Building and Sustaining a Community - Mari Galloway

Without further ado, I want to welcome to the stage Mary Galloway. Thank you for being here. You guys can do better than that. Come on, get some energy, clap, do something, shout. All right, so so far we've had a lot of good information come out. Um, this is my first time actually in Albuquerque, so this is awesome. Um, I'll be back in October for the hot air balloon thing that you guys do here. Um as he said I am Mary Galloway I um I have a lot of experience in cyber security. I also work in the industry too. So I'm a professional um sales engineer previously network engineer all those good things. Um but today I want

to talk to you guys about um building communities sustaining them and then also just finding them. So one of the things that I wanted to ask first is um how many of you are first- timers? Like is this your first besides events? Okay. So, those of you that didn't raise your hand, make sure you greet one of these newcomers so that they feel welcome um in this community in this besides family. Okay. We're going to talk about that. So, um I don't have my notes up here because I don't know how to work a Mac. >> Um let me see if I can make this work. >> Go backwards. Not that I don't know what I'm talking

about, but anyway. So, I've been in the industry for 16 plus years. I currently work for a large retailer that sells sneakers and shoes um across the world. Um I've done everything from like I said uh sales engineering to vulnerability management to network engineering and all the things in between. Um so love the technical stuff but I also like to build communities. So let's start with what a community is. So in a traditional sense we're used to communities being where you live, where you're located. So this Albuquerque location is a community, but it's also a place for folks that have shared interests, common goals, um common values, various characteristics that are similar. So women's groups, minority groups, uh

folks that are neurodeiverse. Um community is not a new thing. We've had community since before uh communities were a name. We've had tribes, we've had crews, we've had villages where groups of folks came together to um Thank you. She's great, y'all. Make sure you guys say thank you to Ashley. She's awesome. To survive, to thrive, right? So, I wanted to give you a quick definition of that. And then, um like I said, this has been around for a long time, since the beginning of time. Um whenever someone says, "Hey, I can do this. They're lying to you and they hate their life at that moment because they're burned out with whatever it is that they're doing. We

thrive in communities. Um, as you can see, we're wired to connect, right? We're supposed to connect with people. We're supposed to share our knowledge, our our information, our resources with other folks. And it's a necessity to survive. back in the day people needed it so that they could outlive you know bad weather and wars and things of that nature and so this is something that we intended actually your phone died on me but that's okay. Um so the senator came up and told us some numbers and I said oh crap his numbers are very different than mine as far as the open roles here in New Mexico. Is everybody familiar with cyersseek.org at all. Show of hands, it's okay. If

you're not, that's fine. It's this great website called cyersseek.org. You go to the website and what you can see on there is a heat map of the entire country and it kind of shows you um the available jobs in a location and it can also break it down to specific regions. So on this screen here, as you can see, all the four areas for uh New Mexico, that's where the heaviest concentration of cyber security will 8,900 plus according to this website that are employed. So why is this important? Right? This is important because this gives you an idea of how vast the cyber security industry is here in New Mexico as a whole. And it also

gives you an opportunity to see where can I start to build a community or join a community or help sustain a community to help bring more folks into the workforce as the senator said to bring more uh professionals into the space to help keep more of us in this space. Um so if you're at all interested in cyber seat there's a lot of great resources on there especially for you new folks. Um there's like training pathways and job pathways. Um it's just a great resource for uh information. Um, so why do I do this work? I mean, why does this matter? When I started my career 16 years ago, um, 16 plus years ago, I'm older than I look. I'm only 29.

