So, welcome back to the Career Hacking Village here at DEF CON Safe Mode.
We know lots of people are at different stages of their career,
and what we wanted to do is make sure that those of you who are
midway in your career, maybe later in your career, and you're really starting
to get to that point where you need to start building your teams,
really taking on a leadership role, and how do you do all of this
while we're in the pandemic and while we are trying to figure out
how to create teams in a remote environment.
So, I've asked my dear friend, Mike Murray, to come back
and really share some of his insights on leadership and building teams
in the new normal. Mike, take it away.
Thanks, Kathleen. Really excited to be here.
Always great to be back on stage at DEF CON.
Even in this weird year when we finally have achieved DEF CON being
cancelled, and none of us get to be in the crazy heat of Las Vegas,
whether we're at the Rio or the RIV, or even back to the Alexis Park.
So, this is yet another format for DEF CON, and I'm pretty excited to be part of it.
And I think this has been a really interesting year for all of us.
I mean, 2020 just gets more strange as time goes on,
and we've still got a third of the year left to go.
So, lots left. And I don't know about you guys,
but I am, at this point, particularly tired.
Across the board, whether it's Zoom fatigue, whether it's fatigue from being locked in our
house, fatigue from having our parents and pets and kids and everybody around all the time that
you can never get away from, or just fatigue from being unable to socialize with your friends.
I mean, I don't know about all of you, but I certainly wish we were in Las Vegas sharing a
cocktail, and able to walk around and able to hug with abandon like we always have.
But this is a new year, and regardless of how tired we are, things are different.
And as Kathleen said, this is a talk, A, for the people who are building teams, but I also want
people out there, especially if you're thinking about joining a team,
I hope to present some of the things that I see as where we're going,
and the way that we're going to have to build our organizations and treat our people
as we go forward. But this should also reflect on when you're searching for a job, do the people
that you're interviewing with do some of these things? And are they doing them well? And is it
a place that is forward-thinking enough that you'd really want to join to be part of this culture of
remoteness, to focus on cultures that have diverse and inclusive workforces, and that have
figured out how to go from this world where a large part of our interaction style was in person,
to a world where a large part of our interaction style is like we're doing today, recording a talk
over Zoom and presenting it, you know, not in the same way we would have in prior years.
Now, the good news about being in security, at least according to all the stereotypes,
is that we're pretty good at remote. You know, the typical stereotype of the remote hacker
sitting in their basement with their headphones on or their hoodie up and, you know, I don't know
if you can tell, but I'm wearing my hoodie today for recording this talk. You know, we have always
done particularly well as an industry with having some amount of remote work.
The problem with that is we weren't ever really remote. I don't know many people who have had
their entire job cycle from first interview to hiring and onboarding to being in a company for
a couple of years and never being in person. You know, every organization I've ever been at,
if we were interviewing for even a remote role, we would often fly the person out for the final
interview. We would often fly them out and have dinner and have a cocktail and get to know them
face to face. And then when they onboarded, the same thing. When I started Scope Security,
my company here in New York City, what I would do is every time I hired somebody, I would fly
them to New York for three days. And we'd spend the first three days sitting in a room with a
whiteboard, talking through everything in the company, talking through the technology, walking
through the product and all of that stuff. And we would have lunches and we would have breakfasts
and we would have dinners and we would have all this face to face interaction. Similarly, I don't
know any sales team around this industry that doesn't have at least once a year, you fly all
the salespeople and put them in a big room and have a sales kickoff. These are all things that
have just evaporated in 2020. And let's be clear, with Google's recent announcement that they're
going to keep all of their people remote until the middle of next year, I fully expect that
many of us are going to go at least another year before we are face to face with a lot of our
co-workers. And so even the roles that we've traditionally thought of as remote are far
more remote than they used to be. And that's where I think the crux of a lot of the changes come
from. Because we're missing a ton of our ability to form those social relationships. I mean,
most of those social bonds are what get us through tough times. I'm going to talk about
that a bunch during this presentation. Additionally, and if you spend as much time
on Zoom and video conferencing as I do, you know that this is real. Zoom fatigue is a thing.
