Managing the Assets of Your Security Career

hi everybody thank you for attending besides I'd like to remind you that there are t-shirts on sale that you can buy at the coat-check all the proceeds from those sales will go to charity you can pick the one you want your sell sale to go to I'd like mind you as well that there is raffle you don't want to miss it it's gonna end at 12:30 tomorrow the winner is gonna be announced at 1:00 p.m. on Monday also there are parties tonight happy hour is sponsored by Airbnb at 5:30 and there's yeah wait this is party sponsored by Airbnb at 6:30 okay it's two different items - okay cool yeah there's a party that you're a big very big party this is

great these help me up Kyle until Neri thank you like you said my name is Kyle Tobin er I've been at Salesforce for nine years and a manager for five I'm the director of our enterprise security team which is vendor security application security and a few other things I first started as a zoologist in my life and failed at that miserably so now I'm here you can see a fun little picture that are included and I'm also an art collector of 90s cyberpunk art so that I threw on some of my favorites there was awesome on this big screen one other thing to know about me I really loved strategy strategy board games especially and I think this really

informs how I operate as a manager a lot of the times I have a board game meet up that I've been running for multiple years is now the biggest board game meetup in San Francisco and so I'm very deep into the board games I love it but when I'm working I often think like I'm playing a board game and I ask myself what are the rules of whatever I'm doing and how do I win how do I'd win most efficiently and that was kind of where I got the inspiration for this talk was you know I think everyone should be strategic about their career growth I definitely have been and I thought maybe I could write a

talk about being strategic about growing your influence so what do I mean by influence I think to me influences the ability to change minds to generate respect within your organization to be able to have an impact on the people around you and as you grow in your career the expectations on your ability to influence will increase so when you're junior you know there's not a lot of expectation that you can walk up to a VP and impress them but as you get more senior to staff or director level it's basically a requirement you have to be able to do it as you get more responsibility you need more influence so I like to think you know if you want

to grow your career you've got to grow your influence how can you do this strategically how can you show improvement in your influence over time and manage this while you're doing all the other things that you're doing with your career one thing I like to focus on is feedback so feedback is often how people measure whether you've got influence or not when you're coming up for promotion your boss may say hi and it'll I need a list of names we're gonna generate some feedback your organization may have different rules like you know mandatory feedback from a certain set of people but it kind of takes this this form here the other thing I hate as a

manager is when I get out of the blue feedback about someone I haven't talked to you in six months and suddenly I get a request for feedback for you and I'm like I don't really know this person what I really like is someone who I have a relationship a strong relationship with when I get that feedback request from them I write awesome feedback because I know how important it is to their career so I really tell my staff you need to plan ahead for killer feedback you know you just got promoted you are gonna start working on your next promotion let's say it's two plus years away start thinking strategically now how you're gonna build up that feedback

set you need to get to the next level but something I hear pretty often is that relationship building is tough especially insecurity I think a lot of us end up in a lot of conflict there's a lot of escalations around what we do we're trying to convince people to do things that they don't often want to do that cost them time cost them money and so it can be difficult to build that influence with stakeholders and can also be difficult to build influence within your organization you've got a mandate it may be focused on a certain set of stakeholders finding that common ground with other security people in your organization can be tough especially if you're in a really big

organization and there's a lot of siloing but that's where we come to the crux of my talk here today I think the strategies of asset management can really help you work on your influence strategically and grow your career much more efficiently than you might otherwise so why do I think that well you know when you're working on your influence you generally have a large number of people that you're keeping track of you know you've got your team you've got other stakeholders you've got other departments within security it's a lot of people and when you're talking about a promotion there's a long time period between you know one role and the next role can be two years

it could be five years depending on where you are in your career so you really have to work on your influence over a long period of time and like I said you've got lots of priorities and you're not just there to make friends and get feedback you've got security impact that you're driving so sometimes getting feedback getting visibility is a secondary thing you know you're focused more on the impact of your work as you should be but you have to keep in the back of your mind that that impact is going to be critical at the moment when you need it so when I talk about asset management I'm talking about people here the people that you are influencing are

