November 6, 2024 • 30 mins
Unlock the secrets of a successful career in cybersecurity with our guest, David Gee, a recently retired industry veteran and author of "The Aspiring CIO and CISO."
Amazon: https://a.co/d/9FCsBQR
Packt (includes a promotion for the e-book version!): https://www.packtpub.com/en-us/product/the-aspiring-cio-and-ciso-9781835469194?srsltid=AfmBOooJFrNzjkRT_cLx3ux-ErfFownjl1EMB-dTupfrpBtI7QMw8103
David takes us on a captivating journey through his diverse career, sharing transformative experiences from working across the US, China, Japan, and Australia. Discover how he navigated the complexities of being a CIO and CISO in different industries, and learn from his unique insights into continuous learning and adaptability. David also unveils the SKB (Skills, Knowledge, Behavior) assessment tool he used to foster talent development and promote diversity at Eli Lilly Japan.
In our engaging conversation, we discuss the evolving role of a modern CISO, where the balance between technical know-how and soft skills is crucial. David, Cody, and Aaron dive into common misconceptions about the CISO role, particularly the narrow focus on technical skills alone. Through anecdotes about bot attacks and the Colonial Pipeline incident, we highlight the critical need for strategic thinking, stakeholder management, and effective communication. These stories underscore the importance of having a well-rounded skill set to thrive in the cybersecurity realm.
As we wrap up, we reflect on the art of making career decisions that resonate with one's passion and promote long-term growth. The implementation of SecureCard Warrior at HSBC serves as a case study for setting clear objectives and achieving data-driven outcomes. David generously shares personal insights about aligning career choices with personal values and finding true fulfillment. Join us in this enlightening episode, where we celebrate David's global perspectives and express our deep appreciation for his valuable contributions to the cybersecurity community.
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:06):
Thanks for tuning back in to Simply Solving Cyber.
I'm Aaron Pritz.
Speaker 2 (00:09):
And I'm Cody Rivers.
Speaker 1 (00:11):
And today we're here with David Gee, who I was
honored to work with a number oftimes back in the day.
I think I first met David whenI was working at a large
pharmaceutical company, eliLilly, and if I remember right,
david, I was on a audit in Lilly, japan if I remember right, and
we met there and then got achance to work with you years
later when we were both in theUS affiliate.
(00:33):
So nice to see you again.
I know we've kept in touch, butnice to see you and, more
importantly, have you on theshow and give some others a
chance to hear a little bitabout your journey and your
background.
Speaker 3 (00:45):
Thanks, Aaron.
If I recall, that was probablya Sox order, if I recall rightly
, and then Sox was a big thing Itried to avoid the
Sarbanes-Oxley.
Speaker 1 (00:52):
I was the privacy guy .
Speaker 3 (00:53):
Oh, okay, got it.
Speaker 1 (00:54):
Yep, yep, yep, awesome.
Well, david, we always like tostart out with the backstory and
obviously the high points,because you've had a long,
illustrious career.
But tell us a little bit aboutyou and then we'll want to make
sure to touch on the new book.
You've recently retired andwrote a new book that I have on
my desk back here called theAspiring CIO and CISO, and I
(01:18):
know it's done really well witha lot of interested people and
kind of advancing their careerin this space.
Speaker 3 (01:25):
Thanks, aaron.
Look, I've retired about 100days ago and so I think the
book's been on sale literallyI've flagged it for a minute for
100 days and, as you can see,it's all about.
You know people who aspire tobe a CIO and CISO and for me it
was part of my journey, and somy battle scars are actually
things I put in the book, and sojourney and so my battle scars
(01:46):
are actually things I put in thebook.
Um, and so I think one of thethings I've alluded to is there
is sort of I had this sort oftransformation career.
I've been sort of atransformation, cio,
transformation, you know, cso,and and transforming myself in
terms of working in differentindustries, and so I'm a bit
unusual, I guess, in that regard, because I look back at you
know, I've worked in, uh, fivecountries the US and China and
Hong Kong and Japan, a couple oftimes each, even in three
(02:10):
cities in Australia and across.
I've met life and insuranceLilly, you know, ceo in the US,
japan, china, australia, etcetera.
But I've also worked in HSBC asa CISO and building products
and print media and televisionand so forth, done all kinds of
different things, and to me itwas always part of my career
(02:32):
design principles was not to bestuck in any one place and pivot
and move and keep learning.
Continuous learning is reallyimportant because I think we can
make a self-redundant if weactually keep focusing on
sharpening our sword.
So it's sort of now enabled meto move from place to place.
I think we can make as aredundant if we actually keep
focusing on sharpening our sword.
So it's sort of now enabled meto move from place to place.
Speaker 1 (02:49):
Yeah, I don't want to disappoint any listeners in any
country, but if you had to pickout of those five countries,
where did you most thrive?
What did you enjoy the best,both personally and
professionally?
Speaker 3 (03:02):
Wow, that's a really hard question.
I've done so many fun jobs andhard jobs.
Right, think honestly the csodrills.
I've done 20 years as cio andthen three years as the cso with
hsbc and the last three and ahalf years I've been ending up
uh, cyber, cyber risk and techrisk for um, australia's largest
investment company, mahari.
Um, each of those has differentsort of challenges.
(03:25):
I guess, aaron, I meanlifestyle-wise, living in Japan
is the best because the food isamazing, the place is amazing,
work is the hardest.
People just don't go home.
So you know it's a combinationof work-life balance.
You don't have any work-lifebalance in Japan, but really
amazing lifestyle, just hardwork.
Speaker 1 (03:45):
But have any work like balance in japan, but, um,
really amazing lifestyle, justhard work, but I think I've had
some fun in the place I'veworked in.
That's awesome.
Um, so, david, I want to askyou a couple questions about
your book and um, the one thingand I love a good venn diagram,
but the skb or skill experience,knowledge, behavior assessment
can you tell our listeners aboutthat?
And the reason why I'minterested in this today is, as
(04:06):
Cody knows, I'm listening to anaudiobook called you Can't Send
a Duck to Eagle School and it'sabout motivational fit and skill
set and people you know, havingthe right people, skills for
the jobs and customer successand all those things.
But I really like this diagramCan you talk about?
what it is and how individualscan use it to help understand
(04:29):
where they are at in a role or aspecific job.
Speaker 3 (04:32):
Yeah, just a bit of background, aaron.
I think Lily, japan was COthere and Chief Privacy Officer
at the time, and we weresuffering from talent in the
organization, both within IT andalso more broadly in the
organization, and we were verymale-centric.
We didn't actually hire anybodythat wasn't Japanese men, and
(04:53):
so we could have said, actually,how do we grow that talent?
So actually the CEO at the time, my boss, said look, let's go
and actually have all of usbecome the trainers, not some
funny consultant.
So some guy came to train andso the SCED process skills,
knowledge, experience, behavioris something we actually taught
to our team.
So we said, okay, we want youto be really good at your
development plan and you ownthat, not us, but we want to
(05:15):
make sure that you understandwhat's required.
And so if you think about thisbeing circles and skills,
knowledge, experience andbehavior, sort of the whole
thing, right, all of us focus onskills and knowledge when we're
young in our career, want to bereally good at you know java,
programming or large languagemodel, prompt engineering etc.
