Rinki Sethi: From Analyst to CISO and Board Member

Frank, thanks for having me.

Yes. So, I was born and raised in the Bay Area by immigrant parents. You know, education was a really, really strong focus in our household. And I was lucky in some ways that my dad was an early adopter of technology from like the time I could remember. I grew up when I was a little baby, and there's pictures of me in his lap using a computer and exposed, I think I was doing something on the keyboard. And so exposed to computers at a very early age, and that continued and my interest with computers continued. And you know, he continued to foster that too. He was one of the early teachers of Java and other programming languages that had come out. But when I was starting to get into the high school age, there was an app called AOL Instant Messenger. And we all used to chat with our friends on that and it was kind of this new hot thing. Well, my dad caught on pretty quick and thought we were wasting a lot of time and was wondering I guess what we were doing on there. And so one day I overhear him talking to my mom about something that I had privately chatted with one of my friends about. And so I was like, he has something on my machine. And I found that he had parental spyware or keylogger on my machine. I uninstalled it. I told my sister, hey, watch out. He's got some kind of spyware. And then he would go back and install it again. And so I was like, I don't have time for this. So, I wrote a program to make sure I caught anytime he installed that spyware and would remove it from my laptop. And I gave that to my sister as well. And I think that's kind of where my hacker mindset, I realized I have a little bit of let's figure out how to work around systems. And I went and did a computer science engineering degree. Not knowing what I would do next, probably assuming I would be a developer, but somehow landed my first job out of college accidentally into cybersecurity.

Oh, yeah. Mine was even more narrow. It was become a doctor or an engineer. When I said I wanted to be a lawyer, it was like, well, that's your second degree. What's your first degree going to be in? And so, it was very specific on it's got to be some kind of engineering or you're going to go into medical school. And I knew that path medical school was not for me. So, it was engineering, but absolutely the same mindset.

Yeah, it was. Yeah, I definitely got some exposure. So you could say my dad influenced me in certain ways and certain ways made me figure out how to bypass some of the tools that we had on there.

Yeah, and I'll try to make it brief. So, I graduated from college at a really bad time. It was after the dot-com bust that happened. There weren't that many jobs. Most of my friends in college were going and getting their master's degree or figuring out what they were going to do next. I happened to go to a recruiting night with one of my friends and it was with PG&E and they were recruiting on our campus at UC Davis and I wasn't being recruited but I was like free pizza, I'll go. And I just started talking to one of the hiring managers that happened to be there and he asked me what's your favorite class you're taking? I said cryptography. And he said, 'Wow, who are you taking the class with?' And I mentioned the professor's name and he said, 'Oh, I know that professor and he wrote one of the first textbooks for colleges in that subject.' And so he's like, I'd love to interview you for this job we have in information protection. And I was like, I will take any interview. At that point, I didn't know what it meant. I interviewed, I was probably one of like 50 kids that was interviewing for that position. Ended up getting the job. And that was my entrance into what we now call cybersecurity. And I got my first job there. So I worked at PG&E for about I think it was two or three years. I was an analyst. I did some engineering work. I realized I didn't know much about security. So I started studying and got my master's degree online in information security. I started that at PG&E. I started getting some certifications and just learning what information security was about. And I decided that I needed to, given that I had this computer science engineering degree, I needed to go back to my engineering roots. So I started looking for a role where I would be much more technical engineer and I happened to get a role at Walmart.com. Did security engineering there. I found my passion in cybersecurity while I was there and had a really good mentor that helped kind of show me the ropes and everything to do with information security. Everything from how do you do a vulnerability scan, how do you do a pen test, what is application security, why is security training important. I learned everything there. I had my first child when I was there and then decided I needed to find a job that was closer to home and so that took me to eBay. I went to eBay to drive security culture change. And you know, roles changed. They had me do several things, but that's where my career really took off. Was a chief of staff for the security organization and I ran several teams in security and then I had my second child and was looking for a change. I went to Intuit to be a security business partner. Three months after I joined they said Rinki we want you to take over the product security team. We want to transform how we do security as we move not just to the cloud but to public cloud moving data from TurboTax and other products that they sold into public cloud into AWS. So I helped with that transformation. And then was there for a few years before moving to Palo Alto Networks. I ran security operations at Palo Alto Networks, built it from scratch, scaled it, made it something that customers could come and see. And then made a little bit of a career mistake. I went to IBM. I was there for six months before I took on my first job as chief information security officer at Rubrik, which is a startup company that's just booming right now and was there, helped them start their entire security program globally and then COVID hit and things had to scale back a little bit and I was looking for another challenge so I took on the role of CISO at Twitter during a very interesting time right after they had the security breach right before the US election and then I left right before the acquisition had happened and joined Bill and I've been at Bill for the last year and a half leading both IT and security. And in the last five, six years I would say I've also joined a couple boards. I sit on the board of ForgeRock. I got to be there in their journey to go public and now they're on their journey to go private again. And then I also sit on the board of Vaultree and advise a dozen security startups or so. So that's been a highlight too. You know, it's fun to do the security work. I'm very passionate about it, but some of the board work and all of that has definitely enhanced just my experience.

