September 5, 2023 • 34 mins
Imposter Syndrome is when a person feels inadequate despite their accomplishments. Not unique to the field of cybersecurity or even software development, imposter syndrome can affect any professional as they advance and grow in their area of expertise.
Matt and Izar, both seasoned security professionals, openly discuss the dichotomy between their intellectual achievements and the emotional weight of feeling like they don't belong. They touch upon the challenges of presenting at conferences, where the internal dialogue of self-doubt might be at its loudest, yet they've learned to project confidence.
The conversation also highlights the importance of understanding one's worth, emphasizing that it doesn't stem from external validation or the opinions of others. The hosts each share personal anecdotes, such as moments when they felt most vulnerable on stage, and how they've learned to navigate these feelings over time.
This podcast serves as a candid exploration of the imposter syndrome, offering insights and encouragement to professionals from any field who might feel the same way.
FOLLOW OUR SOCIAL MEDIA:
➜Twitter: @SecTablePodcast
➜LinkedIn: The Security Table Podcast
➜YouTube: The Security Table YouTube Channel
Thanks for Listening!
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Chris Romeo (00:10):
Hey folks.
Welcome to another episode ofThe Security Table.
This is Chris Romeo, joined bymy friends Izar Tarandach and
Matt Coles.
The topic we have for today isimposter syndrome.
And we, we hear about this a lotin the realm of cybersecurity
and we really just want tounpack it and understand what it
(00:32):
is.
And so let's get a definitiongoing first.
You guys know, I like to, I liketo define things early in the
process.
So I mean primarily so that Iknow what the heck we're talking
about, um, in my simple mind of,uh, understanding of whatever
we're discussing at the moment.
So, uh, what is, so Matt, whydon't you kick it off for us.
What is imposter syndrome fromyour perspective?
Matt Coles (00:53):
Yeah, that so, so, imposter syndrome, uh, is, I, I,
for me is.
A second guessing of a, of anability.
So like why are you, like, whatmakes you the expert or what
makes you qualified, even if youhave the qualifications, feeling
(01:17):
second guessing that not havingthe con, not, I don't, it's not
necessarily not having theconfidence, but just wondering
is this like, are you doing theright thing?
So it's not a I, I can't give aclear definition.
It's sort of the sense that onegets when they're looked to for
guidance or support or orexpertise, and they have the
(01:42):
credentials.
They have the credentials.
Pause
Izar Tarandach (01:51):
So I,
Matt Coles (01:52):
They have the cred, they have the credentials, uh,
but they, uh, may not have theconfidence.
Not always have the all hold on.
Izar Tarandach (02:03):
I, I think I, I, I don't think I can give a
definition, but I, I, I can giveyou the feeling because I'm
assaulted by it every singletime, and I think that at some
point, I, I was in one of ourmany congregations and.
(02:26):
I looked to one side and I hadBrooke.
I looked to the other and I hadAdam, and I'm going, why the
hell am I here?
Like, who, who, who said that Icould be here?
And who said that?
I could say something like, whatis it possibly that could put me
at their level in saying thethings that are in my head?
(02:47):
And I can tell you sometimesit's debilitating, right?
Sometimes, especially sometimesjust before a a, a talk, for
example, and this happened, uh,in, uh, OWASP Dublin.
You can definitely hear on myvoice in the recording that, uh,
(03:08):
I, I'm physically like my voiceis physically trembling because
until you get into this, at, atleast I do, until I get into the
stride of things.
The anxiety of why would thesepeople stop their day to listen
to me?
What gives me the authority orthe the right to take up time
and talk about these things tothem?
(03:29):
And it doesn't matter how manytimes you do that, it doesn't
matter how much validation.
This, again, I'm, I'm talkingpersonally just me.
Doesn't matter how muchvalidation you get.
It keeps coming up to you againand again, again, again.
And I spent a long time thinkingabout this thing and, and asking
myself what, uh, what the hellis happening here?
And talking to people whosupposedly know about these
(03:53):
things.
And, uh, I, I, I'm very openwith it because most people that
I talk, talk with, they, theyimmediately go at, oh, you know
what?
I feel that too, or I feel thatsometimes, or it happened to me
at some point.
So it, it's not a, uh, it's nota, what's it called?
(04:14):
Not humble brag, but it, it,it's not a, oh my God, I'm not
worthy thing.
actually a, a, a, I won't callit a mental health issue.
I, I think, but it's actually aphenomenon.
A, a, a mental phenomenon thathappens to people all the time
in, in all careers, in allplaces of life.
And I think that that goes backto one of our previous episodes.
(04:38):
Only when you know enough toknow how much you don't know.
I think that you get assaultedby this thing.
So it it, it connects to like,what's the name of the effect,
uh, Don Donning Kruger, that youthink that you know everything.
Chris Romeo (04:49):
Yeah.
Izar Tarandach (04:50):
Only when you are in a position where you know
how much you don't know, thenyou can question yourself and
say, why the hell do thesepeople would be willing to
listen to me.
Chris Romeo (05:01):
Mm-hmm.
And so, Matt, from yourperspective, if, if you're
willing to share, like how doesthis, how does it manifest?
You know, Izar gave an exampleof OWASP Dublin, and I was at
that talk and I don't remember.
I don't remember that being areaction, and I tend to be
someone who watches pe peoplespeak.
(05:23):
Listens to what they're saying,but I'm also watching the, just
'cause I'm, I'm a student ofpublic speaking and I, I look
for things other people do thatI might be able to apply to my
own world or I look for things.
And so I don't remember any ofthat.
I don't remember Any hesitationin your delivery or anything?
I could, I didn't perceive itfrom where I was sitting and I
was paying attention too.
Matt Coles (05:42):
I think, I think that those of us who, who, those
of us who have, have, have hadepisodes of Imposs, you know, of
feelings of imposter syndrome.
We have developed skills overtime that helps to mask that,
right?
Or to adapt to that.
So when I get senses, feelingsof imposter syndrome, it's
(06:03):
often, uh, so I'll say, youknow, just being in the threat
while manifesto group.
So here we had, you know, bignames.
We had Alyssa, we had Brooke, wehad Adam, you know, um, Izar,
right?
And, and so, uh, and you know,and so this, uh, this idea of
(06:25):
like, well, what makes my voicevaluable or, um, Is, am I gonna
say something stupid,embarrassing myself and, and
everyone's gonna look at melike, oh, he's the least
inexperienced.
You know, most inexperienced oneof this crowd.
So he doesn't know what he'stalking about.
So there's that aspect and I,but I think when it comes to
like, especially conferencepresentations, right?
(06:48):
I think we're.
We have adapted or, or, um,cultivated a, a, a way to
present without, without showingthat level.
Like there might be a runningtrend of thought in the head,
but you're able to projectconfidence in the presentation.
'cause we've done training andeducation, right?
We've done, uh, you know, we've,we've taught at universities
(07:08):
and, and, uh, and done corporatepresentations and things like
that, uh, in front of friendlycrowds or not so friendly
crowds.
And so we've adapted those,those techniques to, to, you
know, hide the, the internaldialogue to some extent.
Um, but, you know, I thinkimposter syndrome comes in from
a, it, it's, it's hard todescribe it.
(07:30):
I think is is, is our, put itbest, is really what puts what
puts us at the same.
At the same level.
Level.
And, and I wanna be careful'cause we're not really at the
same level.
I mean, you know, Adam, Adam forexample, is like the, the
expert, right?
He, he like effectively, um,catapulted threat modeling into
(07:51):
the, into the, the securityworld.
Izar Tarandach (07:53):
Yeah.
Matt Coles (07:53):
And I'm not saying that any of the people involved
with threat modeling prior thatdidn't do their parts.
But Adam is the more recentexample of that.