(05:35):
And then have knowledge aboutlarge language models, but then
we actually understand thatactually as you get more
advanced in your career, whatmatters more is actually the
other side, the e and the b,which is experience and
behaviors.
And so what we talk about ishow do you try to design your
own career and saying I'mthinking two jobs ahead?
So if I'm talking to you orCody, I'm saying two jobs ahead
(05:57):
of where you are now, what isthat person above me, he or she,
doing in terms of experienceand behaviors that I'm not doing
and trying to map that out?
So in some case you might say,okay, that person's uh, the cio,
and that person's doing a youknow global it strategy, right,
how can I volunteer to do astretch assignment?
How can I volunteer to beinvolved in in that?
Maybe I can't do it by myself,but I can get involved in that
(06:18):
by volunteering, by telling themI'm interested in learning
about strategy and helping theprocess.
So you're trying to find waysto start to role model those
experiences and also see thebehaviors, because what really
matters is that behaviors.
And I'll give you a greatexample I'm doing recruiting now
as one of my advisory roles andwe're trying to find a CISO and
(06:40):
cyber managers, executivemanagers in a few banks, and so
we put forward a short list andthey never come back and say, oh
, david, you've got the wrongskills and knowledge.
They come back and say, actuallywe're not sure about that
person's experience or behaviors.
And so what's really importantis the higher you go, is to have
those right experience andbehaviors and try to build it
out.
So, trying to find one skills,one knowledge, one experience
(07:03):
and behavior that you need toactually identify for yourself,
and then you can, you know, andI think in detail.
I put some in my book, I putsome you know my embarrassing
gaps and say how's that work onmy own gaps for the last you
know, 20 years to overcome thatand make it no longer understood
as be a gap.
People think it's a strength.
Now that's awesome.
Speaker 2 (07:23):
That's really cool, david.
I think too, you know, inlooking at like modern CIOs and
CISOs, and I think that's agreat kind of homage because
it's always the knowledge isthere and the skill set.
But it's like it's not justwhat you believe and what you
know, it's like how do Iinfluence others in different
departments and other leadershipto get on board with this idea?
Because you're spending a lotof money, there's process
(07:46):
changes and things.
So talk about some of thechallenges you've seen you know
as people overcome that.
So I think that is a gap thatyou kind of see.
But how does one overcome thatif there's technical aptitude
there?
But then the challenge may beleadership and influencing
others.
Speaker 3 (08:01):
Yeah, that's a really good point, cody.
You, cody, having thatexecutive presence and poise is
clearly around communicationskills and being able to go to a
boardroom or go to a managementcommittee and say no, not say
yes, but say no.
Saying yes is easy, right, butthe fact is that in cyber or as
a CIO, you never have enoughresources, you never have enough
(08:23):
budget to do what you need todo, and so there's always going
to be a rationing and there'salways going to be someone you
say I'm sorry, I can't do that,or actually that's going to be
my number 10, not my number one.
Okay, so for me, that's thepart of things that I talk about
in my book a lot about softskills, and so many people in
technology are really good atthe skills and knowledge, but
(08:45):
they don't practice their softskills, you know, which is sort
of a strategic thinking, abilityto influence, as you mentioned,
right, how do you thennegotiate?
How do you then managestakeholders so they don't feel
that it's a lose-lose, it'smaybe a win-win and my win is
delayed.
So there's sort of soft skillsthat are really, really
important, and I think all of uscan't be.
(09:07):
I think I talk about in my book10 soft skills.
We can't be good at all 10things Some of those 10 will be
sort of weak at and we need tomake sure we can try to develop
other ones to overcome high-doseweakness if we can.
Speaker 1 (09:22):
Yeah, I love that you and actually think, uh, on one
of your slides for an isakaevent you've got, um, top five
skills.
And then the next slide is plusfive skills to get to ten.
Um, I like that because there'sso many, you are right you
can't be, you know, be themaster of all of them, um.
But I also like that you'retalking about soft skills
(09:42):
because I've seen so many likeespecially on linkedin echo
chambers of cso's that arearguing over, like I have a
SecOps background and I've beenin a SOC and I literally have
heard CISOs say if you've notworked in a SOC, you're not a
credible CISO.
And I know SOC technology.
I've done projects in andaround SOC but I've not been a
SOC operator and I would argueI've been, maybe effective in
(10:07):
different ways, but I think anymyopic technology skill set
thinking is usually mired in theskill set that the person
arguing it has.
And most everyone well, noteveryone, many folks at the CISO
level are arguing about thewrong things.
I'd rather be arguing overthese top 10 things and which to
prioritize for a specific roleor person than like which tech
(10:30):
skills are going to make you abetter CISO.
Speaker 3 (10:33):
Yeah, look, the modern CIO and CISO have got the
same challenges right.
It's stakeholder management,it's regulatory management, it's
all the above.
So being an amazing DevSecOpsperson or pen tester, it's all
the above.
So being a amazing devsoc opsperson or, you know, pen test,
it's all great.
So that's all greatfoundational bits.
But actually what gets youpromoted and gets you noticed,
keeps you a job, because they,you know, get the job?
(10:54):
One thing, keeping the job isthe other thing.
Right, so you want to getbeyond your two or three years,
which is the average, right?
Um, how do you do that is byhaving great at your stakeholder
management, which is softskills, which is trying to make
sure they're not toodisappointed when you say no.
I think one of the things I'vetalked about in my book, aaron,
is their first 90 days, and Ilearned that actually early
(11:15):
because I think, at the end ofthe day, I did five CIO jobs in
15 years, so every three years Iwas being moved to another
place.
And then not only did I do astrategy, I had to rebuild the
team from scratch and leave mysuccessor, find a successor,
make the organization strongerand then leave behind a
successor, which is sort ofunusual.
In this day and age Peopledon't do that, but I did that
(11:36):
because that was my pattern.
No-transcript.
Speaker 1 (12:06):
That's interesting and it makes them focus as well
(12:32):
you know chief privacy officersand a lot of those relationships
sometimes are not starting inhealthy spots.
Or you know privacy versuscyber arguing over like not
monitoring any data from aprivacy standpoint and really
needing some data to understandif your data, your IP, is
walking right out the door.
So give us your thoughts andtips on negotiating and
influencing and building thoserelationships.
Speaker 3 (12:55):
Listen, I think I can talk about identifying where
the examples are.
Lots of cases where you've gotto stick to the facts and you
take a position which is, Ithink, we need to be here, and
so you talk about two examples.
One case was just a while ago,but it was HSBC and we had a bot
attacked, actually in America,on our mobile banking system.
(13:17):
And so, you know, we did someresearch and said, oh, actually
that's really bad.
Bot protection did not exist atHSBC in America at the time.
And so we then said actually,oh, we, the same um software
versions in four countries, inmy, my part of the world, in
asia, pac.
So you know, go back to the ceoand said, by the way, um, we
(13:39):
got a bot attack here, we needto actually put in some mfa, and
we could put in mickey mousemfa, which is, you know, the
capture stuff, which is thatmuch code and that takes five
minutes.
