Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Matt (00:00):
Hi, everyone.
Welcome to the Router, seasontwo, we've hope you've had a
great summer break and we'redelighted to bring you all new
episodes of our UQCS studentpodcast.
Today, we have Jodie and Tanvirfrom Atlassian to tell us all
about their journey to, andtheir life in Atlassian's
Security team.
Hello, Tanvir and Jodie.
(00:29):
How are you both?
Jodie (00:32):
Great.
Thank you.
How are you Matthew?
Tanvir (00:36):
Doing well.
Matt (00:37):
That's good.
I just thought it'd be good tostart, um, to let you to, uh,
introduce yourselves, um, andwhat you do.
Jodie (00:44):
Uh, cool.
I'll go first.
Hi everyone.
My name is Jodie Vlassis and Iam a senior trust analyst, on
the Atlassian security team.
So I currently work in the Trust& Security team based here in
Sydney, Australia.
Tanvir (01:00):
Hi everyone.
My name is Tanvir Ahmed, I alsowork in Atlassian in the product
security team.
I'm here, senior productsecurity engineer.
I'm pretty new to Atlassian,over eight or nine months now.
Yeah, and then working onProdSec team, excited to be
here.
Matt (01:20):
Um, so I guess I'll start
by asking, um, what's a typical
day at work.
Like both of you, um, like a lotof students are interested in
entering cyber security, butthey kind of don't know what's
involved, you know, what's theday-to-day so, um, I guess
Jodie, if you want to elaborateon what your day at work is
like.
Jodie (01:39):
Yeah, for sure.
Um, so here at Atlassian and wehave a small function that sits
within the wider security teamand we're called, uh, the Trust&
Security team.
So the easiest way to explainwhat we do is very, essentially
a small team that, uh, sits, uh,sits within the security team
we're essentially cybersecuritySMEs.
(02:01):
That's, uh, pretty much, uh, thebridge between the customers and
the security team and what wedo.
Uh, we do, we do quite a lot ofthings, but I guess in the day
of what we do is, um, we workquite closely with, um,
customers around, um, around ifcustomers have specific security
related questions, um, inregards to our products or to
(02:24):
our solutions, we generallyprovide that support to a number
of our support teams.
Um, we also, uh, provide a lotof support to other teams within
the organization.
So we work quite closely withthe risk and compliance team to
obtain certain certificationsfor our products.
Um, we also work closely withour privacy and our reliability
(02:47):
teams as well.
Um, there's also a little bit ofmarketing that's involved with
what we do.
We like to showcase andhighlight a lot of the really
cool things that we do with theAtlassian security team.
And we want to showcase to ourcustomers, um, and through that
we build, uh, I guess, we buildtransparency, through security,
um, within our products.
Matt (03:08):
Tanvir, did you want to, I
guess, talk about yours, you're
coming from a product securitybackground, so a bit different?
Tanvir (03:13):
Yeah, so yeah, our, so
we, uh, I mean I'm in a product
security team, which is a bitdifferent than what, uh, Jodie
is, and we are in the same, uh,cybersecurity or information
security umbrella, uh, but ourroles is a bit different.
So we are in product securitywhich encompassed end to end
security responsibilities forAtlassian, uh, products.
(03:35):
Uh, as most of you are awarethat we are a software company.
Uh, so, uh, our day-to-day, youknow, it's like selling software
basically, right?
So we help development teamsfind, fix, prevent or disclose
security vulnerabilities.
Um, our typical day wouldinclude like checking on our
public bug bounty, uh, to ensurethat, you know, there is no sort
of security report from thepublic bug bounty sites we are
(03:58):
on background and then doingsome internal product security
reviews for our products, um,working on security automation
projects, each one of ourproduct security engineers are
assigned to certain Atlassianproducts.
So basically we are kind of asubject matter expert on some,
uh, like, uh, in, on ourassigned, uh, products.
(04:20):
So for example, uh, each, uh,product security engineers will
be a subject matter expert forone or two.
Uh, for example, Atlassianproducts.
So we are closely work withthose teams to make sure they
are securities, uh, you know,um, is, is, is security posture
for that product is good forexample.
Matt (04:38):
Interesting.
Um, so it seems both of you arereally into security.