Your mind and your cognitive resources are not designed to sit and stare at a blank screen
that's not in three dimensions for eight or 10 hours a day. We are built to be social animals,
but that socialness is in person, right? And many of us survive on that in-person,
face-to-face interaction, especially the extroverts in the audience,
for getting back the energy that we need to get through our days.
Similarly, when you're in that informal or sort of... when you're in that remote context,
the staring at a screen over Zoom, you miss out on a lot of information, right? And this is one
of the things we'll talk about a lot in the interviewing section of this conversation.
When you're doing an interview over Zoom, you miss a ton of influence cues that you would get
if you were sitting face-to-face, right? Body language over video conference is effectively
the talking head body language. It's not my full body language. You can't tell what I'm doing with
my feet while I'm sitting here presenting to a screen with a microphone in front of my face.
And you aren't really aware of how much information you get from that until it's gone.
So let's talk about how I'm going to split up this talk. And I'm going to talk about three
things that are really important and difficult in this time, right? The first one is bringing
people aboard. You don't get to fly them out to the office and sit in front of them for a full
day in a room with a whiteboard anymore. And because of that, we have to change our interviewing
and hiring processes a lot. Similarly, when you're onboarding new employees, you also don't get to
fly them to headquarters and have them sit in a room with you. So how do we change onboarding
to accept this new remote reality? And then once people are aboard, how do you keep them mentally
healthy? I know it's a common conversation, and I'm sure that there's going to be a bunch of other
talks here at DEF CON about the mental health impact of locking ourselves in our houses like
this and working all the time. But how do you create touch points in your culture and create
structures by which you can keep your teams mentally sane? These are the three real phases
of the employee life cycle that are changing so much right now that I want to dig into. So with
that, we'll start with interviewing and hiring. We'll start with the onboarding process. And whether
you're a job seeker who's going through this remote interview process or a hiring manager
who's having to figure out how to modify their hiring process, this has been a really tough time.
And it's funny, I was hiring a senior leader early on. Scope's obviously growing a bunch,
and we're hiring a bunch of people. And I was talking to a recruiter friend of mine who
is pretty thoughtful about these things. And I said to him, so do you have any advice for me?
It's a big risk to hire a senior person who you've never met face to face. And his insight was,
well, Mike, it's pretty simple. You either take the risk or you don't.
That's not exactly what I was asking. What I was asking for was a way that we can modulate our
process such that it becomes less risky. And so with that, I set out on the quest to figure out
what we could start to do in our interview processes, knowing that as we're a growing
company, we're probably going to hire 20 people this year, and we're never going to meet any of
them face to face. So how do we do that in a way that we don't end up hiring the wrong people or
breaking our particularly interesting culture? And especially, how do we make sure that we are
getting the right people in the process and then evaluating them effectively so that we get them
through to the onboarding process? So with that, one of the things that we really realize is that
most of the things that you do in an interview process can have more or less rigor.
You don't always have to be the most rigorous interviewer if you can create good bonds with
the people in front of you. And I've seen a lot of hiring managers overcome bad interview processes
and bad HR processes because they create such a strong interpersonal relationship with the
candidate. And in the past, that was enough, right? I could overcome a lot of bad candidate
experience within my interview processes by having really great interviews and creating those
relationships, especially building in things like taking the candidate out to lunch and things that
create that trust interpersonally. But unfortunately, that's all the stuff that's gone away.