Um, I'm not asking your opinionbecause these are cios that I
used to be a ceo right now, oh,no, my customer experience so
important that I can't do this,I said, sorry, I'm not asking
(14:01):
you, I'm telling you um, you canonly negotiate when not yes or
no, um, because this is actuallya serious situation that your
whole, you know, digitalexperience will break down, like
the US has, and so that wasquite interesting, because they
were my old peers, right, theCIOs, who just said, oh no, we
can't do this, it's impossible.
(14:21):
And I was like what do you mean?
And so this you know manyexamples like that, where people
have got a view of the worldand you've got to just change
that.
I mean, another case was justasking questions about tell us
what was the colonial pipeline?
Was it May 2021?
It was right.
(14:43):
So, I came across this.
I was at four in the morning.
I was up early with my iPad andI pinged the sock later and
said okay, this is reallyinteresting.
Can you tell me about the IOCsfor DarkSide?
How do we capture that?
And look, you're busy now, sojust come back.
Eventually, after a few weeks Isaid look, can you show me your
playbook?
Because he didn't come back tome.
He showed me your playbook andI was horrified how bad it was
(15:05):
and said look, let's go and workand rebuild that and let's test
it, because you haven't testedit right.
And so that says I was actuallya risk person asking the size
and his team.
And then eventually we rebuiltthat ransomware playbook.
And then we were then asked sixmonths later by the board.
(15:25):
The board says, hey, can youshow us your playbook?
Can you show us?
Have you tested it?
Show us your results.
And we did a page turn, page bypage.
And I then turned and said bythe way, aren't you happy?
We did this because we wouldimply both of us.
We implied right and and sothat was it's it's kind of
tricky right because you, youwanted the right thing.
Um, not throw people on the bus, because that's the wrong thing
(15:47):
to do, um, but but how do youprogress the organization and
that this is the right thing todo, then actually it's not a
negotiation.
We're just going to say thefacts speak for themselves.
Speaker 2 (15:59):
Yeah, david, that's great.
So a question I like to alwaysask our guests are a couple of
things.
You kind of already alluded toit.
I think you'll have a greatanswer for this.
I'm kidding you up for a greatanswer right here.
But over the years you knowthere's a lot of focus on
technology and tools, but atReveal we have a lot of belief
in like people and process andthe things that enable the tools
(16:20):
.
So, thinking over your careerand your tenure, is there a time
that sticks out when, like aprocess or people won the day
versus a specific technology?
Speaker 3 (16:33):
Oh, it's always that, and I mean the tech piece, um,
hsbc spent a billion dollars onon tech transformation over four
years, okay, and so we werejust buying everything, um, and
and, as you know, right, it'sabout embedding the processes
and having the people understandthe stuff.
So a really, really goodexample maybe is actually that
(16:57):
we'd bought something calledSecureCard Warrior for DevSecOps
, and that was part of thejourney, and HSBC had 25,000
developers 25,000, just a lot ofdevelopers right across mainly
India and China, but all overthe world.
But the two centers hadprobably 20,000 developers.
And so I said that's great,we've spent all this money on
(17:17):
licenses.
And so you're telling me thatactually, we've got great DevOps
, but we've got about 20% of ourcode being scanned and about
20% of our staff have beentrained in this stuff.
Even though we have licensesfor 25,000, we haven't given a
carrot or stick.
We've given them three iPadsand all this nice carrots to go
and do this stuff.
And I said, well, no, no, you'vebeen screwing around for two or
(17:38):
three years.
Here I'm going to mandate this.
I'm going to say we must haveeverybody trained as a white
belt 25,000 people for the nextsix or seven months, and we have
10% of those people as yellowbelts and and I'm going to start
hounding every CEO that ownsthese developers and so we get
it done by December, right?
So to me, that was actually gotthe tech.
(18:00):
Let's get people in place,let's put in some structure to
say identify sort of a yellowbelt, white belt, green belt,
black belt, and we sort of say,here's how we get to the black
belt level.
You need to be good at this andyou need to have, you know, be
mentoring people and embedded inthe pods and, you know, try to
put that whole mechanism.
And also, by the way, we don'twant 20% of scanning 80%, 80% of
(18:24):
code is probably the bestpractice, right?
Let.
We don't want 20% of scanning80%, 80% of code is probably the
best practice, right?
Let's go towards that.
How do we do both the theoryand also the practice to advance
at the same time?
That was fun.
We got there.
We got to 95% in six months.
That's excellent.
Yeah, it's all about data rightand making people accountable
to say sorry, aaron, why haven'tyou done it?
(18:45):
Why is your team behind?
Speaker 2 (18:51):
You're not tracking towards your number and making
them accountable.
That's awesome, that's reallyreally good.
So kind of following that,that's over the time you spent.
But let's say you're going toget one phone call tomorrow.
I've got a special cell phone Iget to hand you and you get to
call yourself 20, 25 years ago,early in your career.
What are one or two thingsyou're telling yourself that
(19:15):
you've learned, that you say,hey, if I can call myself 25 or
20 years ago, what are youtelling yourself?
Speaker 3 (19:20):
So I'll go back to 30 years ago, cody, because 30
years ago I made a decision tobe a CIO and I was tossing up.
I walked into a garden it's inmy book, actually.
I walked into a garden inKodlowanji in Kyoto and it's the
most famous sand garden in theworld, and in this garden there
are 13 or 14 rocks that arepositioned strategically and you
sit there and look at the rocksand contemplate life.
(19:41):
I walked in with three joboffers, right, and two was to be
consultants.
One was to be a partner with EYand I was 35 years old and sort
of.
You know, I'll be a partnernext month, you know and they
gave me a signing bonus and allthe nice put me through an MBA
and, you know, studied to allthe US.
They were throwing it at me.
Right At the same time, lilywas saying to me hey, come be a
(20:03):
ceo with us and we'll send youover to world, maybe send you
through an mba, and thenafterwards send it china and
japan or us, which is what I did.
I became ceo for china,australia, japan, uh, asia, pac,
us, etc.
Um, that that was the decisionI made then.
So to me sitting that garden 30years ago I was like I'm making
the right decision here.
I'm chasing, um, a career, notmoney, you know, not money and
(20:26):
status, because probably moremoney and status now to be a
partner than to be a CEO for alittle Australian company not
the US at that stage.
But for me it felt right.
It felt like Lilly was a greatcompany doing great things for
health.
I felt aligned with that.
I said, okay, I want to do this.
This sounds like a reallyinteresting opportunity for me
(20:47):
to take on.
And so back to your question.
It's around, you know, backyourself because you know if
your instincts are right, youknow, try to make those right
decisions.
Um, don't do it on dollars, doit across.
You know the whole gamut aroundyour family lifestyle, um,
learning ability, you know,because I, I, I think you know
that what turned me off being apartner in a law firm sorry,
(21:09):
e-wife consulting was I felt at35 I'd retire mentally retire.
I'd be then protecting my turf,trying to protect my income and
revenue, and not keep learningnew things, and that scared the
hell out of me.
I didn't want to get to thestage of retiring at 35 mentally
.
Speaker 2 (21:26):
That's great.
I mentor a lot of young men andwomen in cyber and IT.
I feel like cyber is kind ofnebulous to get in from the
outside.
Sometimes people think you haveto be technical to get into
cyber.
I think that's really cool ofwhat you said.