Um, I guess, uh, the nextquestion I wanted to ask is, uh,
what was your journey to thefield of cybersecurity as a
whole?
Like how did you get toAtlassian as well?
Jodie (04:55):
Yeah.
Um, yeah, it's a lot, it's along, my journey is probably a
little bit unique, I guess it'snot your traditional journey
into the cyber security world.
So I guess I was quite exposed,um, I guess, to creating and
programming at a super youngage.
Um, I used to watch my brother,um, do a lot of programming way
back in the day.
(05:16):
I think I was about 12 yearsold, try not to give my age away
too much.
Um, um, and I used to watch himand I used to say, Oh my God,
you know, I'd love to do, youknow, I'd love to learn how to
do that.
Um, I guess, uh, choosing adifferent career path in life, I
somehow managed to come backinto cybersecurity.
So, um, uh, my journey, I guess,was, I eventually went back to
(05:39):
uni as a mature age student andI ended up studying for about
eight and a half years.
Now, my background is nottechnically cybersecurity.
I didn't do a traditionalcomputer science degree.
However I'd like to think I'm apretty good product of, um, and
a pretty good example that youdon't need to do a science
degree to get into cybersecurity.
(05:59):
So, um, not to say that youdon't need a computer science
degree, you definitely do.
If you do work in and moretechnical, um, programming
background prior to joining itlast year.
And I actually came from bigfour professional services.
I actually came from Deloitte,uh, where I was delivering&
uplifting cyber securityproducts and cybersecurity needs
for clients.
(06:21):
Um, a lot of my work, uh, is apretty big intersection of IT
business and risk, and I wasable to assist a number of
clients to develop and implementstrategies, roadmaps, um,
operating models, assess currentstates and develop, uh,
governance and policies, uh,within a client's organizations.
How I came to Atlassian?
(06:43):
Uh, and I say this with suchhigh importance that, you know,
it's really important that youneed to network within this
industry because by the reasonwhy I got this job was because
of networking actually went to,um, uh, cyber security women's
related event.
And, um, you know, just, justwent and introduced myself.
(07:04):
And I wasn't really looking fora job at the time, but it just,
you know, it doesn't hurt to sayhello and introduce yourself.
And then three months later Iwas offered a job.
So that's sort of how I came toit last year.
Matt (07:17):
Sounds amazing.
Um, and I guess Tanvir, did youwant to talk about your journey
as well?
Tanvir (07:24):
Uh, yeah, sure.
Um, so I started my career insort of cyber security, even
though I wasn't like reallykeen, I mean, you know, planning
on doing it.
So I started like very brieflyas a developer, but then I
quickly move into security sortof after graduation.
Um, uh, I'm not even also from acomputer science background, I'm
more of an engineeringbackground, even though I did a
(07:46):
lot of programming and stuff inmy, um, university.
Uh, so anyway, so cybersecurityback then, like it was a while
ago, like probably nine yearsago I started my career.
It was not as popular as it istoday, for example, but once I
started doing, uh, you know, Istarted in this career path, it
seems to be a quite interestingand I thought very good career
(08:07):
prospect as well.
So that's why I started pursuingthe path.
And over the years I had like,you know, many different roles
within information security aswe used to call it.
And even though someorganization call it, uh, within
various different industrysectors as well.
So for example, from banking,financial industries, uh,
consulting, um, and now forexample, over here in software
(08:29):
company, so it's actually a verygood, um, it gives a very good
idea around how, uh, thecybersecurity functions work
within organizations since I wasworking in very different
industry sectors and varied, um,few different functions as well,
not for example, just productsecurity, uh, that I'm currently
working on in few other, uh,related, uh, domains that I was
(08:49):
working.
So it gave me a very goodholistic approach around how
security works in anorganization regarding our
journey to Atlassian.
So, as I mentioned, I'm pretty,still new learning.
Uh, it's only been nine monthsnow, uh, but, uh, I applied
through that Atlassian job site,um, through LinkedIn basically,
uh, because I'm still new toAustralia as well in Sydney.
(09:13):
Um, had been only here for lessthan two years now.
So I am not, I don't have thatmuch of, uh, for example, uh,
you know, um, networkingopportunities, for example, like
that's Jodie mentioned.