So what we realized is that rather than focus on our ability to create bonds with candidates,
we had to actually add rigor to our process. Because what usually creates the trust between
the candidate and the company that's trying to hire them is the interpersonal relationships with
the people. Now you have to replace that by having a really great process. And so refocusing your
interview process on making sure that you follow up with candidates in a timely fashion, that
candidates are getting the right feedback and the right email and the right steps in the middle
of the process, that you have standard questions across each of your sets of interviews so that
the interviewers can focus what ability they have on creating the trust across this impoverished
medium. We've had to go back and add rigor to our process. Now, the funny thing is, we're a
nine-person startup. That's a hard thing to add rigor when you're a tiny company. It's one thing,
you know, when I was at GE in my past, GE has lots of rigor, right? They have, you know, people
to create rigor in the interview process where that's their job. Whereas at a small startup,
you don't have that. So it's been it's been harder for us to do that. And I can't say that we
necessarily do it that well. But we've been focusing on how do we add rigor to the process
because we realize that we can't just rely on our ability to charm the candidate and to have
really great interactions with them to create the bonds that we need and the excitement that
they need about the company. Similarly, it's forced us to change our interview formats. You know,
most companies I know have an interview process that involves some amount of remote interviewing,
whether a phone screen or a phone screen and then a chat with the hiring manager.
And then usually you bring the candidate in for one of these marathon, you know,
four to six to eight hour back-to-back interview days, which is exhausting even when you're
sitting in a room with a whiteboard with a bunch of people that come in and out.
Over Zoom, it's not just exhausting. It's actually impossible. You know, by the eighth hour of an
eight hour back-to-back Zoom day, the candidate's eyes are going to be so glazed over that they can
barely form a sentence. And the last half of your interview process is not going to get the
information that you want. So what we realized is we had to start breaking it up. Whereas,
you know, you may have had a three-step interview process with the third step being a lot of
different conversations. We've now added additional steps to that process. We're also
experimenting with adding different media into the process. As an example, we know that we live
on Slack. You know, other organizations live on Teams or Google Meet or, you know, Skype or whatever
your preferred instant messenger is. We've started adding in attempts at interviews over those
different mediums. Because if a person is going to join our team, they're going to spend a lot of
time interacting with us on Slack. It would be terrible to find out that they don't know how
to use Slack in their first week, you know. And we want to be able to replicate that experience.
Now, you don't want to throw somebody out just because they don't know how to use Slack. I mean,
obviously, there's a conversation there and a teaching opportunity. But you have to figure
out how to replicate the real life you're going to be in. The real life you're going to be in is
not in an office with a whiteboard for at least the next 12 months. So what is their life going to
be for the next 12 months? Is it you're going to be drawing things in Lucidchart or Vizio online?
Are you going to be collaborating on docs in Google Docs? How are you, you know, are you going to be
pair programming? What are those things that are going to reflect that person's day-to-day life
once they've joined your company? And in that time, how do we create effectively an interview
process that replicates that so you can see what the candidate is going to be like in your
environment? And I've sort of harped on this a little bit. And I've hit it pretty hard. But
the idea of let's just get the candidate in front of a whiteboard and let's solve problems together
started to become really hard. And we did... I specifically really love the whiteboard interview,
right? I bring the candidate in. We will start working on a problem. I have five or six that
I use depending on what the role is that I'm hiring. And let's solve the problem together.
I get a sense of the person's interaction style. I get a sense of how they think, how they
communicate, when they ask for help, whether they ask for help, all of those things. And all of that
sort of evaporates when you can't do it remotely. I don't know if anybody's tried using the
whiteboarding feature of Zoom, but I will tell you it is a poor, poor, poor replacement for a real
whiteboard. And so what have we done to start focusing on how do you replace the whiteboard?
We've started looking at online testing opportunities. I mentioned a second ago,
real-time collaboration. If I was hiring a user interface person, maybe we co-design a screen of
something in Figma. Figma is effectively like Google Docs for designers where we can basically...
it's kind of like PowerPoint remotely, or not PowerPoint, sorry, Photoshop remotely, where you
can basically co-comment on and co-design a UX. Maybe we work on a product spec within a Google
Drive or the like. Or like I said, use Lucidchart or Visio to create an architecture and comment on
it. Things that allow us to do real-time collaboration in the same way we do in a daily
meeting. You know, our architecture meetings often end up with somebody sharing their screen
and Lucidchart up on the screen and people drawing things and dragging them around.