your assets and I think you can track them more efficiently so let's dig into what I mean I believe very strongly that you know at the outset of a new moment in your career say you just got promoted and you've got new responsibilities or you've just started a new role you really need to identify who your assets are or possibly where you need assets and don't have them so you know variety is very key here you need people within the security organization you need people outside of the security organization you need leaders within your vertical depending on the size of your security team you need leaders outside of your vertical and you have to build all of these relationships over

time some of these can be really hard depending on the role that you're in I know for my team enterprise security we're very business focused so building business relationships is a piece of cake before the people on my team it's with insecurity where they're often not overlapping roles that it can be really hard so we really have to be proactive with our security partners to try and build that visibility within our team also you know discs and very company the company you know Salesforce has certain requirements on the kinds of feedback you need going into a promotion for certain levels your company may have different requirements so I think identifying what those requirements are upfront so they're not a surprise later

is really effective the other thing you might notice is what if you have some gaps here you don't know a manager really well outside of your direct manager in the security function well then you know okay I have an area where I need to go in and identify an asset but once you've got that asset list what do you do next I recommend fingerprinting your assets I think you need to know a lot more about them and then you're probably tracking day to day and there's some reasons to this that I'll get to but I think it's important to know what role they play to you or they appear of yours or a leader and then rank varies company to company

I see that as like one being you know CEO 10 being any level finding out where they are and the hierarchy is important because many companies have hierarchy requirements for promotion so some people may not be as effective in terms of feedback for your promotion as others are also knowing whether there's security organization or not prioritizing them based on your needs you know where you are your career currently and then I think it's really important to be honest about the status of your relationship with people ideally you want to have a great relationship with everyone but in a in a company in an organization especially when you're in security it's not really realistic but I think it's important to identify

some people that you maybe don't have a great relationship and target them and really work overtime on approve improving their opinion of you because I know when you get into promotion conversations as a manager it's really powerful to hear someone say you know I really like this person at first but they kept working on me they kept showing me how good they were and I've turned around I love this person now that means a ton in a promotion conversation and goes a long way you also want to track when you're talking to them so how do you use this info once you've got it then you want to monitor your assets and this is a little

more manual than traditional asset monitoring but I recommend blocking your calendar I do mine thirty minutes every four weeks but you could do it as often it's two weeks depending on how often you need to do this kind of thing but you want to look at that spreadsheet of people you've put out there and you want to think about how is that spreadsheet changed a lot of times people get promoted people leave the company people take on new responsibilities or you've just had hallway conversations that when you look at someone's name in that sheet you go oh man I should talk to them about what I just heard this could be really interesting opportunity for both

of us and that's the next thing to do once you've you know spent that time looking at those people is identify opportunities where you can collaborate with those people either reaching out if you haven't spoken to someone in a couple months get coffee with them look at gaps you may have in your coverage organizations change very rapidly people leave the company move on you may need to go and find a new manager because the one you had a really great relationship just went somewhere else promotions are also key too because when people get additional opportunities it is a great time to connect with them both in terms of project opportunities just understanding what their goals are and

you know as they get a bigger promotion they are more interesting in terms of feedback for your career as well so this is how I do my asset management I've been doing this for about six years I have a Google spreadsheet that I spend 30 minutes with every month and I track every one that I'm working on over time and it has been super super effective to me I really like this approach so I thought I'd just share it with you here I'm gonna pop over here that look okay yeah I used random Star Trek data here I didn't want to show you actually the people I'm talking to in my organization but theoretically here I'm a security engineer under Worf

maybe I don't have a great relationship with him because it's hard to have a great relationship with Worf but you know there's a lot of people within the enterprise that I want to influence in order to grow my career and I can track that here so looking at this spreadsheet now I might think well Wesley Crusher is new to the bridge maybe I should spend some time with him he seems pretty smart so I might look at this and then go into my calendar and reach out and schedule a meeting with him I also have a couple other tabs that I use I've got an external one which I didn't populate with with data because

