[00:07.810 --> 00:12.650] So, welcome back to the Career Hacking Village here at DEF CON Safe Mode. [00:12.650 --> 00:16.770] We know lots of people are at different stages of their career, [00:16.770 --> 00:20.590] and what we wanted to do is make sure that those of you who are [00:20.590 --> 00:24.270] midway in your career, maybe later in your career, and you're really starting [00:24.270 --> 00:28.230] to get to that point where you need to start building your teams, [00:28.230 --> 00:32.570] really taking on a leadership role, and how do you do all of this [00:33.130 --> 00:36.830] while we're in the pandemic and while we are trying to figure out [00:36.830 --> 00:40.770] how to create teams in a remote environment. [00:41.070 --> 00:43.990] So, I've asked my dear friend, Mike Murray, to come back [00:43.990 --> 00:48.550] and really share some of his insights on leadership and building teams [00:48.550 --> 00:51.170] in the new normal. Mike, take it away. [00:51.510 --> 00:53.970] Thanks, Kathleen. Really excited to be here. [00:53.970 --> 00:56.450] Always great to be back on stage at DEF CON. [00:57.030 --> 01:03.030] Even in this weird year when we finally have achieved DEF CON being [01:03.030 --> 01:08.790] cancelled, and none of us get to be in the crazy heat of Las Vegas, [01:08.790 --> 01:14.230] whether we're at the Rio or the RIV, or even back to the Alexis Park. [01:14.230 --> 01:19.610] So, this is yet another format for DEF CON, and I'm pretty excited to be part of it. [01:19.870 --> 01:23.670] And I think this has been a really interesting year for all of us. [01:23.670 --> 01:26.590] I mean, 2020 just gets more strange as time goes on, [01:26.590 --> 01:29.290] and we've still got a third of the year left to go. [01:29.290 --> 01:32.870] So, lots left. And I don't know about you guys, [01:32.870 --> 01:36.330] but I am, at this point, particularly tired. [01:37.690 --> 01:45.190] Across the board, whether it's Zoom fatigue, whether it's fatigue from being locked in our [01:45.190 --> 01:51.670] house, fatigue from having our parents and pets and kids and everybody around all the time that [01:51.670 --> 01:57.410] you can never get away from, or just fatigue from being unable to socialize with your friends. [01:57.410 --> 02:01.750] I mean, I don't know about all of you, but I certainly wish we were in Las Vegas sharing a [02:01.750 --> 02:08.390] cocktail, and able to walk around and able to hug with abandon like we always have. [02:08.390 --> 02:14.470] But this is a new year, and regardless of how tired we are, things are different. [02:14.470 --> 02:20.350] And as Kathleen said, this is a talk, A, for the people who are building teams, but I also want [02:21.990 --> 02:25.830] people out there, especially if you're thinking about joining a team, [02:26.330 --> 02:30.670] I hope to present some of the things that I see as where we're going, [02:30.670 --> 02:34.530] and the way that we're going to have to build our organizations and treat our people [02:34.530 --> 02:41.810] as we go forward. But this should also reflect on when you're searching for a job, do the people [02:41.810 --> 02:47.770] that you're interviewing with do some of these things? And are they doing them well? And is it [02:47.890 --> 02:52.570] a place that is forward-thinking enough that you'd really want to join to be part of this culture of [02:52.570 --> 03:02.290] remoteness, to focus on cultures that have diverse and inclusive workforces, and that have [03:02.290 --> 03:09.430] figured out how to go from this world where a large part of our interaction style was in person, [03:09.430 --> 03:15.590] to a world where a large part of our interaction style is like we're doing today, recording a talk [03:15.590 --> 03:21.570] over Zoom and presenting it, you know, not in the same way we would have in prior years. [03:21.570 --> 03:25.650] Now, the good news about being in security, at least according to all the stereotypes, [03:25.650 --> 03:33.090] is that we're pretty good at remote. You know, the typical stereotype of the remote hacker [03:33.090 --> 03:38.350] sitting in their basement with their headphones on or their hoodie up and, you know, I don't know [03:38.350 --> 03:45.730] if you can tell, but I'm wearing my hoodie today for recording this talk. You know, we have always [03:45.730 --> 03:51.410] done particularly well as an industry with having some amount of remote work. [03:51.410 --> 03:58.550] The problem with that is we weren't ever really remote. I don't know many people who have had [03:58.550 --> 04:06.670] their entire job cycle from first interview to hiring and onboarding to being in a company for [04:06.810 --> 04:13.230] a couple of years and never being in person. You know, every organization I've ever been at, [04:13.230 --> 04:18.130] if we were interviewing for even a remote role, we would often fly the person out for the final [04:18.130 --> 04:21.830] interview. We would often fly them out and have dinner and have a cocktail and get to know them [04:21.830 --> 04:27.550] face to face. And then when they onboarded, the same thing. When I started Scope Security, [04:27.550 --> 04:33.330] my company here in New York City, what I would do is every time I hired somebody, I would fly [04:33.330 --> 04:37.650] them to New York for three days. And we'd spend the first three days sitting in a room with a [04:37.650 --> 04:41.390] whiteboard, talking through everything in the company, talking through the technology, walking [04:41.390 --> 04:46.770] through the product and all of that stuff. And we would have lunches and we would have breakfasts [04:46.770 --> 04:51.570] and we would have dinners and we would have