 Hi, welcome back everyone. This is a time where we have a content discussion with our speaker. But first of all, let me thank you all for your time today in your generosity. It's so much like first it's a lot of fun, but we've learned so much with having you here today, the three of you, and having a lot of different perspective on the security team topic. I think one of the common team throughout your different talks is like, how do we make sure we recognize the work of our security teams throughout metrics, and how do we foster a healthy culture and a safe culture as well around for our folks, for our best assets, which is our teams. So how we will work today? We have a lot of great questions in the Slido chat. Since we do have a little bit of a flag, I'll try to redirect the question back to back to each one of you. So it's a little bit easier for you guys as well to answer me. So before we start any comments or anything you would like to add because I don't know, I'm just asking. I really liked Chloe's talk. I liked Tonya's talk. It was nice to finally get to see it because it's brand new, but it's like, yeah, thank you. It's good. Also, people all last night were texting me to tell me, No, it's so awesome. And I was like, I know. Well, that's really cool to hear. Thank you. I think like both, but not both, but the three of you were having different talks and what we usually have at Nordsec. And I think it's refreshing, especially in these days where we feel a lot of pressure to be on top of everything and to excel and to be perfect. So yeah, that's that was really great. Thank you all so much for that. So let's start with the few questions on the slide or board if that's okay with you. Is the infosec industry particularly bad at dealing with mental health and burnout. So I will put my question first to Ange. If that's okay with you because you mentioned a lot. That was also one of your team throughout your presentation. So I'm curious to see what you what your thoughts on on the industry. I personally think that infosec is very young as a topic as a domain. And there is a lot of arrogance and novelty and whatever and still a lot of misunderstanding which increased the will of showing off, because mental health and burnout are like losers. And therefore only it's like a still a very immature industry and world. And because it's still possible to to break so much. It's still so new as a topic. I, I, you don't need to. You don't need. I don't know it's worth comparison probably but if you're a train driver, it's been established to job for a long time, and the, the, the damages it caused to the users to the to the people doing it is long documented in half, you know, and it's still new to new. So that's why it's the youth problem, the problem of youth, you know. Yeah, absolutely. And I know I shuffled the card a little bit. Everyone was expecting my question to be directed to Chloe, but I wanted to spice it up a little bit, but Chloe, any thought on it. I would say that Brenna is definitely prevalent in our industry. I think you can find Brenna and almost any industry when you're expected to do a lot more than you can give, and when you don't have boundaries. So for example, I think of all the frontline work health workers right now, they're around the clock, and it's extremely emotionally tolling to see so much death happen before you're on here. So that's not why you went into in the health care in the first place right, you wanted it to help people to have them have a healthier long life, and then seeing that that's intense. So I think all industries you'll find burnout. It's whenever when we are overextending ourselves and when we're putting too much on one another, but also the demand is not taken in the factor that mental health is part of this like we have to keep separating mental health from physical health, it's, it's one of the same. You will have if you have anxiety or depression, you're going to have pains. If you have anxiety, depression, you're going to feel pains like it doesn't it's, it's part of health and so we need to start recognizing that and I think that from the pandemic itself, companies are becoming more open about that conversation and trying to figure out how do we do better because they're realizing that they've over demanded from their employees quite a bit. Absolutely. And Tanya, yeah, of course, do you have a do you want to pitch in a little bit on this one. So computer science is one of the youngest of the science, but then on top of that cybersecurity within it is even younger. And then the area that I specialize in application security is is yet even younger it's around 20 years old. And I feel like with some other industries, they have well established processes of how they do things, but we don't. We go in and talk to companies everyone has a different way they're trying to make their software secure they have different expectations and what they want etc of how to do things and so I feel like part of the stress and burnout is also because one keep failing. So it's, it's really distressing to work somewhere work your butt off try really hard and you, you know, you don't have the exact guidance of what to do. So when you are an engineer and you learn how to architect house and build a house, and you go and buy like a two by four is an exact measurement every time but when we go to build software or build networks these things are changing out from under us constantly. And then the expectation is that we're somehow going to be aware of all these changes and make sure that I perfectly protect all of them every time. I think that's part of the problem and part of the other problem is that there is no exact clear way to do the thing so that you can know you're doing the best work. Right. And so again an engineer knows I check these things. I do a really good job of these things. I should be good. We don't have that. And I think that that's part of the thing that can lead to, you know, people doing some of the things Chloe and Ange talked about like working past the hours they're supposed to if they knew I have to do these seven things. Once you've kicked the crap out of those seven things it's like, I'm going home and I'm relaxing but we know it's not clear for us in information security the way it is in many other industries. So, I hope that helps. Absolutely. And this is maybe