BSidesCharm 2025 - Bridging Disciplines: The Role of Coalition Building in Cybersecurity

[Music]

All right, welcome everyone. Before I go into my presentation, I am a backup speaker talking about people skills and cyber security. And I think originally this room was reserved for AI and governance. So if you're here for that, sorry, but it's a different topic and I think you'll still get something out of it. And with that, my name is Tina Gacho. I'm excited to talk about my perspective as a former lobbyist who pivoted in cyber security about three years ago. And my goal is to demonstrate the importance of interpersonal people skills and how you can identify them and apply them to your career in cyber security or tech in general. This session will be less of a lecture and

more of an interactive session. So I don't want to talk at you. I want to talk with you and I'll also be asking the crowd for um questions and input throughout the presentation today. So just prepare for that kind of dynamic. As a business intelligence manager, I connect cyber security with business units to drive business outcomes. I focus on alignment between business focused security risks and the central security and risk function. And with that I want to note that nothing in my presentation is representative of my employer Haleyon and scenarios in this presentation are purely examples and not indicative of my personal experience there. Previously, I worked in state and federal government relationships and relations in Washington DC and I also

worked at a think tank in Santiago, Chile for a while as well. So, I've been talking about people's skills, but what are they? I feel like some people can identify them, not really sure, or they are aware of them, but just don't want to use them at all. This is a definition I found in a Forbes article, and I really liked it. And I also want to ask is this what this kind of quotation means to you? Is there anything about it that resonates with you when you read about what people's skills are in this slide? So anything that comes to mind when you see play well with others for example?

Yeah, that's a good one. Anyone else? Being able to read non-verbals. Yes. Great perspective. something that I thought Oh, yeah. Go ahead. Attributes versus competencies. Some of them are born with some of you have to train. That's a really good point. Attributes versus competencies. You guys are going level two with this. When I first saw this quotation, I just thought about playing in the playground with as kids and but really in a playground, I remember having to barter things. I wanted to, you know, push the tire swing all the time, but I had to let other people take turns. and you're just using those same skills that you did at, you know, sixth grade in the workplace now

and now just your salary is dependent on it. So, first I will reflect on some skills that I used in my former life in government relations and then general skills needed in cyber security that we're all aware of and I'm also going to have some case studies from my experience before I went into cyber security. And also I want to note that the skills here in this slide are probably obvious. I don't think anybody's surprised to know that assertiveness is a key characteristic for someone who is a lobbyist, right? Um, but I just kind of want to show what the environment was there and also the transition to cyber security. So, this is exactly what I thought when I got the

offer uh to work in cyber security. I thought, oh, no more. I can be myself. I don't have to plate anyone. And as soon as I started maybe day two, uh I realized that was not the case some things that I thought were needed in cyber security. Knowing what you're going to use, right? Knowing the environment, knowing the threats, um knowing how to be assertive because that is a trait that you do need and tech and just working on teams as well. But of course, you also need people skills. Whether you're working virtually, hybrid, or in person, in a sock center, you name it. There are collaboration opportunities in tech. So, here are some examples of

people skills. As you can see, this is not an exhaustive list. These are just some things that I wanted to highlight today. And I wanted to focus on these because some of these I feel are underrated like good manners and others I believe deliver high impact such as active listening. Are there other people's skills that are not on this list that come to mind to you?

Yes, absolutely. knowing when to apply sense of humor and, you know, fine-tuning the word sense, right? Empathy versus empathy versus sympathy. I would say both, right? Empathy and sympathy are both people's skills. You just have to know when to apply. It's the same thing as a sense of humor. You just need to know when to apply it to that environment. And ultimately, it doesn't come with a manual. It comes through practice with people. So some of case studies that I have when I used to work in government relations when I was in Santiago I worked for a Chilean think tank called Fundion Chile and as part of the team I was conducting research on the president at the time Michelle

Bachellet's first 100 days in office was less eventful than now and before the presentation I confirmed with my colleagues on how to pronounce names of the cabinet ministers that were in the room that I was presenting to because obviously they were in Spanish, they were not in English, and I wanted to make sure I had their attention, and I was being respectful of their names and the titles that they had as well. Now, as someone with a foreign last name, I can personally attest that this is very helpful in establishing rapport. Just getting people's names right can really get you a long way. And I also note that good manners are different culturally from the north or the south, the United