I would totally agree that.
Focus on learning and growingand the value will find you.
(21:47):
But you chase the dollar.
Sometimes those paths end andthen it's hard to pick up again.
Absolutely.
Speaker 1 (21:56):
It's hard to also just kind of a comment on that.
I've seen people for the moneyin the wrong job and the
motivational fit is clearly offand it's if you can't find your
passion from what you're doing,um, and wake up every day and
get excited about it andcontinuously want to learn.
If you're, if you're justdistracting yourself and getting
your through, it's gettingthrough the day uh and kind of
(22:17):
bumping along, you're not goingto probably achieve your goals,
you're probably not going to beoverly excess, uh, successful
and even if the money is there,it's probably going to plateau.
So I totally agree witheverything everyone's saying and
again, I've probably at certainpoints in my career been in the
points where it's oh, this isthe wrong job, this is the wrong
fit.
And the sooner that you canknow that and kind of make that
(22:38):
pivot to get back to somethingthat's more getting you into a
place of thriving, the better.
Speaker 3 (22:44):
Yeah, which is Aaron I think I talk about in my book
and I often sign these coversand I write you know, um, keep
striving to be uncomfortable andcomfortable means more growth
and and it's kind ofcounterintuitive.
But actually, if you arecomfortable, you're going to
just sit there and and you floatbecause it's easy.
Right, life's easy versusactually I don't know what I'm
doing.
I need to learn fast.
(23:05):
You know, I've got.
The great example I talkedabout in one of my chapters is
around being a CISO at HSBC andvolunteering to be a CISO after
being a CIO for so many years tosay I can keep doing a CIO role
, but actually I'm bored withthat.
I don't know.
20 years.
I want to, you know, dosomething different.
And so to me, you know, being aCISO where I don't know
everything, I need to learn fastand I need to um, engage the
(23:28):
business and get them to helptransform.
Um and the team to transformwas the challenge for me.
It's excellent.
Speaker 1 (23:35):
Yep, um, david, hold that book back up for a second.
I do have one question, so I'vegot my copy.
If, if individuals order thecopy.
Uh, I'm a skier and I see thegondola.
Will you guarantee ourlisteners that they will be on a
fast track gondola to the topof their mountain?
Is that the?
Is that the imagery it's?
Speaker 3 (23:54):
a really interesting question.
I I'd um when I designed thecover is this sunday morning and
and I was thinking about, okay,blue sky, you know that further
you go up the mountain, um, itgets kind of cold and sharp
rocks and it's not very nice,which is what it's like in the
C-suite, okay.
And so I got up to thepublisher and sent me an iStock
(24:15):
photo access and I went on theirlittle search with sort of AI
not really good AI and I'mlooking for a gondola that goes
left to right, that's up, notdown, and I want a blue sky
background and I want this sortof snow and whatever.
And I picked about fivedifferent pictures and showed my
wife she was still sleeping, itwas six in the morning and then
(24:37):
when the artist got this hesaid oh, you know, I've removed
the safety line, david, becauseit made the photo look kind of
ugly.
I said, no, no, it's greatbecause there's no safety line
in these jobs.
Right, you just fall.
But I think at the end of theday, the guide is meant for
people to help them.
Not everyone wants to be at thevery top.
Some people actually are okayto be at base camp because, you
(24:58):
know, further up the mountain,the Everest right, there's no
oxygen, it's life-threatening.
So Basecamp's okay for somepeople.
So a lot of people read thebook and say I don't want to be
a CIO or CISO, but I want to beclose to that role, and so the
book's more about actually howdo you become the best version
of yourself and grow yourselfbeyond where you think you could
be.
And so, if I look at my owncareer, have I gone further than
(25:20):
I thought I could?
Absolutely, and I think I'vealso coached people to the same
point where they didn't believethere could be a CRSU.
So I've coached them to believethat by actually then them
understanding, identifying whatis it I'm not doing and how do I
round out those rough edgesthat otherwise would stop me
being a CRSU I love that?
Speaker 1 (25:39):
Yeah, I know.
The only analogy that you mightthrow in there is the gondola
has one one compartment going upand one going down, and there's
a joke or something in thereabout like, for those that get
near the top and don't like it,they might either choose to ride
back down or be sent back down.
Speaker 3 (25:56):
So yeah, it was.
It was interesting.
There's probably not seeing thedetails here, but there was, um
when, when the, the photo cameback, actually the the actual
version going down had no oneinside it and I asked the artist
to add it back in again.
Because the reality is, as youknow, some people choose to go
down right, you might say, forlifestyle, for family health
(26:16):
reasons, I want to go up and Igo down.
I talk about this using theelevator's analogy, actually in
my book, which says thatsometimes you're open to the
person calling person callingyou to the doors open, or doors
closed, or you actually justtake your boss, you press that
panic button.
There's different mechanisms,but up is not always the answer.
Sometimes down is okay as well,cause it depends what you're
(26:37):
looking for in that sort ofholistic viewpoint.
Great points.
Speaker 2 (26:43):
That's excellent, david.
We have one more question foryou Very, very important
question here.
So for all of our listeners, Iwant to give them the VIP access
and say give us one fun fact ofDavid that maybe everyone
wouldn't know.
So share either a story, a funfact, but give our listeners
something special here that'snot super public knowledge about
(27:05):
you.
Speaker 3 (27:08):
I met him when I was 20 years old, and so for me,
being married at 20, atuniversity, doing odd jobs pizza
, bar man, whatever it was tomake money.
But then to me then saying okay, I want to go and support my
family, I want to go and buy ahouse and do all the right
things, but inside I had thisdrive not to ever be stuck in my
(27:32):
job, never to be stuck in onecompany.
So when banks offered me a job,I thought I can't take that,
because the banks will offer mea job and I'll have this
half-priced loan I'll never beable to leave.
So I ended up working at bankslater in my career.
But it working in banks laterin my career.
But it's kind of intuitive,right, because the safe answer
is to go to the safety which istake the job with the seven
percent loan, not 15 percentloan, and because it's it's it's
(27:52):
it's a high incentive.
But I said no, no, I'm going toresist that.
So to me the fun fact is aroundknow yourself, know what you
know what, what drives you.
For me it was actually.
I know, if I make myself into acomfortable position, I get get
lazy and floppy right, and Ineeded to keep pushing myself
and so that was sort of a funfact, katie, that helped me
(28:15):
drive.
And I think being a young dadalso meant that I had to learn
how to teach my son things.
So my son, at the age of 12,could read books, he could play
the violin, he could swim,because we did all this things
with him.
So my, my son, um, the firstmusic he heard was was mozart,
and he didn't.
(28:35):
He didn't talk about dogs, hetalked about this is a wind
mariner, this is a dacha.
You know we.
He saw books on monet and thisis the age of 12 months, by the
way.
He saw manet, he saw picasso,we showed him things because we
said we don't we're doing here,and I realized very quickly that
actually all the techniques Ilearned to teach my son to
(28:55):
enhance faster than schools just, you know, you don't get to
school until you're five yearsold.
Right at one years old he couldread right and and.
And I said actually you knowwhat all of us can actually
enhance ourselves if we chooseto.
We've just been told you're notthat good, david, or you are
that good.