And you know, now that, forinstance, Izar and I wrote,
wrote the.
So threat modeling book, youknow, we're, we're talked about
in the same circles, and thatthat's a little scary, right?
(08:17):
And, but also a littlevalidating.
But it's hard to overcome that.
Well, did I, did I stumble uponthat or did I, like, are my
ideas valid?
And it's a confi, there's someconfidence building that has to
happen there, right?
Um, so that's, uh, I thinkthat's the best way to look at
this.
Chris Romeo (08:35):
Yeah.
Just to, to give you kind of myexperience, I can't.
I can't remember really dealingwith this, and maybe I did
earlier in my career, and I'mjust at a point where I just
don't remember, you know, youremember the good things.
You don't always remember.
You remember the good things,the tough things.
You don't always remember thechallenging things in the
Izar Tarandach (08:55):
Oh, I wish.
Chris Romeo (08:57):
and kind of how they came together.
But, you know, I, uh, I used tobe deathly afraid to stand in
front of a room of people andspeak.
I wouldn't, I wouldn't, early inmy career I would not do it.
I would refuse to do it.
And a f a friend of mine draggedme kicking and screaming into
the process of stepping out onthe stage and it, throughout my
(09:20):
time at Cisco and then le, youknow, get, take, getting me to
RSA the first time and, andgoing through that process.
And for me, the, the, the thingthat, that I really came to, to
understand was, and, and where Ireally became free.
Speaking in front of a group ofpeople is when I realized I
don't really care what anybodythinks about me.
Matt Coles (09:43):
Hmm,
Chris Romeo (09:44):
And it's, it's, it's may sound like a harsh
thing to say, but the truth is,and you guys have done a lot of
talks, a lot of differentconference talks, every room of
people, let's say there's ahundred people in the room,
okay?
10 people are gonna think you'resaying the best things on earth,
and they're gonna be takingnotes and they're gonna be
writing everything down.
10 people are gonna think, thisis the dumbest thing I've ever
(10:05):
heard in my life, who let thisperson talk here.
And the other 80 people, theother 80 people in the room are
just gonna be like, I was thereat that talk.
I don't know.
I don't really remember anythingmomentous about it or whatever.
And so for me it was, it wasfreeing when I reached that
point where, And I shouldn't sayI don't care.
I definitely care about, Iprepare, I want to deliver great
(10:28):
talks for people.
That's my goal.
Um, and you know, once in awhile, maybe I get lucky and,
and, and hit one, but, you know,it's, but when I realized like
I'm not, my worth doesn't comefrom what the people in the room
think about me, it was sofreeing because then I was able
to just be myself and.
You guys know, I mean, I like togoof around and, and I like to
do that from the stage now too.
(10:49):
And once, sometimes people don'tlaugh at all.
And that's a really awkwardmoment because I'm like, what is
wrong with you people?
Why?
That was funny! Come on, get uphere and listen.
Um, but it was really thatmoment where I realized like, I
just can, I can just be me.
I can do my thing and somepeople are gonna love me.
Some people are gonna hate me.
Most of the people are gonna belike, I don't even remember him
being there.
Like, was I in the room forthat?
Matt Coles (11:11):
So, so my, my first conference, my first, uh, public
speaking, uh, talk that I reallyfelt comfortable was early two
or mid two thousands, I guess itwas, uh, talking in front of a
Fortify user, user, uh, userforum, technol technical user
forum.
And I got up and talked aboutour experiences with Fortify at
(11:34):
the time.
And, um, I was completelynervous because, uh, you know, I
was, I was representing acompany.
My, my company we're rep.
You know, here's what we did andwe did some really interesting
things with, with Fortify at thetime.
And, um, The one thing Iremember is the, the crowd being
very supportive, right?
They were all in the same boat.
(11:55):
And that really, that helped toget over that fear of, well, am
I gonna say something wrong?
Well, I can't say somethingwrong if it's a debate or a
discussion, right?
As opposed to instruction.
And, and that really helped, butthat wasn't, they weren't
looking at looking to me for,for direction.
(12:16):
They were looking for discussionand debate.
Right.
And now I have a lot ofexperience.
Uh, my early career was with,with tech support, you know,
doing tech support for, fortechnology products.
Um, you know, had the.
Izar Tarandach (12:34):
He can say, have you tried turning it off and on
in three languages?
Chris Romeo (12:39):
You knew that was coming.
Matt Coles (12:43):
Usually you have to, usually you have to kick it
first.
Uh, so anyhow, uh, so, you know,I always prided myself on being
capable of, of, of talking topeople of, I, I was very
comfortable talking one-on-oneand in small groups.
(13:03):
Right.
Um, uh, even today, you know,influence without authority is a
very powerful thing, right?
Um, but with that, the reason Ithat you get there is having, is
projecting confidence andhaving, uh, the, your audience
(13:24):
or your, your, whatever you'retalking to have, have confidence
in your ability.
Or trust in your ability.
And while it's relatively easyto project confidence, right,
that those techniques for how doyou do public speaking, you
know, that we've learned overtime, uh, the internal dialogue
(13:48):
has to, you have to, you have topush back the internal dialogue
a bit to say to like, you'reconstantly second guessing the
statements that you're making.
So that you keep the train of,of conversation going without
having it go well, and at somepoint you're gonna say, well, I
don't know.
And that's okay.
And you can say, I don't know,with confidence, as opposed to,
I don't know, I gotta go.
(14:10):
Like, you know, why am I here?
Go talk to somebody who knowswhat they're doing and, and I
wanna make sure, you know,obviously, you know, this is,
this is a security table therapysession, to some extent.
It's good to talk about thesethings.
I think a lot of people in thesecurity space, uh, probably
suffer from this.
Either they, they know it orthey don't know it, uh, but that
(14:31):
they suffer from it.
Um, right.
But, you know, we're expertshere, right?
We're recognized.
We have certifications.
We've done presentations thatwe've delivered material, both
in an academic and non-academicsetting.
We've, we've proven that wecollectively here have proven
that we, we know what we'redoing.
(14:53):
We have to prove to ourselvesthat we're on the same stage as
the people we're working with.
Izar Tarandach (15:01):
So I, I, I want to, to take a, a, take a lift on
that and, and sort of start byseparating things.
The public speaking part, it'sextremely important and
everything that, that Matt saidis, is completely right.
I, I think that that preparationhelps to, to mitigate the
(15:21):
imposter syndrome, but thatinternal dialogue that Matt said
that we are constantly fightingagainst or trying to, to shout
over that, that's the bit wherethe anxiety leaves, right.
That, that's especially forpeople with anxiety, that's a
(15:44):
huge precursor.
you start ask, asking yourself alot of, uh, negative questions
and, and people say that one ofthe, the first things that you
should try is to like, reframethose questions instead of why
should these people be, uh, whyshould I be talking to these
people?
You should be asking yourself,isn't it great that these people
(16:07):
took time to come and listen tome?
Because they didn't come on a,on a, on a limbo.
They, they came becauseapparently your abstract was
good enough to convince them to,to come over.
And while, uh, most public,public speaking, people will
say, Hey, you have to rehearse,rehearse, rehearse, rehearse.
I, I myself, I, I don't rehearsemy talks.
Right?
(16:27):
My, my new, uh, place of work,they, well not so new now.
They have internal rules that ifyou're going to present outside,
they have a team that's willingto come and listen to your
rehearsal and give you pointersand everything.
And to me, that that was a bitin the beginning.
Now I see absolutely see thevalue of it, but in the
beginning it was hard for mebecause I, I never give the same
(16:49):
talk twice.
I may say the same things, butit's never the same talk twice.
I try to, to read the, the, thepeople, see how they're
reacting.
Interesting parenthesis here.