all this face to face interaction. Similarly, I don't [04:51.570 --> 04:56.630] know any sales team around this industry that doesn't have at least once a year, you fly all [04:56.630 --> 05:02.390] the salespeople and put them in a big room and have a sales kickoff. These are all things that [05:02.390 --> 05:08.670] have just evaporated in 2020. And let's be clear, with Google's recent announcement that they're [05:08.670 --> 05:13.890] going to keep all of their people remote until the middle of next year, I fully expect that [05:13.890 --> 05:18.750] many of us are going to go at least another year before we are face to face with a lot of our [05:18.750 --> 05:25.410] co-workers. And so even the roles that we've traditionally thought of as remote are far [05:25.410 --> 05:31.050] more remote than they used to be. And that's where I think the crux of a lot of the changes come [05:31.630 --> 05:39.510] from. Because we're missing a ton of our ability to form those social relationships. I mean, [05:39.510 --> 05:44.210] most of those social bonds are what get us through tough times. I'm going to talk about [05:44.210 --> 05:49.410] that a bunch during this presentation. Additionally, and if you spend as much time [05:49.410 --> 05:55.670] on Zoom and video conferencing as I do, you know that this is real. Zoom fatigue is a thing. [05:55.670 --> 06:01.110] Your mind and your cognitive resources are not designed to sit and stare at a blank screen [06:01.110 --> 06:07.450] that's not in three dimensions for eight or 10 hours a day. We are built to be social animals, [06:07.450 --> 06:14.650] but that socialness is in person, right? And many of us survive on that in-person, [06:14.650 --> 06:19.150] face-to-face interaction, especially the extroverts in the audience, [06:19.150 --> 06:24.870] for getting back the energy that we need to get through our days. [06:25.110 --> 06:33.330] Similarly, when you're in that informal or sort of... when you're in that remote context, [06:33.330 --> 06:39.190] the staring at a screen over Zoom, you miss out on a lot of information, right? And this is one [06:39.190 --> 06:42.930] of the things we'll talk about a lot in the interviewing section of this conversation. [06:42.950 --> 06:48.190] When you're doing an interview over Zoom, you miss a ton of influence cues that you would get [06:48.190 --> 06:54.690] if you were sitting face-to-face, right? Body language over video conference is effectively [06:54.690 --> 06:59.130] the talking head body language. It's not my full body language. You can't tell what I'm doing with [06:59.130 --> 07:04.370] my feet while I'm sitting here presenting to a screen with a microphone in front of my face. [07:04.430 --> 07:10.610] And you aren't really aware of how much information you get from that until it's gone. [07:10.930 --> 07:16.250] So let's talk about how I'm going to split up this talk. And I'm going to talk about three [07:16.250 --> 07:23.190] things that are really important and difficult in this time, right? The first one is bringing [07:23.190 --> 07:28.830] people aboard. You don't get to fly them out to the office and sit in front of them for a full [07:28.830 --> 07:33.010] day in a room with a whiteboard anymore. And because of that, we have to change our interviewing [07:33.010 --> 07:39.270] and hiring processes a lot. Similarly, when you're onboarding new employees, you also don't get to [07:39.270 --> 07:43.450] fly them to headquarters and have them sit in a room with you. So how do we change onboarding [07:43.450 --> 07:48.870] to accept this new remote reality? And then once people are aboard, how do you keep them mentally [07:48.870 --> 07:55.850] healthy? I know it's a common conversation, and I'm sure that there's going to be a bunch of other [07:55.850 --> 08:00.030] talks here at DEF CON about the mental health impact of locking ourselves in our houses like [08:00.030 --> 08:06.810] this and working all the time. But how do you create touch points in your culture and create [08:06.810 --> 08:13.070] structures by which you can keep your teams mentally sane? These are the three real phases [08:13.070 --> 08:20.150] of the employee life cycle that are changing so much right now that I want to dig into. So with [08:20.150 --> 08:24.570] that, we'll start with interviewing and hiring. We'll start with the onboarding process. And whether [08:24.570 --> 08:29.730] you're a job seeker who's going through this remote interview process or a hiring manager [08:29.730 --> 08:36.310] who's having to figure out how to modify their hiring process, this has been a really tough time. [08:36.310 --> 08:42.870] And it's funny, I was hiring a senior leader early on. Scope's obviously growing a bunch, [08:42.870 --> 08:47.030] and we're hiring a bunch of people. And I was talking to a recruiter friend of mine who [08:47.990 --> 08:57.150] is pretty thoughtful about these things. And I said to him, so do you have any advice for me? [08:57.550 --> 09:05.450] It's a big risk to hire a senior person who you've never met face to face. And his insight was, [09:05.450 --> 09:09.150] well, Mike, it's pretty simple. You either take the risk or you don't. [09:10.190 --> 09:15.650] That's not exactly what I was asking. What I was asking for was a way that we can modulate our [09:15.650 --> 09:23.670] process such that it becomes less risky. And so with that, I set out on the quest to figure out [09:23.670 --> 09:27.810] what we could start to do in our interview processes, knowing that as we're a growing [09:27.810 --> 09:32.810] company, we're probably going to hire 20 people this year, and we're never going to meet any of [09:32.810 --> 09:37.770] them face to face. So