So it's still pretty new here asI applied through the, through
the, uh, through the portal, uh,and then had a very good, uh,
you know, experience seamlessexperience.
We now started with a seamlessor remote onboarding because
(09:35):
since I joined Atlassian, Inever got to see, got to work in
the office.
So it was all remote, anonboarding experience, which is
really fantastic.
And then you're in a veryseamless journey and, uh, I'm
really, really, uh, you know,pleased with my, uh, with, uh,
how chatting is going so far.
It's very, I mean, I'm quiteimpressed with the team cultures
(09:56):
and you know, how we collaboratewith different teams within the
organization.
It's, it's really good so far.
Matt (10:03):
That sounds great.
I think Atlassian is known fortheir kind of team culture all
around the company.
Um, I guess another thing Iwanted to ask is, I guess this
is a really good question aswell now, cause I know, um, both
, uh, both of you are not fromstrictly computer science, uh,
backgrounds.
Um, but a lot of our listenersare currently, um, university
students or might not even beuniversity, they might just be
(10:24):
graduates, but, um, if they'reinterested in entering, um,
cybersecurity, are there anytopics or like different things
that you think that they shouldfocus on learning about?
Jodie (10:37):
Uh, good question.
Um, when I think Tanvir, and Imight have different responses
to this, which is really goingright.
Um, we want a bit of diversityand variety in, in, in different
approaches to these.
So I guess I can only reallytalk from experience from what
I've gone through.
So, um, as I previouslymentioned, I don't, I actually
(10:57):
don't hold a technical degree.
i.e.
Like a computer science degree.
Um, I guess if, if the listenerswant to know what topics they
think they should focus on.
I think ideally what worked forme was, um, was doing a couple
of units that were cybersecurity, um, specific, but were
(11:22):
very like broad learnings,right?
So what I mean by that is, isthey're not specific or
technical, they're not toospecific or too technical
enough.
It was more, um, somewhat of abeginner/ intermediate
introductory to cybersecurity,because cybersecurity is just
such a huge industry, right?
(11:43):
Like you can really just go downa rabbit hole, and then all of a
sudden you're sort of, you know,neck deep into application
security or vulnerabilitymanagement, or, you know, coding
or whatever.
Right.
Um, I think the one thing that Iwant to stress to people is that
you don't need to have atechnical background or
technical degree to get intocybersecurity.
(12:04):
I think, um, as an individual,you should sort of start with
knowing what your strengths andweaknesses are and sort of do
your research and see whatreally interests you, you know,
a lot of people sort of freakout or quite surprised when I
say I've been, I, you know, Istudied for like eight and a
half, nine years.
And the reason for that isbecause I was really passionate.
And when you're reallypassionate about something, the
(12:26):
learning comes quite easy toyou.
So, you know, do your researchand see what really interests
you.
Um, a lot of, I, I get asked alot of questions about, um, you
know, should, should individuals, um, consider taking on, uh
post-graduate so it's degreeslike master's or post-graduate,
or, um, PhDs.
(12:47):
Um, I guess it's just each totheir own, I guess it's up to a
situation or circumstances up towhere you sort of are at, in
life.
Um, I think, uh, for me as amature age student, are, I felt
like in my own personalsituation for me, in order to
stand out, I chose to do amaster's degree, um, because I
(13:08):
did want to stand out.
I knew that I was going to begoing up, um, a lot of
individuals that were probably alittle bit younger than me, and
probably a little bit smarterthan me, but I sort of wanted to
stand out from the rest and go,you know, what, I'm going to do
a master's degree.
Um, also study the market andthe industry that you'd like to
prefer to work in as well.
Um, you know, my background wasI went into Deloitte as a
(13:31):
graduate, and I, I say this to alot of my mentees.
I say, you know, the best way togain as much experience as
possible is starting in agraduate or an internship role,
because it gives you theopportunity to learn so much and
to ask so many questions andreally be a sponge, and really
(13:53):
experience all the differentareas of security.
Um, and the last thing that Iwant to sort of suggest and
mention as well is, um, youknow, you might be, you might be
starting a, uh, an engineeringdegree, like Tanvir, for example
, um, with security, I think theunique thing about working in
the cybersecurity role is your,your attributes and your skills
(14:18):
that you have are so easilytransferable into the cyber
security world, you know,identify and look at what, what
your uniqueness is to theindustry and see how you can
transfer that into the cybersecurity world, because I can
guarantee you, there is always aspot for anyone, um, in the
security world.
