start	end	text
7810	12650	So, welcome back to the Career Hacking Village here at DEF CON Safe Mode.
12650	16770	We know lots of people are at different stages of their career,
16770	20590	and what we wanted to do is make sure that those of you who are
20590	24270	midway in your career, maybe later in your career, and you're really starting
24270	28230	to get to that point where you need to start building your teams,
28230	32570	really taking on a leadership role, and how do you do all of this
33130	36830	while we're in the pandemic and while we are trying to figure out
36830	40770	how to create teams in a remote environment.
41070	43990	So, I've asked my dear friend, Mike Murray, to come back
43990	48550	and really share some of his insights on leadership and building teams
48550	51170	in the new normal. Mike, take it away.
51510	53970	Thanks, Kathleen. Really excited to be here.
53970	56450	Always great to be back on stage at DEF CON.
57030	63030	Even in this weird year when we finally have achieved DEF CON being
63030	68790	cancelled, and none of us get to be in the crazy heat of Las Vegas,
68790	74230	whether we're at the Rio or the RIV, or even back to the Alexis Park.
74230	79610	So, this is yet another format for DEF CON, and I'm pretty excited to be part of it.
79870	83670	And I think this has been a really interesting year for all of us.
83670	86590	I mean, 2020 just gets more strange as time goes on,
86590	89290	and we've still got a third of the year left to go.
89290	92870	So, lots left. And I don't know about you guys,
92870	96330	but I am, at this point, particularly tired.
97690	105190	Across the board, whether it's Zoom fatigue, whether it's fatigue from being locked in our
105190	111670	house, fatigue from having our parents and pets and kids and everybody around all the time that
111670	117410	you can never get away from, or just fatigue from being unable to socialize with your friends.
117410	121750	I mean, I don't know about all of you, but I certainly wish we were in Las Vegas sharing a
121750	128390	cocktail, and able to walk around and able to hug with abandon like we always have.
128390	134470	But this is a new year, and regardless of how tired we are, things are different.
134470	140350	And as Kathleen said, this is a talk, A, for the people who are building teams, but I also want
141990	145830	people out there, especially if you're thinking about joining a team,
146330	150670	I hope to present some of the things that I see as where we're going,
150670	154530	and the way that we're going to have to build our organizations and treat our people
154530	161810	as we go forward. But this should also reflect on when you're searching for a job, do the people
161810	167770	that you're interviewing with do some of these things? And are they doing them well? And is it
167890	172570	a place that is forward-thinking enough that you'd really want to join to be part of this culture of
172570	182290	remoteness, to focus on cultures that have diverse and inclusive workforces, and that have
182290	189430	figured out how to go from this world where a large part of our interaction style was in person,
189430	195590	to a world where a large part of our interaction style is like we're doing today, recording a talk
195590	201570	over Zoom and presenting it, you know, not in the same way we would have in prior years.
201570	205650	Now, the good news about being in security, at least according to all the stereotypes,
205650	213090	is that we're pretty good at remote. You know, the typical stereotype of the remote hacker
213090	218350	sitting in their basement with their headphones on or their hoodie up and, you know, I don't know
218350	225730	if you can tell, but I'm wearing my hoodie today for recording this talk. You know, we have always
225730	231410	done particularly well as an industry with having some amount of remote work.
231410	238550	The problem with that is we weren't ever really remote. I don't know many people who have had
238550	246670	their entire job cycle from first interview to hiring and onboarding to being in a company for
246810	253230	a couple of years and never being in person. You know, every organization I've ever been at,
253230	258130	if we were interviewing for even a remote role, we would often fly the person out for the final
258130	261830	interview. We would often fly them out and have dinner and have a cocktail and get to know them
261830	267550	face to face. And then when they onboarded, the same thing. When I started Scope Security,
267550	273330	my company here in New York City, what I would do is every time I hired somebody, I would fly
273330	277650	them to New York for three days. And we'd spend the first three days sitting in a room with a
277650	281390	whiteboard, talking through everything in the company, talking through the technology, walking
281390	286770	through the product and all of that stuff. And we would have lunches and we would have breakfasts
286770	291570	and we would have dinners and we would have all this face to face interaction. Similarly, I don't
291570	296630	know any sales team around this industry that doesn't have at least once a year, you fly all
296630	302390	the salespeople and put them in a big room and have a sales kickoff. These are all things that
302390	308670	have just evaporated in 2020. And let's be clear, with Google's recent announcement that they're
308670	313890	going to keep all of their people remote until the middle of next year, I fully expect that
313890	318750	many of us are going to go at least another year before we are face to face with a lot of our
318750	325410	co-workers. And so even the roles that we've traditionally thought of as remote are far
325410	331050	more remote than they used to be. And that's where I think the crux of a lot of the changes come
331630	339510	from. Because we're missing a ton of our ability to form those social relationships. I mean,
339510	344210	most of those social bonds are what get us through tough times. I'm going to talk about
344210	349410	that a bunch during this presentation. Additionally, and if you spend as much time
349410	355670	on Zoom and video conferencing as I do, you know that this is real. Zoom fatigue is a thing.