One of my first talks at AppSeccolleague, I'm talking and
people all of a sudden take outtheir phones and start taking
pictures, and my immediatereaction was, my fly is open.
(17:16):
But then I noticed that notethat they were actually taking
pictures of the slides.
So being aware of what your,what your audience is doing and,
and why.
I find it's extremely important.
But so I, I, I think that whereI was going with, with this is
that I, I find, especially inmy, in my, uh, personal case,
(17:41):
that imposter syndrome is, isjust like one piece of the
puzzle.
Chris Romeo (17:47):
Hmm.
Izar Tarandach (17:48):
So, uh, The way that I came to, to, to work with
it, not, not to solve it, but towork with it is, first of all, I
accept it.
It'll happen.
Just wait for it to kick.
Then there's the fact that,yeah, if this audience came
here, it's because they see somevalue in what you have to tell
(18:08):
them.
Third, As Matt said, sometimesit's, it's shocking to look
around at the rooms that I findmyself of the people that I find
myself with, and the fact thatsometimes they stop talking to
listen to what I have to say.
And the way that I'm looking atit is I, I am not alternatively
(18:29):
putting out something thatpeople should just accept.
I am having a huge opportunityto rent the time in the brain of
a lot of very smart people.
To put out my ideas and let thempoke at them.
Chris Romeo (18:45):
Hmm.
Izar Tarandach (18:47):
So it's not like I'm coming down with the 10
Commandments down from themountain.
No, I'm, I'm, I'm just walkingaround this mountain shouting
stuff and, Hey, you guys get toanswer to me.
Sometimes it's good, sometimesit's less good, right?
Chris Romeo (19:01):
Yeah.
Izar Tarandach (19:02):
But, uh, mainly when, when, when I am presenting
and when I'm with an audienceand I, and I start questioning
myself, why me?
It's not because I know more,it's not because I, I taught
more.
It's just because most of thetimes when it comes to the q and
a question, uh, to the q and asession and people start asking
me things, I can actually reachback in my history and say, I've
(19:25):
been through this and this iswhat happened.
Chris Romeo (19:27):
Mm-hmm.
Izar Tarandach (19:28):
it's not what I know, it's what I went through.
I am now in a place, especiallyof actually to that.
Let, let, let me be a bit honesthere.
I.
I'm in a place of my securityjourney right now that a lot of
people are just starting to gothrough now, and that has value.
I can point at mines before theystep on them.
Chris Romeo (19:48):
Yeah, because you've been through it, you've,
you've got the experience.
You've got the scars that gowith getting smacked and falling
on the ground, picking yourselfback up.
And you've, you've, that's,that's wisdom.
Izar Tarandach (19:59):
And it may not give me authority, but it gives
me value.
Chris Romeo (20:04):
It gives you wisdom.
Experiences that
Izar Tarandach (20:08):
It gives value.
Chris Romeo (20:08):
you've lived through is, is something that
you can then reflect to the nextgeneration.
And a lot of times people arestill gonna do the thing that we
all did that that caused painand they're gonna be, I don't
believe you.
I'm gonna do it.
Yeah.
Remember, well come back andtalk to me after, after it blows
up.
And just tell me that.
Just say I told you so I can sayI told you so.
Matt Coles (20:28):
Well, it is, it isn't just, I guess it isn't
just the, the, the priorexperience that you're able to
relate, right?
Because you use those asanecdotes for, uh, either using
as anecdotes, you use'em asdirect references for, well,
here's, here's some pitfalls.
Watch out for them.
Right?
Or here's some good things thathappened.
Look for those, or, or makethose happen.
It's also that we're able to, Wehave, or, and I say we, not just
(20:55):
those of us, you know, the threeof us here, but, but others, uh,
in this similar boat the abilityto take very complex things and,
and deliver it, the message inthe right way to the right
audience.
Again, not, not making those 10commandments kind of statements,
(21:19):
but.
Helping others put that intheir, in their head, collect,
you know, correlate that withother information that they have
to make an, and you know, wealways say making informed risk
decisions, but you know, itinformed decisions period.
Right.
That we can give them, you know,our expertise isn't just
(21:40):
thinking of interesting ways todo things, but also.
Correlating, uh, a whole lot ofinformation and providing that
in a way that makes sense topeople that they can then
utilize in their day to daylives.
Well, at least work.
Chris Romeo (21:54):
I wanna, I wanna unpack this a little bit deeper.
I wanna, I wanna ask you guys aquestion, um, based on your,
what you've experienced.
Because I real, I really don'tknow the answer to this.
I wanna, I wanna understandfrom, from what you've
experienced, how you would, howyou, how you think about this.
Like, if you break this problemdown into two pieces and you say
(22:15):
head versus heart, meaningintellectually versus what
you're feeling, Intellectually,you both are very accomplished
pro security professionals, yourauthors, your podcast hosts,
okay?
I worked that in podcast hosts.
but you're, I mean, you'reconference speakers, your,
(22:37):
you're, all of these things.
And so intellectually, if youkind of separate it, if you, if
you can separate this problemand cut it in two, you
intellectually say, Like, Idon't have the chops to hang
with the rest of these peoplethat, that I'm hanging around
with.
Or is it more on the heart sideof it?
(22:59):
Like, it's more like, I feellike I'm not, I, I, I'm, I don't
belong there, so like, I'mtrying to, I'm just trying to
unpack this and understand it inmore depth.
Matt Coles (23:07):
So let me, let me give you some of the, sometime I
thought that I, I getoccasionally, and I don't know
if it's intellectual or, or, orfeeling, I guess you can think
about the, the luminaries thatwe've been with.
But think about, just thinkabout some of the people that,
(23:28):
that you may converse with.
Um, In terms of, uh, you know,security, security experience,
for instance, right?
Where they have eight, you know,eight times as many
certifications as you, or theyspent 20 years in the, in at the
NSA or have, you know, uh, a tonof experience, you know,
(23:51):
defending nation states, uh, or,um, you know, or have built, you
know, have been CISOs of majorcorporations.
Right.
They have a ton of experience, alot of, a lot of letters after
their name.
A lot of, you know, maybe theyhave a newspaper article, you
know, Bruce Schneier, you know,kind of thing, right?
(24:13):
Um, I mean, we, I, I work withsome of these people on a
regular, on a regular basis,right?
Some of the, my close colleaguesare, are, are like this, they've
worked at, you know, at CSA or,or, you know, NIST or DISO or
NSA or wherever, you know,wherever else, right?
And we have a need to interacton a regular, on a regular
(24:39):
basis.
And I need to be an expert, needto be an expert.
And so, How do I compete withthat?
Like I have a master's degree,not, I have a master's degree in
computer science and I wrote abook on threat modeling and I
have 20 years of experienceright in, in, uh, in corporate
worlds.
Chris Romeo (24:58):
So that sounds like you're, it sounds like you're
intellectually, it sounds likeyou're on both sides of the
equation then.
It sounds like you're kind ofthinking through, like you're
intellectually saying, I feellike I don't stack up against
these folks, and then I feellike I don't as well is kind of
what I'm taking away.
Matt Coles (25:18):
Right, but I, but I know that I, for the expertise
that I have, I'm an equal, I'm apartner in this.
Chris Romeo (25:26):
Okay, so intellectually then you, so that
would be the intellectual side.
That's what I'm trying to get tois, is there a way to separate
this, but it's not, so you'resaying yes, you on paper, you
can look at their resume andexperience and your resume and
experience and say, yeah, Ibelong at the table in the
conversation.
Matt Coles (25:46):
Uh, yeah.
Yeah, we'll go with
Izar Tarandach (25:50):
But, but look how funny it is because now, now
comes like the, the outsideaspect of the thing that there
is a reason why.
