Do You Even Tech Anymore: Management & Leadership in Security?

good afternoon everyone welcome to be sighs I'm supposed to make an announcement that there will be a private showing for the hackers movie so if you just go to be sighs SSS org slash hackers to find out more information so without further ado let's welcome mark hillock for do you even talk anymore

cool thank you so just really quickly can everyone at the back see the images on the screen just give a hands up if it's good cool just conscious of the light so my name is Mark hillock I'm here to do a talk about even tech anymore which is essentially what some of the people who would be considered my direct reports often like to tell me as you can probably tell they literally do it because they know it's gonna like you know tease the hell out of me and annoy me so the talk is about the transition from being like an individual contributor so technologists engineer etc or whatever could be even a finance person into management and it's based on

my experiences working in InfoSec the talk split into five sections who what where quick introduction to me write games the security team at riot and then talking about hey you want to be a manager before we move into a story time section which talks about many occasions that I failed before we move into like from the what to the how which is literally we all know what to do we typically just don't know how to do it and then finally we're going to summarize the key points at the end in the post game section so who what where I'm the product leader security at Riot Games which means I'm the person accountable for the vision for InfoSec

or security and the execution of said vision there's five teams up SEC SEC ups riders which is corporate security platform security and then anti-cheat I've been working in info SEC for a lot of years hence the gray hairs which my wife loves reminding me about every day but I'll get over that this is my twitter ID but I typically don't use Twitter anymore but if you want to reach up a check it about once a week so quick show of hands who has heard the right games who has who plays video games who plays League of Legends okay Wow a lot of hands just on twitch who plays fortnight okay that's so many that means

everyone here is too old so if you play League of Legends you will get this is a fantasy world 140 plus champions two champions on the screen this is from a recent cinematic Riven and Draven if you play the game you will know that if Riven is anywhere ever close to driven that Draven is dead other than that it's a beautiful image I get to work in you know folklore essentially every day so for me it's pretty cool it's kind of like a childhood dream I never really thought you know playing shinobi on an Amstrad CPC 464 8-bit system tips Trek trying to copy one taped it all there that I could literally work in a in a

games company anyone here heard of eSports cool everyone here think it's like the work of the devil and stuff right so this is our like 10 year history season 1 basically shows a conference in Dreamhack in Sweden that's what the League of Legends world champion was all the way down the season 6 which was in 2016 in the Staples Center you've got like 22,000 people that have a kind of surreal advancement in year so that makes sense still blows my mind 2017 went to the bird's nest although wise known as the stadium essentially built for the Olympics in 2008 so yeah you can play video games for a living you can get a college scholarship you can

essentially get the same visa that you know someone in the NBA NFL maybe even the MLS although I don't know what you're going to play in the MLS but you know same visa right we have a lot of offices across the world 20-plus offices basically all continents apart from africa antartica we are owned by 10 cent which means we've a different kind of philosophy towards China that most people have a security perspective I mean this is the key statement like this is our mission everything for us is about the player and we actually walk the walk it's not just talk so has anyone heard of the poodle vulnerability from like 2014 okay so hands up if he patched

immediately right so we didn't actually PI to immediately the reason is is because a lot of our players playing on XP sp2 which means that you don't have the correct ciphers to support the correct version TLS you couldn't upgrade sp2 sp3 because it wasn't supported you couldn't upgrade from ie6 that I ate because that wasn't supported either so we actually sat down on those two security team we were like hey can we actually patch because if we patch will lock out millions of players for those of us in the Western world XP is like a distant memory but in in Asia it's still a very popular operating system and video game and see you in Asia

ultimately we did patch but I just wanted to use it as an example like hey we genuinely think of what's the most important thing from the player like we can't take the traditional security approach so how many managers to be on the audience how many people do we have that used to be monitoring or like stuff thought that okay cool totally legit how many people want to be a manager okay you crazy so going back to my earlier career the big thing when I did interviews was like hey what's your five-year career plan I was in my 20s like I didn't know I've no I just turned 40 I still don't really know what my

five-year career plan is and I don't really like these questions because I've never had a really good answer and the answer I get from a lot of people is like hey I'm going to be made engineer in year two and then two years later I'm going to be senior in two years later I'm gonna be in monitor and it doesn't really work like that I'm a huge believer in goals and measuring the goals like okay ours and stuff like that but I find these type of questions or you know this type of advice from your manager in order to be a manager or be a leader like not really very good I think it's much more important to actually

build a relationship context understand what the person wants to do and build it from there and Dan actually measure now when I did some research into like why people want to go into management these are typically like the four most common reasons does anyone think these are good reasons so typically these aren't like they're very short-term you're not gonna last there's always going to be something that's going to drive you like absolutely bananas you gotta want it for the right reasons which is which can be anything but for me it was really understanding that I want the people to grow I wanted to achieve more I wanted to like help others teach them you know things that I