355670	361110	Your mind and your cognitive resources are not designed to sit and stare at a blank screen
361110	367450	that's not in three dimensions for eight or 10 hours a day. We are built to be social animals,
367450	374650	but that socialness is in person, right? And many of us survive on that in-person,
374650	379150	face-to-face interaction, especially the extroverts in the audience,
379150	384870	for getting back the energy that we need to get through our days.
385110	393330	Similarly, when you're in that informal or sort of... when you're in that remote context,
393330	399190	the staring at a screen over Zoom, you miss out on a lot of information, right? And this is one
399190	402930	of the things we'll talk about a lot in the interviewing section of this conversation.
402950	408190	When you're doing an interview over Zoom, you miss a ton of influence cues that you would get
408190	414690	if you were sitting face-to-face, right? Body language over video conference is effectively
414690	419130	the talking head body language. It's not my full body language. You can't tell what I'm doing with
419130	424370	my feet while I'm sitting here presenting to a screen with a microphone in front of my face.
424430	430610	And you aren't really aware of how much information you get from that until it's gone.
430930	436250	So let's talk about how I'm going to split up this talk. And I'm going to talk about three
436250	443190	things that are really important and difficult in this time, right? The first one is bringing
443190	448830	people aboard. You don't get to fly them out to the office and sit in front of them for a full
448830	453010	day in a room with a whiteboard anymore. And because of that, we have to change our interviewing
453010	459270	and hiring processes a lot. Similarly, when you're onboarding new employees, you also don't get to
459270	463450	fly them to headquarters and have them sit in a room with you. So how do we change onboarding
463450	468870	to accept this new remote reality? And then once people are aboard, how do you keep them mentally
468870	475850	healthy? I know it's a common conversation, and I'm sure that there's going to be a bunch of other
475850	480030	talks here at DEF CON about the mental health impact of locking ourselves in our houses like
480030	486810	this and working all the time. But how do you create touch points in your culture and create
486810	493070	structures by which you can keep your teams mentally sane? These are the three real phases
493070	500150	of the employee life cycle that are changing so much right now that I want to dig into. So with
500150	504570	that, we'll start with interviewing and hiring. We'll start with the onboarding process. And whether
504570	509730	you're a job seeker who's going through this remote interview process or a hiring manager
509730	516310	who's having to figure out how to modify their hiring process, this has been a really tough time.
516310	522870	And it's funny, I was hiring a senior leader early on. Scope's obviously growing a bunch,
522870	527030	and we're hiring a bunch of people. And I was talking to a recruiter friend of mine who
527990	537150	is pretty thoughtful about these things. And I said to him, so do you have any advice for me?
537550	545450	It's a big risk to hire a senior person who you've never met face to face. And his insight was,
545450	549150	well, Mike, it's pretty simple. You either take the risk or you don't.
550190	555650	That's not exactly what I was asking. What I was asking for was a way that we can modulate our
555650	563670	process such that it becomes less risky. And so with that, I set out on the quest to figure out
563670	567810	what we could start to do in our interview processes, knowing that as we're a growing
567810	572810	company, we're probably going to hire 20 people this year, and we're never going to meet any of
572810	577770	them face to face. So how do we do that in a way that we don't end up hiring the wrong people or
578650	584150	breaking our particularly interesting culture? And especially, how do we make sure that we are
584150	588490	getting the right people in the process and then evaluating them effectively so that we get them
588490	596090	through to the onboarding process? So with that, one of the things that we really realize is that
596090	605950	most of the things that you do in an interview process can have more or less rigor.
605950	611690	You don't always have to be the most rigorous interviewer if you can create good bonds with
611690	617730	the people in front of you. And I've seen a lot of hiring managers overcome bad interview processes
617730	623730	and bad HR processes because they create such a strong interpersonal relationship with the
623730	628750	candidate. And in the past, that was enough, right? I could overcome a lot of bad candidate
628750	635590	experience within my interview processes by having really great interviews and creating those
635590	640430	relationships, especially building in things like taking the candidate out to lunch and things that
640430	645750	create that trust interpersonally. But unfortunately, that's all the stuff that's gone away.
645750	653430	So what we realized is that rather than focus on our ability to create bonds with candidates,
653430	661730	we had to actually add rigor to our process. Because what usually creates the trust between
661730	666470	the candidate and the company that's trying to hire them is the interpersonal relationships with
666470	673310	the people. Now you have to replace that by having a really great process. And so refocusing your
673310	679690	interview process on making sure that you follow up with candidates in a timely fashion, that
679690	685010	candidates are getting the right feedback and the right email and the right steps in the middle
685010	692270	of the process, that you have standard questions across each of your sets of interviews so that
692270	701530	the interviewers can focus what ability they have on creating the trust across this impoverished
701530	709670	medium. We've had to go back and add rigor to our process. Now, the funny thing is, we're a
709670	715990	nine-person startup. That's a hard thing to add rigor when you're a tiny company. It's one thing,
715990	723990	you know, when I was at GE in my past, GE has lots of rigor, right? They have, you know, people
723990	728770	to create rigor in the interview process where that's their job. Whereas at a small startup,
728770	732430	you don't have that. So it's been it's been harder for us to do that. And I can't say that we
732430	737610	necessarily do it that well. But we've been focusing on how do we add rigor to the process
737610	743190	because we realize that we can't just rely on our ability to charm the candidate and to have
743730	750830	really great interactions with them to create the bonds that we need and the excitement that
750830	756010	they need about the company. Similarly, it's forced us to change our interview formats. You know,
756010	762850	most companies I know have an interview process that involves some amount of remote interviewing,
762850	767250	whether a phone screen or a phone screen and then a chat with the hiring manager.