Matt and I co-author the, thebook and for the
Matt Coles (26:05):
because he asked, he asked, and I said, yeah, that
sounds like
Izar Tarandach (26:07):
Yeah, there's a reason why I asked and, and
here's the reason.
For the past, I don't know, uh,11, 12 years, every time that I
had an idea connected to, tosecurity, that idea would not go
forward.
Before I went to Matt and Iasked, Hey, what do you think
about this?
(26:28):
Because I see him.
As the expert that he may notsee himself, right?
Chris Romeo (26:35):
Hmm.
Izar Tarandach (26:36):
But that voice inside your head telling you,
you're not worth it.
You're not worth it.
You're not worth it, okay?
That thing is shouting all thetime.
And you know what?
No, no names.
We know a couple of people.
One who's a very, very prominentperson in our field.
(26:59):
Who gets hit by impostersyndrome every single time that
they are asked.
And it, it's not something toquestion or to, to criticize or
to keep saying, come on, you,you, you know how good you are.
Just step out of it.
(27:21):
Right?
You cannot quieten that voice.
It, it's not as you put, it'snot.
It's not an analytical process.
It, it's, it's a, it's a feelingthing.
And, and God knows that, youknow, I'm, I'm not the most
connected people to the personto, to feelings, but it is, it
is, it is just something in youconstantly asking you, what are
(27:45):
you doing here now, in myexperience, fighting that you
can give into it.
And then that's it.
I'm, I'm sorry.
Bye.
By what I'm saying, but you'rescrewed because you gave up and
you are not getting out of it,but you can at the same time.
And, and I, I, I want to believethat that's what I do with it.
(28:06):
You can use it to move youforward.
You can use it to say, prove toyourself that you can be here.
Constantly prove to yourselfthat you can hear that, that it
can be here.
Constantly ask questions,constantly say what you're
thinking and expect answersbecause those people that you
value, Those are the oneslooking at your ideas and
riffing back to you and tellingyou, Hey, you know what?
(28:26):
There's value to this.
So now you don't have to askyourself, do I bring value?
Because you have other peoplethat you respect that are
telling you, Hey, there's valuein this thing.
Chris Romeo (28:38):
Hmm.
Izar Tarandach (28:40):
So again, the the choice is not to have it or
not have it.
The choice is how you deal withit.
Chris Romeo (28:47):
Yeah.
I see.
So you're, so you're, you'vejust kind of accepted the fact
that this is going to besomething you'll struggle with
through your entire career, ormaybe not struggle, maybe you
turn it into a strength based onhow you described it.
Here, you're gonna turn it intoa superpower.
Izar Tarandach (29:01):
That, that's the dream,
Chris Romeo (29:02):
You're reflecting.
You're reflecting through it toyour own success because you're
using it to push yourselffurther.
Izar Tarandach (29:09):
and I want to believe that it also makes me
better at communicating withpeople,
Matt Coles (29:13):
Yeah,
Izar Tarandach (29:13):
because now in order
Matt Coles (29:14):
it.
Sorry.
Go
Izar Tarandach (29:17):
No, no, no, no.
Go ahead.
Go ahead.
Matt Coles (29:18):
Well, I was just, I, I think we adapt to it, right?
I think we, we, we lean intocertain characteristics of our
role, right?
I, I mentioned earlier aboutinfluence without authority.
Like that is the basis from mywork.
For most, for the most part,right?
They're not, I'm, I'm work, I,the teams that I work with and,
(29:40):
and the people I, I communicatewith, you know, whether at work
or at conferences or wherever,um, is, is really a, you know, I
am, I need to be the expert, butI don't have a mandate like, you
know, that's not, it's not thatthey have to take my word as, as
as edict, right?
(30:05):
So I approach everything as anegotiation, as a conversation.
I'm there to relay informationand provide experience in a way
that like they have a particularway of looking at things.
I'm gonna come in from adifferent angle to help them see
it in a different way,
Izar Tarandach (30:20):
And to
Matt Coles (30:20):
bring in that and facilitate and bring in that
security experience andknowledge that they need from
me.
Izar Tarandach (30:25):
Yeah.
Because the system itself, theyknow much better than we ever
will.
They're writing it.
Matt Coles (30:30):
Right.
And so the imposter syndromethere doesn't that, that's, it
doesn't come into play so muchthere as when it's, you know,
you to a crowd or you to a,
Izar Tarandach (30:43):
To a forum like to, to a forum of equals
Matt Coles (30:46):
for, for, well,
Izar Tarandach (30:48):
Uh.
Matt Coles (30:48):
It's more interesting.
I, I think it's, it's evenbroader than that.
Um, you know, like, uh, so ifyou're looking at.
If you start comparing yourself,if you're in a, in a position
that, that you would be comparedwith others, that's where
imposter syndrome, I think,starts to come into play.
Izar Tarandach (31:07):
It's, it's different levels of, uh, not
authority, but, uh, I think thatwhen you're on a board of
directors, your opinions aremuch more pointed and, and, um,
this is where I stand.
This is where this is myposition, and it's going to be
very hard to move me from it.
(31:27):
When you're in a panel withother experts.
I, I think that we, at leastwhen we do that, and, and I
speak for the three of us, Wecome in open-minded and we say,
I have my, my things to say, butyou know what?
I'm willing to be convincedotherwise.
And many times it happened, evenhere in the podcast, that I came
one way and I left another, orat least with questions.
And, and i, I, I, I think thatI, I I, I love people who go in
(31:53):
front of an audience andpresent.
And you can see that thesepeople, damn, they're really
good presenters.
Like Chris is one, for example,he is, uh, in Dublin, his DevOps
thing.
It, it was a masterpiece inpresent, in presenting, right.
The, the timing, the, the, thesubject, the way that he pulled
the, the, the public in the waythat he riffed with everybody,
(32:14):
like the, the back and forth.
I, I sat in there like, I haveno clue what he talked about
because it was so much focusedon how he was talking about it.
On the other hand, there arepeople who have to like,
rehearse again and again, andagain, again, until they have
the whole script in their, in,in their head, and.
Some of them are good at it,some of them are not so good at
(32:35):
it, but it's a way of doing itas well.
Chris Romeo (32:40):
Before, uh, just FYI, before Dublin, I had
delivered that presentationprobably 10 times.
Izar Tarandach (32:46):
You had to deliver, but you, you, but you
didn't sit in front of thecamera recording it to
Chris Romeo (32:50):
No, no, no.
It was out on, it was out on thescene.
But it's, I mean, the jokes arecanned in that just FYI, because
over time you learn which jokeshit and they just, I don't know.
That's just the way my brainprocesses.
If I
Izar Tarandach (33:03):
That That's showmanship.
Chris Romeo (33:04):
if I can get a laugh, I'll drive, I'll drive to
that laugh each time.
Izar Tarandach (33:08):
So I, I, I mean, what, what I'm trying to go at
is when you get that impostersyndrome Yeah.
The, there are ways to fightagainst it.
Some of them are more timeconsuming, some of them
apparently are more, um, proven.
It is something that's you, you,you like, like they say here in
the, the us in the, themilitary, you have to embrace
(33:29):
the suck.
It's going to happen, so makepeace with it, move forward or
not, but don't let it stop you.
That that's my, my, my closing.
Chris Romeo (33:41):
I like that.
That's a good place to close.
That's a good place to end thisconversation.
I, I don't think this is thelast time we talk about this.
I think we can come back aroundand talk about it some more.
I think there's, there's more tounpack and more to more to just
learn and, uh, you know,
Izar Tarandach (33:55):
Because after all, who are we to talk about
this?
Right?
Chris Romeo (33:59):
I knew that, I knew you could see you like canned
jokes too.
You like the delivery and, andset it up and that's right.