how do we do that in a way that we don't end up hiring the wrong people or [09:38.650 --> 09:44.150] breaking our particularly interesting culture? And especially, how do we make sure that we are [09:44.150 --> 09:48.490] getting the right people in the process and then evaluating them effectively so that we get them [09:48.490 --> 09:56.090] through to the onboarding process? So with that, one of the things that we really realize is that [09:56.090 --> 10:05.950] most of the things that you do in an interview process can have more or less rigor. [10:05.950 --> 10:11.690] You don't always have to be the most rigorous interviewer if you can create good bonds with [10:11.690 --> 10:17.730] the people in front of you. And I've seen a lot of hiring managers overcome bad interview processes [10:17.730 --> 10:23.730] and bad HR processes because they create such a strong interpersonal relationship with the [10:23.730 --> 10:28.750] candidate. And in the past, that was enough, right? I could overcome a lot of bad candidate [10:28.750 --> 10:35.590] experience within my interview processes by having really great interviews and creating those [10:35.590 --> 10:40.430] relationships, especially building in things like taking the candidate out to lunch and things that [10:40.430 --> 10:45.750] create that trust interpersonally. But unfortunately, that's all the stuff that's gone away. [10:45.750 --> 10:53.430] So what we realized is that rather than focus on our ability to create bonds with candidates, [10:53.430 --> 11:01.730] we had to actually add rigor to our process. Because what usually creates the trust between [11:01.730 --> 11:06.470] the candidate and the company that's trying to hire them is the interpersonal relationships with [11:06.470 --> 11:13.310] the people. Now you have to replace that by having a really great process. And so refocusing your [11:13.310 --> 11:19.690] interview process on making sure that you follow up with candidates in a timely fashion, that [11:19.690 --> 11:25.010] candidates are getting the right feedback and the right email and the right steps in the middle [11:25.010 --> 11:32.270] of the process, that you have standard questions across each of your sets of interviews so that [11:32.270 --> 11:41.530] the interviewers can focus what ability they have on creating the trust across this impoverished [11:41.530 --> 11:49.670] medium. We've had to go back and add rigor to our process. Now, the funny thing is, we're a [11:49.670 --> 11:55.990] nine-person startup. That's a hard thing to add rigor when you're a tiny company. It's one thing, [11:55.990 --> 12:03.990] you know, when I was at GE in my past, GE has lots of rigor, right? They have, you know, people [12:03.990 --> 12:08.770] to create rigor in the interview process where that's their job. Whereas at a small startup, [12:08.770 --> 12:12.430] you don't have that. So it's been it's been harder for us to do that. And I can't say that we [12:12.430 --> 12:17.610] necessarily do it that well. But we've been focusing on how do we add rigor to the process [12:17.610 --> 12:23.190] because we realize that we can't just rely on our ability to charm the candidate and to have [12:23.730 --> 12:30.830] really great interactions with them to create the bonds that we need and the excitement that [12:30.830 --> 12:36.010] they need about the company. Similarly, it's forced us to change our interview formats. You know, [12:36.010 --> 12:42.850] most companies I know have an interview process that involves some amount of remote interviewing, [12:42.850 --> 12:47.250] whether a phone screen or a phone screen and then a chat with the hiring manager. [12:47.530 --> 12:51.410] And then usually you bring the candidate in for one of these marathon, you know, [12:51.410 --> 12:58.630] four to six to eight hour back-to-back interview days, which is exhausting even when you're [12:58.630 --> 13:02.750] sitting in a room with a whiteboard with a bunch of people that come in and out. [13:02.750 --> 13:09.410] Over Zoom, it's not just exhausting. It's actually impossible. You know, by the eighth hour of an [13:09.410 --> 13:14.930] eight hour back-to-back Zoom day, the candidate's eyes are going to be so glazed over that they can [13:14.930 --> 13:20.330] barely form a sentence. And the last half of your interview process is not going to get the [13:20.330 --> 13:26.150] information that you want. So what we realized is we had to start breaking it up. Whereas, [13:26.150 --> 13:31.410] you know, you may have had a three-step interview process with the third step being a lot of [13:31.410 --> 13:37.850] different conversations. We've now added additional steps to that process. We're also [13:37.850 --> 13:44.530] experimenting with adding different media into the process. As an example, we know that we live [13:44.530 --> 13:50.490] on Slack. You know, other organizations live on Teams or Google Meet or, you know, Skype or whatever [13:50.490 --> 13:58.330] your preferred instant messenger is. We've started adding in attempts at interviews over those [13:58.330 --> 14:02.470] different mediums. Because if a person is going to join our team, they're going to spend a lot of [14:02.470 --> 14:07.850] time interacting with us on Slack. It would be terrible to find out that they don't know how [14:07.850 --> 14:13.130] to use Slack in their first week, you know. And we want to be able to replicate that experience. [14:13.130 --> 14:16.910] Now, you don't want to throw somebody out just because they don't know how to use Slack. I mean, [14:16.910 --> 14:23.330] obviously, there's a conversation there and a teaching opportunity. But you have to figure [14:23.330 --> 14:26.850] out