sometimes you're trying to influence people don't work at your company and I also have an archive because a lot of times people will leave your company you'll scratch them off but there's boomerangs it happens all the time especially you know I've been at Salesforce for nine years yeah Amar'e's waving he's a boomerang they leave and then they come back and then you should just throw them right back into the roster and get to know them again because they will be your friend so you've got this spreadsheet now you've got people in it you're you're targeting them for conversations for coffee for opportunities I just thought it might be useful to talk about a few tips that

have worked for me over the years using this strategy to make the most of the people that you're spending your time with or that you're investing your energy to befriend and turn into an asset so I think collaboration is really really really important even when it might be faster for you to do something on your own by yourself and I'll tell you a bit why collaboration tends to create opportunities even where you wouldn't expect it so let's say there's a project you know a scripting project you can knock it out on your own but if you invite someone in to participate with you you might teach them something that could be really useful to them they

might have ideas about that project that you didn't even think of but oftentimes though they think is most exciting as you knock out a small project with someone and then the ideas that come for follow-ups projects that you didn't even expect what at the outset where you wouldn't even got there if you didn't partner with someone the other thing that I think is important here is the chance to expand your impact you know when you bring someone else in they've got a different perspective they may have a totally different job if they can apply what you're thinking you know if you have some automation in mind and they can expand what that automation can do

to their department as well you are not only influencing that person in that organization but you're a driving additional security impact which is super important and you might learn new things from these people so once you're collaborating this is a very very important step at least to me you and this person let's say me and Emmerich is he's sitting right here in front of me me and Emery are collaborating together and we've got great visibility between each other you know we both know exactly what we're doing but that isn't always useful when it comes to promotion time I can get feedback from him but what I really want is feedback from his boss and he may want feedback from my boss so

this is something I like to tell the people who work on my team your boss and your boss is time or a currency that you can spend you know someone on my team can come to me and say hey I need your attention on this thing so I recommend leveraging your boss as currency in trade for access to someone else's boss you can say let's send a status email talking about the work we're doing together to your boss in my boss and let's make sure that we each get the visibility we need someone up the chain so that when it comes time to promotion I have access to feedback from someone at a much higher level than if I just

stuck with with them right here all right one more silly trick that I think is useful email filters are a great way to prioritize the people that you're tracking you know there's a lot of noise we all get a ton of email we may not always keep up on it but with a you know 15 minutes of work you can add everyone you're tracking to an email filter that pops them into a special gmail box where you see it immediately at the top of everything else this can greatly improve how you respond to these people how you manage these relationships over time make you seem really be consistent to them which is important you know everyone's a priority when

you're in security but when you're working on your career you also have to really prioritize the people who are going to talk to your boss about how effective you are so in conclusion I think it's really important to approach building your influence strategically and you can do it like I'm doing it you can throw people in a spreadsheet you can treat it like asset management and you can be consistent with these people over time by monitoring what they're doing watching the changes in your organization looking for new opportunities and taking advantage of those to build your career finally I think everyone needs to collaborate more often I say this the most in one-on-ones find people to collaborate with outside

your organization because it will really drive your career forward more than you think and you will get great value out of that influence that you have not just in your department but in other departments as well and that's it thank you very much and if you want me to work on your career I'm also hiring so you can come and I'd be happy to help and I'm happy to answer questions too and I put this in here because I wanted to see how it looks really big that's cool yeah yeah so I actually think that's we're adding some structure like this can really help you because it's a reminder to challenge yourself you know if you're looking at your sheet and

you're being like oh gosh I've never talked to this person that I really want to just put together a quick email that says hey I you know I really value what you're doing with your career I think it's really interesting would you have time to get coffee with me that goes a long way you know and if you're just reminding yourself constantly you're gonna push yourself a little more than you might otherwise if you can put that you know that need way off to the side and not pay attention to it question from slide oh yeah anonymous is wondering would you say asset management in quotes is difficult for underrepresented minorities including people of color and women do you have