So, hey folks, thanks forjoining another episode of the
Security Table and uh, reach outto us on LinkedIn or X if you
have any thoughts on impostersyndrome, we'd love to.
Learn more from what otherpeople have experienced.
And so we'll launch a couple of,uh, social posts to try to get
(34:22):
that conversation going.
So we'll talk to you again soonon the security table.
Hey folks.
Welcome to another episode ofThe Security Table.
This is Chris Romeo, joined bymy friends Izar Tarandach and
Matt Coles.
The topic we have for today isimposter syndrome.
And we, we hear about this a lotin the realm of cybersecurity
and we really just want tounpack it and understand what it
(00:32):
is.
And so let's get a definitiongoing first.
You guys know, I like to, I liketo define things early in the
process.
So I mean primarily so that Iknow what the heck we're talking
about, um, in my simple mind of,uh, understanding of whatever
we're discussing at the moment.
So, uh, what is, so Matt, whydon't you kick it off for us.
What is imposter syndrome fromyour perspective?
Matt Coles (00:53):
Yeah, that so, so, imposter syndrome, uh, is, I, I,
for me is.
A second guessing of a, of anability.
So like why are you, like, whatmakes you the expert or what
makes you qualified, even if youhave the qualifications, feeling
(01:17):
second guessing that not havingthe con, not, I don't, it's not
necessarily not having theconfidence, but just wondering
is this like, are you doing theright thing?
So it's not a I, I can't give aclear definition.
It's sort of the sense that onegets when they're looked to for
guidance or support or orexpertise, and they have the
(01:42):
credentials.
They have the credentials.
Pause
Izar Tarandach (01:51):
So I,
Matt Coles (01:52):
They have the cred, they have the credentials, uh,
but they, uh, may not have theconfidence.
Not always have the all hold on.
Izar Tarandach (02:03):
I, I think I, I, I don't think I can give a
definition, but I, I, I can giveyou the feeling because I'm
assaulted by it every singletime, and I think that at some
point, I, I was in one of ourmany congregations and.
(02:26):
I looked to one side and I hadBrooke.
I looked to the other and I hadAdam, and I'm going, why the
hell am I here?
Like, who, who, who said that Icould be here?
And who said that?
I could say something like, whatis it possibly that could put me
at their level in saying thethings that are in my head?
(02:47):
And I can tell you sometimesit's debilitating, right?
Sometimes, especially sometimesjust before a a, a talk, for
example, and this happened, uh,in, uh, OWASP Dublin.
You can definitely hear on myvoice in the recording that, uh,
(03:08):
I, I'm physically like my voiceis physically trembling because
until you get into this, at, atleast I do, until I get into the
stride of things.
The anxiety of why would thesepeople stop their day to listen
to me?
What gives me the authority orthe the right to take up time
and talk about these things tothem?
(03:29):
And it doesn't matter how manytimes you do that, it doesn't
matter how much validation.
This, again, I'm, I'm talkingpersonally just me.
Doesn't matter how muchvalidation you get.
It keeps coming up to you againand again, again, again.
And I spent a long time thinkingabout this thing and, and asking
myself what, uh, what the hellis happening here?
And talking to people whosupposedly know about these
(03:53):
things.
And, uh, I, I, I'm very openwith it because most people that
I talk, talk with, they, theyimmediately go at, oh, you know
what?
I feel that too, or I feel thatsometimes, or it happened to me
at some point.
So it, it's not a, uh, it's nota, what's it called?
(04:14):
Not humble brag, but it, it,it's not a, oh my God, I'm not
worthy thing.
actually a, a, a, I won't callit a mental health issue.
I, I think, but it's actually aphenomenon.
A, a, a mental phenomenon thathappens to people all the time
in, in all careers, in allplaces of life.
And I think that that goes backto one of our previous episodes.
(04:38):
Only when you know enough toknow how much you don't know.
I think that you get assaultedby this thing.
So it it, it connects to like,what's the name of the effect,
uh, Don Donning Kruger, that youthink that you know everything.
Chris Romeo (04:49):
Yeah.
Izar Tarandach (04:50):
Only when you are in a position where you know
how much you don't know, thenyou can question yourself and
say, why the hell do thesepeople would be willing to
listen to me.
Chris Romeo (05:01):
Mm-hmm.
And so, Matt, from yourperspective, if, if you're
willing to share, like how doesthis, how does it manifest?
You know, Izar gave an exampleof OWASP Dublin, and I was at
that talk and I don't remember.
I don't remember that being areaction, and I tend to be
someone who watches pe peoplespeak.
(05:23):
Listens to what they're saying,but I'm also watching the, just
'cause I'm, I'm a student ofpublic speaking and I, I look
for things other people do thatI might be able to apply to my
own world or I look for things.
And so I don't remember any ofthat.
I don't remember Any hesitationin your delivery or anything?
I could, I didn't perceive itfrom where I was sitting and I
was paying attention too.
Matt Coles (05:42):
I think, I think that those of us who, who, those
of us who have, have, have hadepisodes of Imposs, you know, of
feelings of imposter syndrome.
We have developed skills overtime that helps to mask that,
right?
Or to adapt to that.
So when I get senses, feelingsof imposter syndrome, it's
(06:03):
often, uh, so I'll say, youknow, just being in the threat
while manifesto group.
So here we had, you know, bignames.
We had Alyssa, we had Brooke, wehad Adam, you know, um, Izar,
right?
And, and so, uh, and you know,and so this, uh, this idea of
(06:25):
like, well, what makes my voicevaluable or, um, Is, am I gonna
say something stupid,embarrassing myself and, and
everyone's gonna look at melike, oh, he's the least
inexperienced.
You know, most inexperienced oneof this crowd.
So he doesn't know what he'stalking about.
So there's that aspect and I,but I think when it comes to
like, especially conferencepresentations, right?
(06:48):
I think we're.
We have adapted or, or, um,cultivated a, a, a way to
present without, without showingthat level.
Like there might be a runningtrend of thought in the head,
but you're able to projectconfidence in the presentation.
'cause we've done training andeducation, right?
We've done, uh, you know, we've,we've taught at universities
(07:08):
and, and, uh, and done corporatepresentations and things like
that, uh, in front of friendlycrowds or not so friendly
crowds.
And so we've adapted those,those techniques to, to, you
know, hide the, the internaldialogue to some extent.
Um, but, you know, I thinkimposter syndrome comes in from
a, it, it's, it's hard todescribe it.
(07:30):
I think is is, is our, put itbest, is really what puts what
puts us at the same.
At the same level.
Level.
And, and I wanna be careful'cause we're not really at the
same level.
I mean, you know, Adam, Adam forexample, is like the, the
expert, right?
He, he like effectively, um,catapulted threat modeling into
(07:51):
the, into the, the securityworld.
Izar Tarandach (07:53):
Yeah.
Matt Coles (07:53):
And I'm not saying that any of the people involved
with threat modeling prior thatdidn't do their parts.
But Adam is the more recentexample of that.
And you know, now that, forinstance, Izar and I wrote,
wrote the.
So threat modeling book, youknow, we're, we're talked about
in the same circles, and thatthat's a little scary, right?
(08:17):
And, but also a littlevalidating.
But it's hard to overcome that.
Well, did I, did I stumble uponthat or did I, like, are my
ideas valid?
And it's a confi, there's someconfidence building that has to
happen there, right?
Um, so that's, uh, I thinkthat's the best way to look at
this.
Chris Romeo (08:35):
Yeah.
Just to, to give you kind of myexperience, I can't.
I can't remember really dealingwith this, and maybe I did
earlier in my career, and I'mjust at a point where I just
don't remember, you know, youremember the good things.
You don't always remember.
You remember the good things,the tough things.