(14:38):
It's such a, it's such a uniqueindustry that we work in, that
you can pretty much bring anytype of skillset into our world
and really apply it.
Matt (14:46):
It certainly sounds
cybersecurity has so many
different, um, opportunities.
And I know, I know a lot of, uh,um, listeners and students and
things like that all want toexplore their own different, you
know, um, paths.
So it's good to know that cybersecurity allows for all those
different, um, things to beapplied to something, um, yeah.
(15:09):
Uh, Tanvir.
Do you have any thoughts onlike, topics to focus on or just
like things to learn about?
Um, yeah.
Tanvir (15:16):
Yeah.
Yeah.
I think I agree with Jodie inthat sense that, you know, find
out what area of cybersecurityor in any careers.
So to say in IT or in any otherfield, for example, you are
interested in and then pursuingit, uh, because I mean, you
don't want to be like, justgoing around until, okay.
I just want to work in cybersecurity finding out that
interest, what interests you,and then they know, and then go
(15:38):
forward for it and then try tolearn knowledge or gain
knowledge in that area where youare interested in, uh, I think
that will help you progress amuch more focused way of going.
Um, but I mean, having saidthat, you know, like a lot of
the knowledge, for example, whenyou started working, you are not
definitely not going to get itfrom the textbooks or, or in
(15:59):
the, you know, our, we learn inthe classroom.
Right.
Uh, so a lot of the knowledgethat you'll be getting is
through what Jodie mentionedwhile you were doing an
internship, or when you aredoing the, for example, um, you
know, when you're actuallyworking.
So just, uh, you know, I mean,be at that in mind, for example.
Um, but, uh, anyways, I mean, uh, having said that like in our
cyber security as most of auniversity students or anyone in
(16:21):
that sense, I know, always thinkabout, you know, cybersecurity
is mostly about hacking acompany.
You know, when we see on themovies, a hacker in a hoodie who
tried to hack into a computer,but that's not always, that's
not the case.
Right.
I mean, as you know,
Jodie (16:39):
If you work at Atlassian,
you will definitely be wearing a
hoodie.
I mean, that's pretty much allthere.
So that bit's right!
Tanvir (16:44):
Yeah, yeah, exactly.
Um, but yeah, I mean, havingsaid that, so, I mean, that's
not only what cybersecurity is,right.
I mean, as we all know that, youknow, there are various
different domains within, oncybersecurity.
That's only one section or onepart of it, which is like, where
do you do a hacking our way wedo work in red team already work
in penetration testing, forexample, but there are other
domains within cyber security,for example, the security risk
(17:05):
and governance incident,response, infrastructure, uh,
product security dev cycles, andso on and so forth.
There are so many areas.
So, yeah.
So just try to find out whatinterests you and then probably,
you know, um, learn and try todevelop knowledge in that area
that might help, um, uh, to, forbeginners outside.
Matt (17:27):
Sounds good.
Um, I think going into thatquestion a little bit more, uh,
specifically, uh, with regardsto like what you need to know,
um, and work, um, I know there'sa lot of talk about, um, things
like the OSCP or like, uh,security certificates and things
like that.
Um, I've either of you, I guess,had experienced with obtaining
(17:48):
like cyber securitycertificates, and have they,
have they been useful in, uh, atwork or obtaining the job at
Atlassian, or anything likethat?
Jodie (18:02):
Tanvir, do you want to
answer this?
Tanvir (18:04):
Uh, yeah, sure.
So, yeah, I mean, I have takenquite a few certifications a few
years ago actually.
Um, so things like OSCP that youmentioned and, um, and some
sense certifications and so on,so forth, AWS, those are really
good.
Um, I highly recommend that, uh,but I think for university
(18:25):
graduates or at least for peoplewho are studying in the
universities, um, my advice islike, yeah, it's good to have
those certifications, but had tomake sure that, you know, you
have those technical, um,technical fundamental skills
that you really need.
Like, you know, things like asif you really want to go into
the technical stream.
