. I have my network, I have the forums that I want to work with. And I think it's worked extremely well. But the benefit, Michael, is that my team has their own networks and they have their own people that they talk to. So just because I have quite a narrow view doesn't mean that we're very sort of insular in what we're trying to achieve or what we're trying to get. Because we need information, we need to know what the industry is doing, we need to know what other companies are doing, because if we're not continuing in the same path as them, we're likely to be left behind. So it's good for us to have our team, they have their own networks, they have their own forums and seminars and things that they go to, own sort of close network groups of sources of information, I think it's extremely beneficial But it's got to be managed well because you just don't want to get embroiled in things that are wasting your time I think we can't do without that external validation or sort of relationships. but we've also gone to different organizations that are looking for who are you as a function, who are you as an organization and how are you showing value. And we've put information in, we've won, we've got a lot of recognition, we've won awards, we've got certifications. So That's why we still need to have that external sort of validation and external connections and relationships. you've got to be very careful in how you do that. Otherwise you're gonna go down a path that you don't really need to. And your energy and investments being wasted on something that could be better placed somewhere else. Michael Collins: Absolutely. What other topics are top of mind for corporate security leaders, maybe apart from AI or executive protection? Or if you want to touch on those, please. Andrew Tosh: I think now, AI is everywhere. And I think we as a function are definitely interested in AI. We're interested in what it can do for us. and I think, as an organization it's something they're gonna be looking at as well. But certainly from what it can do for us, it's definitely going to sort of be a game changer, I think. Whether it's just from an efficiency perspective, whether it can sort of pull data together and help us better understand what's happening in various countries or globes or geopolitical aspects, But what we don't want to do is use AI as a piece to say, AI is doing this for us, so we don't need you. We always need the human element behind the lens to say, this AI piece is really good, but There's some inaccuracies or whatever. I think cyber threat, is definitely, Michael Collins: Mm. Andrew Tosh: something that I know many organizations will be looking at in today's world, with recent events across Iran, Israel, etc. And I think we have to be very careful on how geopolitical risk is impacting not only certain countries, but is having, a wider impact on things across the globe. Local policies, certain regulations we all have to follow from a security perspective, some of our sites, some of our government requirements. So those are things that we're regularly looking at and continue to focus on. And more importantly, physical risk, which is about people, it's what's going on in the country, and we assess this country as a high risk or a low risk But what does it mean for our people and our employees? So how can we ensure that we are getting the best out of our employees for what we're articulating. So we try and invest in our employees. we try to inform them what we do, why we do it, and then what we're trying to do is develop a culture where health, safety, environment is top of the agenda. And make security to sort of align with that. there are risks within HSE, but there's also risks in security. So what can we do from a cultural perspective to embody our employees to say, hey, I'll take responsibility for this, I'll make sure that we lock our laptops away at night, I'll make sure that we lock the doors, I'll make sure that we don't leave our kit in the car so if we can change that thought process and invest in our employees. And then I feel that we as a culture we're getting a better response from security. we look at, every year is different, absolutely, but generally people risk, physical risk, geopolitical risk, these are things that we keep on top of our radar. Michael Collins: How do cyber security and physical security professionals collaborate and communicate? In your opinion, what sort of best practice for how they interact? Are they largely siloed given the complexity and size of an organization? Or is there regular, you know, collaboration? Andrew Tosh: There is collaboration, Michael, with us. there has to be. and I would hate to think that, cyber is completely siloed and we do the same. There's definitely some synergies, there's some areas that we can overlap and we can support. cyber used to fall within our function, but then as things have changed, you know, digital technology, AI, all these different things, you know increased use of social media, etc. different platforms. Cyber is rightfully so, its own domain and focusing on that. Michael Collins: Looking out at the short to