You don't always remember thechallenging things in the
Izar Tarandach (08:55):
Oh, I wish.
Chris Romeo (08:57):
and kind of how they came together.
But, you know, I, uh, I used tobe deathly afraid to stand in
front of a room of people andspeak.
I wouldn't, I wouldn't, early inmy career I would not do it.
I would refuse to do it.
And a f a friend of mine draggedme kicking and screaming into
the process of stepping out onthe stage and it, throughout my
(09:20):
time at Cisco and then le, youknow, get, take, getting me to
RSA the first time and, andgoing through that process.
And for me, the, the, the thingthat, that I really came to, to
understand was, and, and where Ireally became free.
Speaking in front of a group ofpeople is when I realized I
don't really care what anybodythinks about me.
Matt Coles (09:43):
Hmm,
Chris Romeo (09:44):
And it's, it's, it's may sound like a harsh
thing to say, but the truth is,and you guys have done a lot of
talks, a lot of differentconference talks, every room of
people, let's say there's ahundred people in the room,
okay?
10 people are gonna think you'resaying the best things on earth,
and they're gonna be takingnotes and they're gonna be
writing everything down.
10 people are gonna think, thisis the dumbest thing I've ever
(10:05):
heard in my life, who let thisperson talk here.
And the other 80 people, theother 80 people in the room are
just gonna be like, I was thereat that talk.
I don't know.
I don't really remember anythingmomentous about it or whatever.
And so for me it was, it wasfreeing when I reached that
point where, And I shouldn't sayI don't care.
I definitely care about, Iprepare, I want to deliver great
(10:28):
talks for people.
That's my goal.
Um, and you know, once in awhile, maybe I get lucky and,
and, and hit one, but, you know,it's, but when I realized like
I'm not, my worth doesn't comefrom what the people in the room
think about me, it was sofreeing because then I was able
to just be myself and.
You guys know, I mean, I like togoof around and, and I like to
do that from the stage now too.
(10:49):
And once, sometimes people don'tlaugh at all.
And that's a really awkwardmoment because I'm like, what is
wrong with you people?
Why?
That was funny! Come on, get uphere and listen.
Um, but it was really thatmoment where I realized like, I
just can, I can just be me.
I can do my thing and somepeople are gonna love me.
Some people are gonna hate me.
Most of the people are gonna belike, I don't even remember him
being there.
Like, was I in the room forthat?
Matt Coles (11:11):
So, so my, my first conference, my first, uh, public
speaking, uh, talk that I reallyfelt comfortable was early two
or mid two thousands, I guess itwas, uh, talking in front of a
Fortify user, user, uh, userforum, technol technical user
forum.
And I got up and talked aboutour experiences with Fortify at
(11:34):
the time.
And, um, I was completelynervous because, uh, you know, I
was, I was representing acompany.
My, my company we're rep.
You know, here's what we did andwe did some really interesting
things with, with Fortify at thetime.
And, um, The one thing Iremember is the, the crowd being
very supportive, right?
They were all in the same boat.
(11:55):
And that really, that helped toget over that fear of, well, am
I gonna say something wrong?
Well, I can't say somethingwrong if it's a debate or a
discussion, right?
As opposed to instruction.
And, and that really helped, butthat wasn't, they weren't
looking at looking to me for,for direction.
(12:16):
They were looking for discussionand debate.
Right.
And now I have a lot ofexperience.
Uh, my early career was with,with tech support, you know,
doing tech support for, fortechnology products.
Um, you know, had the.
Izar Tarandach (12:34):
He can say, have you tried turning it off and on
in three languages?
Chris Romeo (12:39):
You knew that was coming.
Matt Coles (12:43):
Usually you have to, usually you have to kick it
first.
Uh, so anyhow, uh, so, you know,I always prided myself on being
capable of, of, of talking topeople of, I, I was very
comfortable talking one-on-oneand in small groups.
(13:03):
Right.
Um, uh, even today, you know,influence without authority is a
very powerful thing, right?
Um, but with that, the reason Ithat you get there is having, is
projecting confidence andhaving, uh, the, your audience
(13:24):
or your, your, whatever you'retalking to have, have confidence
in your ability.
Or trust in your ability.
And while it's relatively easyto project confidence, right,
that those techniques for how doyou do public speaking, you
know, that we've learned overtime, uh, the internal dialogue
(13:48):
has to, you have to, you have topush back the internal dialogue
a bit to say to like, you'reconstantly second guessing the
statements that you're making.
So that you keep the train of,of conversation going without
having it go well, and at somepoint you're gonna say, well, I
don't know.
And that's okay.
And you can say, I don't know,with confidence, as opposed to,
I don't know, I gotta go.
(14:10):
Like, you know, why am I here?
Go talk to somebody who knowswhat they're doing and, and I
wanna make sure, you know,obviously, you know, this is,
this is a security table therapysession, to some extent.
It's good to talk about thesethings.
I think a lot of people in thesecurity space, uh, probably
suffer from this.
Either they, they know it orthey don't know it, uh, but that
(14:31):
they suffer from it.
Um, right.
But, you know, we're expertshere, right?
We're recognized.
We have certifications.
We've done presentations thatwe've delivered material, both
in an academic and non-academicsetting.
We've, we've proven that wecollectively here have proven
that we, we know what we'redoing.
(14:53):
We have to prove to ourselvesthat we're on the same stage as
the people we're working with.
Izar Tarandach (15:01):
So I, I, I want to, to take a, a, take a lift on
that and, and sort of start byseparating things.
The public speaking part, it'sextremely important and
everything that, that Matt saidis, is completely right.
I, I think that that preparationhelps to, to mitigate the
(15:21):
imposter syndrome, but thatinternal dialogue that Matt said
that we are constantly fightingagainst or trying to, to shout
over that, that's the bit wherethe anxiety leaves, right.
That, that's especially forpeople with anxiety, that's a
(15:44):
huge precursor.
you start ask, asking yourself alot of, uh, negative questions
and, and people say that one ofthe, the first things that you
should try is to like, reframethose questions instead of why
should these people be, uh, whyshould I be talking to these
people?
You should be asking yourself,isn't it great that these people
(16:07):
took time to come and listen tome?
Because they didn't come on a,on a, on a limbo.
They, they came becauseapparently your abstract was
good enough to convince them to,to come over.
And while, uh, most public,public speaking, people will
say, Hey, you have to rehearse,rehearse, rehearse, rehearse.
I, I myself, I, I don't rehearsemy talks.
Right?
(16:27):
My, my new, uh, place of work,they, well not so new now.
They have internal rules that ifyou're going to present outside,
they have a team that's willingto come and listen to your
rehearsal and give you pointersand everything.
And to me, that that was a bitin the beginning.
Now I see absolutely see thevalue of it, but in the
beginning it was hard for mebecause I, I never give the same
(16:49):
talk twice.
I may say the same things, butit's never the same talk twice.
I try to, to read the, the, thepeople, see how they're
reacting.
Interesting parenthesis here.
One of my first talks at AppSeccolleague, I'm talking and
people all of a sudden take outtheir phones and start taking
pictures, and my immediatereaction was, my fly is open.
(17:16):
But then I noticed that notethat they were actually taking
pictures of the slides.
So being aware of what your,what your audience is doing and,
and why.
I find it's extremely important.
But so I, I, I think that whereI was going with, with this is
that I, I find, especially inmy, in my, uh, personal case,
(17:41):
that imposter syndrome is, isjust like one piece of the
puzzle.
Chris Romeo (17:47):
Hmm.
Izar Tarandach (17:48):
So, uh, The way that I came to, to, to work with
it, not, not to solve it, but towork with it is, first of all, I
accept it.
It'll happen.
Just wait for it to kick.