767530	771410	And then usually you bring the candidate in for one of these marathon, you know,
771410	778630	four to six to eight hour back-to-back interview days, which is exhausting even when you're
778630	782750	sitting in a room with a whiteboard with a bunch of people that come in and out.
782750	789410	Over Zoom, it's not just exhausting. It's actually impossible. You know, by the eighth hour of an
789410	794930	eight hour back-to-back Zoom day, the candidate's eyes are going to be so glazed over that they can
794930	800330	barely form a sentence. And the last half of your interview process is not going to get the
800330	806150	information that you want. So what we realized is we had to start breaking it up. Whereas,
806150	811410	you know, you may have had a three-step interview process with the third step being a lot of
811410	817850	different conversations. We've now added additional steps to that process. We're also
817850	824530	experimenting with adding different media into the process. As an example, we know that we live
824530	830490	on Slack. You know, other organizations live on Teams or Google Meet or, you know, Skype or whatever
830490	838330	your preferred instant messenger is. We've started adding in attempts at interviews over those
838330	842470	different mediums. Because if a person is going to join our team, they're going to spend a lot of
842470	847850	time interacting with us on Slack. It would be terrible to find out that they don't know how
847850	853130	to use Slack in their first week, you know. And we want to be able to replicate that experience.
853130	856910	Now, you don't want to throw somebody out just because they don't know how to use Slack. I mean,
856910	863330	obviously, there's a conversation there and a teaching opportunity. But you have to figure
863330	866850	out how to replicate the real life you're going to be in. The real life you're going to be in is
866850	871510	not in an office with a whiteboard for at least the next 12 months. So what is their life going to
871510	876450	be for the next 12 months? Is it you're going to be drawing things in Lucidchart or Vizio online?
876450	880750	Are you going to be collaborating on docs in Google Docs? How are you, you know, are you going to be
880750	885730	pair programming? What are those things that are going to reflect that person's day-to-day life
885730	892930	once they've joined your company? And in that time, how do we create effectively an interview
892930	897370	process that replicates that so you can see what the candidate is going to be like in your
897370	904110	environment? And I've sort of harped on this a little bit. And I've hit it pretty hard. But
904110	910530	the idea of let's just get the candidate in front of a whiteboard and let's solve problems together
910530	916350	started to become really hard. And we did... I specifically really love the whiteboard interview,
916350	922670	right? I bring the candidate in. We will start working on a problem. I have five or six that
922670	927690	I use depending on what the role is that I'm hiring. And let's solve the problem together.
927690	931910	I get a sense of the person's interaction style. I get a sense of how they think, how they
931910	938030	communicate, when they ask for help, whether they ask for help, all of those things. And all of that
938030	943190	sort of evaporates when you can't do it remotely. I don't know if anybody's tried using the
943190	949230	whiteboarding feature of Zoom, but I will tell you it is a poor, poor, poor replacement for a real
949230	955390	whiteboard. And so what have we done to start focusing on how do you replace the whiteboard?
955690	961490	We've started looking at online testing opportunities. I mentioned a second ago,
961490	968830	real-time collaboration. If I was hiring a user interface person, maybe we co-design a screen of
968830	976190	something in Figma. Figma is effectively like Google Docs for designers where we can basically...
976190	980970	it's kind of like PowerPoint remotely, or not PowerPoint, sorry, Photoshop remotely, where you
980970	989430	can basically co-comment on and co-design a UX. Maybe we work on a product spec within a Google
989430	997330	Drive or the like. Or like I said, use Lucidchart or Visio to create an architecture and comment on
997330	1002350	it. Things that allow us to do real-time collaboration in the same way we do in a daily
1002350	1010070	meeting. You know, our architecture meetings often end up with somebody sharing their screen
1010070	1013970	and Lucidchart up on the screen and people drawing things and dragging them around.
1014450	1021390	It's reflective of the real role that they will do, but it's also a good way
1021390	1028650	to replace that whiteboard interview. Similarly, and this is the one that we've found the most
1028650	1033710	valuable over the last six months, is we've added in audition interviews for pretty much
1033710	1040430	everything. Basically, an audition interview, from my perspective, is you give the candidate
1041030	1045110	a bit of a take-home assignment, something they can do in an hour or two. It doesn't have to be
1045330	1050530	a huge thing. And then they have to come present. And they have to present their thoughts. So,
1050530	1055490	whether that is a threat hunter who you say, you give them a threat actor, you know,
1055490	1061930	here's APT29. Come tell us everything you learned about APT29 in a couple of hours.
