[Music] Welcome to 909 Exec, your source for wit and wisdom in cyber security and beyond. On this podcast, your host, veteran chief security officer and cyber aficionado Den Jones taps his vast network to bring you guests, stories, opinions, predictions, and analysis you won't get anywhere else. Join us for 909 Exec, episode 37 with Rinki Seti.
Hey everybody, welcome to another episode of 909 Exec. I'm your host, Dan Jones, the guy with the silly accent and the unicorn on the shirt. So, every week we try and bring you guests that have some experience, some wit, some wisdom, and ideally you're going to learn something about your executive journey in technology. And our goal is let's leave you with some nuggets, a little bit of laughter, some fun, some humor, and something that makes you want to return and pretend you love the 909 vibe. So, this week, I'm blessed. I've been chasing this woman around. She is busier than a queen bee. Rinki Seti, you are a busy lady. So, why don't you introduce yourself just so I don't butcher the heck out of it.
Sounds great. Hi everyone. I'm Rinki. I'm honored to be on the show. I am in the Bay Area. I'm currently the chief security officer at Upwind. I've been in cyber for a little over 21 years now. I've worked with some amazing tech companies in the valley here. Started at Pacific Gas and Electric. Have worked at Walmart, eBay, Intuit, Palo Alto Networks, IBM, first CISO gig at Rubrik, second one at Twitter, third one at Bill.com and then Upwind Security for the last five months.
Wow. So Upwind is the new gig. And in some of these gigs as well, I think you've been the CIO and the CISO at the same time, right?
That's right. At Bill.com, I was both CISO and CIO. And at Upwind, I have both security and IT as well.
Yeah. It's funny. I see more and more, especially in smaller companies, they actually have the blended role. My last gig was that as well. You've got the responsibility to try and protect the company and operate, and then you've got the other responsibility of doing the checks and balances on yourself, which never feels like a conflict of interest. So let's jump in. I'm really curious. What got you into technology? I read somewhere that when you were younger you were building a program to detect a key logger or something. Were you into this at an early age?
I was. It's funny. I was born and raised in the Bay Area and so I was exposed to tech at a really early age. My dad, my uncles, they'd be talking about tech all the time. They had the latest and greatest computers. So I was exposed to this super early on. Although I was late on jumping on the AOL instant messenger bandwagon as a kid. I heard about it later, but I was like, this is so cool, you can chat with your friends. My dad found out, what are they doing on dialup so late at night? Me and my siblings. He suspected that I was talking to boys and he wanted to spy on me, so he put a keylogger on our machine. I overheard him talking to my mom about something that I had typed that he shouldn't have known about. So I knew he had something on my computer and I found the keylogger. I would uninstall it then he'd install it back again. So I literally wrote a small program to detect it and then uninstall it. I gave it to my sister too. We were playing this cat and mouse game and we would purposely write things that weren't real just to mess with my dad. That was my hack back in the day.
Wow. And how old were you then?
I was somewhere like 14 or 15.
And that was before you decided, okay, this is going to be my career, right? So you're in high school at that point and you're coming up with a program to bust your dad's keylogger. That's pretty awesome. What got you into the whole tech career thing? What was that first thing going from school to college to tech?
It was interesting because I was trying to figure out what I wanted to do. I was really good at math. I was good with tech. But for some reason at that time tech didn't seem cool as a career choice. So I was like, I'm going to be a lawyer. My dad, typical Indian family, was like, lawyer is a second degree, what's going to be your first degree? Choose medicine or engineering. So I ended up choosing computer science engineering reluctantly. And I've never looked back since then. I got my computer science engineering degree from UC Davis and that was my entrance into tech.
Wow. Did you ever pursue the second degree of being a lawyer?
No, my senior year I was like, I don't want to be sitting at home. I want to be getting a paycheck when I graduate. I'm going to look for a job. That was my motivation.
Yeah, that's brilliant. So, if you were going to give the teenage hacker Rinki some advice now with the advent of AI and deep fakes and stuff, what would you build to protect yourself?
It's interesting. I don't know if I would build. I might have been the builder of some of that stuff, like the deep fakes. But now when I think about that, I would definitely, especially now having kids of my own, I wish I knew that security was even a thing. Nobody talked about it back then. I wish I would have built some tech to prevent attacks if I knew what I knew now.
