Insights For Success

Strategy, Innovation, Leadership and Security

Job

What makes a good Chief Information Security Officer (CISO)

GeneralEdward KiledjianComment
boss-2179948_1920.jpg

Only five years ago, the title of Chief Information Security Officer was likely awarded to an employee that had worked hard and was dedicated to the company. It was an honorific title often given as a reward. Times have changed and companies need a new breed of CISO.

The number, severity, and impacts of cyber threats are continually increasing. Companies now rely on complex highly integrated IT systems whose confidentiality, availability and integrity are paramount. 

The WannaCry ransomware was a good example of how poorly managed security can cripple an organization. The National Health Service in the United Kingdom had up to 70,000 infected devices and was forced to turn away non-emergency patients. (1)

The CISO is now a senior-level business executive who can directly impact the profitability and viability of an entire organization. Instead of being a technical specialist, the CISO must now be a seasoned business leader that can become a trusted advisor to other executives within the organization. 

CISOs can help maintain your brand value, help build relationships with various stakeholders, and are charged with protecting an organization's most important assets (the digital ones).

The job of a true modern CISO is getting harder by the day, and organizations need to ensure they have the best CISO they can find & afford, to guiding them. 

If we agree that the nature of the CISO's role has changed and that the modern CISO is a very different creature than his predecessor, what makes a good CISO?

1 - Problem solvers

A modern-day CISO can solve complex rapidly changing problems under stress and high pressure. A CISO must enjoy solving complex puzzles while being able to juggle day-to-day tasks and driving the organization's long-term vision. The CISO must understand that every decision made today can have dramatic repercussions tomorrow. 

2- The CISO must be a people person

The modern CISO is often a front-line representative of the organization to shareholders, customers, partners, and regulators. They must have the ability to build strong relationships based on trust and respect. The CISO must have the ability to communicate complex security issues to stakeholders that may not understand even basic IT. The modern CISO must be a people person. The modern CISO must lead his team with fervor and engender commitment from the security team. 

3 - The CISO is a citizen of the world

Information flows without respective national boundaries, but companies are being asked to navigate complex global regulations that sometimes contradict each other. The only way a CISO can manage this increasingly complex regulatory environment is with non-traditional skills (for an IT person) that include law, business, compliance and governmental relations. 

4 - The CISO must be business minded

The CISO must make security decisions based on how it impacts the organization or enables the organization to perform its primary business functions. The CISO must weight security decisions against profitability, efficiency and must build a competitive advantage for the organization. A CISO must be obsessed with efficiency and must be resource conscious (people, time and money). Gone are the days when a CISO makes purely technical decisions based on technical need. 

5- CISOs tend to be workaholics

Even if work-life balance is all the rage, a CISO is always on call. Unfortunately, the bad guys never take a break and often neither does the CISO. It is common for a CISO to work long hours and weekends while guiding the organization to where it needs to go. The modern CISO is humble and respects the capabilities of his/her adversaries. A CISO must always be vigilant. A CISO is continually thinking about how he/she will keep the organization one step ahead of threat actors.

6 - Strong team building skills

CISOs work long and hard but so do their teams. A CISO must be self-confident enough to hire the highly skilled professionals the organization needs to succeed. I have met many CISOs who refused to hire employees that were more technically competent than them for fear of being replaced. This is the reflex of a "bad" CISO that doesn't understand his/her new role. A good CISO will hire the best resources he/she can find and them coach them to grow and become exceptional. The stronger the team, the better the CISO.

7 - Your CISO doesn't need to be certified 

Full disclosure, I do not currently hold any security certifications but I believe I can challenge anyone that does. The CISO is a business professional with security experience, not a security professional with business experience. 

You should rely on the proven track record.

Conclusion

The role of CISO is constantly changing, and the ideal candidate must also be constantly evolving.  I have been a security executive since 2001 and have seen the role of CISO morph from a backroom function performed by geeks, to a font of the house leader that can communicate with clients and regulators. The right CISO can drive business growth while the wrong one can sink your entire organization. 

Invest the time, energy and resources required to hire the right CISO for your company. If you have a CISO already, make sure he/she is the right one your organization needs right now. 

---------------------------------------------

(1) Ungoed-Thomas, Jon; Henry, Robin; Gadher, Dipesh (14 May 2017). "Cyber-attack guides promoted on YouTube"The Sunday Times. Retrieved 14 May2017.

3 secrets to using LinkedIn to advance your career

GeneralEdward KiledjianComment
Image by  Adriano Gasparri  used under Creative Commons License

Image by Adriano Gasparri used under Creative Commons License

LinkedIn has created a unique niche for itself amongst professionals looking to bolster their career. Read my article about The You Brand , and you may start to see opportunities to use LinkedIn as your personal self promotion platform. 