Um, I was isolated in my very first job as a network engineer. I was the only woman. I was the only black person on the team and I was the newest. So, I didn't have a lot of experience or knowledge in cyber security, in the tech space or things like that. And so I was always looking for a group that I could be a part of. Um, and so I don't want others to feel isolated, feel unwelcome. Um, because we need people in cyber security space. We're only going to get better. Uh, we've heard already that, you know, quantum computing is moving quickly, AI is moving quickly, and all of these things are moving quickly. So, it's

important that when we bring folks in, they feel like they can be here, contribute, and stay in the space. Um, so a quick story, um, and we'll talk about this here. Um, about four years after I got started in the industry, I was told that if I take the SEC or CISSP, I'd get a $20,000 increase. I said, "Okay, cool. Let me go study for this exam." You all are familiar with the CISSP, correct? Yes. Anybody hated taking it if they took it? Yes. Shake your head. Yes. I took it twice. I failed the first time by four points. Um and it was at my job as a network engineer that somebody said find a study group find a support system that

can help you study this. And so that's when I found uh the women society of cyber. Lisa was starting the organization. We were having um hands-on workshops every month for women to come and pack things reverse engineering all of those good things. And that's when I found my community, my tribe, my my crew in cyber security and I started to feel like I was at home and that I belonged in the space. So if you build it, they will come. So we're going to talk about today um is um a framework that we can use that you all can use to be better in communities, build better communities, find better communities. And so we're going to use the find build sustain um

method here. I did use AI to help me create these slides because well they do it a lot faster than I do. Um and so just FYI use AI for this. So what it means by finding is super simple, super easy. You find a community like these sites communities um like I saw there's a sponsor they have communities in the cities and you start to engage and contribute to those communities. You can also build one. So the founders that started to build conference three years ago. They said, "Hey, there's a need. Let's put something together in this area. Let's bring the community." And then it's sustain. So once you built it, you have to sustain it. That's the

hard part. Um I've been building Cyberjitsu or helping build Cyberjitsu for 13 years and I'm going to tell you right now, uh sustaining is the hardest thing because it comes down to funding most of the time. So if you build a community, make sure you keep that in mind. So let's jump in. So usually when you're looking for a community, you want to start with where you are. So what is it that you need in the moment in that season of your life that's going to help you be successful, right? So get clear on what it is you're trying to do. What is your why? What is it that you need um to level up or to get the promotion or

to even get into the space? Okay. Um once you do that, you can reflect on this and then start to for places that meet or resonate with that thing. So, let's say you're looking for accountability and you're like, where do I find a community that can provide accountability? I hired a coach for it, but you can find organizations um I'm not sure what's here in New Mexico, but look for groups on meetup.com um that align with that reflection. So, if you're looking for inspiration in the community, can everybody raise their hand if you're looking for like inspiration accountability um support with learning, raise it high. It's okay if you're not, just raise it high. So, for those of you that are

looking, connect with each other, right? It's a great way to find folks that are looking for the same things. And you guys can either find communities together or build your own together. Okay. Um, like I said, I needed a study group. That's how I found. That was the second largest um community that I joined as an adult. The first being my sorority back I won't say how many years ago, but a lot of years ago, when I needed that support away from home, I found a community then as well. Um, if you didn't raise your hand and you're still trying to figure out, okay, how do I determine what I need, what clarity I need, etc. This is a quick

self assessment that you can do. You ask yourself, okay, am I looking for encouragement and validation? If I am, okay, let me find a place where I can get that. If I'm looking for purpose and structure because I want to um go down a training path and learn how to be a CESO, find those kinds of groups that do that. I'm not sure if there's CISA groups in here or if there are any in here, but if there are, please make it known so that others can go down that path as well. Um, if you're looking for a safe space to ask questions, maybe you've been to an event and you felt really uneasy, uncomfortable, not in a

place to ask the question that you really wanted to ask. And so, you're looking for places like that. One of the things that we pride um at Cyber Jitsu is that you can come and ask us whatever you want. You can come how you want and be comfortable getting that information and that answer. So, quick self assessment. At the end of this, you'll have a document that will have all of this stuff in there. So, if you want to do this at home or whatever, just to kind of figure out where you fit in or where you want to fit in, you'll have that resource there for you. Um and then the last part of this foring