It's reflective of the real role that they will do, but it's also a good way
to replace that whiteboard interview. Similarly, and this is the one that we've found the most
valuable over the last six months, is we've added in audition interviews for pretty much
everything. Basically, an audition interview, from my perspective, is you give the candidate
a bit of a take-home assignment, something they can do in an hour or two. It doesn't have to be
a huge thing. And then they have to come present. And they have to present their thoughts. So,
whether that is a threat hunter who you say, you give them a threat actor, you know,
here's APT29. Come tell us everything you learned about APT29 in a couple of hours.
Or here's a piece of code. Tell us about it. Or write this piece of code. Or, you know, spin up
this service. And then come tell us what you did. So that you get a good understanding of their
communication style. You get a good understanding of their ability to do work. And you get a good
understanding of how they're going to interact with you once they're here. And obviously,
those auditions balance differently depending on who it is. If it's a sales role,
that presentation is the most important thing. If it's a technical role, often the technology and
the skills that they're showing is the most important thing. But they still have to be
able to present their skills, right? So, across all of these, whether we're adding
in initial assessments, whether we're doing collaborative interviewing over collaborative
platforms, or we're doing an audition, we've added in all these steps to try and get a sense
of how the person will work in the real world the way that we used to with a whiteboard interview.
So, let me take a detour for a second. Because 2020 has really put a focus on diversity in a way
that we haven't seen in prior years. And it's something that has been a focus of mine for a
of years, though I very rarely talk about it. A big part of that is, I don't have a whole lot
of experience in my own personal history that lends me to be an expert on diversity by any
stretch, right? I grew up in small-town Ontario, and grew up in Canada, and I'm pretty white here.
So, I'm not really the person to talk about this. But I will say, I've learned a lot about it.
And I have a couple of counterintuitive points that I think I wanted to put on into this talk,
because it's important to think about. Even if you're not somebody who really reflects diversity,
it's incumbent on all of us to get out there and make the change we want to see in the world.
And what I realized when I really started studying diversity is, a lot of the advice
for when you look at diversity and inclusion programs, and when you get into the HR material,
a lot of it is about showing how you're doing diversity for large companies, right? Publish
your metrics, and have diversity committees internally, and do all of these things that
happen at large companies. I was an executive sponsor of the diversity committee when I was
at Lookout. I've done the big company diversity thing. But how do you hire a diverse team when
you're six people? Because a lot of those things that you read about in the HR manuals don't really
apply very effectively when your whole team fits in one Zoom window.
And so, we've had to realize that the diversity effort for us is less a strategy. It's less a
strategic conversation about how we structure the company's program, as it is a tactical activity of
how do I get the right people to apply, and how do we make sure we hire the right people? And so,
there are a few things that I really wanted to emphasize around that. And by the way,
I feel free to hit me up in the Q&A, and to email me, and send me notes on Twitter,
and tell me all the things that I'm not doing right here, and that I'm getting wrong. Because,
like I said, I'm very committed to this, but I'm sure that I'm making mistakes.
But the three things that we have learned really quickly as a small company is one of the very
first things you can do to increase diversity is to focus on the language, and the job ads,
and the job descriptions, and your website. It is really amazing across security,
and across the job descriptions in our industry, how many of those have language that is very
exclusive. And I mean, it excludes people. How many of them, you know, focus on a very
particular sort of standard narrative that doesn't include other cultures,
that doesn't include other life experiences, other genders, etc. And so, you can do a lot
just by looking at all of your job descriptions, and all of your website, and asking yourself,
would somebody who's not like me want this job? And I think that that's something that
very few of us as hiring managers were taught to do when we were writing the job description.
Second, the farther to the front of your interview process you can put questions about
diversity, the more you are going to signal to candidates that it matters. If you go through
your whole interview process and never ask a manager candidate what they've done to increase
diversity in their previous organizations, they're going to get hired never thinking about whether
or not they're going to build a diverse team in your organization. So, the closer you can get that
to the front of your interview process, and I'll talk more about this in a second, the more you're
going to signal to the candidates that, A, this is important enough for you to talk about right up
front, but it's also going to allow you to select people who have answers around building diverse
organizations that match the culture that you want to build. And finally, look at your pipeline.