more a very large question but is there any way we can leverage metrics to use them internally in the security teams in a way to measure. Of course there's survey there's stuff like that but do you have any experience or have you seen this implemented in in real life teams where metrics can really help avoid burnout and situation like that. Yes, Tanya go for it. You're on mute. So, when I worked at elections Canada so that was an example I gave in the talk where basically like when you work on an election in Canada there's 36 days they do something they drop the writ all the way up to the day where the election happens. And they've so one thing they do is they prepare way in advance so they run an entire pretend election six months before, and they throw security incidents in they throw hackers they like just make it the worst it could be. And then we try to iron out things so that everything can be better. They try to have every single thing ready for the day that where it is dropped for years in advance and then when the election is happening they're well aware of things so for instance like I was leading a team. I went and I bought like all of these like protein bars and chocolate like banana, peanut bar, whatever. And I remember like before the election started I'm like listen all these are my drawer. Sometimes it's hard to get people to deliver stuff in the middle of the night. We don't know when we're going to be here. And I guess mom. But then guess what happened. They be coming to my desk. Do you have any of those peanut butter ones left I'm like yeah peanut bar or we've got like I can't remember almond and they're like. Thanks mom and like preparing for the fact that we know that there's going to be long hours making sure that there's food available making sure there's food that each different person can eat because I'm like. I have like all these food sensitivities so like I can't have gluten and other things that are so easy to have. And so we like they plan way in advance and then also after the resting their staff thing is really important so if you work at a place so since then whenever I've worked at a place if there are lots of security incidents happen. I measure the rest points between incidents because you you can burn out your staff really easy with security incidents, especially if that's not their full time job. So upset people specifically if there's a vulnerability in a software and it's been breached or it's been attacked or whatever. Immediately they're like put down your job and all your projects all your operational things that you support and go run off with this for a few weeks. Everyone's still like Tonya are you coming to this meeting and like no Tonya you still get no and so setting that expectation that you can put your work down and that like your project timelines will be extended I think that could help to. Does anyone else want to add anything. Yeah, I would say also on them all that, and I definitely feel you on the food thing because I also have dietary restrictions so when I'm traveling or going anywhere or like going in the office. I'm always worried that I'm not going to have food, because I can't like order pizza if people are going to order pizza I'm not going to be able to eat it. But I would say another thing that one can do is that you know during those one on ones I mentioned that 15 minute one on ones. I have like you can use every now for example but having somewhere a place where you have a shared doc with your, your manager, so they see what you're working on, so then they don't have to keep tapping your shoulder. I would say that's definitely one of the metrics is seen if they're hitting their projects, making sure they're completed. I don't care what, like what hours you work as long as you get your work done and I think that's kind of like the thing that we have to get more flexible about I would say if we're trying to have more diversity equity inclusion, we need to start incorporating that more because that flexibility of no, like, of what hours work best for you is actually a way better process I think for a lot of people. It helps the flexibility so you're able to reduce that burnout to as well. So I would say the metrics would be like, making sure you're hitting your projects on time, and, and making sure that you're on the same page so any type of metrics that you can find in in your organization or the way you function that's going to be really useful. Thanks for that. Would you like to add anything on this question. So, I, I definitely think that the managing the way Chloe mentioned is a good thing, but because I felt two kinds of burnout myself. The ones that where you are worried about the ones where you are. Yeah, so, yeah the ones where you just want to do your project better. But also the ones where you, you should be told not to do anything extra. And at least my, my previous manager, because when you just change manager so let's give. I was saying that if there is a meeting that is late or anything just don't go because preserve yourself and don't. It was weird, like, don't participate in stuff, whatever. It was not like out of jealousy or anything but it's definitely it's technically something that happened to me that's in a big company when you have someone interesting awake and ready to to discuss about interesting stuff at any time. I burned myself out initially very quickly after a couple of weeks, just because, you know, you could just be at 2am talking with someone about something super interesting. And it was like, you know, like when you have this rats and you the if they press a bar to give cocaine to get cocaine directly or something. I just, and it's weird because it's not the usual burnout but it was definitely a risk. And the legend that you get 10 kilo at Google after a month. Now it's more like after a week or something in my case. Your metric right. No, to be honest, no no manager told me not to eat too much but yeah, I realized I was moving slower. I still I'm trying so take it with a pinch of salt. Absolutely. That that's very interesting. There's another question that's kind of related what we talked about is, as a manager. There are concrete ways that managers and mentors can help either battle their direct reports or the people around them, either burnout but also imposter syndrome that we also talked about any tips