Yeah. First of all I didn't realize it's been a decade Frank since I've known you. That went by fast. It was really interesting, you know, when I took over this team around product security, there was almost a resistance to change, right? Like folks were wanting to do security the same way that they understood it at the time. And so there you were, everybody's starting to learn about AWS and AWS was not back then what it is today and their capabilities around security were so different and for them to take on a company like Intuit at that time was so early for them, right? So now it feels like things have just completely transformed in 10 years but there was a real mindset shift needed in the folks that were in the security org. You need to rethink things like the cloud, how you architect apps, how you think about security, how you can bake in security earlier on and why that's even more important than ever. All required a mindset and culture change and people that wanted to learn and innovate and do things differently. And so that was a really interesting journey to go through. It was very challenging because how do you change culture in a team and you can't execute on what you need to do until you can build that in first. Now a decade from now it's still like many companies, being at Rubrik and listening to our customers or Palo Alto Networks and now even at Bill we're early in our cloud journey but there's still companies that are still early in their journey into cloud. But now that's in such a more mature state and there's so many solutions out there on how and advice on how to do it right. And then many companies, I think Intuit was about 10 years ago, many companies are going through that journey right now. And it's really interesting to see.

Yeah, I think like you mentioned it. I think that zero trust, you know, and it's become this buzzword now but like how do you make sure that you verify and make sure that you're building that kind of, you're on that journey of zero trust and especially because everything's no longer within your own perimeters which is exactly how it was when I started my career, right? If you wanted to get into your data center you had VPN but again that was in your own network. Now things have just completely changed. Having worked at different types of companies, especially I think when the pandemic hit, you could see which companies just it was like no change. You just go home and work instead of working in the office. And it's because these companies that were born cloud first that had all SaaS applications didn't have their own data centers. And it was like they had built already for a remote world. Whereas other companies really struggled. They were like, 'Oh my gosh, now our employees are going to go home. We have no visibility into anything.' And so you're starting to think about that zero trust journey a little bit later and it was a little bit more of a struggle but I think now as companies build in this hybrid world that we live in, you're thinking about that from the very inception of the company, right? Where it's how do you build in a way where it's zero trust, how do you build that right from the beginning.

I think data always helps, right? When you go in and you try to change a culture and you're trying to say you have to do this because it's important. And folks will say, 'Oh, yeah, yeah, but it's like that's not going to happen to us. Like a breach is not going to happen to us. This isn't going to happen to us.' I think you have to show them, right? I've found a lot of success in a couple ways. One of course like sharing with them, if you're trying to convince a marketing team that they need to do something more securely, showing how other marketing teams have been impacted either whether it's by social engineering or phishing or some tool that they're using that they didn't consider the security ramifications for all of that I think is important data to bring as you're trying to change the culture. For engineers I've seen that find a security hole in their code and show what you can do through red team exercise and all of a sudden you start seeing folks really realize how what they're doing can have massive impact if they're not taking security seriously and they're not taking that on as a responsibility. The other thing I've found that's been really fun actually and has worked really well in past few companies is I like to make my executive team champions. So all the way from the CEO down, right? And I take them and we make these funny videos where we make someone doing the wrong thing as it relates to security and there's a few folks from the executive team that will come in and save the day and we show that at our company all hands and so quarterly we'll make a video like that where CEO or CFO or CMO are in the videos. It's become a part of the culture. People are waiting for the video every quarter. What is the security message going to be this quarter? And it gets like thousands of messages and people just love it and it starts being something that people talk about, right? And we're talking about security so I think there's a lot of things you can do around the culture. I think regular training, I think there's two schools of thought around incidents, right? Do you hide incidents like we used to in the security team like it's totally like you don't share with anybody you keep it private you keep it confidential you're in a private room. But now we're starting to learn like yes, there might be certain incidents you just can't share broadly, but there's a lot you can and there's so many things to learn from that, right? Whether you take it to the board or the executive team or to the team that the incident impacted. I think being transparent and saying like how do we make sure this doesn't happen again is super important.

Yeah. I was just in the elevator and like, you know, someone didn't badge in. Someone said, 'Hey, you need to go and make sure you badge in.' And it's all part of like that campaign. Maybe that's because I was in the elevator, but there is that culture of people, you know, holding others accountable.

Yeah. So a lot of like the principles that we run by as security practitioners they don't change right from company to company they're pretty much the same. I think what's changed is a couple things now having done this for 20 years. The world is different. Like so different how we thought about security. Like there were no CISOs there. I don't even I don't remember hearing the CISO title until about five years into my career. And I think eBay was one of the first non-banking companies that had a CISO back then. So things have changed drastically. I think time has been a big thing in seeing change. But like for example, how private companies run security is very different than how public companies do. There's usually private companies are focused on let's get a product out the door, proof that we can generate revenue and that there's a customer demand. And so security although they're starting to think about it and have to, it's not maybe the highest investment area and it may be something that's lagging. Whereas like now you're in utility this day and age or fintech it's highly regulated, right? There's so many regulations around financial transactions and so forth. And so that makes it very different, a lot more scrutiny around security, a lot more audits that you go through. And so that's been a little bit of a learning that maybe my governance risk compliance team was very small at one company, but now at a company where you're going through bank audits and things like that on a very regular basis, your team may be larger. So I think that there is definitely difference between industries. There's difference in culture. There's difference in kind of like the championship level and understanding of every company when you join and where their state of security is. So you kind of have to assess that and then come up with your game plan on how am I going to go attack this and how are we going to build the strategy here. But it is quite different. But I would say like the principles have been the same like whether I go from this company I care about identity and access management. You have to get that right. You've got to be on that zero trust journey. So there's some basic things that always remain the same. I think to what maturity level do you take the company, to what degree of scrutiny is there on your controls that changes.