Related Articles:

Here are some of the elements you could use to improve your overall LinkedIn visibility and credibility.

Update Your Profile

Sounds pretty basic but it deserves a special spot here as the first suggestion.  Remember that LinkedIn is where potential employers go to discover who you are. It is often the first opinion a potential partner or employer will have of you. 

It is very important to remember:

LinkedIn is not Facebook, please stay professional

Make sure everything in your profile exudes professionalisms from the level of english you use to describe your positions to the picture you upload. You'll notice on my LinkedIn profile that my background (on the very top) is a serene picture of a forest. Chose something that describes you without going overboard. 

LinkedIn also allows you to add other content which may be relevant to your future job prospects such as whitepapers, images, presentations, etc.

LinkedIn Profile Tips:

  1. Have a well lit professional looking photo
  2. Have an original (non job title) tagline that describes your capabilities
  3. Have more contacts. Add anybody you have met to LinkedIn. There is something powerful when that 500+ connection number is shown on your profile
  4. When using LinkedIn for intelligence work, turn on anonymous browsing (link) to do it discreetly
  5. Linkedin in NOT a resume and shouldn't be treated as such. Consider it a living document that describes you. 
  6. It is important to update your LinkedIn status at least once a week. Remember to stay professional.
Image by  Sean MacEntee  used under Creative Commons License

Image by Sean MacEntee used under Creative Commons License

Blogging

Blogging is the great equalizer of the internet. Everyone has an equal opportunity to produce quality content and demonstrate their thought leadership capabilities.

In fact this article you are reading will be posted on my own personal blog at kiledjian.com and also cross-posted on LinkedIn using their blogging feature.

If your readers like your content, they can like or share it which increases your visibility beyond your own network.

Image by  Hans Põldoja  used under Creative Commons License

Image by Hans Põldoja used under Creative Commons License

Nurture your network

LinkedIn created the Connected app (link) and describes it as: " Because most opportunities come from the people you already know, and fostering genuine relationships can help you be more successful."

LinkedIn is telling you how important nurturing your network is... Are you listening? 

You want to be top of mind within your network. If an opportunity comes up, you want your contacts to think of you. Remember that 70% of jobs aren't posted so your LinkedIn army can help you get hired.

The secrets to acing that next interview

GeneralEdward KiledjianComment
Image by  Ed Dunens  used under Creative Commons License

Image by Ed Dunens used under Creative Commons License

Believe it or not, getting an interview is becoming harder and harder. The last thing you want to do is waste a good opportunity, so here is what you need to know to ace the next interview. 

It's an interview not a discussion

Regardless of how casual you think the interview will be, remember that it is not a conversation. Typically it is the roadblock to getting that better job with better pay, more benefits, increased flexibility or a better location.  There is a lot riding on your performance and I want to make sure you are prepared. So remember:

An interview is never a conversation, it’s an interview.

Remember that the interviewer has a lot of pressure to find the right candidate in a very short period of time (spending only 30-60 minutes with each candidate). Remembering this already puts you ahead of the game.

Preparation is your key to success

Image by  Chris Isherwood  used under Creative Commons License

Image by Chris Isherwood used under Creative Commons License

Good methodical preparation is the only sure way of hitting a home run. Before jumping to the following steps, take the time you need to prepare. In this case preparation means:

  • Find out the history of this job / job posting. Was this job held by the same person for the last 5 years or has it been a hot seat with a new employee every 3 months?
  • Find out about the company and specifically the office you are applying to. What do they do? How many employees do they have? What makes them different? 
  • Find out about your future boss. Who is it and what kind of person are they? What does his/her command structure look like? Do you know anyone in his organization or a related organization?
  • Find out about the interviewer. Who is she/he? What is their style? etc.
  • What are the companies values? What are their corporate social responsibility commitments?

Use every resource available to you to dig and go in prepared. 

Practice, practice, practice

Image by  davejdoe  used under Creative commons license

Image by davejdoe used under Creative commons license

In theory there is no difference between theory and practice. In practice there is
— Yogi Berra

I can't stress this enough. Chance favours the prepared. If you really want this job, you need to practice.

The first step of preparation is knowing your CV inside out:

  1. companies you worked for
  2. dates you work at each (day, month and year)
  3. what your title was
  4. what you did there
  5. the value you delivered to the organization, clients and shareholders

Once you know the above, you need to practice how you will vocalize it. This means practicing out loud while simulating the work environment. Practice in front of a camera, so you can analyze the words you used, the flow you created and what you were communicating non verbally. It may be tough to truly and honestly analyze yourself with a critical eye, but better to do it now and fix issues before you sit in front of the interviewer.