And I learned early in my lifethat actually these guys are all
wrong.
They got it all wrong.
(29:16):
You can break these molds andthat's why I've kind of done my
own things in my career andwritten books and things that
people probably thought theynever could do, because I always
challenged myself and wanted tonever be put in that little box
.
That's excellent.
Speaker 2 (29:29):
Excellent.
Well, sir, I want to thank youagain.
This has been a great episodeand we appreciate you spending
the time with us.
We know you're very busy andblessed to have you here on the
US side for a little while thisside of the globe.
So thank you again for the time.
Speaker 1 (29:44):
And lovely Vegas.
Maybe he's in Paris now.
He could be, you know, at theSahara desert.
No, I think that that casinowent under.
So thanks so much, david.
Appreciate it, thank you.
Thanks, david Cheers.
Thanks for tuning back in to Simply Solving Cyber.
I'm Aaron Pritz.
Speaker 2 (00:09):
And I'm Cody Rivers.
Speaker 1 (00:11):
And today we're here with David Gee, who I was
honored to work with a number oftimes back in the day.
I think I first met David whenI was working at a large
pharmaceutical company, eliLilly, and if I remember right,
david, I was on a audit in Lilly, japan if I remember right, and
we met there and then got achance to work with you years
later when we were both in theUS affiliate.
(00:33):
So nice to see you again.
I know we've kept in touch, butnice to see you and, more
importantly, have you on theshow and give some others a
chance to hear a little bitabout your journey and your
background.
Speaker 3 (00:45):
Thanks, Aaron.
If I recall, that was probablya Sox order, if I recall rightly
, and then Sox was a big thing Itried to avoid the
Sarbanes-Oxley.
Speaker 1 (00:52):
I was the privacy guy .
Speaker 3 (00:53):
Oh, okay, got it.
Speaker 1 (00:54):
Yep, yep, yep, awesome.
Well, david, we always like tostart out with the backstory and
obviously the high points,because you've had a long,
illustrious career.
But tell us a little bit aboutyou and then we'll want to make
sure to touch on the new book.
You've recently retired andwrote a new book that I have on
my desk back here called theAspiring CIO and CISO, and I
(01:18):
know it's done really well witha lot of interested people and
kind of advancing their careerin this space.
Speaker 3 (01:25):
Thanks, aaron.
Look, I've retired about 100days ago and so I think the
book's been on sale literallyI've flagged it for a minute for
100 days and, as you can see,it's all about.
You know people who aspire tobe a CIO and CISO and for me it
was part of my journey, and somy battle scars are actually
things I put in the book, and sojourney and so my battle scars
(01:46):
are actually things I put in thebook.
Um, and so I think one of thethings I've alluded to is there
is sort of I had this sort oftransformation career.
I've been sort of atransformation, cio,
transformation, you know, cso,and and transforming myself in
terms of working in differentindustries, and so I'm a bit
unusual, I guess, in that regard, because I look back at you
know, I've worked in, uh, fivecountries the US and China and
Hong Kong and Japan, a couple oftimes each, even in three
(02:10):
cities in Australia and across.
I've met life and insuranceLilly, you know, ceo in the US,
japan, china, australia, etcetera.
But I've also worked in HSBC asa CISO and building products
and print media and televisionand so forth, done all kinds of
different things, and to me itwas always part of my career
(02:32):
design principles was not to bestuck in any one place and pivot
and move and keep learning.
Continuous learning is reallyimportant because I think we can
make a self-redundant if weactually keep focusing on
sharpening our sword.
So it's sort of now enabled meto move from place to place.
I think we can make as aredundant if we actually keep
focusing on sharpening our sword.
So it's sort of now enabled meto move from place to place.
Speaker 1 (02:49):
Yeah, I don't want to disappoint any listeners in any
country, but if you had to pickout of those five countries,
where did you most thrive?
What did you enjoy the best,both personally and
professionally?
Speaker 3 (03:02):
Wow, that's a really hard question.
I've done so many fun jobs andhard jobs.
Right, think honestly the csodrills.
I've done 20 years as cio andthen three years as the cso with
hsbc and the last three and ahalf years I've been ending up
uh, cyber, cyber risk and techrisk for um, australia's largest
investment company, mahari.
Um, each of those has differentsort of challenges.
(03:25):
I guess, aaron, I meanlifestyle-wise, living in Japan
is the best because the food isamazing, the place is amazing,
work is the hardest.
People just don't go home.
So you know it's a combinationof work-life balance.
You don't have any work-lifebalance in Japan, but really
amazing lifestyle, just hardwork.
Speaker 1 (03:45):
But have any work like balance in japan, but, um,
really amazing lifestyle, justhard work, but I think I've had
some fun in the place I'veworked in.
That's awesome.
Um, so, david, I want to askyou a couple questions about
your book and um, the one thingand I love a good venn diagram,
but the skb or skill experience,knowledge, behavior assessment
can you tell our listeners aboutthat?
And the reason why I'minterested in this today is, as
(04:06):
Cody knows, I'm listening to anaudiobook called you Can't Send
a Duck to Eagle School and it'sabout motivational fit and skill
set and people you know, havingthe right people, skills for
the jobs and customer successand all those things.
But I really like this diagramCan you talk about?
what it is and how individualscan use it to help understand
(04:29):
where they are at in a role or aspecific job.
Speaker 3 (04:32):
Yeah, just a bit of background, aaron.
I think Lily, japan was COthere and Chief Privacy Officer
at the time, and we weresuffering from talent in the
organization, both within IT andalso more broadly in the
organization, and we were verymale-centric.
We didn't actually hire anybodythat wasn't Japanese men, and
(04:53):
so we could have said, actually,how do we grow that talent?
So actually the CEO at the time, my boss, said look, let's go
and actually have all of usbecome the trainers, not some
funny consultant.
So some guy came to train andso the SCED process skills,
knowledge, experience, behavioris something we actually taught
to our team.
So we said, okay, we want youto be really good at your
development plan and you ownthat, not us, but we want to
(05:15):
make sure that you understandwhat's required.
And so if you think about thisbeing circles and skills,
knowledge, experience andbehavior, sort of the whole
thing, right, all of us focus onskills and knowledge when we're
young in our career, want to bereally good at you know java,
programming or large languagemodel, prompt engineering etc.
(05:35):
And then have knowledge aboutlarge language models, but then
we actually understand thatactually as you get more
advanced in your career, whatmatters more is actually the
other side, the e and the b,which is experience and
behaviors.
And so what we talk about ishow do you try to design your
own career and saying I'mthinking two jobs ahead?
So if I'm talking to you orCody, I'm saying two jobs ahead
(05:57):
of where you are now, what isthat person above me, he or she,
doing in terms of experienceand behaviors that I'm not doing
and trying to map that out?
So in some case you might say,okay, that person's uh, the cio,
and that person's doing a youknow global it strategy, right,
how can I volunteer to do astretch assignment?
How can I volunteer to beinvolved in in that?
Maybe I can't do it by myself,but I can get involved in that
(06:18):
by volunteering, by telling themI'm interested in learning
about strategy and helping theprocess.
So you're trying to find waysto start to role model those
experiences and also see thebehaviors, because what really
matters is that behaviors.