right before you go into the building is um lurking to leading. Now, I know lurking can seem really weird, but it just means observations or observing. So, don't get mad. Um but before you go head first into an organization, observe how um that organization moves. Observe the vibe of it. If it doesn't match with what you're looking for, it may not be the place for you. Um you also want to look how people are communicating and interacting in those communities. So, if you're joining their Slack channels and their Discords, are folks answering questions timely or is it just the same two or three people constantly talking and communicating? Um, is the content that they're sharing relevant to what

you're looking for? Right? Um, once you've joined, you've kind of lurked around a little bit a couple of weeks, you're like, "Okay, I like this route. Now, it's time to get in." So, start to contribute. Are you going to post on the Discord channels? Are you going to respond to post? going to share information. Um, are you going to join a committee to help put together events like this? Right? You got to start contributing to that community. You can't just sit in it and not do anything because then you don't get the most out of it. And then finally, um, as you're going through all of these things and observing and trying to determine whether this is a good group, you can

start to lead those initiatives. We had a number of members that would start um, they come and help out at the workshop and then they're like, I want to do a little bit more. And so then they would um start a chapter. They like, "Oh, I want to do some more." And we've had them rise through the ranks because they felt like they were empowered and they felt like they were giving back to a bigger cause. So in that fine stage, you can do all of those things and still contribute to the community. Uh so we found our tribe, but maybe we didn't, right? So now it's time to build something. We want to build. This is a

very big effort and do not do it by yourself. always have a team of people because one, it's just easier with folks. Plus, there's a lot of different and good ideas. Um, when you're collaborating with other people and it just makes building this so much more fun, right? You get to build with people you like that care about the mission, that care about the passion. Um, and so always remember to do that. One way to get started in case you're like, well, how do I start? What do I need to focus on? What do I need to do? There's a quick framework um that we didn't realize we were using but over time we realized we

started to use this to be able to identify what was needed for the members of agency. And so this particular model here um there is six phases of the work spaces but you can focus on one at a time. So this model is um let me see it's a humanentric blueprint to building and thriving. So when you're about this. You want to make sure your community um people feel seen. So that's support and encouragement. Um they're clear on why they're here or why they're a part of this community. That's the purpose. Um they're able to participate, you know, do they have access to your resources, to the people in the community, to the training, materials, etc. Um are they

connected to people? A lot of folks want to feel that connection. So does your community provide connections to others? um encouragement. Are we amplifying their voices, celebrating their wins, um lifting them up to feel like they're contributing to the space? And then structure. Um does this help them feel empowered to grow? Do we have the resources and the framework and the infrastructure in place to actually support our our community and those folks in it? So how you can do this? Um you can ask yourself, we do things like for support, you know, looking how do they feel supported? So we offer study groups, we offer mentoring, we offer coaching. So in your community, if you're putting providing support, what

types of things can you offer to those that are needed um for the purpose? Um we do events together, we do the flags together, we do workshops, we go to conferences together, and that's the purpose. We're here to educate. And so we're doing that through a variety of different avenues. Our folks access us on the website that we have LinkedIn, YouTube, uh, social media sites, all of those things, Slack. So, is your community going to be on those platforms? Is it accessible to those that need to have access to it? Again, the connection, that's training, that's having study groups, that's having uh conference events, volunteer opportunities, etc. And then encouragement and structure. So this part of it is a little bit different

than what the actual meaning is. We're focused on making sure folks feel that their accomplishments are being recognized. So how do you do that? We do amplify her WSC. And so whenever somebody passes a certification, whenever they get promotion, whenever they do something that they're excited about, we we amplify that. That's another way to keep your community members in the community and keep them wanting to contribute and give back. And then the structure, we talked about that briefly. Um Don't do it all at once. Pick one thing. Say, "Okay, we're going to focus on this right now. We need to get good at it." Do something else. But whatever it is, be consistent. Okay, we're going to skip this one.