And I'll talk about this more in a second, but one of the most eye-opening things that you can do
is if you have a candidate tracking system that's tracking the interview pipeline that you have,
look at it and look at each stage. If 90% of the people that get in-person interviews, or 95%,
I've been in places where 100% of the people who get in-person interviews are white dudes,
well, guess what your team's going to end up as? It's going to end up as a bunch of white dudes.
If your pipeline is 90% diverse candidates, you're going to end up with a diverse team,
whether you like it or not. Who ends up in your interview process is who you end up hiring,
period, full stop. And so if the beginning of your pipeline does not look diverse,
the end's really not going to. So with that, I have two pieces of more tactical advice.
One is my absolute favorite new question. This question is the question that has moved to the
front of our interview process. And if I could actually put this on LinkedIn and make it a
qualifying question, I would. I don't claim credit for this. I was talking to the folks
over at Gapjumpers. Talk about a really neat organization. Gapjumpers is a group of folks
that are doing some really interesting work around diversity, and specifically diversity
in the hiring process. And one of their founders gave me this one. What actions have you taken,
or wish you had taken, to advocate for and support diverse and inclusive cultures and
teams in your previous roles? And by asking that question up front... and by the way,
the answer is not always going to be a great one. And especially if you're asking this of
a junior engineer, they might not have a good answer. But do they have things they wish they
could do? Do they have things that they wanted to do? Do they have things they've seen done well?
This starts a conversation that helps you to understand who the people you're interviewing
are around this. And it really helps you to identify people who are going to support the
culture you're building, but also that are going to be allies for you as you grow. And so we've
started asking this very, very close to the front of our interview questions... our interview
questions and panels. Like I said, if I could, I would put it in the qualifying questions to even
apply right next to, right next to, are you authorized to work in this country? This would
be a question I would ask right up front. Because by asking this, we are signaling like, hey,
by the way, when you get here, you're going to be expected to do this.
And so I don't know if you realize that all of these things that I've just put forward
are ultimately the same thing. I've actually created all of these ideas around a single idea.
And it comes from Richard Thaler's work around default choice. I was talking to a friend of
mine who runs HR at a Bay Area startup. And she said, my fundamental job is to make it so that
right now, the default choice for most of our engineering managers is to hire a white male.
My job is to make the default choice to hire not that. Because we know that it's, you know,
if I, if I pull a candidate, if I pull a pool of 100 engineers in the Bay Area, there's going to
be a lot of white males in that, in that random sample. If I can force us away from the default
choice that is currently the default choice, and create a new default choice to create a new
way of operating, then we're going to get the decisions we want. Similarly to the way that
with Thaler's work around 401ks, that if people if, if the default choice is not to enroll in a
401k, something like 65% of people don't enroll in a 401k. If you make the default choice that
they're defaulted to a 401k, and they have to enroll in a 401k, or they can opt out, something
like 65% of the people enroll in a 401k. By setting the default choice, which is what all of these
functions that I've that I've just talked about are doing, they are creating a situation where
diversity is the default choice, we're able to actually modify the behavior of people in our
organizations. And I think if we thought about how do we modify the default choice more effectively,
we would end up with a better outcome in much in many of our cases. So with that,
now we've hired a bunch of people, right? We've we've made offer letters, they've quit their jobs,
they're about to start. And this is the point where I'd be normally buying plane tickets and
having people come show up and I'd be giving them their laptop face to face on the first day.
Unfortunately, that's not exactly the world we live in anymore. We don't, you know, no longer
do we get to do the fly the person here, sit them in a room for five days and indoctrinate them
for for 40 hours and have cocktails with them after that and take them out to dinner every night.
That doesn't get to be how we do this anymore, because we're not able to do it in person.