And I'll give you a greatexample I'm doing recruiting now
as one of my advisory roles andwe're trying to find a CISO and
(06:40):
cyber managers, executivemanagers in a few banks, and so
we put forward a short list andthey never come back and say, oh
, david, you've got the wrongskills and knowledge.
They come back and say, actuallywe're not sure about that
person's experience or behaviors.
And so what's really importantis the higher you go, is to have
those right experience andbehaviors and try to build it
out.
So, trying to find one skills,one knowledge, one experience
(07:03):
and behavior that you need toactually identify for yourself,
and then you can, you know, andI think in detail.
I put some in my book, I putsome you know my embarrassing
gaps and say how's that work onmy own gaps for the last you
know, 20 years to overcome thatand make it no longer understood
as be a gap.
People think it's a strength.
Now that's awesome.
Speaker 2 (07:23):
That's really cool, david.
I think too, you know, inlooking at like modern CIOs and
CISOs, and I think that's agreat kind of homage because
it's always the knowledge isthere and the skill set.
But it's like it's not justwhat you believe and what you
know, it's like how do Iinfluence others in different
departments and other leadershipto get on board with this idea?
Because you're spending a lotof money, there's process
(07:46):
changes and things.
So talk about some of thechallenges you've seen you know
as people overcome that.
So I think that is a gap thatyou kind of see.
But how does one overcome thatif there's technical aptitude
there?
But then the challenge may beleadership and influencing
others.
Speaker 3 (08:01):
Yeah, that's a really good point, cody.
You, cody, having thatexecutive presence and poise is
clearly around communicationskills and being able to go to a
boardroom or go to a managementcommittee and say no, not say
yes, but say no.
Saying yes is easy, right, butthe fact is that in cyber or as
a CIO, you never have enoughresources, you never have enough
(08:23):
budget to do what you need todo, and so there's always going
to be a rationing and there'salways going to be someone you
say I'm sorry, I can't do that,or actually that's going to be
my number 10, not my number one.
Okay, so for me, that's thepart of things that I talk about
in my book a lot about softskills, and so many people in
technology are really good atthe skills and knowledge, but
(08:45):
they don't practice their softskills, you know, which is sort
of a strategic thinking, abilityto influence, as you mentioned,
right, how do you thennegotiate?
How do you then managestakeholders so they don't feel
that it's a lose-lose, it'smaybe a win-win and my win is
delayed.
So there's sort of soft skillsthat are really, really
important, and I think all of uscan't be.
(09:07):
I think I talk about in my book10 soft skills.
We can't be good at all 10things Some of those 10 will be
sort of weak at and we need tomake sure we can try to develop
other ones to overcome high-doseweakness if we can.
Speaker 1 (09:22):
Yeah, I love that you and actually think, uh, on one
of your slides for an isakaevent you've got, um, top five
skills.
And then the next slide is plusfive skills to get to ten.
Um, I like that because there'sso many, you are right you
can't be, you know, be themaster of all of them, um.
But I also like that you'retalking about soft skills
(09:42):
because I've seen so many likeespecially on linkedin echo
chambers of cso's that arearguing over, like I have a
SecOps background and I've beenin a SOC and I literally have
heard CISOs say if you've notworked in a SOC, you're not a
credible CISO.
And I know SOC technology.
I've done projects in andaround SOC but I've not been a
SOC operator and I would argueI've been, maybe effective in
(10:07):
different ways, but I think anymyopic technology skill set
thinking is usually mired in theskill set that the person
arguing it has.
And most everyone well, noteveryone, many folks at the CISO
level are arguing about thewrong things.
I'd rather be arguing overthese top 10 things and which to
prioritize for a specific roleor person than like which tech
(10:30):
skills are going to make you abetter CISO.
Speaker 3 (10:33):
Yeah, look, the modern CIO and CISO have got the
same challenges right.
It's stakeholder management,it's regulatory management, it's
all the above.
So being an amazing DevSecOpsperson or pen tester, it's all
the above.
So being a amazing devsoc opsperson or, you know, pen test,
it's all great.
So that's all greatfoundational bits.
But actually what gets youpromoted and gets you noticed,
keeps you a job, because they,you know, get the job?
(10:54):
One thing, keeping the job isthe other thing.
Right, so you want to getbeyond your two or three years,
which is the average, right?
Um, how do you do that is byhaving great at your stakeholder
management, which is softskills, which is trying to make
sure they're not toodisappointed when you say no.
I think one of the things I'vetalked about in my book, aaron,
is their first 90 days, and Ilearned that actually early
(11:15):
because I think, at the end ofthe day, I did five CIO jobs in
15 years, so every three years Iwas being moved to another
place.
And then not only did I do astrategy, I had to rebuild the
team from scratch and leave mysuccessor, find a successor,
make the organization strongerand then leave behind a
successor, which is sort ofunusual.
In this day and age Peopledon't do that, but I did that
(11:36):
because that was my pattern.
No-transcript.
Speaker 1 (12:06):
That's interesting and it makes them focus as well
(12:32):
you know chief privacy officersand a lot of those relationships
sometimes are not starting inhealthy spots.
Or you know privacy versuscyber arguing over like not
monitoring any data from aprivacy standpoint and really
needing some data to understandif your data, your IP, is
walking right out the door.
So give us your thoughts andtips on negotiating and
influencing and building thoserelationships.
Speaker 3 (12:55):
Listen, I think I can talk about identifying where
the examples are.
Lots of cases where you've gotto stick to the facts and you
take a position which is, Ithink, we need to be here, and
so you talk about two examples.
One case was just a while ago,but it was HSBC and we had a bot
attacked, actually in America,on our mobile banking system.
(13:17):
And so, you know, we did someresearch and said, oh, actually
that's really bad.
Bot protection did not exist atHSBC in America at the time.
And so we then said actually,oh, we, the same um software
versions in four countries, inmy, my part of the world, in
asia, pac.
So you know, go back to the ceoand said, by the way, um, we
(13:39):
got a bot attack here, we needto actually put in some mfa, and
we could put in mickey mousemfa, which is, you know, the
capture stuff, which is thatmuch code and that takes five
minutes.
Um, I'm not asking your opinionbecause these are cios that I
used to be a ceo right now, oh,no, my customer experience so
important that I can't do this,I said, sorry, I'm not asking
(14:01):
you, I'm telling you um, you canonly negotiate when not yes or
no, um, because this is actuallya serious situation that your
whole, you know, digitalexperience will break down, like
the US has, and so that wasquite interesting, because they
were my old peers, right, theCIOs, who just said, oh no, we
can't do this, it's impossible.
(14:21):
And I was like what do you mean?
And so this you know manyexamples like that, where people
have got a view of the worldand you've got to just change
that.
I mean, another case was justasking questions about tell us
what was the colonial pipeline?
Was it May 2021?
It was right.
(14:43):
So, I came across this.
I was at four in the morning.
I was up early with my iPad andI pinged the sock later and
said okay, this is reallyinteresting.
Can you tell me about the IOCsfor DarkSide?
How do we capture that?
And look, you're busy now, sojust come back.
Eventually, after a few weeks Isaid look, can you show me your
playbook?
Because he didn't come back tome.