1061970	1067530	Or here's a piece of code. Tell us about it. Or write this piece of code. Or, you know, spin up
1067530	1072510	this service. And then come tell us what you did. So that you get a good understanding of their
1072510	1076790	communication style. You get a good understanding of their ability to do work. And you get a good
1076790	1082750	understanding of how they're going to interact with you once they're here. And obviously,
1082750	1087110	those auditions balance differently depending on who it is. If it's a sales role,
1087110	1092410	that presentation is the most important thing. If it's a technical role, often the technology and
1092410	1096110	the skills that they're showing is the most important thing. But they still have to be
1096110	1102310	able to present their skills, right? So, across all of these, whether we're adding
1102310	1107470	in initial assessments, whether we're doing collaborative interviewing over collaborative
1107470	1114310	platforms, or we're doing an audition, we've added in all these steps to try and get a sense
1114310	1120280	of how the person will work in the real world the way that we used to with a whiteboard interview.
1121030	1128170	So, let me take a detour for a second. Because 2020 has really put a focus on diversity in a way
1128170	1136920	that we haven't seen in prior years. And it's something that has been a focus of mine for a
1136920	1143780	of years, though I very rarely talk about it. A big part of that is, I don't have a whole lot
1143780	1149000	of experience in my own personal history that lends me to be an expert on diversity by any
1149000	1159040	stretch, right? I grew up in small-town Ontario, and grew up in Canada, and I'm pretty white here.
1159140	1165220	So, I'm not really the person to talk about this. But I will say, I've learned a lot about it.
1165220	1170620	And I have a couple of counterintuitive points that I think I wanted to put on into this talk,
1170620	1175320	because it's important to think about. Even if you're not somebody who really reflects diversity,
1175320	1180340	it's incumbent on all of us to get out there and make the change we want to see in the world.
1180340	1184960	And what I realized when I really started studying diversity is, a lot of the advice
1184960	1190600	for when you look at diversity and inclusion programs, and when you get into the HR material,
1191320	1196620	a lot of it is about showing how you're doing diversity for large companies, right? Publish
1196620	1200880	your metrics, and have diversity committees internally, and do all of these things that
1200880	1207460	happen at large companies. I was an executive sponsor of the diversity committee when I was
1207460	1212760	at Lookout. I've done the big company diversity thing. But how do you hire a diverse team when
1212760	1218640	you're six people? Because a lot of those things that you read about in the HR manuals don't really
1218640	1225160	apply very effectively when your whole team fits in one Zoom window.
1225460	1232420	And so, we've had to realize that the diversity effort for us is less a strategy. It's less a
1232420	1240540	strategic conversation about how we structure the company's program, as it is a tactical activity of
1240540	1244900	how do I get the right people to apply, and how do we make sure we hire the right people? And so,
1244900	1249380	there are a few things that I really wanted to emphasize around that. And by the way,
1249380	1255040	I feel free to hit me up in the Q&A, and to email me, and send me notes on Twitter,
1255040	1259580	and tell me all the things that I'm not doing right here, and that I'm getting wrong. Because,
1259580	1263980	like I said, I'm very committed to this, but I'm sure that I'm making mistakes.
1263980	1269740	But the three things that we have learned really quickly as a small company is one of the very
1269740	1274440	first things you can do to increase diversity is to focus on the language, and the job ads,
1274440	1282640	and the job descriptions, and your website. It is really amazing across security,
1282640	1289820	and across the job descriptions in our industry, how many of those have language that is very
1289820	1297660	exclusive. And I mean, it excludes people. How many of them, you know, focus on a very
1297660	1304080	particular sort of standard narrative that doesn't include other cultures,
1304080	1310720	that doesn't include other life experiences, other genders, etc. And so, you can do a lot
1310720	1315380	just by looking at all of your job descriptions, and all of your website, and asking yourself,
1315380	1320000	would somebody who's not like me want this job? And I think that that's something that
1320000	1326380	very few of us as hiring managers were taught to do when we were writing the job description.
1326380	1333460	Second, the farther to the front of your interview process you can put questions about
1333460	1338400	diversity, the more you are going to signal to candidates that it matters. If you go through
1338400	1342660	your whole interview process and never ask a manager candidate what they've done to increase
1342660	1347280	diversity in their previous organizations, they're going to get hired never thinking about whether
1347280	1352440	or not they're going to build a diverse team in your organization. So, the closer you can get that
1352440	1357820	to the front of your interview process, and I'll talk more about this in a second, the more you're
1357820	1361940	going to signal to the candidates that, A, this is important enough for you to talk about right up
1361940	1368060	front, but it's also going to allow you to select people who have answers around building diverse
1368060	1374700	organizations that match the culture that you want to build. And finally, look at your pipeline.
1374840	1380280	And I'll talk about this more in a second, but one of the most eye-opening things that you can do
1380280	1387200	is if you have a candidate tracking system that's tracking the interview pipeline that you have,
1387200	1396300	look at it and look at each stage. If 90% of the people that get in-person interviews, or 95%,
1396300	1402820	I've been in places where 100% of the people who get in-person interviews are white dudes,
1402820	1406160	well, guess what your team's going to end up as? It's going to end up as a bunch of white dudes.