And because of the challenge of Zoom fatigue, and the challenge of basically sitting someone in
front of a video conference for eight hours at a time, we have to realize that onboarding has
to change. Onboarding can no longer be a monolithic entity where you start talking at nine o'clock on
Monday and you stop talking at five o'clock on Monday and the person has set up their benefits
and their laptop and all of that. Because of this new world, we have to we have to realize
that you have to break it up. Right? That means you have to change formats, you have to have
multiple media, some things can be in documents, some things can be email, some things can be over
Slack, some, you know, Zoom is still important, you still will use Zoom. But often we can we can
do things like videos, or one-on-one mentorship, or, you know, breakout rooms, or just go read
this book even to replace that monolithic put a person in a room situation. And I mean, otherwise,
you're just going to end up with exhausted people who haven't learned anything. Ditto, logistics
start to get hard for onboarding. I mean, one of the things that we we've realized, and I have
people in the US and I have people in Canada, it was really easy when I flew them here to New York
to hand them all a laptop that we had, you know, bought from the store in advance and preconfigured.
Now I have to figure out how to get those laptops configured and to their house. Right? Simple,
something that should be simple logistically starts to become difficult. How about how do
you buy lunch for everybody on their first day? You know, do I get their home address and have
somebody send them Postmates? You know, how do we how do we even do something that simple? Right?
How do you have happy hour on on their first day? Like, how do you socially onboard these people?
These are all things we've never really had to worry about, right? The default action has always
been, oh, I will just fly them here, we'll stick them in a room and we're all good. The default
has changed. And so now we have to be thoughtful about not just the logistical part of the
onboarding, right? Not just how do I teach them where Jira is? And how do I make sure that their
laptop connects to VPN? But also, how do we socially integrate them into the team? Right?
A big part of that onboarding process at most companies is when you put all those people in a
room, you create an immediate social group. I still have relationships with people I onboarded
at Lookout and people I onboarded with at GE, even though they weren't on my team.
Right? We have traditionally used that onboarding process because, you know, as the meeting breaks
up and people go to the go get coffee in the kitchen, they start a natural conversation.
These are things that don't happen over Zoom. So as part of the onboarding of your employees,
you have to sit and think about what do I do to socially integrate them normally? Right?
Do we take them out to lunch? Do we do happy hours? Do we play games? What is the thing that
we normally do to socially onboard people? And then how can I create that same thing,
knowing that the mediums that we have don't enable that? So, for example, I'm a big fan of happy
hours. I love taking, you know, taking the team out to happy hour. The best part about it is
you can have big group conversations, but you also end up with a lot of one-on-one conversations.
The problem with Zoom, for example, and frankly, any of them, I use Zoom as shorthand,
right? It could be Teams. It could be Google Meet. It could be Hangouts. It could be anything.
But the problem with it is what you have in a video conference interaction is very different
than what you have in an in-person organization. Because even if you have like a suppose you have
lunch meeting. We have 10 people on Zoom. We all have lunch. If we had those 10 people around the
table, we would talk as a large group for a while. Somebody would present. Somebody would talk.
And then you'd see all of these splinter conversations that would happen. And those
splinter conversations are often where the most important relationships are formed. You know,
we're sitting around the table and I start having a small side conversation with the person next to
me or the person right across from me. And the people next to me are doing the same thing.
Those conversations can't happen over video conference. And nobody has yet created the Zoom
equivalent that allows me to be sitting in a large group meeting and have a side conversation
with some other person on Zoom without effectively talking over the speaker of the meeting.
And so you have to be really thoughtful about how do we create those things. You know,
if we normally do happy hour, it's great that we do remote happy or like a Zoom happy hour,
but how do we create the opportunity for all those people to have side conversations?
And so in, you know, one of the things that I've been forcing people to do is have a ton more
one-on-ones, especially with new people. You know, have one-on-ones with your new staff, you know,
every day for the first month. That's actually something I've been doing is as I've been
bringing some people aboard on my staff, I'm literally the first 30 days I meet with them
every day for 30 minutes. That's a lot of time, but it replicates a lot of the conversations we
would have had naturally as a side conversation in a meeting that we don't get to have anymore.
And similarly, you have to be able to do that with your team. You have to be able to think about
what are those social interactions? What do they look like when they're done well? And how do I
hold my organization accountable for doing that with the new person when they come aboard?