Yeah. It's really interesting. One of the things I talk to people every week about is another scam, another this, another that. And they're all personal. I talk to clients and companies, but in my personal life, my mom calls me up and it's like, you'll never guess what happened. And we actually publish an ebook on our website for free because I hate hearing about people who are trying to protect their family and they're not tech savvy. So it's like how do you protect your family when you and I grew up with technology? It's easy for us to give our family and friends advice, but I think of thousands of people out there, especially older generations, that just don't have any idea and they're getting scammed left and right. So for me, that's a bit gnarly. So let's talk about you leaving college, UC Davis. What was the first job you got and what was your impression of working for the first time?
I got my first job at a utility company here in the Bay Area. I was really lucky to get my first job because it was a really bad time in the economy and students weren't getting jobs. They were pursuing graduate school or sitting at home. So I was lucky and it happened to be in information protection analyst. I didn't care what the job was. I was just like, thank goodness that I have a job and I'm going to get a paycheck and I'm not going to be sitting at home having my parents pressure me about when are you going to get a job. I knew April of my last year in school that I was going to be joining PG&E. The average age of PG&E at the time was 55. So I'd be walking into the elevator and people would be like, when does your pension kick in? It was a cube environment with really big walls, which you rarely see now. My first role there, I remember walking into my cube and there was clicking sounds coming out of it. One of my first tasks was to find all the modems that were unauthenticated in the company. There was a war dialer that dials all the modems. That was my first job. I didn't know how to socialize properly at work. I was just graduating from college and the average age was 55. It was a very interesting environment.
Yeah. It's hard enough when you leave school and you try and engage with adults. I'm kind of struggling on how kids who graduated the last couple of years like their last few years of school was not sociable, so their social skills get harder and harder. I also know you were doing some interning. I actually turned my eyeballs towards interns last year after doing a conference talk about leveraging school talent and internships. I think of it like interns on steroids where they do the summer thing but then I would keep them on as a part-time worker. When you deal with interns now based on being an intern yourself, what do you look for in a student who wants to be a part-time worker in a company?
I think I would like to see hunger to learn. Having some tech table stakes skills is interesting, but with AI I feel like that's even changing. I think hunger to learn, curiosity, that is the most important thing. I feel that now more than ever. When people are eager to learn and just dive in and have this, I want to do as much as I can do, I love that kind of energy. That energy is really infectious amongst teams. You're coming into the same place doing similar type of work and this new energy with new ideas and this hunger to learn can strike an energy. To me, that's the most important thing. People that are willing to learn and do things a different way. I think communication is also really important because you have to be able to communicate new ideas.
Yeah, I always coach people the ability to communicate with human language rather than being this technical genius. Quite often you've got that tendency to try and prove to people how technically gifted you are and your ego leads that as opposed to understanding that the person you're talking to may not be technical at all and you've got to translate it into their language. Especially the higher up the organization you go, you get to some board level conversations. The valley is a bit different because we have so many technologists, but at some board level you meet people that really don't know technology very well. If you're trying to explain security stuff, it gets pretty tricky. So you really got to figure out your audience. I learned this in communications years ago. It's an audience driven thing. Don't think about yourself. Think of the audience.
I want to dig in a little bit to the dual CIO CISO role at Bill. One of the biggest challenges I see when the orgs are separate is that tension between IT and security. How did you overcome that or what advice would you give to people who are following your footsteps who are taking on that type of role for the first time? How do you overcome that tension and make it thrive? What kind of tips do you have?
I want to dig in a little bit to the dual CIO CISO role at Bill. One of the biggest challenges I see when the orgs are separate is that tension between IT and security. How did you overcome that or what advice would you give to people who are following your footsteps who are taking on that type of role for the first time? How do you overcome that tension and make it thrive? What kind of tips do you have?
Can I share with you what my mindset was because I think that's what made it different. I've been in companies where security and IT are pure peer organizations, and then I've also been where security reports into IT. Every time there's tension when security and IT are peers, you're fighting over prioritization. Security wants to prioritize security initiatives, but IT's whole measure of success is based on enablement and availability. Those can sometimes be in conflict. When security reports into IT, you're always going to prioritize enablement and availability and there's no escalation path because their escalation path is the CIO. The way I thought about this was I was a CISO with IT and security reporting to me. I was a CISO and CIO, but my mindset came from a security mindset. I think it was the first time I ever saw IT and security get along in a really cool way. There was no tension between the teams. Why? Because if I wanted security to be a priority, I could transfer over budget or put additional resources and say, I'm taking a hit on enablement and availability of something in order to prioritize something that I think is really important. That decision was on me many times. So there was no argument. It was a different way of looking at it. Maybe it's because I come from a security mindset, but it was like, let's figure out the right way to do this understanding that if you don't prioritize security that is definitely going to create enablement and availability issues down the line.