Um, we talked a little bit about this already, but giving folks roles in your organization definitely keeps them engaged. Don't give don't give somebody new the role of COO unless they have that experience and they can do that job, right? Because they're going to jump in and be like, "Oh, crap. Um, but start small. Give them roles like notetaker or researcher like they're researching grants or programs or events like this to attend for the organization to attend. And once they start to see their success, then they'll start to be motivated to do more. You can start to give them more things to be in charge of. And ownership lightens your load. We learned this very early on. Um there was

five of us that were at the very beginning and we burned out very quickly because we were technical folks trying to run a business and your community is essentially a business. Um once we started to be like wait a minute stop we started to realize let's bring in the folks in the community and they can help us run this organization and grow it to where it is today. Um and if you're not familiar with women society cyber we are a cyber security community. We do not have a chapter here but I'm interested in the next great um but we provide training to women and girls and minority groups to get them into cyber security and that's through a lot of the hands-on

technical trainings the CTFs the lockpicking um certified in cyber security plus the sand certifications you want to prepare folks for that um we talked about this make sure you highlight your successes and your team successes okay and then this is my favorite thing to talk about is leveraging the local community. Um I was recently in uh SoCal last weekend for an event that was between ISSA, both of their chapters, OAS, both of the chapters in SoCal, Cyberjitsu and a couple of others. And they had a picnic and it dawned on me that hey, this is actually the best way to continue to expand and build your community partnerships with the local groups. So if you're starting your

community, make sure you partner with Besides Isafa, ISSA, any of the other communities outside in this hallway in New Mexico because that's how you your reach grows, right? That's how you start to get into those areas that you may not have been able to get to because your specific mission may not be directly related, but it's related around the way, right? You get to meet new people. You get to build your community bigger. This also works with noncyber security stuff just FYI. So if you're into I'm into Lego so I'm in a couple of Lego groups and into puzzles and so we have lots of communities um there as well and we go over connected and so you can use

these things very well. All right so the last part of this is going to be the sustain. So once you've built it now you have to sustain it. So you have to keep your members engaged. So that's what we mean by re onboarding often. So the experience your your members, your your partners, your whomever is coming to your organization has starts before they get into your doors. Once they get in there, that very next step is probably going to be your most important to keep them engaged and keep them in the loop. You can do this by sending out emails monthly. You can text message, you can call, uh you can host ask me anything

sessions. You can virtual networking, um, coffee hours, things of that nature to continue to keep your people involved. One of the things that our members love is in person, going to a bar, a happy hour, a restaurant, eating, talking about everything outside of cyber talking about cyber security. But keep your members engaged. Keep the folks that you're trying to support engaged and keep them engaged often. Five more minutes. Um, do you guys think about technology when you're working in communities or is it just about the people? So, a lot of folks would forget that it's people process technology. So, with that, you still have to make sure that technology is updated. So, if you have a

website, if you have, you know, Discord, Slack, or whatever, make sure you have folks that can come in and make sure that's updated. You don't want people that's new coming to your your page and like this is from like four years ago and it's not relevant because then they're not going to come back. So you want to make sure that you make time for maintenance. Hire interns if you need to. So y'all need pro any need projects. So get an internship program going. Boom. There you go. Um any business owners in here? Do you guys think about exit plans? Have you thought about an exit plan? So, we didn't either. Totally totally understandable. No one really thinks

about, well, what happens when it's time to exit? I went I went to a business training because I I still get coaching. And he said, well, what are you trying to do when you leave? And I said, oh, I wasn't thinking about that. I was going to do this till I die. What do you mean? Um, exit plan. What does that look like? How do you sustain your organization without you? And if you don't know, then it's time to start thinking about it. it's time to start looking at, okay, who can I build up in the community to be the next leader, the next set of leaders? Um, do I need to say, you know what, at