States. I'm originally a Texan and when I go home to Texas, I talk to people more than I would when Washington DC and I kind of say the hello, the good morning, how's it going before I get to the ask of what I want. And it's something that I have to keep relearning of not rushing into the ask. It's more of a conversational dance, if you will. And I think just having that in mind as people here, I don't know if everyone here's from the east coast, but likely just remember having to have that conversation with the person that you are speaking with and meeting them halfway. Another key skill here is honesty. People want to believe that

what you're saying to them is true. And if your work or your personality contradicts that, it's really hard to develop a relationship. And so I think of honesty as a building block where you are starting on a strong foundation. Once you kind of have a shaky foundation and you're found to be a dishonest person, it's really hard to get along with folks in the workplace. So just again something I think is underrated and I think it's very easy to do. If you don't have the answer, just say I don't know. I say it almost all the time at work. I learned it's better that way than pretending I did know the answer. Um when I worked in DC for an advocacy

organization for the actuaries, I was tasked with directing a financial summit. So this is another case study that I wanted to show here. are some of the things that I learned here a lot was patience because I was leading this summit for about 100 stakeholders and I had to have a lot of patience because the staff members didn't necessarily like each other but yet I had to make everyone focus towards a common goal of getting this thing out the door and so that for me individually meeting with the different people listening to them really trying to relay back to them what I was hearing so that they felt felt heard. A lot of times people just want

to feel that they're heard and um with that it was successful, went really well and it was the inaugural summit and I did get recognized in front of everyone. So that was really nice and it was nice to have the staff as on board as well. All right, so we're going to go into some sample scenarios. Now that we've reviewed some people skills at a high level, let's try to incorporate some communication techniques to solve some scenarios in cyber security. Now before I go the first scenario, I just want to caveat these are very high level and very hypothetical. Okay. All right. So scenario number one, you're one month in a new job and there's a significant amount of

employees, right? So nobody knows you. You are tasked with a project and you have to find someone in another department that you worked with to begin the project. What communication techniques do you use to find this person? Curiosity because yes, you do have to find out who this is. Yes. Um, you may think you have their name, but um, in a big organization, your line manager isn't available to help you. How about that? And your image just dropped on your lap.

Yep. Mhm. Yep. That's a really good one. And the go with the go and ask in mind, I put patience because sometimes it takes one or two or three people to get to the right point of contact. So you're asking the curiosity is applied here. You're using directory as well as a starting point, right? But ultimately, it's a big company and you need to find the right person and you just need to have the patience that you're going to get to that person. Another skill here is good manners. Why? You're one month in at a new company. Nobody knows you, right? So, like I said before, you need to introduce yourself. Hi, my name is Tina. And depending on who you're

talking to, they could be a chatty Kathy and you just kind of have to go with it to get to the ask before you get to the next person. They may even help you more than you realize just by having that good manners. So next one you manage a team of de developers and this never happens right the thing that you're working on change in scope and everything has a start from the beginning again as a manager of this team what do you do to support the team what are some people skills you can use here empathy for sure empathizing being motivating by pivoting to the common goal company mission statement team mission statement whatever it is But

making sure they feel heard with that empathy. Yes, for sure. Tacked. Yes. Depending on the environment that the team is in. Yeah. Exactly. That's where the empathy comes in. Giving them the room for that. And that's also the act of listening as well. Thank you very much. Exactly. Yeah. You're just you're just the messenger, right? um supporting them, letting them know they have an ally, right? Even if you can't control external stakeholders, you just let them vent. We all have this. We all go through this. All right, last scenario. Again, hypothetical. But if you were to speak with that employee that keeps doing it over and over, some things you can do. Ability to relate, right? business evil compromise

is still 85% right the point of entry so it's keep it's done because people keep clicking on it so just the ability to relate to that person and kind of beginning with yeah I know these things are really tricky motivating because you remind them it is a threat they're not supposed to do it and they are endangering the company's um information also offering motivate um training materials that they have internally or even externally, right? And then of course patience because it is annoying. Um, but working in tech, you have to just remember that with folks that are outside of tech, it's just a matter of kind of meeting them halfway and just having that patience. So that's pretty