Examples, examples, examples

A picture is worth a thousand words
— Arthur Brisbane

You should prepare to answer the standard questions of :

  • why are you leaving your current job
  • why are you the best candidate
  • how did you generate value for your last employer

Make sure you prepare clear examples to illustrate your real world reaction to these questions. A question can be asked hundreds of different ways and your formal answer needs to be customized to the question but if you prepare a handful of different examples for different situations, you'll always be able to respond properly.

Find examples for each section (work, school and personal) of your resume that highlight your contribution to a certain activity.  Try to find enough examples to illustrate your strengths, leadership skills and tailor your examples to the companies values.

Remember that often interpersonal skills are more important than technical ones so don't forget to show some examples of how you handles thorny people issues. 

Have questions ready?

Image by  Duncan Hull  used under Creative Commons License

Image by Duncan Hull used under Creative Commons License

Assuming you did everything mentioned above, you should have various questions ready to go. A candidate that doesn't have questions is usually a cause for concern to the interviewer potentially showing a lack of preparation or interest.

You may want to know why this position has been advertised 4 times in the last year. Are the candidates leaving?

You may want to know about compensation, job flexibility, etc.

Whatever it is, create a master list and then sort it by audience. 

Ask the right question to the right person

Don't ask the HR person about on the ground questions. Those are better suited to the actual boss. By tailoring your questions to the right audience, you will look much more prepared. When meeting HR, ask them all the HR questions. When meeting a manager, ask them all about the "on the ground" questions.

7 non verbal mistakes people make during interviews

GeneralEdward KiledjianComment
Image by  Quinn Dombrowski  used under Creative Commons License

Image by Quinn Dombrowski used under Creative Commons License

Non-verbal communication can actually make up 70% of the message your are transmitting. It is much more powerful than verbal communications but much more difficult to control. Having performed hundreds of interviews, I have a list of the biggest non-verbal blunders I have notices during interviews that I wanted to share with you.

  1. Too much or too little eye contact -  Not enough eye contact and it conveys lack of interest or low self confidence. Too much eye contact can be seen as intimidating and frightening in some cases. During one 45 minute interview, the interviewee starred at a spot on my forehead the entire time blinking very very rarely. It made the entire discussion very awkward.The trick is stay relaxed and do as you would normally do.
  2. Inappropriate clothing - You should dress for the position you are applying for and the culture of the company. I was interviewing for a director position in a conservative multinational consulting company and the candidate showed up in a 1970's candy blue tuxedo.  In another situation an interviewee for an entry level PC field technician job showed up in a $5,000 Armani suit with crocodile skin shoes. How do I know? Because the candidate worked it into the interview conversation to ensure I realized what he was wearing. Do your homework and wear appropriate clothing. 
  3. Give me a normal handshake - Your father told you that a handshake quickly defines who you are in he was right. Too weak and it projects insecurity. Too strong and it exudes arrogance. As ridiculous as it may sound, practice your handshake strength with friends and family to find a happy medium. 
  4. Don't be tick man/woman - The interviewer knows being interviewed is stressful and we access that there will be a certain amount of movement because of this (movement often relieves pressure for the interviewee)but there are limits. Be conscious about your body, posture and movements. Don't tap your foot nervously on the floor, table or chair leg. Don't continually click and unclick you pen. Don't twirl your hair. It's good to have a normal amount of arm and hand movements as you are explaining your points but don't let it get out of hand (you are not directing an orchestra). Remember that you want to present yourself as an energetic but in control individual. Practicing your interview in front of a mirror or camera can help.
  5. You are not a statue - On the other end of the spectrum is the emotionless statue. These are people that have a completely blank emotionless presence during the entire interview. I had one of these and he gave off a serial killer vibe that quickly "killed" the opportunity for him. The modus operandi is be calm but engaged. A little emotion is a good thing.
  6. Smell nice not like a perfume department - It is a good idea to pick a nice smell and use it sparingly (cologne, perfume, aftershave, etc). First don't bathe in the smell. A few dabs or spritzes is all you need. Second please choose one smell and go with it. Don't mix different products each with their own smell. There was one interviewee that showed up smelling like an entire department store perfume section. He had used a handful of different smells on him (clearly) from body spray, perfume, deodorant, etc. I know because I asked. Why did I ask? Because the combination was so strong my co-interviewer and I sneezed for about 5 minutes.
  7. Other general recommendations:
  • Smile sometimes
  • Don't cross your arms, it shows you as being closed off

A survey of 2,000 hiring managers showed that most thought they could properly judge a candidate within 90 seconds of first seeing them. This shows the power of non-verbal cues. I would never make a hiring, firing or promotion decision based solely on non-verbal cues, they do play an important role in building an overall picture of the person being evaluated.  The key to presenting a positive and welcoming non verbal aura is consciously acknowledging these points and working on them to "put your best foot forward"

Related Article:

 

9 ultimate job search tips and tricks

GeneralEdward KiledjianComment
Image by  Alex France  used under Creative Commons License

Image by Alex France used under Creative Commons License

Whether you have been laid of, abused at work or simply need something new, here are 10 tips to help you find your next perfect job.