Then there's the fact that,yeah, if this audience came
here, it's because they see somevalue in what you have to tell
(18:08):
them.
Third, As Matt said, sometimesit's, it's shocking to look
around at the rooms that I findmyself of the people that I find
myself with, and the fact thatsometimes they stop talking to
listen to what I have to say.
And the way that I'm looking atit is I, I am not alternatively
(18:29):
putting out something thatpeople should just accept.
I am having a huge opportunityto rent the time in the brain of
a lot of very smart people.
To put out my ideas and let thempoke at them.
Chris Romeo (18:45):
Hmm.
Izar Tarandach (18:47):
So it's not like I'm coming down with the 10
Commandments down from themountain.
No, I'm, I'm, I'm just walkingaround this mountain shouting
stuff and, Hey, you guys get toanswer to me.
Sometimes it's good, sometimesit's less good, right?
Chris Romeo (19:01):
Yeah.
Izar Tarandach (19:02):
But, uh, mainly when, when, when I am presenting
and when I'm with an audienceand I, and I start questioning
myself, why me?
It's not because I know more,it's not because I, I taught
more.
It's just because most of thetimes when it comes to the q and
a question, uh, to the q and asession and people start asking
me things, I can actually reachback in my history and say, I've
(19:25):
been through this and this iswhat happened.
Chris Romeo (19:27):
Mm-hmm.
Izar Tarandach (19:28):
it's not what I know, it's what I went through.
I am now in a place, especiallyof actually to that.
Let, let, let me be a bit honesthere.
I.
I'm in a place of my securityjourney right now that a lot of
people are just starting to gothrough now, and that has value.
I can point at mines before theystep on them.
Chris Romeo (19:48):
Yeah, because you've been through it, you've,
you've got the experience.
You've got the scars that gowith getting smacked and falling
on the ground, picking yourselfback up.
And you've, you've, that's,that's wisdom.
Izar Tarandach (19:59):
And it may not give me authority, but it gives
me value.
Chris Romeo (20:04):
It gives you wisdom.
Experiences that
Izar Tarandach (20:08):
It gives value.
Chris Romeo (20:08):
you've lived through is, is something that
you can then reflect to the nextgeneration.
And a lot of times people arestill gonna do the thing that we
all did that that caused painand they're gonna be, I don't
believe you.
I'm gonna do it.
Yeah.
Remember, well come back andtalk to me after, after it blows
up.
And just tell me that.
Just say I told you so I can sayI told you so.
Matt Coles (20:28):
Well, it is, it isn't just, I guess it isn't
just the, the, the priorexperience that you're able to
relate, right?
Because you use those asanecdotes for, uh, either using
as anecdotes, you use'em asdirect references for, well,
here's, here's some pitfalls.
Watch out for them.
Right?
Or here's some good things thathappened.
Look for those, or, or makethose happen.
It's also that we're able to, Wehave, or, and I say we, not just
(20:55):
those of us, you know, the threeof us here, but, but others, uh,
in this similar boat the abilityto take very complex things and,
and deliver it, the message inthe right way to the right
audience.
Again, not, not making those 10commandments kind of statements,
(21:19):
but.
Helping others put that intheir, in their head, collect,
you know, correlate that withother information that they have
to make an, and you know, wealways say making informed risk
decisions, but you know, itinformed decisions period.
Right.
That we can give them, you know,our expertise isn't just
(21:40):
thinking of interesting ways todo things, but also.
Correlating, uh, a whole lot ofinformation and providing that
in a way that makes sense topeople that they can then
utilize in their day to daylives.
Well, at least work.
Chris Romeo (21:54):
I wanna, I wanna unpack this a little bit deeper.
I wanna, I wanna ask you guys aquestion, um, based on your,
what you've experienced.
Because I real, I really don'tknow the answer to this.
I wanna, I wanna understandfrom, from what you've
experienced, how you would, howyou, how you think about this.
Like, if you break this problemdown into two pieces and you say
(22:15):
head versus heart, meaningintellectually versus what
you're feeling, Intellectually,you both are very accomplished
pro security professionals, yourauthors, your podcast hosts,
okay?
I worked that in podcast hosts.
but you're, I mean, you'reconference speakers, your,
(22:37):
you're, all of these things.
And so intellectually, if youkind of separate it, if you, if
you can separate this problemand cut it in two, you
intellectually say, Like, Idon't have the chops to hang
with the rest of these peoplethat, that I'm hanging around
with.
Or is it more on the heart sideof it?
(22:59):
Like, it's more like, I feellike I'm not, I, I, I'm, I don't
belong there, so like, I'mtrying to, I'm just trying to
unpack this and understand it inmore depth.
Matt Coles (23:07):
So let me, let me give you some of the, sometime I
thought that I, I getoccasionally, and I don't know
if it's intellectual or, or, orfeeling, I guess you can think
about the, the luminaries thatwe've been with.
But think about, just thinkabout some of the people that,
(23:28):
that you may converse with.
Um, In terms of, uh, you know,security, security experience,
for instance, right?
Where they have eight, you know,eight times as many
certifications as you, or theyspent 20 years in the, in at the
NSA or have, you know, uh, a tonof experience, you know,
(23:51):
defending nation states, uh, or,um, you know, or have built, you
know, have been CISOs of majorcorporations.
Right.
They have a ton of experience, alot of, a lot of letters after
their name.
A lot of, you know, maybe theyhave a newspaper article, you
know, Bruce Schneier, you know,kind of thing, right?
(24:13):
Um, I mean, we, I, I work withsome of these people on a
regular, on a regular basis,right?
Some of the, my close colleaguesare, are, are like this, they've
worked at, you know, at CSA or,or, you know, NIST or DISO or
NSA or wherever, you know,wherever else, right?
And we have a need to interacton a regular, on a regular
(24:39):
basis.
And I need to be an expert, needto be an expert.
And so, How do I compete withthat?
Like I have a master's degree,not, I have a master's degree in
computer science and I wrote abook on threat modeling and I
have 20 years of experienceright in, in, uh, in corporate
worlds.
Chris Romeo (24:58):
So that sounds like you're, it sounds like you're
intellectually, it sounds likeyou're on both sides of the
equation then.
It sounds like you're kind ofthinking through, like you're
intellectually saying, I feellike I don't stack up against
these folks, and then I feellike I don't as well is kind of
what I'm taking away.
Matt Coles (25:18):
Right, but I, but I know that I, for the expertise
that I have, I'm an equal, I'm apartner in this.
Chris Romeo (25:26):
Okay, so intellectually then you, so that
would be the intellectual side.
That's what I'm trying to get tois, is there a way to separate
this, but it's not, so you'resaying yes, you on paper, you
can look at their resume andexperience and your resume and
experience and say, yeah, Ibelong at the table in the
conversation.
Matt Coles (25:46):
Uh, yeah.
Yeah, we'll go with
Izar Tarandach (25:50):
But, but look how funny it is because now, now
comes like the, the outsideaspect of the thing that there
is a reason why.
Matt and I co-author the, thebook and for the
Matt Coles (26:05):
because he asked, he asked, and I said, yeah, that
sounds like
Izar Tarandach (26:07):
Yeah, there's a reason why I asked and, and
here's the reason.
For the past, I don't know, uh,11, 12 years, every time that I
had an idea connected to, tosecurity, that idea would not go
forward.
Before I went to Matt and Iasked, Hey, what do you think
about this?
(26:28):
Because I see him.
As the expert that he may notsee himself, right?
Chris Romeo (26:35):
Hmm.
Izar Tarandach (26:36):
But that voice inside your head telling you,
you're not worth it.
You're not worth it.
You're not worth it, okay?
That thing is shouting all thetime.
And you know what?
No, no names.
We know a couple of people.