much it. I hope you enjoyed this presentation. I hope mostly that I made you think about interacting with people and the importance of people skills in tech and in cyber security. I sometimes hold um reservation when people refer to people's skills as soft skills. I don't think they're soft skills. I think it's something you have to practice over and over again. I personally sometimes want to go straight to the teams chat and just say, "Hey, this is what I need. How's it going?" Like the how's it going can go out the door. I need this deliverable by this time. Can you make it happen? But I also have to remember because people do this to me. They'll

say, "Good morning, Tina." D. So, I've started saying the good mornings. I've started to say the goodbyes at the end of the call. These are like small things that I'm also practicing myself. So, I do practice what I preach. But with that, I just hope that with some patience and understanding of other people and ourselves that the workplace can be a bit more bearable and perhaps even pleasant. So, thank you. [Applause] All right, any questions? Yep. So, I actually was kind of excited when I saw that this got changed to the backup discussion because I think it's something that is a bigger issue in this community than ever. I think people wondering if you had any

experiences or advice on We can practice socializ How do you teach somebody who doesn't have a problem?

Yeah. Yeah. How do you teach someone who doesn't have strong skill set and people's skills to get them? I have this experiences. Well, one thing that I do is I give them resources. So, personally, I'm a member of a Toastmasters club. That really helps. I see someone with potential, I'm like, all they need is really just to help get that presentation going, speaking to somebody in a leadership level, but you have to practice it. So, I recommend Toast Masters for those kind of people. Um people skills overall they do need to practice interacting but it could be something as good manners taking one thing from that list that I showed earlier the people skills taking one

thing and saying try working on this just try working on this and just keeping it simple again it requires requires patience on your side and on their side is right because we're not all starting from the same level so my sort of echoing his sentiment and also the other side of that conversation. I recently started a position where I'm dealing more I come from a tech support background recently and started dealing more with like director level VP level people and uh sometimes they have a completely different way of talking to me than they do a director level person and part of that is because the director level person can say yes I can do that

for you whereas I have to say I got to talk to the director level person. Do you have like good ways of of saying that without saying it like that to where I'm like I don't actually have any power but you know I got your back you know. Yeah. Do you have a response? I feel like you do. Yeah. So

also negotiation also itself is going

My name

is not only professional level.

So going back to your questions what my former was doing was actually giving our software developers opporters.

part of that too. I

mean those people are

Yeah, I mean it goes back to practice. just, right? Cuz even if you're seeing it, the person who is speaking in the back, you can see it, but you still have to practice it with someone to actually get to that level of being comfortable speaking to a group of people. It's harder when you don't have the clout that the person above you does. Yeah. From my personal experience, what I've learned in that to help foster the credibility of relationship building as you said is to make it very clear this is what you're interested in because what are the options and here what I'm hearing you're interested in xyz and this is also like here are the

options available to you and if you're amendable then I can confirm with the director that this. So, it's almost like you have to have that early engagement and and also um you're having your boss director introduce people like in the room to say this is my right hand person XYZ. If you can't find me, this is the next decision. Like I trust them and I know that if there's a decision that they can't make at least the and then come to me for whatever. That's what I've kind of found where it also then reduces the the pain point of oh gosh now I have to wait for an answer or wait for my options they're able to get it right

then and there and then understand yeah that's the trick getting them to come to me I don't need them to send different emails they need to come to me and not to the security engineer to the director I'm the guy and so that's I have to tell I have to tell my boss like make my life easier for you. If you don't want questions, then start telling people that I'm your suggest.

Especially my location is agency. department will not necessarily mean the same thing. I I have been told that it is time. I do love the dialogue that's going on. Everybody's practicing their people skills. This is great. But this to your point earlier, I feel like this is just another instance of the cu of the importance of communication. Um we're all working with other people. We also have the power to empower other people to get those dialogues going as well. So I appreciate everyone attending this session and I encourage the conversations too. U maybe in the hallway so that the next speaker has the room but thanks everyone for your time. [Applause]