He showed me your playbook andI was horrified how bad it was
(15:05):
and said look, let's go and workand rebuild that and let's test
it, because you haven't testedit right.
And so that says I was actuallya risk person asking the size
and his team.
And then eventually we rebuiltthat ransomware playbook.
And then we were then asked sixmonths later by the board.
(15:25):
The board says, hey, can youshow us your playbook?
Can you show us?
Have you tested it?
Show us your results.
And we did a page turn, page bypage.
And I then turned and said bythe way, aren't you happy?
We did this because we wouldimply both of us.
We implied right and and sothat was it's it's kind of
tricky right because you, youwanted the right thing.
Um, not throw people on the bus, because that's the wrong thing
(15:47):
to do, um, but but how do youprogress the organization and
that this is the right thing todo, then actually it's not a
negotiation.
We're just going to say thefacts speak for themselves.
Speaker 2 (15:59):
Yeah, david, that's great.
So a question I like to alwaysask our guests are a couple of
things.
You kind of already alluded toit.
I think you'll have a greatanswer for this.
I'm kidding you up for a greatanswer right here.
But over the years you knowthere's a lot of focus on
technology and tools, but atReveal we have a lot of belief
in like people and process andthe things that enable the tools
(16:20):
.
So, thinking over your careerand your tenure, is there a time
that sticks out when, like aprocess or people won the day
versus a specific technology?
Speaker 3 (16:33):
Oh, it's always that, and I mean the tech piece, um,
hsbc spent a billion dollars onon tech transformation over four
years, okay, and so we werejust buying everything, um, and
and, as you know, right, it'sabout embedding the processes
and having the people understandthe stuff.
So a really, really goodexample maybe is actually that
(16:57):
we'd bought something calledSecureCard Warrior for DevSecOps
, and that was part of thejourney, and HSBC had 25,000
developers 25,000, just a lot ofdevelopers right across mainly
India and China, but all overthe world.
But the two centers hadprobably 20,000 developers.
And so I said that's great,we've spent all this money on
(17:17):
licenses.
And so you're telling me thatactually, we've got great DevOps
, but we've got about 20% of ourcode being scanned and about
20% of our staff have beentrained in this stuff.
Even though we have licensesfor 25,000, we haven't given a
carrot or stick.
We've given them three iPadsand all this nice carrots to go
and do this stuff.
And I said, well, no, no, you'vebeen screwing around for two or
(17:38):
three years.
Here I'm going to mandate this.
I'm going to say we must haveeverybody trained as a white
belt 25,000 people for the nextsix or seven months, and we have
10% of those people as yellowbelts and and I'm going to start
hounding every CEO that ownsthese developers and so we get
it done by December, right?
So to me, that was actually gotthe tech.
(18:00):
Let's get people in place,let's put in some structure to
say identify sort of a yellowbelt, white belt, green belt,
black belt, and we sort of say,here's how we get to the black
belt level.
You need to be good at this andyou need to have, you know, be
mentoring people and embedded inthe pods and, you know, try to
put that whole mechanism.
And also, by the way, we don'twant 20% of scanning 80%, 80% of
(18:24):
code is probably the bestpractice, right?
Let.
We don't want 20% of scanning80%, 80% of code is probably the
best practice, right?
Let's go towards that.
How do we do both the theoryand also the practice to advance
at the same time?
That was fun.
We got there.
We got to 95% in six months.
That's excellent.
Yeah, it's all about data rightand making people accountable
to say sorry, aaron, why haven'tyou done it?
(18:45):
Why is your team behind?
Speaker 2 (18:51):
You're not tracking towards your number and making
them accountable.
That's awesome, that's reallyreally good.
So kind of following that,that's over the time you spent.
But let's say you're going toget one phone call tomorrow.
I've got a special cell phone Iget to hand you and you get to
call yourself 20, 25 years ago,early in your career.
What are one or two thingsyou're telling yourself that
(19:15):
you've learned, that you say,hey, if I can call myself 25 or
20 years ago, what are youtelling yourself?
Speaker 3 (19:20):
So I'll go back to 30 years ago, cody, because 30
years ago I made a decision tobe a CIO and I was tossing up.
I walked into a garden it's inmy book, actually.
I walked into a garden inKodlowanji in Kyoto and it's the
most famous sand garden in theworld, and in this garden there
are 13 or 14 rocks that arepositioned strategically and you
sit there and look at the rocksand contemplate life.
(19:41):
I walked in with three joboffers, right, and two was to be
consultants.
One was to be a partner with EYand I was 35 years old and sort
of.
You know, I'll be a partnernext month, you know and they
gave me a signing bonus and allthe nice put me through an MBA
and, you know, studied to allthe US.
They were throwing it at me.
Right At the same time, lilywas saying to me hey, come be a
(20:03):
ceo with us and we'll send youover to world, maybe send you
through an mba, and thenafterwards send it china and
japan or us, which is what I did.
I became ceo for china,australia, japan, uh, asia, pac,
us, etc.
Um, that that was the decisionI made then.
So to me sitting that garden 30years ago I was like I'm making
the right decision here.
I'm chasing, um, a career, notmoney, you know, not money and
(20:26):
status, because probably moremoney and status now to be a
partner than to be a CEO for alittle Australian company not
the US at that stage.
But for me it felt right.
It felt like Lilly was a greatcompany doing great things for
health.
I felt aligned with that.
I said, okay, I want to do this.
This sounds like a reallyinteresting opportunity for me
(20:47):
to take on.
And so back to your question.
It's around, you know, backyourself because you know if
your instincts are right, youknow, try to make those right
decisions.
Um, don't do it on dollars, doit across.
You know the whole gamut aroundyour family lifestyle, um,
learning ability, you know,because I, I, I think you know
that what turned me off being apartner in a law firm sorry,
(21:09):
e-wife consulting was I felt at35 I'd retire mentally retire.
I'd be then protecting my turf,trying to protect my income and
revenue, and not keep learningnew things, and that scared the
hell out of me.
I didn't want to get to thestage of retiring at 35 mentally
.
Speaker 2 (21:26):
That's great.
I mentor a lot of young men andwomen in cyber and IT.
I feel like cyber is kind ofnebulous to get in from the
outside.
Sometimes people think you haveto be technical to get into
cyber.
I think that's really cool ofwhat you said.
I would totally agree that.
Focus on learning and growingand the value will find you.
(21:47):
But you chase the dollar.
Sometimes those paths end andthen it's hard to pick up again.
Absolutely.
Speaker 1 (21:56):
It's hard to also just kind of a comment on that.
I've seen people for the moneyin the wrong job and the
motivational fit is clearly offand it's if you can't find your
passion from what you're doing,um, and wake up every day and
get excited about it andcontinuously want to learn.
If you're, if you're justdistracting yourself and getting
your through, it's gettingthrough the day uh and kind of
(22:17):
bumping along, you're not goingto probably achieve your goals,
you're probably not going to beoverly excess, uh, successful
and even if the money is there,it's probably going to plateau.
So I totally agree witheverything everyone's saying and
again, I've probably at certainpoints in my career been in the
points where it's oh, this isthe wrong job, this is the wrong
fit.
And the sooner that you canknow that and kind of make that
(22:38):
pivot to get back to somethingthat's more getting you into a
place of thriving, the better.
