Hello and welcome to another episode of Random Access Memories: Stories That Bite. Today I have the CISO of Upwind, Rinki, who has held pretty much every CISO role from a company you've heard of, as well as her own VC, and having more LinkedIn followers than people you probably know in some countries. So, let's kick it right off. If I ask you first, Rinki, introduce yourself, tell us what you do, who you are, tell us your hobby, and tell us who your hero is, someone that inspires you.
Yeah, first of all, Jake, it's an honor to be here, and I'm glad we're finally doing this. I know this was in the works for a while. Yes, I'm Rinki, nice to meet all of you. Born and raised in the Bay Area, I have two kids, 18-year-old girl, 14-year-old son. I've been in cyber for almost 25 years. Started at Pacific Gas and Electric, went to Walmart, eBay, Intuit, Palo Alto Networks, short stint at IBM before I took on my first CISO job at Rubrik, my second one at Twitter, third one at bill.com as CISO and CIO, and then just joined Upwind Security on my fourth CISO gig here. That's a little bit about me. And let's see, my favorite hobby outside of traveling is a grandma hobby. I love to crochet. So, I do crochet blankets.
Did not have you down for crocheting. Wow. I like it. That's cool.
Yeah, so if you watch my Instagram, it's usually travel posts, something about cybersecurity, or my crocheted blankets.
So, you have to get on the—you have to get on the Christmas list to get a blanket then. Okay. I understand. Life goals. What about your hero?
My hero, it would be my dad. I just, you know, he's—has always been an inspiration and someone I continue to learn from. And, you know, I've seen him change. You know, people say people can't change after a certain age and I don't believe that's true because of him.
That is a really interesting thought, that people don't change. I actually just commented. Do you know Aisha Khan, a strategy editor?
So she posted on LinkedIn today about doing something with one of her kids in middle school. But the whole point was that kids don't have fears. They just come up with an idea. They don't think of like the drawbacks or the possibility or the plausibility, right? And I think that as we age, we lose this ability to see like opportunity. And I think what what you're saying is that it's a choice. So that we still have the ability to choose to change or to believe in the impossible at any age. We just have to kind of rewire our brains to be like the kids that we once were.
I love that. I love that. I need to go read the post. I haven't been on LinkedIn this morning yet.
So, I think I wanted to ask you a few subjects. Look, your background, as you just mentioned it, is pretty mad. So you've done Bill, Twitter, Rubrik, there's some Walmart in there, some eBay, IBM, Palo Alto, and now Upwind, which is one of the cyber star darlings. Like, your background is you worked at every company that everyone's heard of effectively, right? Is there one in there, or is there two in there, specific roles where either the company or the situation or the role that you had taught you an astronomical amount? Is there a point there where you kind of accelerated? Like, is there certain places that were just amazing to be?
It's a really good question. I think you learn something in every job, and I feel like I'm constantly learning. The second I feel like I'm not, that's when I'm shifted. But I think the most pivotal one for me was when I was at walmart.com. It was my second job out of college. I had worked at Pacific Gas and Electric before that. I was almost about to leave cyber because of the work I was doing and just the way that PG&E was, wasn't like the right culture for me. I had to self-learn everything I knew about cyber, but it was all textbook knowledge when I was there. And I went to walmart.com. Not only did I find my passion in cybersecurity, but I had the most amazing mentor, Jake, that literally took me under his wings for who knows what reason and taught me everything technically about cyber, and I got to get hands-on and just work with him hand-in-hand, and he was kind of a legend in the cyber space.
And it changed my trajectory. It's what's kept me in cyber. But my passion that I found was I had a developer background. Like, I was a computer science engineering graduate, and working with developers back then—and this I'm talking two decades back now—this was at the start of PCI when developers were forced to learn the OWASP Top 10 as a requirement. And I remember thinking like, this is not the way you train a developer. Being a developer myself, it's like if you want to win hearts and minds, you've got to get into the head of developers. And that's my passion in cyber, is how do you drive culture change by really getting in the hearts and minds of folks. And that became my passion, and it's where I learned everything I know about cyber.