1406160	1411560	If your pipeline is 90% diverse candidates, you're going to end up with a diverse team,
1411560	1416680	whether you like it or not. Who ends up in your interview process is who you end up hiring,
1416680	1421820	period, full stop. And so if the beginning of your pipeline does not look diverse,
1421820	1428120	the end's really not going to. So with that, I have two pieces of more tactical advice.
1428120	1432500	One is my absolute favorite new question. This question is the question that has moved to the
1432500	1437660	front of our interview process. And if I could actually put this on LinkedIn and make it a
1437660	1443200	qualifying question, I would. I don't claim credit for this. I was talking to the folks
1443200	1449360	over at Gapjumpers. Talk about a really neat organization. Gapjumpers is a group of folks
1449360	1454180	that are doing some really interesting work around diversity, and specifically diversity
1454180	1459260	in the hiring process. And one of their founders gave me this one. What actions have you taken,
1459260	1463860	or wish you had taken, to advocate for and support diverse and inclusive cultures and
1463860	1468680	teams in your previous roles? And by asking that question up front... and by the way,
1469200	1473720	the answer is not always going to be a great one. And especially if you're asking this of
1473840	1479320	a junior engineer, they might not have a good answer. But do they have things they wish they
1479320	1483400	could do? Do they have things that they wanted to do? Do they have things they've seen done well?
1483400	1487160	This starts a conversation that helps you to understand who the people you're interviewing
1487160	1495060	are around this. And it really helps you to identify people who are going to support the
1495060	1500640	culture you're building, but also that are going to be allies for you as you grow. And so we've
1500640	1505060	started asking this very, very close to the front of our interview questions... our interview
1505060	1511380	questions and panels. Like I said, if I could, I would put it in the qualifying questions to even
1511380	1517760	apply right next to, right next to, are you authorized to work in this country? This would
1517760	1523300	be a question I would ask right up front. Because by asking this, we are signaling like, hey,
1523300	1527740	by the way, when you get here, you're going to be expected to do this.
1529060	1533980	And so I don't know if you realize that all of these things that I've just put forward
1534680	1542320	are ultimately the same thing. I've actually created all of these ideas around a single idea.
1542320	1549300	And it comes from Richard Thaler's work around default choice. I was talking to a friend of
1549300	1558640	mine who runs HR at a Bay Area startup. And she said, my fundamental job is to make it so that
1558640	1565960	right now, the default choice for most of our engineering managers is to hire a white male.
1566020	1572560	My job is to make the default choice to hire not that. Because we know that it's, you know,
1572560	1578240	if I, if I pull a candidate, if I pull a pool of 100 engineers in the Bay Area, there's going to
1578240	1586300	be a lot of white males in that, in that random sample. If I can force us away from the default
1586300	1591380	choice that is currently the default choice, and create a new default choice to create a new
1592860	1598900	way of operating, then we're going to get the decisions we want. Similarly to the way that
1598900	1607600	with Thaler's work around 401ks, that if people if, if the default choice is not to enroll in a
1607600	1612780	401k, something like 65% of people don't enroll in a 401k. If you make the default choice that
1612780	1618140	they're defaulted to a 401k, and they have to enroll in a 401k, or they can opt out, something
1618140	1623620	like 65% of the people enroll in a 401k. By setting the default choice, which is what all of these
1623620	1629320	functions that I've that I've just talked about are doing, they are creating a situation where
1629320	1634240	diversity is the default choice, we're able to actually modify the behavior of people in our
1634240	1639220	organizations. And I think if we thought about how do we modify the default choice more effectively,
1639220	1646660	we would end up with a better outcome in much in many of our cases. So with that,
1646660	1651900	now we've hired a bunch of people, right? We've we've made offer letters, they've quit their jobs,
1651900	1658520	they're about to start. And this is the point where I'd be normally buying plane tickets and
1658520	1663500	having people come show up and I'd be giving them their laptop face to face on the first day.
1664160	1670320	Unfortunately, that's not exactly the world we live in anymore. We don't, you know, no longer
1670320	1676340	do we get to do the fly the person here, sit them in a room for five days and indoctrinate them
1677080	1683080	for for 40 hours and have cocktails with them after that and take them out to dinner every night.
1684460	1689500	That doesn't get to be how we do this anymore, because we're not able to do it in person.