So to say like things likeprogramming, networking, uh, I
(18:48):
think like I didn't work in, uh,yeah, not that the networking is
all important, but like thingssuch as sys admin courses, like,
you know, like Linux or drag tounderstand how Linux or windows
environment work and so on.
So for like very technicalskills will definitely be very,
very fundamental.
And then you add on to yoursecurity certifications or
(19:09):
security.
Um, you know, of course if youdesire things like OSCP, which
is a bit more advanced, I need abit tricky for, but first of
all, you need to know abouttechnology, right?
I mean, that's, that's importantand fundamental.
If you don't know how technologyworks, you won't know how to
hack it, for example.
Right.
So for example, first it'sactually knowing the basics,
(19:29):
trying to learn securityfundamentals and then move on
properly.
Um, doing securitycertifications, if you, if you,
if you're willing to.
Yeah.
Jodie (19:37):
Just to add to that, um,
to what Tanvir has said as well.
Um, I think, you know, as auniversity students, I think
probably what's more importantis to study, get his teeth sunk
into like work.
Um, don't focus too much onsecurity certifications.
Um, what's more important isexperience.
And I think a lot of ourlisteners will find that, um,
(20:01):
you know, when you're applyingfor jobs and roles, you know,
yeah.
So skills is one thing, but likeexperience is way more valuable
than skills themselves.
You can, you can obtain skillsand you can get certifications
whenever.
But like, if you, and likeTanvir said, you know, if you
don't understand the technologyand you don't have that
experience, a certification isnot going to mean anything.
(20:22):
So, you know, as a graduate oras someone who is trying to, um,
you know, get their foot intothe door, really just focus,
trying to get that job first andget that experience.
And, you know, thecertifications will come and
follow after that.
Um, I know that I'm currentlyworking on, um, Susan at the
moment.
(20:43):
Um, and a lot of, some of the, Iguess not suiting, I guess, some
of the non-technical, um,certifications out there, like
your CISSPs, your CISM, um,CSSAs and whatnot, um, actually
require, um, an individual tohave, um, X amount of
experiences before X amount ofyears of experience.
(21:04):
Sorry.
Um, before you can even, um,apply to do those certifications
.
So, you know, don't, don't focustoo much on certifications.
Yeah.
They're great.
Go find certifications that arefree.
Like, you know, there's anabundance of free, um, free
websites out there that willoffer free, um, free
certifications and, you know, goand do those ones, you know, to
(21:28):
me that shows, um, that showsdedication that shows
enthusiasm, you know, and, youknow, someone's behavior and
someone's attitude is way morevaluable and experience is way
more valuable than, than acertification in my eyes.
Matt (21:45):
Yeah, fair enough.
And I think, yeah, as, as unistudents, they're just getting
started I guess, to, to build upthose fundamentals.
Um, and certainly I guess a CSdegree might help with those
fundamental things as well.
Um, you learned those after aswell, but, um, they've building
up this fundamentals and thenfocusing on certificates
afterwards, I guess, or evenlike when you're at work, maybe.
(22:06):
Yeah.
Yeah.
Um, I just have one finalquestion.
Uh, I wanted to ask it's a bitmore specific to what Atlassian
does.
Um, so, uh, that's, I think somepeople will have heard at last
year, uh, started this big shifttowards, uh, software as a
service and like cloud basedofferings.
(22:27):
Um, and this, I guess mightaffect, um, you know, the
security concerns is involvedwith having data in the cloud
and things like that.
Um, how has working in the lastyear and how, how has that, um,
move towards this cloud-basedoffering impacted, um, the
different security concernsAtlassian faces?
Jodie (22:50):
For sure.
Um, I'm happy to talk to this.
Um, just because, you know, I,myself and our team, the trust
insecurity team does work veryclosely with, um, our customers
globally.
Um, and we do hear a lot ofthese concerns.
So, um, you know, Atlassian ishelping more enterprises move
critical workflows to the cloudevery day, and we field a wide
(23:12):
variety of questions to helpthem make that process, um, you
know, as easy, but as well assecure as possible.
Um, the most common among themare worthy of consideration by
any business with cloudaspirations.
So for example, we see acontinuous pattern of customers
becoming more, I guess, woke ormore inept about data residency,
(23:35):
for example, um, compliance, uh,encryption of data, uh, and so
forth.