Speaker 3 (22:44):
Yeah, which is Aaron I think I talk about in my book
and I often sign these coversand I write you know, um, keep
striving to be uncomfortable andcomfortable means more growth
and and it's kind ofcounterintuitive.
But actually, if you arecomfortable, you're going to
just sit there and and you floatbecause it's easy.
Right, life's easy versusactually I don't know what I'm
doing.
I need to learn fast.
(23:05):
You know, I've got.
The great example I talkedabout in one of my chapters is
around being a CISO at HSBC andvolunteering to be a CISO after
being a CIO for so many years tosay I can keep doing a CIO role
, but actually I'm bored withthat.
I don't know.
20 years.
I want to, you know, dosomething different.
And so to me, you know, being aCISO where I don't know
everything, I need to learn fastand I need to um, engage the
(23:28):
business and get them to helptransform.
Um and the team to transformwas the challenge for me.
It's excellent.
Speaker 1 (23:35):
Yep, um, david, hold that book back up for a second.
I do have one question, so I'vegot my copy.
If, if individuals order thecopy.
Uh, I'm a skier and I see thegondola.
Will you guarantee ourlisteners that they will be on a
fast track gondola to the topof their mountain?
Is that the?
Is that the imagery it's?
Speaker 3 (23:54):
a really interesting question.
I I'd um when I designed thecover is this sunday morning and
and I was thinking about, okay,blue sky, you know that further
you go up the mountain, um, itgets kind of cold and sharp
rocks and it's not very nice,which is what it's like in the
C-suite, okay.
And so I got up to thepublisher and sent me an iStock
(24:15):
photo access and I went on theirlittle search with sort of AI
not really good AI and I'mlooking for a gondola that goes
left to right, that's up, notdown, and I want a blue sky
background and I want this sortof snow and whatever.
And I picked about fivedifferent pictures and showed my
wife she was still sleeping, itwas six in the morning and then
(24:37):
when the artist got this hesaid oh, you know, I've removed
the safety line, david, becauseit made the photo look kind of
ugly.
I said, no, no, it's greatbecause there's no safety line
in these jobs.
Right, you just fall.
But I think at the end of theday, the guide is meant for
people to help them.
Not everyone wants to be at thevery top.
Some people actually are okayto be at base camp because, you
(24:58):
know, further up the mountain,the Everest right, there's no
oxygen, it's life-threatening.
So Basecamp's okay for somepeople.
So a lot of people read thebook and say I don't want to be
a CIO or CISO, but I want to beclose to that role, and so the
book's more about actually howdo you become the best version
of yourself and grow yourselfbeyond where you think you could
be.
And so, if I look at my owncareer, have I gone further than
(25:20):
I thought I could?
Absolutely, and I think I'vealso coached people to the same
point where they didn't believethere could be a CRSU.
So I've coached them to believethat by actually then them
understanding, identifying whatis it I'm not doing and how do I
round out those rough edgesthat otherwise would stop me
being a CRSU I love that?
Speaker 1 (25:39):
Yeah, I know.
The only analogy that you mightthrow in there is the gondola
has one one compartment going upand one going down, and there's
a joke or something in thereabout like, for those that get
near the top and don't like it,they might either choose to ride
back down or be sent back down.
Speaker 3 (25:56):
So yeah, it was.
It was interesting.
There's probably not seeing thedetails here, but there was, um
when, when the, the photo cameback, actually the the actual
version going down had no oneinside it and I asked the artist
to add it back in again.
Because the reality is, as youknow, some people choose to go
down right, you might say, forlifestyle, for family health
(26:16):
reasons, I want to go up and Igo down.
I talk about this using theelevator's analogy, actually in
my book, which says thatsometimes you're open to the
person calling person callingyou to the doors open, or doors
closed, or you actually justtake your boss, you press that
panic button.
There's different mechanisms,but up is not always the answer.
Sometimes down is okay as well,cause it depends what you're
(26:37):
looking for in that sort ofholistic viewpoint.
Great points.
Speaker 2 (26:43):
That's excellent, david.
We have one more question foryou Very, very important
question here.
So for all of our listeners, Iwant to give them the VIP access
and say give us one fun fact ofDavid that maybe everyone
wouldn't know.
So share either a story, a funfact, but give our listeners
something special here that'snot super public knowledge about
(27:05):
you.
Speaker 3 (27:08):
I met him when I was 20 years old, and so for me,
being married at 20, atuniversity, doing odd jobs pizza
, bar man, whatever it was tomake money.
But then to me then saying okay, I want to go and support my
family, I want to go and buy ahouse and do all the right
things, but inside I had thisdrive not to ever be stuck in my
(27:32):
job, never to be stuck in onecompany.
So when banks offered me a job,I thought I can't take that,
because the banks will offer mea job and I'll have this
half-priced loan I'll never beable to leave.
So I ended up working at bankslater in my career.
But it working in banks laterin my career.
But it's kind of intuitive,right, because the safe answer
is to go to the safety which istake the job with the seven
percent loan, not 15 percentloan, and because it's it's it's
(27:52):
it's a high incentive.
But I said no, no, I'm going toresist that.
So to me the fun fact is aroundknow yourself, know what you
know what, what drives you.
For me it was actually.
I know, if I make myself into acomfortable position, I get get
lazy and floppy right, and Ineeded to keep pushing myself
and so that was sort of a funfact, katie, that helped me
(28:15):
drive.
And I think being a young dadalso meant that I had to learn
how to teach my son things.
So my son, at the age of 12,could read books, he could play
the violin, he could swim,because we did all this things
with him.
So my, my son, um, the firstmusic he heard was was mozart,
and he didn't.
(28:35):
He didn't talk about dogs, hetalked about this is a wind
mariner, this is a dacha.
You know we.
He saw books on monet and thisis the age of 12 months, by the
way.
He saw manet, he saw picasso,we showed him things because we
said we don't we're doing here,and I realized very quickly that
actually all the techniques Ilearned to teach my son to
(28:55):
enhance faster than schools just, you know, you don't get to
school until you're five yearsold.
Right at one years old he couldread right and and.
And I said actually you knowwhat all of us can actually
enhance ourselves if we chooseto.
We've just been told you're notthat good, david, or you are
that good.
And I learned early in my lifethat actually these guys are all
wrong.
They got it all wrong.
(29:16):
You can break these molds andthat's why I've kind of done my
own things in my career andwritten books and things that
people probably thought theynever could do, because I always
challenged myself and wanted tonever be put in that little box
.
That's excellent.
Speaker 2 (29:29):
Excellent.
Well, sir, I want to thank youagain.
This has been a great episodeand we appreciate you spending
the time with us.
We know you're very busy andblessed to have you here on the
US side for a little while thisside of the globe.
So thank you again for the time.
Speaker 1 (29:44):
And lovely Vegas.
Maybe he's in Paris now.
He could be, you know, at theSahara desert.
No, I think that that casinowent under.
So thanks so much, david.
Appreciate it, thank you.
Thanks, david Cheers.
Popular Podcasts
United States of Kennedy
United States of Kennedy is a podcast about our cultural fascination with the Kennedy dynasty. Every week, hosts Lyra Smith and George Civeris go into one aspect of the Kennedy story.
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com