and tricks about that. I will. Yeah, go Chloe. I would say the best leader wants someone to succeed beyond them. And one of the things is being transparent. And it sounds like I think when when leaders keep pretending that everything's okay with them like that they're able to keep doing everything with a smile I think it's really bad because you're also, it's harder for people to connect with you. And I think one of the things we have to see ourselves is like as a manager, it's not being just a leader it's also being there for your team being part of that team. So that means like, I like to do more of a round table way of looking at things in a sense where I have everyone around the table no matter what their title is, we're all talking frankly with each other. And I think that's one of the things how to be a good manager is to be okay with being transparent. Also to want to lead your team in a sense where you're not dealing on what to do instead you're coming together to come up with solutions. I think that is one thing for sure. Interesting. So more like a coaching and also being more vulnerable with your team can also make it more easy for them to talk to you and vice versa. That's what I think it's one of the things because we never really, I think in the past year we were very personal with each other so it used to be like, Hey, how are you today. I'm doing okay. That's usually how our responses then, but now I don't know like even with a stranger, you'll be on a you know zoom first time you meet them and you're like, Hi, it's nice to meet you how are you doing. This is what's going on my daughter has COVID-19. I'm stuck at home now for 14 days and I'm overwhelmed because my partner has asthma like you could just and it's just complete stranger but the reality is it changed the circumstances because something you realize. Oh, we're equals here we got we have issues, and it's okay for us to be real with each other and think that the thing is like no one wants to do small talk anymore people and be real with each other now. And I will pass the bottle to Tanya but one last thing is that now we see the homes of everyone right so you already feel that connection with someone because you see their dog you see their kids. You see the environment that they are in so that creates also a bond. That's at least my my feeling about what the situation that we have today. Tanya, I see I'm sure you have a lot to add on top of this. I'm a company I'm the CEO so I'm sort of the boss of everyone and we hold 360 reviews. And so we have sessions we call them feedback loops. And it's where they give me feedback and I give them feedback. And I try to be extremely explicit. So, extremely specific. So for instance, you know you wrote this newsletter, and it was excellent. And it's excellent because like you follow the format perfectly the images you chose were great. You remembered, you know, all the links were linked correctly, your grammar was awesome. And like, I remember we talked about this before, and like now you fix that and I'm just like, and you know you finished it on time you gave me lots of time to review it like, I want you know you did a really great job this week. And if there is a problem so for instance like let's pretend it's the newsletter it's like okay so this link was broken. And you know we sent it out and then people complained so how can we fix that in the future and so then we developed a QA process. We also always do a do you have enough work. Do you have too much work. If you have too much work then like we prioritize and like drop things like often we drop things and also so we're a startup right there's only five of us right now. So I do a lot of, where do you want your career to go and then I make sure I assign them specific things on that so like we have one student, and she's really interested in finance and so we're going to do a bunch of financial forecasting together, rather than me doing it solo so she can have that experience and the other one is really interested in HR so I'm like, you know what I've been meaning to create policies around this this and this will you create all of them with me and she's like, and so then we can motivate them, right because they're getting experience they want, we're building them up to be the best people that they can be and if I'm lucky I'll be able to retain them and hire them when they graduate, right. And, but I also receive feedback from them like I haven't had enough time with you, you know, or your explanation was good but then I forgot these details so we've started things where sometimes when we give training, like do you want me to record this so that you have a copy of it, right. And so we've by asking all the time for feedback so at first they're always like nothing everything's great, but then after a while they're like, well actually, I'd really like this or I'd really like that. And so sometimes like for some some of them we have like an everyday stand up and other ones they're like I really like it when you just give me a big chunk of work, and I just go through it for X number of days till I'm done. And so like figuring out which way each person needs to work and so like having, you know, regular sessions where you give them constructive feedback and that's good and bad and sometimes it's, it's not even that bad but I find a lot of managers. They're never specific, like I'll have managers say you're really awesome. That doesn't help me. That doesn't make me better. I'm like, who are you, my mom, my mom needs to tell me I'm awesome. I need you to tell me, you're really good at this you're so strong at that. I would love to see more of this. Right. And I feel like a lot of managers are worried that like the employees will, you know, react badly but if you're sensitive in the way that you deliver the feedback. I find that it can go really really really really well. Those are my thoughts and I also in the past when I've had bosses I do 360 reviews whether they want to or not I'm like I'm going to give you feedback they're like what am I sit down. Like I need more of this from you I would like more of that. You know, I see this happening how can both of us be better like I feel I'm failing at this I need this from you so I can do more. I don't know I've never been worried I'm going to get fired I've never been fired. I'm like that jackass employee