made mistakes on that I don't really want them making and then ultimately it's really nice to see a team of 10 a team of 15 a team of 5 collaborate together and achieve a lot more than you could have as an individual person however prerequisite side with Pokemon if you're wondering why there's Pokemon here that's probably the wrong question I have a six-year-old boy I know like the whole Pokemon universe at this stage so unfortunately in in in our industry now you can go multiple different ways right so you don't have to progress your career through management and that's okay you can stay as an individual contributor you can become an architect like have a still a technical influence

but more holistic or you can go super deep in your tag can become a principal and when I was younger like these pots didn't exist so I think it's really exciting to see those pots and I think it's ok to say you don't want to be a manager right but ultimately if you do want to be a manager you want to get to like the price right you want to get to the endgame where your team is contributing successfully where they're collaborating and they're all in sync towards a common goal does anyone know what this is great answer $10 so this is actually legal Legends World Championship cool and then when everyone is collaborating you're essentially

going to be the leader you could be at the front or you could be at the box but ultimately I think your goal as a manager is to support your team always be there for your team and ensure that everyone's collaborating I'm ensure that there's two-way accountability but that's more difficult than it actually sounds so I'm going to take you into the next section now and walk you through some examples of where I I guess I made complete nutter scripts so please don't love so this is our most popular champion in the game everyone loves this guy it's called Teemo the mistake that I made is that I I guess if I look at myself and myers-briggs I'm one of the

doers I like to get stuff done if I see someone like taking too long I'm like I'll just take it and like do it by myself and then that's leading by example but it's not really leading by example it's actually hitting into like micromanagement it's damaging the confidence of the people that you're working with and it's not really set in an example which is something that you should be done so for those people that are managers would you say that management is the only half that you wear yes no okay so I was kind of hoping for a more immediate response but for me at times I've been wearing for huts right and that's because people have left

that's because business priorities changed that's because we may have had new hires and I needed the ramp load in your arse up but the problem with that is that you can't focus on any one thing so instead of doing one thing really well you end up doing four things average or really bad and at the start it's pretty hard because you people typically don't have the self-awareness to actually recognize that but as you get more experienced you're going to detect uh the other thing that is really recommended in hindsight is that when you become a manager like have a mentor have someone who's been a manager for a while like a senior leader in the

company or someone on the industry because when you talk to that person they have the third party objective our third party observation and they will actually recognize the things that you're doing because most likely made them in themselves but they're also they have an independent view and like even today I typically wear two to three hats but I've been doing it for a while so I can handle it a lot lot better but this is one of the biggest mistakes I made it to start trying to do too much and not delegating enough stepping back one of the other key learnings for me was like the weight of my words so in California people traditionally are not very direct in

their communication which for a European is very very challenging in Europe people will literally tell you exactly what you think what they think at that time so as a European coming into California that doesn't really go very well so I was a big learning for me but the more important point is holistically the weight of your words have a much bigger impact as a manager then as an individual contributor so as you become more senior in the company you know new people join more junior people are there people that don't have that like contacts about you they don't have that relationship with you so when you're seeing hey I don't think that work was very good that's literally taken by them

as I suck or I'm not very good and it also carries more weight because of your seniority so when you're given that feedback or when you're having those you know bad days it's really important that you figure out a better way to you know share the message or in some cases not share the message but for me like this was this was a big learning that as I became more senior in the company be it from an individual contributor to a team lead to a manager to manager of managers every step I made my role changed but the weight of my words also changed and I also interacted with an increasing amount of people that didn't know me so

they didn't have the context and how I communicated which when you have a dry sense of humor at direct communication does not really work in California I eventually figured it out otherwise I would have been fired so how many managers do one-on-ones and okay anyone ever feel like a 101 in one machine or your day is likely already won at once yeah it doesn't feel really good at the end of the day right where you're essentially listening to all the people's concerns and issues and you you don't actually get any time - I guess consider what people have been telling you like take it all in you're literally jumping from one one and one and in case you're wondering I

feel like Aurelia which is a smaller the lady I don't feel like the Scion so when you look at one on once and you google or you read books like saying Michael ops engineering blogs are is book like one-on-ones are super beneficial you get a lot of context even when you're like direct reports like hey I don't have anything if you just go for coffee typically something comes up and it's super educational and it helps the strength of your team however you can also become a one-on-one machine which literally means that you don't feel you're achieving anything you don't feel you're actually getting into deep work you don't feel anyone is listening to you because you're listening to everyone