the end of 10 years, that's it. This is over. Let's merge this to somebody else. Let's close this down. And that's okay if you do that. A lot of businesses will last for 10, 20 years. And they say, you know, I'm done. Running a business is hard, y'all. It takes money. It takes resources. And so, if you don't have them, if you don't want to do that, what's the plan going to be next? And don't forget to build your leadership pipeline. Um, that's always a hard thing. It's always hard to let go of what you built, but sometimes if you wanted to continue to thrive, you have to let that go. Uh, and this is just some example

metrics. Um, obviously if you're trying to keep people coming, you want to measure your success. Measure what you've done, how you've helped people. Um, these are totally fake. They don't mean anything, but these are good examples of to measure on and share out with people, right? Besides can say, "Hey, this is our third year. We've hadund how many people, 300 people. This is what you're going to get when you work with us and invest in us and know your numbers. If you can spin your numbers off the top of your head, that's golden in any business conversation." All right, so right on time, too. Um, I did something for you all. You can scan this QR code.

It's not malicious. I promise it goes right to my website. It goes to uh the marygalloway.com to the store. I created a checklist for all of you that are interested in um having some kind of guide to help you figure out if you want to find a community, build a community, or sustain one. Um it's free to download for you all here today. And it's just a quick little guide that says, hey, if you're interested in finding, here's some things that you should consider. Don't forget to do these things if you're interested in building or sustaining the same. Um, and then couple of groups you can follow. Of course, I'd be remiss not to put Cyberu up there because, well,

that's what we do and that's why we're here. But also my friends at Black Girls Hack, if you're not familiar with them, they do all things uh related to hacking and penetration testing. They're in uh Vegas in two weeks, I think. Yeah, two weeks for Black Hat Defcon. Um, they do have a conference called SquadCon. Great time. lot of fun. They have a pool party as well if you like to swim in Vegas. There we go. Um, obviously Peace Life Albuquerque, got to have them up there. There's a community here. And what you can do here is work with the founders and build smaller events and activities throughout the year if you want to keep

the conversations going. Um, and then all these here across the bottom, um, I don't know if you guys are familiar with layer 8, um, but that's another conference. And then ISC2, they have chapters here, Isaka, all of those groups. So join those, look at those and contribute to that community. Your homework, you guys like homework, right? >> Love it. Because this is like day one, day two of the conference. I think day one and a half. Yes. Um so you've got today and tomorrow to do both of these things. Find a new community to connect with. You can find someone in here and see what communities they're in and start to join that. And then connect

with somebody new. If you're feeling a little extra froggy, a little like I can do this more, connect with three people today. Phone number, LinkedIn, email, whatever it is, connect with them and make it a point to call them later. You're starting to build your own individual community when you do that. And then of course, uh share your experience about the conference, about who you're connecting with, all of those things using that hashtag up there, build belonging. And then make sure you tag me. I think that's my tag on all of the sites. Um I know It's de Mary Galloway, but tag me in it and I'll share it out because I want to hear all

of your stories. We're going to skip that one. Reminder, start with one. You do not have to boil the ocean. Do one thing at a time. Find out if it's what you like and then move on to the next. And then I just wanted to throw this in there because um you can find a community, you can build a community, and you can help sustain it at this very same time. This is one of our workshops in um SoCal. I don't know what it was on. uh probably like AWS or something. But these kind of events also help you build community. And then if you want to connect with me, here's my contact information. Um I

should have put a QR code. I do do cyberc consulting and education as well as coaching. Um so please feel free to reach out. Um cyberjitsu's website is ba cyber.binga. It'll take you to the page. Hang out. If you want any of the books listed here, let me know and I'll give you a link to that as well. And that is time.

Wow, that was that was excellent. I learned so much. It seemed like every slide was just something practical that that we can do. I do want to make a plug for Chile. So, thank you for validating some of the things that we've been doing here. Chili Sack is a little bit of a community that people can connect to. Uh the banner is right over here. has a little logo. So, we invite you, Mary, to join Chili Sack. Yeah. And it's a community of community. So, thank you very much for being here. And one more round of applause.