1690440	1698560	And because of the challenge of Zoom fatigue, and the challenge of basically sitting someone in
1698560	1704560	front of a video conference for eight hours at a time, we have to realize that onboarding has
1704560	1712060	to change. Onboarding can no longer be a monolithic entity where you start talking at nine o'clock on
1712060	1717220	Monday and you stop talking at five o'clock on Monday and the person has set up their benefits
1717220	1724780	and their laptop and all of that. Because of this new world, we have to we have to realize
1724780	1729160	that you have to break it up. Right? That means you have to change formats, you have to have
1729160	1733900	multiple media, some things can be in documents, some things can be email, some things can be over
1733900	1741580	Slack, some, you know, Zoom is still important, you still will use Zoom. But often we can we can
1741580	1749700	do things like videos, or one-on-one mentorship, or, you know, breakout rooms, or just go read
1749700	1757400	this book even to replace that monolithic put a person in a room situation. And I mean, otherwise,
1757400	1762360	you're just going to end up with exhausted people who haven't learned anything. Ditto, logistics
1762360	1768060	start to get hard for onboarding. I mean, one of the things that we we've realized, and I have
1768060	1774340	people in the US and I have people in Canada, it was really easy when I flew them here to New York
1774340	1779320	to hand them all a laptop that we had, you know, bought from the store in advance and preconfigured.
1779380	1785380	Now I have to figure out how to get those laptops configured and to their house. Right? Simple,
1785380	1789900	something that should be simple logistically starts to become difficult. How about how do
1789900	1794080	you buy lunch for everybody on their first day? You know, do I get their home address and have
1794080	1799520	somebody send them Postmates? You know, how do we how do we even do something that simple? Right?
1799520	1806360	How do you have happy hour on on their first day? Like, how do you socially onboard these people?
1806360	1811660	These are all things we've never really had to worry about, right? The default action has always
1811660	1816300	been, oh, I will just fly them here, we'll stick them in a room and we're all good. The default
1816300	1820960	has changed. And so now we have to be thoughtful about not just the logistical part of the
1822060	1826980	onboarding, right? Not just how do I teach them where Jira is? And how do I make sure that their
1826980	1832300	laptop connects to VPN? But also, how do we socially integrate them into the team? Right?
1832300	1838960	A big part of that onboarding process at most companies is when you put all those people in a
1838960	1846600	room, you create an immediate social group. I still have relationships with people I onboarded
1846600	1850940	at Lookout and people I onboarded with at GE, even though they weren't on my team.
1851260	1858360	Right? We have traditionally used that onboarding process because, you know, as the meeting breaks
1858360	1863300	up and people go to the go get coffee in the kitchen, they start a natural conversation.
1863340	1868600	These are things that don't happen over Zoom. So as part of the onboarding of your employees,
1868600	1875300	you have to sit and think about what do I do to socially integrate them normally? Right?
1875300	1881140	Do we take them out to lunch? Do we do happy hours? Do we play games? What is the thing that
1881140	1887280	we normally do to socially onboard people? And then how can I create that same thing,
1887280	1893900	knowing that the mediums that we have don't enable that? So, for example, I'm a big fan of happy
1893900	1899520	hours. I love taking, you know, taking the team out to happy hour. The best part about it is
1899520	1905820	you can have big group conversations, but you also end up with a lot of one-on-one conversations.
1906340	1912000	The problem with Zoom, for example, and frankly, any of them, I use Zoom as shorthand,
1912000	1916140	right? It could be Teams. It could be Google Meet. It could be Hangouts. It could be anything.
1916140	1922920	But the problem with it is what you have in a video conference interaction is very different
1922920	1927380	than what you have in an in-person organization. Because even if you have like a suppose you have
1927380	1932480	lunch meeting. We have 10 people on Zoom. We all have lunch. If we had those 10 people around the
1932480	1937400	table, we would talk as a large group for a while. Somebody would present. Somebody would talk.
1937900	1942460	And then you'd see all of these splinter conversations that would happen. And those
1942460	1946460	splinter conversations are often where the most important relationships are formed. You know,
1946460	1950240	we're sitting around the table and I start having a small side conversation with the person next to
1950240	1954500	me or the person right across from me. And the people next to me are doing the same thing.
1954500	1961540	Those conversations can't happen over video conference. And nobody has yet created the Zoom
1962100	1967220	equivalent that allows me to be sitting in a large group meeting and have a side conversation
1967220	1972460	with some other person on Zoom without effectively talking over the speaker of the meeting.
1972800	1978580	And so you have to be really thoughtful about how do we create those things. You know,
1978580	1984360	if we normally do happy hour, it's great that we do remote happy or like a Zoom happy hour,
1984360	1988780	but how do we create the opportunity for all those people to have side conversations?
1989040	1994180	And so in, you know, one of the things that I've been forcing people to do is have a ton more
1994180	1999260	one-on-ones, especially with new people. You know, have one-on-ones with your new staff, you know,
1999260	2004900	every day for the first month. That's actually something I've been doing is as I've been
2004900	2009140	bringing some people aboard on my staff, I'm literally the first 30 days I meet with them
2009140	2017040	every day for 30 minutes. That's a lot of time, but it replicates a lot of the conversations we
2017040	2022340	would have had naturally as a side conversation in a meeting that we don't get to have anymore.
2022340	2027420	And similarly, you have to be able to do that with your team. You have to be able to think about
2027420	2033220	what are those social interactions? What do they look like when they're done well? And how do I
2033220	2038060	hold my organization accountable for doing that with the new person when they come aboard?