midterm future, how do you anticipate that corporate security will evolve, maybe in the next five to 10 years? Andrew Tosh: so my philosophy is certainly from my perspective when I leave Baker Hughes, whenever that might be, let's say in the next five years, if I leave Baker Hughes, I want to leave our security function in a much better place than where it was. And I'm not saying it wasn't a bad place in any way, but I want to make sure that our Team is in a much better position to understand where they fit in the broader organization. So I think we've got to understand the strategy of the organization, we've got to understand tactically that means for us, and how do we support it? I think we as a function, as corporate security, will continue to be an important part of what the business does. And I think certainly over the last ten years, in my opinion, corporate security has become much more visible. At a higher level within the organization than it probably used to be. it's not just by my hard work, but it's through many other people who sort of are an ally to say this is what security brings, this is what you need to listen about, this is what you need to learn. So I think corporate security will continue to be an important part of large organizations, smaller organizations, providing you can continue to show value. If you don't, then I think the business is going to say we don't need it. And we're very fortunate. we have great leadership, very strong leadership, and support is what we do. And I think as long as we can continue to do that and again invest and show the value to them, then I think we're in a good place. But I think the world is such a complex it's so volatile to be honest. It's very fluid from a macro risk perspective, but also from a sort of very tactical, very country driven. It can be very, very different from one month to the next. And I don't see that changing. I think, different leadership, different agendas, different policies, I think that's gonna impact organizations. so corporate security should continue to play very important role in that. But I think technology, we're seeing technologies advancing what we're doing every day. We're looking at different ways of managing security and implementing resources and mitigations and things. So I think technology will play if it's not already, in some organizations will continue to play or will play a much bigger role in how security is managed on a larger basis, on a much bigger scope than what we are at the moment. Michael Collins: Looking back at your career, in security and your time in the military, is there a particular event that was memorable, something that you reflect on today? Andrew Tosh: probably too many to mention, but probably at the time they weren't that funny, but when I look back at it now, there's a couple of instances. I remember being in Iraq. I was in Basra down in the south. myself and a colleague had been visiting the military base and the military commander there. And when we were there, there were some rockets started coming into the camp. everyone was very calm about it, it's okay. and we're starting to think, you know, it's getting a little bit close. then what happened was the military guy said, Hey, we'll be back in a minute, we'll go and check what's going on. If you just stay here. And you can get a cup of tea. This guy'll make you a cup of tea. So we're thinking you guys are all disappearing, but you're asking us to stay here. And it was a very young guy there, probably a private or a Lance Corporal in the British military. And we went over to him and said, Hey, you're gonna make us a cup of tea. And you could see he was, really shaking when he was making the cup of tea. And we said, are you okay? And he was like, Yeah, it's okay. and we said, how long have you been here? And he said, I've been here only like a week. and I said, Okay, are you enjoying it? He said, Well, I shouldn't actually be here. I got on the wrong plane at the military base and ended up in Badra instead of Belize or somewhere else it was. So you know, that in itself, Michael Collins: my... Andrew Tosh: and the poor kid had to phone his mom and say, I'm not where I should be, I'm here, and etc. when you look back on it, it was quite funny. But the poor kid was, he was a nervous wreck trying to make us Cups of tea when things are sort of coming. The other, Iraq was another example. I was in Baghdad with a couple of colleagues. We were looking after a customer. We had gone through the sort of immediate action drills, if this happens, do this. If this happens, don't do that. And sure enough, later that evening, and there was a bar upstairs where our customers were, they were having a drink with some other colleagues. sure enough, some rockets came in very close to where we were. And the lights went out, there's a bit of dust and a bit of rubble flying everywhere. And obviously, we were like, right, we've got to make sure that everyone's okay. So we sort of moved up to where the bar was. Thankfully, no one was there. and we thought, okay, I wonder where they are. we looked around the building and eventually we went all the way down to the basement, which is where they should have been. But the interesting thing was not only had they left the bar, but they'd taken all the drinks with them and were stood there sort of carrying away. drinking way as if to say, it's all right, we're fine, don't worry, we've got our glasses of wine and boo here, so we're fine. So, some little things like that which always, when I reflect on things it could have been completely different, but now you look back and think it's pretty funny. some good things to reflect on. but there's you know so many. I I've had a fantastic career. I've had some great people. it's not been easy, it's been hard work in many cases. you've got really gotta put yourself out there. And thankfully I had some people that saw some potential in me, which I obviously