And by the way, this feels forced. This feels really uncomfortable to basically force everyone
to have, you know, five one-on-ones a week with people where they normally wouldn't have. But
you're replacing the informal hallway conversation. You're replacing their ability to just sort of
stand up in their cube and ask over the cube wall. You're trying to create a situation where
we replace those social interactions that happen organically within the office with an actual
forced interaction. I too know it feels forced and not organic, but it's kind of what we got,
right? We don't have the ability to do the things we've always done. And similarly, and so you sort
of get the transition, right? We're doing those things to onboard people, but a lot of those same
activities go into maintaining the health of the team and the health of the culture,
because you don't anymore have the random sitting down next to each other at lunch opportunity that
we used to have. You know, one of my favorite things when I've been in previous jobs is just
to walk into the kitchen with food and see who's sitting at what table and go sit at whatever table
and have whatever conversation I have that day with whoever's talking, right? And I'm an introvert,
by the way, but that's how you create really strong relationships within an organization.
Well, how do we do that same thing in this world? And I think there's a couple of things that we
have to be very cognizant of. First off, and you know, it's the old, this meeting could have been
an email idea. We have to be really ruthless about information format and information delivery.
If I know that I'm in an office and I have basically unlimited face-to-face time without
exhaustion, which as an introvert, I don't, I only have a certain amount of time I can be
face-to-face before I have to put on headphones and not talk to anybody. But in general, even
me as an introvert, when I'm in a room full of people, I can be pretty, you know, I can be pretty
good and know I can have as many conversations as I want and I'm not going to be exhausted.
In this new world, the hours we spend on video conference are a finite resource.
So, if I schedule a whole ton of meetings that could have easily been an email or a Slack,
suddenly I'm eating up time that I could have used for a more important face-to-face meeting
with those meetings. So, in order to keep our culture strong and in order to keep our ability
to have those social conversations and to have those in-person conversations when they're needed,
we have to start being ruthless about saving our time face-to-face for the things that matter
and finding a way not to do that. So, I've been doing a ton more with Google Docs. I've been
doing... I've even been writing long emails again, where I've gotten away traditionally from writing
long emails to my team. That was a very 2008 sort of strategy. I've started doing more longer emails,
documents, a ton more on Slack, because I realized that I have to save up the Zoom face-to-faces
for things that require that. And especially, especially for the social connection.
Now, if you read the story, you know, there have been studies over the years about the amount of
time people spend at work not working. And they're always presented in the traditional,
they're presented as people wasting time. I've never believed that the time at work
not working is people wasting time. Because fundamentally, the social bonds that you create
on your teams, they're not as important... they're not important in good times. Don't get me wrong.
I love being friends with all my team. I love loving the people I work with is really important.
I spend a ton of time with the people I work with. But what the social bonds that you create
in good times actually do for you that is most important is when things break down,
when stress is happening, when you're in the middle of incident response,
when your whole product goes down and nobody can figure out why, when a customer calls you
and is unhappy and you have to figure out a solution right then, those are the times when
you don't have time to build goodwill in that. And everyone's at a high stress level. Everyone's
on edge. Those are the times that your social bonds and the social cohesiveness of your
organization save you from the little misunderstandings. And so the time that you
spend building social bonds in non-work interaction, conversations as you walk down the hall,
conversations in the kitchen, you know, let's go get coffee next door. All of those little things
put in the bank goodwill and trust and ultimately psychological safety that saves you when things
go wrong. And this is exactly what we're missing right now. This is exactly what we're failing to
get. When work becomes effectively transactional because our Zooms don't allow us to have those
social times, we've basically set up a situation where it doesn't affect us on the normal days.
It doesn't affect us badly that we barely know our coworkers when everything's fine,
right? On every iteration sprint planning, everything's great. But when things go wrong
and people haven't built that trust, that's when things break down. And so in this new time,
as leaders, but also each person, we need to think about how do we create that non-work
interaction for our teams and replicate it intentionally. And it goes back to what I was
saying about onboarding. You should be thinking, if you're, you know, if you have a team of people,
you should be thinking for each of those people, what social relationships are going to matter
most when things hit the fan, right? Could, you know, if it's a team of developers, could be
another developer, could be a QA person, could be a member of the customer support team.