One who's a very, very prominentperson in our field.
(26:59):
Who gets hit by impostersyndrome every single time that
they are asked.
And it, it's not something toquestion or to, to criticize or
to keep saying, come on, you,you, you know how good you are.
Just step out of it.
(27:21):
Right?
You cannot quieten that voice.
It, it's not as you put, it'snot.
It's not an analytical process.
It, it's, it's a, it's a feelingthing.
And, and God knows that, youknow, I'm, I'm not the most
connected people to the personto, to feelings, but it is, it
is, it is just something in youconstantly asking you, what are
(27:45):
you doing here now, in myexperience, fighting that you
can give into it.
And then that's it.
I'm, I'm sorry.
Bye.
By what I'm saying, but you'rescrewed because you gave up and
you are not getting out of it,but you can at the same time.
And, and I, I, I want to believethat that's what I do with it.
(28:06):
You can use it to move youforward.
You can use it to say, prove toyourself that you can be here.
Constantly prove to yourselfthat you can hear that, that it
can be here.
Constantly ask questions,constantly say what you're
thinking and expect answersbecause those people that you
value, Those are the oneslooking at your ideas and
riffing back to you and tellingyou, Hey, you know what?
(28:26):
There's value to this.
So now you don't have to askyourself, do I bring value?
Because you have other peoplethat you respect that are
telling you, Hey, there's valuein this thing.
Chris Romeo (28:38):
Hmm.
Izar Tarandach (28:40):
So again, the the choice is not to have it or
not have it.
The choice is how you deal withit.
Chris Romeo (28:47):
Yeah.
I see.
So you're, so you're, you'vejust kind of accepted the fact
that this is going to besomething you'll struggle with
through your entire career, ormaybe not struggle, maybe you
turn it into a strength based onhow you described it.
Here, you're gonna turn it intoa superpower.
Izar Tarandach (29:01):
That, that's the dream,
Chris Romeo (29:02):
You're reflecting.
You're reflecting through it toyour own success because you're
using it to push yourselffurther.
Izar Tarandach (29:09):
and I want to believe that it also makes me
better at communicating withpeople,
Matt Coles (29:13):
Yeah,
Izar Tarandach (29:13):
because now in order
Matt Coles (29:14):
it.
Sorry.
Go
Izar Tarandach (29:17):
No, no, no, no.
Go ahead.
Go ahead.
Matt Coles (29:18):
Well, I was just, I, I think we adapt to it, right?
I think we, we, we lean intocertain characteristics of our
role, right?
I, I mentioned earlier aboutinfluence without authority.
Like that is the basis from mywork.
For most, for the most part,right?
They're not, I'm, I'm work, I,the teams that I work with and,
(29:40):
and the people I, I communicatewith, you know, whether at work
or at conferences or wherever,um, is, is really a, you know, I
am, I need to be the expert, butI don't have a mandate like, you
know, that's not, it's not thatthey have to take my word as, as
as edict, right?
(30:05):
So I approach everything as anegotiation, as a conversation.
I'm there to relay informationand provide experience in a way
that like they have a particularway of looking at things.
I'm gonna come in from adifferent angle to help them see
it in a different way,
Izar Tarandach (30:20):
And to
Matt Coles (30:20):
bring in that and facilitate and bring in that
security experience andknowledge that they need from
me.
Izar Tarandach (30:25):
Yeah.
Because the system itself, theyknow much better than we ever
will.
They're writing it.
Matt Coles (30:30):
Right.
And so the imposter syndromethere doesn't that, that's, it
doesn't come into play so muchthere as when it's, you know,
you to a crowd or you to a,
Izar Tarandach (30:43):
To a forum like to, to a forum of equals
Matt Coles (30:46):
for, for, well,
Izar Tarandach (30:48):
Uh.
Matt Coles (30:48):
It's more interesting.
I, I think it's, it's evenbroader than that.
Um, you know, like, uh, so ifyou're looking at.
If you start comparing yourself,if you're in a, in a position
that, that you would be comparedwith others, that's where
imposter syndrome, I think,starts to come into play.
Izar Tarandach (31:07):
It's, it's different levels of, uh, not
authority, but, uh, I think thatwhen you're on a board of
directors, your opinions aremuch more pointed and, and, um,
this is where I stand.
This is where this is myposition, and it's going to be
very hard to move me from it.
(31:27):
When you're in a panel withother experts.
I, I think that we, at leastwhen we do that, and, and I
speak for the three of us, Wecome in open-minded and we say,
I have my, my things to say, butyou know what?
I'm willing to be convincedotherwise.
And many times it happened, evenhere in the podcast, that I came
one way and I left another, orat least with questions.
And, and i, I, I, I think thatI, I I, I love people who go in
(31:53):
front of an audience andpresent.
And you can see that thesepeople, damn, they're really
good presenters.
Like Chris is one, for example,he is, uh, in Dublin, his DevOps
thing.
It, it was a masterpiece inpresent, in presenting, right.
The, the timing, the, the, thesubject, the way that he pulled
the, the, the public in the waythat he riffed with everybody,
(32:14):
like the, the back and forth.
I, I sat in there like, I haveno clue what he talked about
because it was so much focusedon how he was talking about it.
On the other hand, there arepeople who have to like,
rehearse again and again, andagain, again, until they have
the whole script in their, in,in their head, and.
Some of them are good at it,some of them are not so good at
(32:35):
it, but it's a way of doing itas well.
Chris Romeo (32:40):
Before, uh, just FYI, before Dublin, I had
delivered that presentationprobably 10 times.
Izar Tarandach (32:46):
You had to deliver, but you, you, but you
didn't sit in front of thecamera recording it to
Chris Romeo (32:50):
No, no, no.
It was out on, it was out on thescene.
But it's, I mean, the jokes arecanned in that just FYI, because
over time you learn which jokeshit and they just, I don't know.
That's just the way my brainprocesses.
If I
Izar Tarandach (33:03):
That That's showmanship.
Chris Romeo (33:04):
if I can get a laugh, I'll drive, I'll drive to
that laugh each time.
Izar Tarandach (33:08):
So I, I, I mean, what, what I'm trying to go at
is when you get that impostersyndrome Yeah.
The, there are ways to fightagainst it.
Some of them are more timeconsuming, some of them
apparently are more, um, proven.
It is something that's you, you,you like, like they say here in
the, the us in the, themilitary, you have to embrace
(33:29):
the suck.
It's going to happen, so makepeace with it, move forward or
not, but don't let it stop you.
That that's my, my, my closing.
Chris Romeo (33:41):
I like that.
That's a good place to close.
That's a good place to end thisconversation.
I, I don't think this is thelast time we talk about this.
I think we can come back aroundand talk about it some more.
I think there's, there's more tounpack and more to more to just
learn and, uh, you know,
Izar Tarandach (33:55):
Because after all, who are we to talk about
this?
Right?
Chris Romeo (33:59):
I knew that, I knew you could see you like canned
jokes too.
You like the delivery and, andset it up and that's right.
So, hey folks, thanks forjoining another episode of the
Security Table and uh, reach outto us on LinkedIn or X if you
have any thoughts on impostersyndrome, we'd love to.
Learn more from what otherpeople have experienced.
And so we'll launch a couple of,uh, social posts to try to get
(34:22):
that conversation going.
So we'll talk to you again soonon the security table.
Popular Podcasts
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
24/7 News: The Latest
The latest news in 4 minutes updated every hour, every day.
Therapy Gecko
An unlicensed lizard psychologist travels the universe talking to strangers about absolutely nothing. TO CALL THE GECKO: follow me on https://www.twitch.tv/lyleforever to get a notification for when I am taking calls. I am usually live Mondays, Wednesdays, and Fridays but lately a lot of other times too. I am a gecko.