else and you need to like schedule time in your calendar have focused time and for me that every time I change role the problem has happened worse because there's more people that want to talk to me and older people who previously had one-on-ones with me still want to keep those one-on-ones so then there are days that you go into work and you're like from like 9 a.m. to 5 p.m. I have nothing but one-on-ones and it's super hard to get out of because as humans we're not really good at saying no right because we don't want to offend people but the only way to do it is to actually say no as long as you explain the

context and give the impact of like your schedule that makes sense the the other thing that has been challenging as a manager is the amount of communications hopefully there's no one from slack in the audience okay I love slack I know quite a few people from a slack security team however if you do not use slack correctly it can literally like just take your whole day all right so you have an hour you're like I'll just respond to this message 45 minutes later right and then you can email coming in and then people have your phone number so they want to text you and then you're like I want to stay a little bit technical so I'm gonna

review pull requests I'm gonna watch this repo and it's like ting ting ting ting ting and then it's like where did the hour go and then you have drop drop buys even when you're wearing like the really big headphones and it's like Do Not Disturb unlikes is it up here people will disturb you but it's really tough because as the manager you want to be approachable right you want to be collaborative with people and you want people to come to you because the worst thing you can do is if anyone has ever dealt with performance management issues is like hey why didn't you come to me three months ago that this person on this team wasn't collaborating with you

so it's like literally a fine line that every time you change role or every time you harp someone you start the whole process again and trying to make sure that you're on the right side of the line trying to stay technical and watching every single repo is probably a bad idea probably only need to like watch ten ten percent okay anyone read this book do you like it so when you move from an individual contributor to a even to like a principal engineer and architect where you're like a team lead and you're not just concerned with your own tech but all the people's tech trying to get into like that deep work is super super hard and similarly moving

into manager it's also hard because you've got other people's challenges other people's issues to deal with and to support and to help them improve and to help them achieve their potential the concept of deep work also changes when you go from being an individual contributor to a monitor it's no longer like I'm going to sit and write code in C++ or go or it could be for example during this presentation so in order to do this presentation I had to block off like two to three hour chunks for several days for preparation for dry runs and the other thing I learned about my calendar this year is for four years at riot last four or five years I've had it public so

people could see what I was doing and where I was in the last like six weeks I've made a private that was I was not going well I was like getting invites all over the place so recently about four or five months ago I moved from leading like two to three teams to leading five to six teams and as a result I've influenced there were a lot more people and a lot more people want to like just grab 30 minutes but when you multiply that out across all the people that you're potentially collaborating with or that are reporting up to you it's just not sustainable and if you don't get to do deep work it's

not rewarding so doing like shallow work like going through your email going through slack the best thing to do is to actually schedule it so in this book Cal Newport talks about you literally have to schedule every minute of your day and that's like taking your own calendar back so that you can manage yourself so you can basically be in the right frame of mind to support other people okay so we basically know what we need to do but it's typically really hard to move from the walk to the how ultimately this is what we want we want a team that's having fun collaborating moving towards the one goal and in sync as you can see I have

really cool artists I have nothing to do with the creation of this stuff but I get this deal so Andy Grove said the Clayton Christensen in the mid 90s I know what I need to do I just don't know what how to do it and that was when Intel was being hit by AMD with cheaper chips and they were like hey we need to like come up with a new solution I think they came out with a Celeron so he he knew he needed to pivot the company he just didn't know to do so I'm gonna try and give you some tips on what I've done I think the most important thing is you need to monitor

self you need to figure out what is the most important thing for you to do what you need to do it and then you need to like make sure that your tools and your objectives and goals and and how you work every day's is lined up so you can manage yourself this is a typical sort of day as a manager otherwise known as chaos right so if you moneyed yourself though like you can stop this but it literally means owning your calendar owning your schedule saying no but at the same time ensuring that your people can work with you can collaborate and that you're still staying close enough to the team but you need your own focused time you need your

own separation one of the biggest learnings is being transparent and collaborative and this really means like making yourself available for the team explaining the decisions so if you have to fire someone for example that you're actually upfront and honest in terms of why the person has been fired if you're hiring similarly in terms of interview panels because not everyone is like a thumbs-up for the person coming on you got to explain what why your thumbs up while you're hiring the person my people don't mind being told no as long as they know why and the minute you start not explaining that or being secretive then that'll be the start to like losing the team so accountability this is super

important this is where you want to be accountable for your actions but more importantly you need to hold your people accountable so if you're delegating which you should do as a manager if you're asking people to do stuff you need to hold them accountable so you need to be explicit and clear on what they're doing and what they need to do and why and then you need to hold them accountable if you don't hold them accountable then they're not going to learn they're not going to achieve what they can they need to achieve however the more damage and aspect is damaging to the team if people see that people aren't egde of other people on the team are