And then you have to sit down with that person and force them to create opportunities to create
those social bonds. And, you know, one of the easiest way to do that is just to force them to
have 30 minute one-on-ones with that person every week or every two weeks or every month. And yes,
it is, it is forced. It is not organic. It is going to feel weird and uncomfortable.
And it's especially going to feel weird and uncomfortable for you because you should be
doing it for yourself too. What other people in your organization are important for you to be
having those social bonds with when things go wrong? Who are you going to need to rely on?
And so who are you going to need to build trust with in advance? And so we need to start forcing
ourselves to put ourselves in the situation to have those conversations. Have a one-on-one with
that person, you know, say it's your QA person. Put a one-on-one on the calendar and just talk
about your families. Talk about what happened that weekend and talk about, you know, whatever
you would talk about if you went to get coffee and you were sitting in the office. Because it's not
wasting time. It's your ability to put those things in the bank that will save you when things
go wrong. And it's not about Zoom happy hours or game nights. Don't get me wrong. I love those.
But it's about creating those bonds of trust with those people that you're going to need later on.
So, in conclusion, and just, you know, sort of putting a bow on it, the fatigue that we're all
feeling from isolation and from social change and from COVID and from everything are real.
And yet we don't get to kind of put it back in the bottle. The world's not going back to the way
it was any time soon. You know, there may be pieces and pockets and parts, but as a whole,
we're going to live remotely for a while. We're going to learn to have remote teams for a while.
We believe some people, we're going to have remote teams forever. Right? And so, it's going
to change how we hire. It's going to change how we onboard people and make them part of our team.
And it's going to change how we keep them part of our team. And the sooner we start adapting to that
and the sooner we start creating these new habits, the less they're going to feel weird,
the less they're going to feel forced, and the sooner we're going to be able to create
an opportunity to build a great culture in this world. And so, we have to be intentional. We have
to be intentional about creating the quality of information, especially in the interview process.
Right? If you know that you're only going to get from here up on somebody, you got to find a way
to get more information about them that you would normally get from their body language through
other means, through either additional questions, additional time, additional interactions,
however you want to do it. Similarly, we have to replace the ability to interact
in ways that deliver information. Right? We used to onboard by just sticking people in a room.
Now we have to go multimedia. Now we have to come up with multiple channels and do a whole
bunch of different things. And finally, we have to figure out how to be intentional about creating
the social bonds that hold our team together. Right? I talked a lot at B-Sides last year about
how to build great cultures. This is culture building. Right? How do you build a culture
in this new time is something we're all going to have to figure out together. And I hope that
next year and the year after at B-Sides, DEF CON, Black Hat, et cetera, there's a lot of people
that have better ideas than me. Because I'm obviously talking about this as I'm figuring
it out. Right? We're building the race car as we're driving the race. And I hope that a lot
of other people who come up with a lot of better ideas that I can learn from as well.
With that, thank you so much. I hope we're having good Q&A. And feel free to email me,
hit me on Twitter, hit me on LinkedIn, however you want to find me. I'm around. This is stuff
I love to talk about. So, find me and let's chat about this. Let's chat about medical cybersecurity
because I love to talk about that, too. Obviously, the scope logo on the CT scanner there.
But yeah. Anybody wants to hit me up, please feel free.
Mike, thank you. As always, love hearing your perspective and how you inspire people to
be better leaders, be better managers, and overall be better people. And it was so great when you
announced last year at B-Sides Las Vegas the beginning of scope security. So, that was
fabulous. Thank you for that. And I know we're having some really great conversations going on
in the Q&A. Please do follow up with Mike. Definitely interested in always hearing people's
perspective and having a great dialogue. Remember that we have career coaching and resume review
going on. And look forward to seeing everyone at our next presentation. Thanks so much.