Preparation is king

Before starting the job search process, make sure you have the required infrastructure in place to look professional. Make sure your primary voicemail (attached to the number on your CV) has a professional sounding message (no music, slang or clichés). 

Make sure your email address looks professional and isn't something childish (e.g. [email protected], [email protected], etc). Ideally you should invest in your own domain name (which can be had with a hosted email service for about $20 a year). Some recruiters even recommend setting up a new email address to be use only for your job search but this isn't something I personally recommend.

Have a cell phone number that makes you immediately reachable and add that to your CV (instead of your home number). The worst thing that can happen is you are selected and the recruiter can't reach you.

Find contacts in the fields (jobs) you are looking for and ask them about their jobs. What is it like? What are the required skills? How did they find their job? Ask them for recommendations on getting a similar job.

Update the paperwork

You should be updating your CV a couple of times a year, even if you aren't looking for a job. During a job search, spend the time to critically evaluate your CV and ask trusted friends to also provide their honest feedback. You only have once chance to make a good first impression.

Use the PDCA continuous improvement approach : Plan, Do, Check Act.  Plan what you want on your CV. Write it. See how recruiters react and then make changes as necessary to solicit the required response.

Google yourself

Most recruiters will search for you on the internet as part of their funnelling process. Google yourself and see what comes up. If you find embarrassing items, try to have them removed by the site hosting the content.

Make sure you have an up to date LinkedIn profile with some (select) information showing on your public LinkedIn profile page. Here are 7 LinkedIn tips to help you make a great first impression and to help with your job search:

  1. LinkedIn Tip #1 - Customize your public LinkedIn URL
  2. LinkedIn Tip #2 - Create a profile badge for your blog or website
  3. LinkedIn Tip #3 - Your profile should be keyword friendly
  4. LinkedIn Tip #4 - OpenLink allows you to message non connected members
  5. LinkedIn Tip #5 - Export your LinkedIn contacts
  6. LinkedIn Tip #6 - Convert your LinkedIn Profile to a professional resume
  7. LinkedIn Tip #7 - Don't spam your connections with every update

I recommend you start a personal about you page. You can start by using a site like About.Me or setup your own personal blog (like I have at https://www.kiledjian.com). These sites are an opportunity for you to put your best foot forward. If you don't know anything about websites or blogs, setup a site using one of the hosted services like SquareSpace , Tumblr, WithKnown or WordPress.

Reference List

Most companies will ask you to provide a list of 3 references. You should already plan on who you would use and contact them asking for their permission and contact information. Never use an existing colleague or boss. Never use a contact without first asking for their permission. 

Ideally you brief your contacts on why you are looking, what you are looking for and what skills they may be asked to verify.

Use your network

Most jobs are found through contacts and not job sites. Use your network (friends, former colleagues, LinkedIn, Facebook, etc) to let everyone know you are looking. Tell them what kind of job you want and solicit their help in finding opportunities. 

Most jobs are found this way. 

Don't follow your passion

Cal Newport has written a book called "So Good They Can’t Ignore You: Why Skills Trump Passion in the Quest for Work You Love" (link) and says the most common advice he sees is to "follow your passion".  He says this is a fallacy and explains in his book how (through a study) people end up loving their work didn't follow a pre-existing passion and instead their passion developed as they got better at their jobs.

Be a good listener and journalist

My wife is was a journalist and her ability to extract information from people she meets is uncanny. A good journalist knows how to ask open ended questions that encourage the other person to talk and talk and talk. 

Practice being a good journalist and asking potential interviewers open ended questions to get them talking about the job and company. Find out who is hiring? Why are they hiring? What are the skills they are looking for? What does the ideal candidate look like? 

First you have to build rapport, then start your gentle interrogation. Once you start asking questions, become an active listener and pay attention to every nuance. Some of my best interviews were spend listening rather than pitching myself.

Be nice to everyone

I love talking to everyone from the administrative assistant to the janitor. Everyone has a story. Unfortunately I have seen too many candidates ignore these people when waiting for the main interviewer. My recommendation is to be nice and try to talk to everyone. 

Talk to the receptionist. Talk to the administrative assistant. Talk to anyone from the company that may pass by and say hi. Just be a nice likeable guy or girl. 

Learn to speak body language

Most candidates I have met don't spend too much time thinking about this but it is critically important. What are your non vocal cues saying? Take the time to read up on body language and then practice your's using a mirror.

Once you learn body language, you will also be able to interpret how the interview is going by reading the body language of the interviewer.