2038140	2044060	And by the way, this feels forced. This feels really uncomfortable to basically force everyone
2044060	2050080	to have, you know, five one-on-ones a week with people where they normally wouldn't have. But
2050080	2055600	you're replacing the informal hallway conversation. You're replacing their ability to just sort of
2055600	2061080	stand up in their cube and ask over the cube wall. You're trying to create a situation where
2061080	2066800	we replace those social interactions that happen organically within the office with an actual
2066800	2075360	forced interaction. I too know it feels forced and not organic, but it's kind of what we got,
2075360	2082900	right? We don't have the ability to do the things we've always done. And similarly, and so you sort
2082900	2087320	of get the transition, right? We're doing those things to onboard people, but a lot of those same
2087320	2092260	activities go into maintaining the health of the team and the health of the culture,
2092260	2098940	because you don't anymore have the random sitting down next to each other at lunch opportunity that
2098940	2104360	we used to have. You know, one of my favorite things when I've been in previous jobs is just
2104360	2110080	to walk into the kitchen with food and see who's sitting at what table and go sit at whatever table
2110080	2116060	and have whatever conversation I have that day with whoever's talking, right? And I'm an introvert,
2116060	2120980	by the way, but that's how you create really strong relationships within an organization.
2121060	2127600	Well, how do we do that same thing in this world? And I think there's a couple of things that we
2127600	2133840	have to be very cognizant of. First off, and you know, it's the old, this meeting could have been
2133840	2142460	an email idea. We have to be really ruthless about information format and information delivery.
2142920	2149100	If I know that I'm in an office and I have basically unlimited face-to-face time without
2149100	2153180	exhaustion, which as an introvert, I don't, I only have a certain amount of time I can be
2153180	2160240	face-to-face before I have to put on headphones and not talk to anybody. But in general, even
2160740	2166680	me as an introvert, when I'm in a room full of people, I can be pretty, you know, I can be pretty
2166680	2171060	good and know I can have as many conversations as I want and I'm not going to be exhausted.
2171060	2175900	In this new world, the hours we spend on video conference are a finite resource.
2176040	2182540	So, if I schedule a whole ton of meetings that could have easily been an email or a Slack,
2182540	2188800	suddenly I'm eating up time that I could have used for a more important face-to-face meeting
2188800	2195140	with those meetings. So, in order to keep our culture strong and in order to keep our ability
2195140	2199940	to have those social conversations and to have those in-person conversations when they're needed,
2199940	2207960	we have to start being ruthless about saving our time face-to-face for the things that matter
2207960	2212140	and finding a way not to do that. So, I've been doing a ton more with Google Docs. I've been
2212140	2216860	doing... I've even been writing long emails again, where I've gotten away traditionally from writing
2216860	2225040	long emails to my team. That was a very 2008 sort of strategy. I've started doing more longer emails,
2225040	2234300	documents, a ton more on Slack, because I realized that I have to save up the Zoom face-to-faces
2234300	2241420	for things that require that. And especially, especially for the social connection.
2241780	2247180	Now, if you read the story, you know, there have been studies over the years about the amount of
2247180	2255020	time people spend at work not working. And they're always presented in the traditional,
2255760	2260920	they're presented as people wasting time. I've never believed that the time at work
2260920	2266280	not working is people wasting time. Because fundamentally, the social bonds that you create
2266280	2271280	on your teams, they're not as important... they're not important in good times. Don't get me wrong.
2271280	2276520	I love being friends with all my team. I love loving the people I work with is really important.
2276520	2281760	I spend a ton of time with the people I work with. But what the social bonds that you create
2281760	2287080	in good times actually do for you that is most important is when things break down,
2287080	2291320	when stress is happening, when you're in the middle of incident response,
2291320	2299240	when your whole product goes down and nobody can figure out why, when a customer calls you
2299240	2304260	and is unhappy and you have to figure out a solution right then, those are the times when
2304260	2309840	you don't have time to build goodwill in that. And everyone's at a high stress level. Everyone's
2309840	2314520	on edge. Those are the times that your social bonds and the social cohesiveness of your
2314520	2319200	organization save you from the little misunderstandings. And so the time that you
2319200	2326640	spend building social bonds in non-work interaction, conversations as you walk down the hall,
2326640	2332480	conversations in the kitchen, you know, let's go get coffee next door. All of those little things
2332480	2341040	put in the bank goodwill and trust and ultimately psychological safety that saves you when things
2341040	2346940	go wrong. And this is exactly what we're missing right now. This is exactly what we're failing to
2346940	2354860	get. When work becomes effectively transactional because our Zooms don't allow us to have those
2354860	2363000	social times, we've basically set up a situation where it doesn't affect us on the normal days.
2363000	2368340	It doesn't affect us badly that we barely know our coworkers when everything's fine,
2368340	2374780	right? On every iteration sprint planning, everything's great. But when things go wrong
2374780	2380560	and people haven't built that trust, that's when things break down. And so in this new time,
2380560	2386360	as leaders, but also each person, we need to think about how do we create that non-work
2386360	2391120	interaction for our teams and replicate it intentionally. And it goes back to what I was
2391120	2395540	saying about onboarding. You should be thinking, if you're, you know, if you have a team of people,
2395540	2399700	you should be thinking for each of those people, what social relationships are going to matter
2399700	2403960	most when things hit the fan, right? Could, you know, if it's a team of developers, could be
2403960	2408600	another developer, could be a QA person, could be a member of the customer support team.