So, you know, it's our jobworking in security, um, is to
build trust and transparency,through security.
So, um, as most businesschallenges, large and small,
they're usually sold not byindividuals, but by teams.
(23:56):
And it's been last scene'smission to unleash the full
potential of every team acrossall organizations and all, um,
all sorts throughout the world.
Um, and I guess in recent years,we've witnessed the growth in
one of the most significanttools for tank collaboration,
which is the cloud.
And, um, you know, Atlassian'sembraced it wholeheartedly.
(24:18):
And our cloud products enableteams to collaborate and
innovate more effectively andscale quickly and focus more
time and energy on their coremission.
Uh, the cornerstone of our cloudapplications and services is
security.
And our mission Atlassiansdepends on those.
So we are pretty committed toensuring, uh, the unfaltering
(24:39):
safety and security of acustomer's data and to providing
all our customers with theinformation that they need to
understand and evaluate, um, youknow, our security practices as
security posture, our policies,uh, for themselves that they
have the right information andto make that salt, that sound
decision, um, when migrating tothe cloud,
Matt (25:03):
Sounds fantastic.
Um, I guess, uh, Tanvir, do youwant to say anything or?
Tanvir (25:08):
No, I think Jodie is the
expert over a year in advising
the company moving to SaaS andcloud based.
So I think she covered most ofthe points that we wanted to
cover.
So yeah,
Matt (25:22):
I think that was a great
summary.
Um, and yeah, so I think that'sall from me.
Uh, I just want to say thanks somuch for, uh, you know, uh,
giving some time to chat about,uh, security with all with us.
Um, and I think a lot of, uh,university students or anyone
listening to the podcast willfind this really helpful, um,
(25:43):
for, I guess the planning, the,their careers moving forward of
thinking if they want to go intocyber security, maybe this will
help sway them.
Um, but yeah, uh, any, any lastthings?
Jodie (25:58):
Yeah, for sure.
So, um, just for all ourlisteners who are university
students, um, that are wantingto step into, uh, you know, a
full-time role, whether that'sin, um, professional services or
whether that's in the tech spaceor whether that's in private or
public sector.
Um, so Atlassian, uh, weobviously have our internship
(26:20):
program as well as our graduate,um, graduate ship program as
well.
Um, I'd highly recommend all ofyou to go and visit that which
is, uh,www.atlassian.com/students.
Uh, you'll find all updatedinformation about upcoming, uh,
applications for our internshipprogram, as well as our graduate
ship program.
(26:41):
Um, also as well, um, our humanresources and talent community,
um, have created a new groupcalled the student talent
community.
And this is actually a reallygood opportunity for any
individual that wants to getdirect contact and response, uh,
from our campus recruitmentrecruiters or our human
resources recruiters.
(27:03):
Um, what I'll do is I'll postthe link down below so that you
can join that student talentcommunity, because if you have
any questions, uh, that youwould like to ask about the
hiring process, or maybe gettingsome tips on, um, interviewing
and things like that, our teamis more than happy to support
you and your journey, whetherthat's with that last in, um, or
(27:26):
to provide any, um, advice ortips or tricks are for
interviewing for other job rolesas well.
So I'll provide that informationas well.
Matt (27:35):
Fantastic.
Jodie (27:37):
And that's it, thank you
for having us Matthew,
appreciate it!
Tanvir (27:43):
Thanks for having us,
Matthew.
Matt (27:44):
Yeah, it was a pleasure.
And, um, we hope that, uh, allof our listeners are now
inspired to, uh, considercybersecurity as a career.
Jodie (27:52):
For sure.
And if you'd like to reach outto Tanvir and I we're both on
LinkedIn, so just feel free to,um, to follow us or hit us up
and we'll then happy to answerany questions.
Tanvir (28:03):
Yep.
Matt (28:03):
Fantastic.
All right.
Thanks so much.
Our next episode will be in twoweeks time, we'll be following
the fortnightly schedule as wedid last season and, uh, until
then make sure to join us on ourSlack community at slack.uqcs
.org.
My name is Matthew Low and thispodcast was created by the UQ
Computing Society with gracioussupport from our industry
(28:26):
sponsors.