not been held accountable that eventually leads the toxicity which is like just it's going to take you an astronomical amount of time to remove that toxicity from the team and it typically leads to like being fired now think about accountability is feedback really helps so feedback is a two-way system again remember your your words carry more weight so you have to figure out how to communicate it's not like you did a bad job you're not strategic enough in your thinking you really need to like approach the person from a learning perspective such as hey what was your thought process in terms of making that decision or I'm I recognize some of the things you're doing let me tell you

about something from my personal experience where I did something that was similar but had a bad effect now how do you think you would do that and there's also a couple models that you can follow for feedback it's like action impact desired outcome or you can do SBI which is like situation behavior impact and that's really bringing everything into the third person and making the feedback no one personal but also improvement focused so there's a Harvard Business Review in terms of feedback and how we used to be back so what do people think is the ratio of feedback and in most places so like good feedback improvement feedback and then it's roughly 0.75 2.8 to 1 so that means like roughly for

every 3 bits a good feedback people are getting 4 bits of areas of improvement that's not really successful it's a similar statistic for people that get divorced which take that in for a second the recommended ratio is for every one bit of feedback that you give for area of improvement you should be given 5 I wasn't hitting that so the other thing is you need to modify your approach so we all have done myers-briggs personality tests we're all different right that means world all different we shouldn't have the same approach for people here we manage some people need the far away approach other people's need to close up approach right now if you do the close up approach on

the wrong people they'll consider micromanagement or if you do the distant approach on the wrong people they'll feel you're not supporting them right so this is where emotional intelligence comes in and trying to figure out what's the best approach but you need to build that relationship in order to understand that we don't think of management as a practice we typically think it is like an end result or a goal or something that we just do but it's not our core thing we need to think of management as a practice in the same way we think of like I want to get better at Python I want to get better go I want to go to

the gym and get stronger right this means like self-improving studying getting mentors reaching out to other people and until we actually think of management as a practice then it's going to be diminished and not at the you know the standard that it needs to be has anyone heard of the Reid mace that go around texting so there's mixed opinions on this I've done a readme that I've shared across riot I've shared it with actually shared it publicly but it literally describes hey I'm not American I'm Irish I communicate in a certain way it's intended as an icebreaker it's been received really positively by people who report to me and people who collaborate with me and it's something that I work

with all any hires on and it's like hey here's how I communicate here's how I don't communicate and it's really to give context on on how I work but also because it's intended as an icebreaker I'm really looking for feedback and while I think about it when you're looking for feedback from direct reports or people who you collaborate with be really specific don't go hey do you've any feedback for me because that literally leads to like nope nothing and then three months later you find out something so it could be like hey when I did this thing X at that time Y you seemed like a little upset what can I do better and that will actually generate

feedback is it breaks the ice and encourages people to give you feedback and then thirdly it's actually so specific that it makes them think on the actual action that you did so summarizing everything together if there's four takeaways manage yourself it's a practice so self-improve reach out continue to study always be transparent and collaborative and two-way accountability and when you're looking for that accountability look for a specific feedback oh yeah we're hiring if you want to play video games and any questions I think I've few minutes I still have it because people keep oh sorry the question was I don't use Twitter anymore why so I've just found that it's like too noisy and it doesn't hugely help me I guess in the

earlier days I found a really good Club for collaboration but there's literally so much noise that it just takes the attention away from what I want I still check for direct messages because that's how some people communicate with me

so you'd mentioned that one of the things strategies they use to improve yourself as a manager is to find mentors if you work at a smaller company how do you find mentors and how do you build out your network to improve your management skills so context I haven't worked at a small company I guess outside of maybe MongoDB which isn't that small anymore so it's really through the industry like establishing relationships going to conferences I did a lot of volunteer work with like certs and stuff back in Europe and that's how I I built up contacts there it doesn't it doesn't have to be a monitor in your industry also it can be like from other industries I had like

my mother and I friends a family that had been like directors and stuff so I was comfortable asking them questions also I'm also happy to answer questions if you have questions specifically but I think it's really just about trying to establish contacts and three family friends are in the wider industry we have one last question what are the one or two resources you would advice to aspiring managers probably books so thanks for the feedback is actually a really good book a lot of the books that I've found that have helped me most of being around communication radical candor is really good just want to take your candor to radical principles by Ray Dalio is also really

good just in terms of amount of stuff that he's learnt throughout his life like that he shared I've heard good things about the monitor's path by calm Kamel fournier but I haven't read it what else work rules bylaws of a buck is really good talks about a lot of the stuff they've learned on Google the particular section on that that was super useful was wasn't the lessons that they learned with regard to interviewing terms of like how the brain teasers and stuff didn't work Michael ops engineer minder handbook is really good too and I think I talked about deep work thank you Mark for coming to speak at the sides and let's give mark a round of applause

[Applause]