didn't see at the time, you know, 20 years ago, 15 years ago, and said, look, you need to do this. And I mentioned earlier, Michael, you know, when I left school, I didn't have a formal education. and it was probably about 12 years ago I was asked, or I was sort of Commented if you want to get on, it's probably best you get a formal education. So I then did, I did my master's with London University and completed that, at a time which was actually funny when you think about it. my wife was giving birth, or she'd just given birth, we were moving from the US to the UK. I was doing my master's, and there was some other sort of personal things going on at the time. You think, how did I actually manage all of that, and do a master's degree? you know that in itself was a great experience for me. you asked about misconceptions as well earlier. When I came to the organization, it was very apparent that having a education was very important if you wanted to progress. And I'm all for that now, I think it's great. but when we talk about that sort of misconception, we don't have to be military, we don't have to be police, we don't have to be intelligence to be able to support our business as long as we can understand what we're trying to achieve. But more importantly, a formal education, in my view, is not the be-all and end all. And I find that because we've brought some people on who are absolutely fantastic at what they do and have no formal master's degree or bachelor's degree. but you know, they have education, of sorts. So if you can find the right people with the right qualities and you know that you have an opportunity, to mentor them and guide them in the right path, I think that in itself can stand way above having. educational qualifications. And I've seen that, firsthand. Michael Collins: How do security leaders handle stress and the burden of the safety of their organization in their role? how do they empower their organization with the confidence of the safety that they provide? Andrew Tosh: Today there's a lot of focus on mental health, well being. and when we think about stress of what we do, we're not unique. everyone in our business is stressed, they have different goals and objectives and things to deal with every day. We're no different, it's just a different type of stress, different type of risk. And I think, as long as we better understand that and make sure that we can put that into perspective, we should be okay. But it's also making sure that we manage Our time, it's a high-pace environment. Baker Hughes, asks a lot of you, which is great. It asks you to grow and develop and lead and things, which is fantastic. But we also want to care about our people. So, for me, it's making sure that my team understands there has to be a work-life balance with what they do. some it may be very cyclical, you know, we have high periods of activity, and then there might be a little bit Of a calmer period, use that calmer period to sort of reset, reflect, take some time, take a step back and think, okay, where do I need to prioritize and what do I need to do? so it's making sure that you understand your team. I'm an avid believer that if you don't understand who the people are on your team, you're not going to get the best out of them. So if you can understand your team, if you can understand what makes them tick, what doesn't make them tick, and you can start to see where there's stresses and things, how can you manage that for them? So as long as we can continue to support them in that way, I think that we're in a good place. and again, having the confidence to go forward to your leadership. recent events across the Middle East is a prime example of saying this is our posture, this is where we are, this is where I think we need to continue to be. If you can instill that confidence with your senior leadership and your executives, I think you're in a good place. So, as much as the stress might be and the business is under a lot of stress to support our customers and continue to operate, as long as we can say, Hey, we might have some challenges here, but if we do A, B, and C and instill that level of confidence and reassurance and that we've got robust mechanisms in place, I think that reduces the stress overall and I think that works. It's worked for us certainly. Michael Collins: That's great. This has been fantastic. Andy, what are you excited about for the future? Andrew Tosh: For me personally, it's about the trajectory where Baker Hughes is going. it's an exciting journey. there's a lot going on and a lot that we can continue to learn. But also for me personally, it's the growth of my team and where our security function is heading with the advancements of technology, resources, etc. Michael Collins: That's great. Andy, I've really enjoyed the conversation. Thank you so much for your time and being available for this interview. Andrew Tosh: Pleasure. Thank you very much, Michael. Appreciate Michael Collins: Thank you