that like does most the work so everyone you know like you know you have that confidence you're like yeah but if I leave everything will break so it's fine. But like I want every employee to feel safe that they can say like I don't have the reason like one of our questions in the 60 review is do you have everything you need to do your job the best you could do it. And sometimes they're like well actually it'd be really cool if this I'm like done. And sometimes it's like the little list thing that makes a huge, huge difference for your employees so I guess like listening and asking the right questions and building trust so they feel they can actually tell you the truth. Absolutely you're building this relationship and you're much spending, much spending them while like learning and growing your business as well. And all of these tips and tricks, we can apply them to larger organization. So, for sure. Any, and maybe more on the postdoc syndrome, any thoughts on how we can make our help our team battle them to empower them to be what do you really want to be those persons. I think it just, I think it just goes to the essence of that of fighting that is just showing that everyone has it in their own way. We actually have a, I'm not sure how confidential it is at Google we have a imposter syndrome chain where you can say, Hey, this colleague is giving me imposter syndrome and it's you know and you can see it's only it feels like, Oh, I'm giving imposter syndrome to that person. You know, the following reason and then that shows that it's pretty commonplace and also had extremely some of my even extremely brilliant colleagues sometimes some of them just acknowledge like a child I have no idea how sorry I'm just a beginner and it's like, wait what wait what. It was sometimes even almost too much of humility, but definitely it was showing that it was just widespread and everywhere, and no matter the experience or the actual experience somewhere. And in the end, it's still easy to I mean no one in the security teams, at least at Google is just pretending to know everything or a lot or anything because that you would be just in may mean you know it doesn't work you know. You see what I mean, we are enough and So, so that's, I just think there's not such a process but on the other hand, in previous jobs I had previous employers I had before, when they ask employees to rate themselves some some of them. So basically, I think it was you rate yourself from one to five five being the best and I said, no one on earth can have the five, because it was like you have a complete knowledge of all file formats or something. It's like, no one has that ever. And some people greatly themselves five straight away. And I don't sure it's a part of the culture of the company in this case. But if you don't have someone super experience who just says, hey, I'm level three or something you see what I mean, if no one, the one that is kind of an acknowledges with the most experience has shows no humility, then they show the bad direction for everything you know. So, yeah. Thanks for that. I think as well it's circling back to something that was in your presence, say it's regarding failing not being scared of failing I think it's also goes back to imposter syndromes and burnout because you feel like you're failing. If you guys have any aspirational or any good, not good, but stories that you can share to maybe empower the people that are listening here today. I'll start with Daniel. If you feel insecure about something, go learn it. It makes me feel like I don't know a thing or makes me feel bad. First of all, I often think it's, it's they are saying that about themselves. Like whenever I've had anyone really lash out at me it's 99.9%. It's, it's something that they feel about themselves. Think about that if someone lashes out at you and then the other thing is, if I feel uncomfortable about something I just go and look. I look it up I learn about it and then I'm like, next time that comes up. Oh yeah, I know everything about it and I just feel strong I feel better and I feel proud of myself. I try to, if I feel insecure, improve myself so I don't feel insecure. I don't know people where they take it out on other people or they take it out on themselves. And like that's not a win for anyone, especially for you. So I would suggest improve yourself so you don't feel insecure if possible. Thanks for that, Chloe. This will be our last question so Chloe if you have any thoughts or anything else. I have a ton of nailed it. I'm going to be honest, anytime I don't know something, I learn it, because I know that if I don't know something, and I need to provide an answer I need to learn anything I can about it and ask people to. I think the one thing is that admitting that you don't know something is okay too. But I think that's one of the things is like we're always trying to be perfect sometimes and I think that can be extremely exhausting. And it's okay not to be perfect. But I would say the one thing that I have learned is that there will always be people out there that don't want to see you succeed too. I think that's the hardest part that I've dealt with in my work like career experience is there will be people that don't want you to succeed. There will be people that don't want to see you go up because it makes them feel uncomfortable about themselves. I have to admit, if you're around people like that surround yourself with people that support you and want to see you thrive and are applauding for you. When you're doing all incredible work, because there will always be people that they don't want change, and they don't want to see change happen because it scares them. Absolutely. It's sad, but it's kind of true. Also, any last thought that you want to share with us regarding failures? Maybe not, that's okay. Yeah, I failed at providing a good answer. You see, there you go. I gave a whole talk about that too before, so no, that's okay. Lucy, well, I would like to thank you all again for being here today, for being part of this community. It was very, very interesting. That's all I can say thank you for your time. And hopefully everyone who watched it enjoyed it. And hopefully we'll see you all next year. Yes, thank you so much. Thank you so much. Thank you, Anja and Chloe for your amazing comments too. Well likewise everyone. Thank you and take care.