how to replicate the real life you're going to be in. The real life you're going to be in is [14:26.850 --> 14:31.510] not in an office with a whiteboard for at least the next 12 months. So what is their life going to [14:31.510 --> 14:36.450] be for the next 12 months? Is it you're going to be drawing things in Lucidchart or Vizio online? [14:36.450 --> 14:40.750] Are you going to be collaborating on docs in Google Docs? How are you, you know, are you going to be [14:40.750 --> 14:45.730] pair programming? What are those things that are going to reflect that person's day-to-day life [14:45.730 --> 14:52.930] once they've joined your company? And in that time, how do we create effectively an interview [14:52.930 --> 14:57.370] process that replicates that so you can see what the candidate is going to be like in your [14:57.370 --> 15:04.110] environment? And I've sort of harped on this a little bit. And I've hit it pretty hard. But [15:04.110 --> 15:10.530] the idea of let's just get the candidate in front of a whiteboard and let's solve problems together [15:10.530 --> 15:16.350] started to become really hard. And we did... I specifically really love the whiteboard interview, [15:16.350 --> 15:22.670] right? I bring the candidate in. We will start working on a problem. I have five or six that [15:22.670 --> 15:27.690] I use depending on what the role is that I'm hiring. And let's solve the problem together. [15:27.690 --> 15:31.910] I get a sense of the person's interaction style. I get a sense of how they think, how they [15:31.910 --> 15:38.030] communicate, when they ask for help, whether they ask for help, all of those things. And all of that [15:38.030 --> 15:43.190] sort of evaporates when you can't do it remotely. I don't know if anybody's tried using the [15:43.190 --> 15:49.230] whiteboarding feature of Zoom, but I will tell you it is a poor, poor, poor replacement for a real [15:49.230 --> 15:55.390] whiteboard. And so what have we done to start focusing on how do you replace the whiteboard? [15:55.690 --> 16:01.490] We've started looking at online testing opportunities. I mentioned a second ago, [16:01.490 --> 16:08.830] real-time collaboration. If I was hiring a user interface person, maybe we co-design a screen of [16:08.830 --> 16:16.190] something in Figma. Figma is effectively like Google Docs for designers where we can basically... [16:16.190 --> 16:20.970] it's kind of like PowerPoint remotely, or not PowerPoint, sorry, Photoshop remotely, where you [16:20.970 --> 16:29.430] can basically co-comment on and co-design a UX. Maybe we work on a product spec within a Google [16:29.430 --> 16:37.330] Drive or the like. Or like I said, use Lucidchart or Visio to create an architecture and comment on [16:37.330 --> 16:42.350] it. Things that allow us to do real-time collaboration in the same way we do in a daily [16:42.350 --> 16:50.070] meeting. You know, our architecture meetings often end up with somebody sharing their screen [16:50.070 --> 16:53.970] and Lucidchart up on the screen and people drawing things and dragging them around. [16:54.450 --> 17:01.390] It's reflective of the real role that they will do, but it's also a good way [17:01.390 --> 17:08.650] to replace that whiteboard interview. Similarly, and this is the one that we've found the most [17:08.650 --> 17:13.710] valuable over the last six months, is we've added in audition interviews for pretty much [17:13.710 --> 17:20.430] everything. Basically, an audition interview, from my perspective, is you give the candidate [17:21.030 --> 17:25.110] a bit of a take-home assignment, something they can do in an hour or two. It doesn't have to be [17:25.330 --> 17:30.530] a huge thing. And then they have to come present. And they have to present their thoughts. So, [17:30.530 --> 17:35.490] whether that is a threat hunter who you say, you give them a threat actor, you know, [17:35.490 --> 17:41.930] here's APT29. Come tell us everything you learned about APT29 in a couple of hours. [17:41.970 --> 17:47.530] Or here's a piece of code. Tell us about it. Or write this piece of code. Or, you know, spin up [17:47.530 --> 17:52.510] this service. And then come tell us what you did. So that you get a good understanding of their [17:52.510 --> 17:56.790] communication style. You get a good understanding of their ability to do work. And you get a good [17:56.790 --> 18:02.750] understanding of how they're going to interact with you once they're here. And obviously, [18:02.750 --> 18:07.110] those auditions balance differently depending on who it is. If it's a sales role, [18:07.110 --> 18:12.410] that presentation is the most important thing. If it's a technical role, often the technology and [18:12.410 --> 18:16.110] the skills that they're showing is the most important thing. But they still have to be [18:16.110 --> 18:22.310] able to present their skills, right? So, across all of these, whether we're adding [18:22.310 --> 18:27.470] in initial assessments, whether we're doing collaborative interviewing over collaborative [18:27.470 --> 18:34.310] platforms, or we're doing an audition, we've added in all these steps to try and get a sense [18:34.310 --> 18:40.280] of how the person will work in the real world the way that we used to with a whiteboard interview. [18:41.030 --> 18:48.170] So, let me take a detour for a second. Because 2020 has really put a focus on diversity in a way [18:48.170 --> 18:56.920] that we haven't seen in prior years. And it's something that has been a focus of mine for a [18:56.920 --> 19:03.780] of years, though I very rarely talk about it. A big part of that is, I don't have a whole lot [19:03.780 --> 19:09.000] of experience in my own