That's interesting. I've got a couple of things in that one. Mentoring—you mentioned mentor. I've talked a lot on LinkedIn about people in my life who've been mentors and continue to be mentors to me, right? And I think, are the most pivotal moments in our lives nothing to do with the roles and the careers or the companies, but to do with the mentors who shape us more? Is it people that shape us more than opportunities do often?
I think so. I feel like you go work for amazing leaders and you leave bad leaders. It's generally not—you can find different products and companies interesting. And I always advise from college new grads and people like, you don't need to chase the company names just cuz they're amazing. Chase the right people, because if you're surrounded by the right type of folks that are invested in you and they're going to create an environment where you can learn and make mistakes and grow, that's life-changing. For me, it was amazing that I was at Walmart, but it was not that; it was like the team that I had around me that really grew me. And I've been at amazing titles where that's not necessarily the case, and it really holds you back, you know? And so I do think people, mentorship, community is what it's all about at the end of the day.
So in a single sentence, what makes a good leader mentor versus a bad leader mentor? Like, what is the one thing? I mean, sure there's loads, right? But what is the one thing that defines good versus bad?
I think a good leader mentor is somebody who wants to see growth in their people and is not afraid of giving critical feedback, and all with the intent of wanting to see that person do even better than them. I think on the flip side, it's folks that are just not connected on the human side. It's all about just the work and you're not invested in people. You're just managing, and that's not good leadership or mentorship.
You're speaking my language. Some of my team listen to this, and I talk a lot about the fact that we build families, we don't build teams. And I've always said it: my great successes in life are the people who I've hired at junior levels who are now CISOs and VPs. When someone says they have to leave cuz they want my job effectively, that's like the greatest possible accomplishment. I think that's what leadership is, right? It's building people; it's not building process and programs. The other thing you talked about was being technical and trying to make culture shift.
That's interesting. I'm also from a technical background too, but from a different one. I don't build; I broke stuff. I came from a pen testing background. But I think now more than ever, it's super relevant to have a technical engineering understanding. I shared a post that you shared on LinkedIn last week—and this won't be relevant whenever this goes out, it won't be last week—about how AI is exposing bad leaders who are unable to change. It's basically just making broken processes explode quicker, right? And I think that speaks to people who—the engineering mindset is outcome focused, whereas I think the compliance kind of traditional consulting background is like process focused front forwards, whereas engineering is backwards or end backwards. I don't know if you agree on that or what you think. But I think now it's a time where any CISO, particularly in tech companies in SaaS, needs to have a real competence in engineering to be able to move that culture, cuz otherwise the R&D team just don't give a damn what you say.
I think you're right. I talk about this like, you know, for a long time we're like, as leaders you don't want to be too hands-on on the tech because of forest versus trees and all that stuff. I actually think we're at a really interesting time where becoming a builder is going to be really important to be able to lead. And I've been saying this again and again. Why? Because the world's changing around us at a pace that we've never seen before, and how you can leverage AI and agents to get to good outcomes is going to require a builder mindset. And how are you going to do that? You've got to kind of understand it and build yourself to understand what good looks like and bad looks like, and then be able to train your teams to go and make that shift and that transition, which I think CISOs are very well positioned right now to go drive the change in companies that's needed across the board around AI. But if you're just telling your team like, 'Oh, we're going to cut X% by going and leveraging,' it's just not the right way to do it, and people are going to find things to drive efficiency that are not going to move the needle and things like that. And so you can really amplify dysfunction if you're not in that builder mindset.
The builder piece, I have mixed thoughts on this because people tell me that now is the time where you can build without any technical competency at all. Agentic tech and AI means that now anyone can be a builder, right? I reserve my opinions after this speak, but what do you think about that? Is this the time now when non-technical people could suddenly leap forward in technical capabilities? Or is it still required, if you're going to debug AI and agents, to still need to know how the inner workings will work? Where do you stand on the fact—are technical evolutions or progress now available to everyone, or are we still really needing to have people with a technical, solid computer engineering or computer science background?