any specific advice obviously I'm a white man so I don't have a ton of perspective on that question but I do think it can be challenging especially in an organization that doesn't have a lot of underrepresented people I think you know finding you know that could be another lens you put in your asset management it's who are some people that inspire me within this organization that I can reach out to and spend time with and maybe will give me career advice and opportunities that I didn't have otherwise I think that would be a great thing to do sure over here yeah yeah just ask I yes I believe the slides will be posted and I put in a URL link to the

spreadsheet as well so you can just grab it I'll put it on my Twitter that'll be that I'll do that in like ten minutes another question from Jeannie so you're having coffee with one of your assets what's your goal in that conversation trying to get them to advocate down the road for pure promotion questions so I think that's a really good question because you don't want to be super mercenary about this going back to the head of my privacy team is somebody that I've known for six years and she's in my asset deck and I hope she doesn't watch this as I talk about her but I have frequently kept in touch with her over

the years just asking what are your priorities what are you working on right now what is scaring you in the in the company because I can get a lot of interesting ideas just by spending time with like that and if I see a problem that I can solve on her behalf I'm absolutely gonna jump in there and do it because that is a great opportunity to both make an impact at the company but also help someone I really like and build up reputation and influence with someone who can help me in my career as well yeah totally so how do I make time for it Oh repeat the question so well the first question was how do you make time for

something like this when you're really busy I think or when the other person is really busy that's even harder so going back to this slide I think this is a really important strategy in those scenarios you can start by targeting someone who isn't as busy and work your way up the chain so if I know that I want to target someone's boss is someone that I think could be really important spending time with one of their direct reports is a great way to make yourself valuable and I pay attention like a lot of attention to the people who are partnering with the people who are on my direct team because I really like that they're seeking out collaboration

finding ways to help my team have a greater impact I think that's really really important and that's what makes me prioritize someone like that did that answer kind of both your questions at the same time I'm happy to talk after two we have one more question from slide Oh from an ominous the wood units would you not seem oh sorry would you not seem that focused or less professional scheduling so many meetings in coffees as a technical engineer who's not in your minute as a technical engineer was not in management that's a great question so I didn't jump into a lot unlike what is the time frame for this you know I've been at Salesforce over nine years so I stand to

tend to think in really long ranges I don't expect you to be scheduling a coffee with every single person every week that's absurd they're not gonna have the time you don't have the time I tend to think like once a quarter for some people once a month for others it depends on how often you're spending time with like if you're working with them on a project great meet with them a lot if it's someone like an exec over a function that you're partnering with once a quarter maybe once every six months but having some kind of touch point at some point well before you're going up for promotion is super important nice yes to all of it and

sometimes different priorities for different people so like when I'm meeting with when I'm meeting with Mr a right here he's in the product security organization and I'm in the enterprise security organization I'm trying to meet with him to talk about what are areas where our teams have overlapped where we could potentially have a project together that would be awesome I'm not trying to get him to like me I'm just trying to do stuff with him that will be effective for our organization yeah I know you don't like me but there are some people where you know maybe I know that someone has been sniping at me by email or you know talking about me behind my back I might reach out to that

person just to be very very blunt and say you know I don't think we got off on the right foot water you know what we do to improve our relationship and I think that's perfectly valid to do [Music]

Chris you're in my spreadsheet yes yes it is important I think to have a few contacts outside of your company you know you may want a job at some point in the future somewhere else and so maybe you maintain some relationships with some people that you think might help you in that arena or you might want to speak with someone tomorrow about vendor security and so you might have them in there reach out to them on occasion yeah fair question so the question was how did I fail from zoology into security which I think is a really interesting story that's longer than this then longer than the amount of time I have but I would

say I hated zoology a lot I thought it just was too manual for me at the time I really liked computers a lot more and my interest in security has always been about just breaking things and so I I'd love to talk to you afterwards I'll tell you the whole story cool anything else all good all right thank you thank you thank you so much girl [Applause]