personal history that lends me to be an expert on diversity by any [19:09.000 --> 19:19.040] stretch, right? I grew up in small-town Ontario, and grew up in Canada, and I'm pretty white here. [19:19.140 --> 19:25.220] So, I'm not really the person to talk about this. But I will say, I've learned a lot about it. [19:25.220 --> 19:30.620] And I have a couple of counterintuitive points that I think I wanted to put on into this talk, [19:30.620 --> 19:35.320] because it's important to think about. Even if you're not somebody who really reflects diversity, [19:35.320 --> 19:40.340] it's incumbent on all of us to get out there and make the change we want to see in the world. [19:40.340 --> 19:44.960] And what I realized when I really started studying diversity is, a lot of the advice [19:44.960 --> 19:50.600] for when you look at diversity and inclusion programs, and when you get into the HR material, [19:51.320 --> 19:56.620] a lot of it is about showing how you're doing diversity for large companies, right? Publish [19:56.620 --> 20:00.880] your metrics, and have diversity committees internally, and do all of these things that [20:00.880 --> 20:07.460] happen at large companies. I was an executive sponsor of the diversity committee when I was [20:07.460 --> 20:12.760] at Lookout. I've done the big company diversity thing. But how do you hire a diverse team when [20:12.760 --> 20:18.640] you're six people? Because a lot of those things that you read about in the HR manuals don't really [20:18.640 --> 20:25.160] apply very effectively when your whole team fits in one Zoom window. [20:25.460 --> 20:32.420] And so, we've had to realize that the diversity effort for us is less a strategy. It's less a [20:32.420 --> 20:40.540] strategic conversation about how we structure the company's program, as it is a tactical activity of [20:40.540 --> 20:44.900] how do I get the right people to apply, and how do we make sure we hire the right people? And so, [20:44.900 --> 20:49.380] there are a few things that I really wanted to emphasize around that. And by the way, [20:49.380 --> 20:55.040] I feel free to hit me up in the Q&A, and to email me, and send me notes on Twitter, [20:55.040 --> 20:59.580] and tell me all the things that I'm not doing right here, and that I'm getting wrong. Because, [20:59.580 --> 21:03.980] like I said, I'm very committed to this, but I'm sure that I'm making mistakes. [21:03.980 --> 21:09.740] But the three things that we have learned really quickly as a small company is one of the very [21:09.740 --> 21:14.440] first things you can do to increase diversity is to focus on the language, and the job ads, [21:14.440 --> 21:22.640] and the job descriptions, and your website. It is really amazing across security, [21:22.640 --> 21:29.820] and across the job descriptions in our industry, how many of those have language that is very [21:29.820 --> 21:37.660] exclusive. And I mean, it excludes people. How many of them, you know, focus on a very [21:37.660 --> 21:44.080] particular sort of standard narrative that doesn't include other cultures, [21:44.080 --> 21:50.720] that doesn't include other life experiences, other genders, etc. And so, you can do a lot [21:50.720 --> 21:55.380] just by looking at all of your job descriptions, and all of your website, and asking yourself, [21:55.380 --> 22:00.000] would somebody who's not like me want this job? And I think that that's something that [22:00.000 --> 22:06.380] very few of us as hiring managers were taught to do when we were writing the job description. [22:06.380 --> 22:13.460] Second, the farther to the front of your interview process you can put questions about [22:13.460 --> 22:18.400] diversity, the more you are going to signal to candidates that it matters. If you go through [22:18.400 --> 22:22.660] your whole interview process and never ask a manager candidate what they've done to increase [22:22.660 --> 22:27.280] diversity in their previous organizations, they're going to get hired never thinking about whether [22:27.280 --> 22:32.440] or not they're going to build a diverse team in your organization. So, the closer you can get that [22:32.440 --> 22:37.820] to the front of your interview process, and I'll talk more about this in a second, the more you're [22:37.820 --> 22:41.940] going to signal to the candidates that, A, this is important enough for you to talk about right up [22:41.940 --> 22:48.060] front, but it's also going to allow you to select people who have answers around building diverse [22:48.060 --> 22:54.700] organizations that match the culture that you want to build. And finally, look at your pipeline. [22:54.840 --> 23:00.280] And I'll talk about this more in a second, but one of the most eye-opening things that you can do [23:00.280 --> 23:07.200] is if you have a candidate tracking system that's tracking the interview pipeline that you have, [23:07.200 --> 23:16.300] look at it and look at each stage. If 90% of the people that get in-person interviews, or 95%, [23:16.300 --> 23:22.820] I've been in places where 100% of the people who get in-person interviews are white dudes, [23:22.820 --> 23:26.160] well, guess what your team's going to end up as? It's going to end up as a bunch of white dudes. [23:26.160 --> 23:31.560] If your pipeline is 90% diverse candidates, you're going to end up with a diverse team, [23:31.560 --> 23:36.680] whether you like it or not. Who ends up in your interview process is who you end up hiring, [23:36.680 --> 23:41.820] period, full stop. And so if the beginning of your pipeline does not look diverse, [23:41.820 --> 23:48.120] the end's really not going to. So with that, I have two pieces of more tactical advice. [23:48.120 --> 23:52.500] One is my absolute favorite new question. This question is the question that has moved to the [23:52.500 --> 23:57.660] front of our interview process. And if I could actually put this on LinkedIn and make it a [23:57.660 --> 24:03.200] qualifying question, I would. I don't claim credit for this. I was talking to the folks [24:03.200 --> 24:09.360] over at Gapjumpers. Talk about a really neat organization. Gapjumpers is a group of folks [24:09.360 --> 24:14.180] that are doing some really interesting work around diversity, and specifically diversity [24:14.180 --> 24:19.260] in the hiring process. And one of their founders gave me this one. What actions have you taken, [24:19.260 --> 24:23.860] or wish you had taken, to advocate for and support diverse and inclusive cultures and [24:23.860 --> 24:28.680] teams in your previous roles? And by asking that question up front... and by the way, [24:29.200 --> 24:33.720] the answer is not always going to be a great one. And especially if you're asking this of [24:33.840 --> 24:39.320] a junior engineer, they might not have a good answer. But do they have things they wish they [24:39.320 --> 24:43.400] could do? Do they have things that they wanted to do? Do they have things they've seen done well? [24:43.400 --> 24:47.160] This starts a conversation that helps you to understand who the people you're interviewing [24:47.160 --> 24:55.060] are around this. And it really helps you to identify people who are going to support the [24:55.060 --> 25:00.640] culture you're building, but also that are going to be allies for you as you grow. And so we've [25:00.640 --> 25:05.060] started asking this very, very close to the front of our interview questions... our interview [25:05.060 --> 25:11.380] questions and panels. Like I said, if I could, I would put it in the qualifying questions to even [25:11.380 --> 25:17.760] apply right next to, right next to, are you authorized to work in this country? This would [25:17.760 --> 25:23.300] be a question I would ask right up front. Because by asking this, we are signaling like, hey, [25:23.300 --> 25:27.740] by the way, when you get here, you're going to be expected to do this. [25:29.060 --> 25:33.980] And so I don't know if you realize that all of these things that I've just put forward [25:34.680 --> 25:42.320] are ultimately the same thing. I've actually created all of these ideas around a single idea. [25:42.320 --> 25:49.300] And it comes from Richard Thaler's work around default choice. I was talking to a friend of [25:49.300 --> 25:58.640] mine who runs HR at a Bay Area startup. And she said, my fundamental job is to make it so that [25:58.640 --> 26:05.960] right now, the default choice for most of our engineering managers is to hire a white male. [26:06.020 --> 26:12.560] My job is to make the default choice to hire not that. Because we know that it's, you know, [26:12.560 --> 26:18.240] if I, if I pull a candidate, if I pull a pool of 100 engineers in the Bay Area, there's going to [26:18.240 --> 26:26.300] be a lot of white males in that, in that random sample. If I can force us away from the default [26:26.300 --> 26:31.380] choice that is currently the default choice, and create a new default choice to create a new [26:32.860 --> 26:38.900] way of operating, then we're going to get the decisions we want. Similarly to the way that [26:38.900 --> 26:47.600] with Thaler's work around 401ks, that if people if, if the default choice is not to enroll in a [26:47.600 --> 26:52.780] 401k, something like 65% of people don't enroll in a 401k. If you make the default choice that [26:52.780 --> 26:58.140] they're defaulted to a 401k, and they have to enroll in a 401k, or they can opt out, something [26:58.140 --> 27:03.620] like 65% of the people enroll in a 401k. By setting the default choice, which is what all of these [27:03.620 --> 27:09.320] functions that I've that I've just talked about are doing, they are creating a situation where [27:09.320 --> 27:14.240] diversity is the default choice, we're able to actually modify the behavior of people in our [27:14.240 --> 27:19.220] organizations. And I think if we thought about how do we modify the default choice more effectively, [27:19.220 --> 27:26.660] we would end up with a better outcome in much in many of our cases. So with that, [27:26.660 --> 27:31.900] now we've hired a bunch of people, right? We've we've made offer letters, they've quit their jobs, [27:31.900 --> 27:38.520] they're about to start. And this is the point where I'd be normally buying plane tickets and [27:38.520 --> 27:43.500] having people come show up and I'd be giving them their laptop face to face on the first day. [27:44.160 --> 27:50.320] Unfortunately, that's not exactly the world we live in anymore. We don't, you know, no longer [27:50.320 --> 27:56.340] do we get to do the fly the person here, sit them in a room for five days and indoctrinate them [27:57.080 --> 28:03.080] for for 40 hours and have cocktails with them after that and take them out to dinner every night. [28:04.460 --> 28:09.500] That doesn't get to be how we do this anymore, because we're not able to do it in person. [28:10.440 --> 28:18.560] And because of the challenge of Zoom fatigue, and the challenge of basically sitting someone in [28:18.560 --> 28:24.560] front of a video conference for eight hours at a time, we have to realize that onboarding has [28:24.560 --> 28:32.060] to change. Onboarding can no longer be a monolithic entity where you start talking at nine o'clock on [28:32.060 --> 28:37.220] Monday and you stop talking at five o'clock on Monday and the person has set up their benefits [28:37.220 --> 28:44.780] and their laptop