2408600	2413820	And then you have to sit down with that person and force them to create opportunities to create
2413820	2418460	those social bonds. And, you know, one of the easiest way to do that is just to force them to
2418460	2423840	have 30 minute one-on-ones with that person every week or every two weeks or every month. And yes,
2423840	2429420	it is, it is forced. It is not organic. It is going to feel weird and uncomfortable.
2429720	2433220	And it's especially going to feel weird and uncomfortable for you because you should be
2433220	2440360	doing it for yourself too. What other people in your organization are important for you to be
2440360	2444860	having those social bonds with when things go wrong? Who are you going to need to rely on?
2444960	2451280	And so who are you going to need to build trust with in advance? And so we need to start forcing
2451280	2455380	ourselves to put ourselves in the situation to have those conversations. Have a one-on-one with
2455380	2460580	that person, you know, say it's your QA person. Put a one-on-one on the calendar and just talk
2460580	2465280	about your families. Talk about what happened that weekend and talk about, you know, whatever
2465280	2470580	you would talk about if you went to get coffee and you were sitting in the office. Because it's not
2470580	2476580	wasting time. It's your ability to put those things in the bank that will save you when things
2476580	2481820	go wrong. And it's not about Zoom happy hours or game nights. Don't get me wrong. I love those.
2481820	2487520	But it's about creating those bonds of trust with those people that you're going to need later on.
2487520	2494700	So, in conclusion, and just, you know, sort of putting a bow on it, the fatigue that we're all
2494700	2500960	feeling from isolation and from social change and from COVID and from everything are real.
2501380	2506220	And yet we don't get to kind of put it back in the bottle. The world's not going back to the way
2506220	2511800	it was any time soon. You know, there may be pieces and pockets and parts, but as a whole,
2511800	2516620	we're going to live remotely for a while. We're going to learn to have remote teams for a while.
2516620	2521260	We believe some people, we're going to have remote teams forever. Right? And so, it's going
2521260	2526200	to change how we hire. It's going to change how we onboard people and make them part of our team.
2526200	2530760	And it's going to change how we keep them part of our team. And the sooner we start adapting to that
2530760	2534860	and the sooner we start creating these new habits, the less they're going to feel weird,
2534860	2538560	the less they're going to feel forced, and the sooner we're going to be able to create
2539160	2545580	an opportunity to build a great culture in this world. And so, we have to be intentional. We have
2545580	2550900	to be intentional about creating the quality of information, especially in the interview process.
2550980	2555820	Right? If you know that you're only going to get from here up on somebody, you got to find a way
2555820	2560140	to get more information about them that you would normally get from their body language through
2560140	2564720	other means, through either additional questions, additional time, additional interactions,
2564720	2571340	however you want to do it. Similarly, we have to replace the ability to interact
2573060	2578220	in ways that deliver information. Right? We used to onboard by just sticking people in a room.
2578220	2582900	Now we have to go multimedia. Now we have to come up with multiple channels and do a whole
2582900	2587320	bunch of different things. And finally, we have to figure out how to be intentional about creating
2587320	2592760	the social bonds that hold our team together. Right? I talked a lot at B-Sides last year about
2592760	2597960	how to build great cultures. This is culture building. Right? How do you build a culture
2597960	2602360	in this new time is something we're all going to have to figure out together. And I hope that
2603100	2608120	next year and the year after at B-Sides, DEF CON, Black Hat, et cetera, there's a lot of people
2608120	2614420	that have better ideas than me. Because I'm obviously talking about this as I'm figuring
2614420	2618360	it out. Right? We're building the race car as we're driving the race. And I hope that a lot
2618360	2622840	of other people who come up with a lot of better ideas that I can learn from as well.
2622840	2631560	With that, thank you so much. I hope we're having good Q&A. And feel free to email me,
2631560	2636180	hit me on Twitter, hit me on LinkedIn, however you want to find me. I'm around. This is stuff
2636180	2641420	I love to talk about. So, find me and let's chat about this. Let's chat about medical cybersecurity
2641420	2646780	because I love to talk about that, too. Obviously, the scope logo on the CT scanner there.
2647220	2651360	But yeah. Anybody wants to hit me up, please feel free.
2652080	2659380	Mike, thank you. As always, love hearing your perspective and how you inspire people to
2659380	2665660	be better leaders, be better managers, and overall be better people. And it was so great when you
2665660	2671940	announced last year at B-Sides Las Vegas the beginning of scope security. So, that was
2671940	2677100	fabulous. Thank you for that. And I know we're having some really great conversations going on
2677100	2682880	in the Q&A. Please do follow up with Mike. Definitely interested in always hearing people's
2682880	2688380	perspective and having a great dialogue. Remember that we have career coaching and resume review
2688380	2694600	going on. And look forward to seeing everyone at our next presentation. Thanks so much.