and all of that. Because of this new world, we have to we have to realize [28:44.780 --> 28:49.160] that you have to break it up. Right? That means you have to change formats, you have to have [28:49.160 --> 28:53.900] multiple media, some things can be in documents, some things can be email, some things can be over [28:53.900 --> 29:01.580] Slack, some, you know, Zoom is still important, you still will use Zoom. But often we can we can [29:01.580 --> 29:09.700] do things like videos, or one-on-one mentorship, or, you know, breakout rooms, or just go read [29:09.700 --> 29:17.400] this book even to replace that monolithic put a person in a room situation. And I mean, otherwise, [29:17.400 --> 29:22.360] you're just going to end up with exhausted people who haven't learned anything. Ditto, logistics [29:22.360 --> 29:28.060] start to get hard for onboarding. I mean, one of the things that we we've realized, and I have [29:28.060 --> 29:34.340] people in the US and I have people in Canada, it was really easy when I flew them here to New York [29:34.340 --> 29:39.320] to hand them all a laptop that we had, you know, bought from the store in advance and preconfigured. [29:39.380 --> 29:45.380] Now I have to figure out how to get those laptops configured and to their house. Right? Simple, [29:45.380 --> 29:49.900] something that should be simple logistically starts to become difficult. How about how do [29:49.900 --> 29:54.080] you buy lunch for everybody on their first day? You know, do I get their home address and have [29:54.080 --> 29:59.520] somebody send them Postmates? You know, how do we how do we even do something that simple? Right? [29:59.520 --> 30:06.360] How do you have happy hour on on their first day? Like, how do you socially onboard these people? [30:06.360 --> 30:11.660] These are all things we've never really had to worry about, right? The default action has always [30:11.660 --> 30:16.300] been, oh, I will just fly them here, we'll stick them in a room and we're all good. The default [30:16.300 --> 30:20.960] has changed. And so now we have to be thoughtful about not just the logistical part of the [30:22.060 --> 30:26.980] onboarding, right? Not just how do I teach them where Jira is? And how do I make sure that their [30:26.980 --> 30:32.300] laptop connects to VPN? But also, how do we socially integrate them into the team? Right? [30:32.300 --> 30:38.960] A big part of that onboarding process at most companies is when you put all those people in a [30:38.960 --> 30:46.600] room, you create an immediate social group. I still have relationships with people I onboarded [30:46.600 --> 30:50.940] at Lookout and people I onboarded with at GE, even though they weren't on my team. [30:51.260 --> 30:58.360] Right? We have traditionally used that onboarding process because, you know, as the meeting breaks [30:58.360 --> 31:03.300] up and people go to the go get coffee in the kitchen, they start a natural conversation. [31:03.340 --> 31:08.600] These are things that don't happen over Zoom. So as part of the onboarding of your employees, [31:08.600 --> 31:15.300] you have to sit and think about what do I do to socially integrate them normally? Right? [31:15.300 --> 31:21.140] Do we take them out to lunch? Do we do happy hours? Do we play games? What is the thing that [31:21.140 --> 31:27.280] we normally do to socially onboard people? And then how can I create that same thing, [31:27.280 --> 31:33.900] knowing that the mediums that we have don't enable that? So, for example, I'm a big fan of happy [31:33.900 --> 31:39.520] hours. I love taking, you know, taking the team out to happy hour. The best part about it is [31:39.520 --> 31:45.820] you can have big group conversations, but you also end up with a lot of one-on-one conversations. [31:46.340 --> 31:52.000] The problem with Zoom, for example, and frankly, any of them, I use Zoom as shorthand, [31:52.000 --> 31:56.140] right? It could be Teams. It could be Google Meet. It could be Hangouts. It could be anything. [31:56.140 --> 32:02.920] But the problem with it is what you have in a video conference interaction is very different [32:02.920 --> 32:07.380] than what you have in an in-person organization. Because even if you have like a suppose you have [32:07.380 --> 32:12.480] lunch meeting. We have 10 people on Zoom. We all have lunch. If we had those 10 people around the [32:12.480 --> 32:17.400] table, we would talk as a large group for a while. Somebody would present. Somebody would talk. [32:17.900 --> 32:22.460] And then you'd see all of these splinter conversations that would happen. And those [32:22.460 --> 32:26.460] splinter conversations are often where the most important relationships are formed. You know, [32:26.460 --> 32:30.240] we're sitting around the table and I start having a small side conversation with the person next to [32:30.240 --> 32:34.500] me or the person right across from me. And the people next to me are doing the same thing. [32:34.500 --> 32:41.540] Those conversations can't happen over video conference. And nobody has yet created the Zoom [32:42.100 --> 32:47.220] equivalent that allows me to be sitting in a large group meeting and have a side conversation [32:47.220 --> 32:52.460] with some other person on Zoom without effectively talking over the speaker of the meeting. [32:52.800 --> 32:58.580] And so you have to be really thoughtful about how do we create those things. You know, [32:58.580 --> 33:04.360] if we normally do happy hour, it's great that we do remote happy or like a Zoom happy hour, [33:04.360 --> 33:08.780] but how do we create the opportunity for all those people to have side conversations? [33:09.040 --> 33:14.180] And so in, you know, one of the things that I've been forcing people to do is have a ton more [33:14.180 --> 33:19.260] one-on-ones, especially with new people. You know, have one-on-ones with your new staff, you know, [33:19.260 --> 33:24.900] every day for the first month. That's actually something I've been doing is as I've been [33:24.900 --> 33:29.140] bringing some people aboard on my staff, I'm literally the first 30 days I meet with them [33:29.140 --> 33:37.040] every day for 30 minutes. That's a lot of time, but it replicates a lot of the conversations we [33:37.040 --> 33:42.340] would have had naturally as a side conversation in a meeting that we don't get to have anymore. [33:42.340 --> 33:47.420] And similarly, you have to be able to do that with your team. You have to be able to think about [33:47.420 --> 33:53.220] what are those social interactions? What do they look like when they're done well? And how do I [33:53.220 --> 33:58.060] hold my organization accountable for doing that with the new person when they come aboard? [33:58.140 --> 34:04.060] And by the way, this feels forced. This feels really uncomfortable to basically force everyone [34:04.060 --> 34:10.080] to have, you know, five one-on-ones a week with people where they normally wouldn't have. But [34:10.080 --> 34:15.600] you're replacing the informal hallway conversation. You're replacing their ability to just sort of [34:15.600 --> 34:21.080] stand up in their cube and ask over the cube wall. You're trying to create a situation where [34:21.080 --> 34:26.800] we replace those social interactions that happen organically within the office with an actual [34:26.800 --> 34:35.360] forced interaction. I too know it feels forced and not organic, but it's kind of what we got, [34:35.360 --> 34:42.900] right? We don't have the ability to do the things we've always done. And similarly, and so you sort [34:42.900 --> 34:47.320] of get the transition, right? We're doing those things to onboard people, but a lot of those same [34:47.320 --> 34:52.260] activities go into maintaining the health of the team and the health of the culture, [34:52.260 --> 34:58.940] because you don't anymore have the random sitting down next to each other at lunch opportunity that [34:58.940 --> 35:04.360] we used to have. You know, one of my favorite things when I've been in previous jobs is just [35:04.360 --> 35:10.080] to walk into the kitchen with food and see who's sitting at what table and go sit at whatever table [35:10.080 --> 35:16.060] and have whatever conversation I have that day with whoever's talking, right? And I'm an introvert, [35:16.060 --> 35:20.980] by the way, but that's how you create really strong relationships within an organization. [35:21.060 --> 35:27.600] Well, how do we do that same thing in this world? And I think there's a couple of things that we [35:27.600 --> 35:33.840] have to be very cognizant of. First off, and you know, it's the old, this meeting could have been [35:33.840 --> 35:42.460] an email idea. We have to be really ruthless about information format and information delivery. [35:42.920 --> 35:49.100] If I know that I'm in an office and I have basically unlimited face-to-face time without [35:49.100 --> 35:53.180] exhaustion, which as an introvert, I don't, I only have a certain amount of time I can be [35:53.180 --> 36:00.240] face-to-face before I have to put on headphones and not talk to anybody. But in general, even [36:00.740 --> 36:06.680] me as an introvert, when I'm in a room full of people, I can be pretty, you know, I can be pretty [36:06.680 --> 36:11.060] good and know I can have as many conversations as I want and I'm not going to be exhausted. [36:11.060 --> 36:15.900] In this new world, the hours we spend on video conference are a finite resource. [36:16.040 --> 36:22.540] So, if I schedule a whole ton of meetings that could have easily been an email or a Slack, [36:22.540 --> 36:28.800] suddenly I'm eating up time that I could have used for a more important face-to-face meeting [36:28.800 --> 36:35.140] with those meetings. So, in order to keep our culture strong and in order to keep our ability [36:35.140 --> 36:39.940] to have those social conversations and to have those in-person conversations when they're needed, [36:39.940 --> 36:47.960] we have to start being ruthless about saving our time face-to-face for the things that matter [36:47.960 --> 36:52.140] and finding a way not to do that. So, I've been doing a ton more with Google Docs. I've been [36:52.140 --> 36:56.860] doing... I've even been writing long emails again, where I've gotten away traditionally from writing [36:56.860 --> 37:05.040] long emails to my team. That was a very 2008 sort of strategy. I've started doing more longer emails, [37:05.040 --> 37:14.300] documents, a ton more on Slack, because I realized that I have to save up the Zoom face-to-faces [37:14.300 --> 37:21.420] for things that require that. And especially, especially for the social connection. [37:21.780 --> 37:27.180] Now, if you read the story, you know, there have been studies over the years about the amount of [37:27.180 --> 37:35.020] time people spend at work not working. And they're always presented in the traditional, [37:35.760 --> 37:40.920] they're presented as people wasting time. I've never believed that the time at work [37:40.920 --> 37:46.280] not working is people wasting time. Because fundamentally, the social bonds that you create [37:46.280 --> 37:51.280] on your teams, they're not as important... they're not important in good times. Don't get me wrong. [37:51.280 --> 37:56.520] I love being friends with all my team. I love loving the people I work with is really important. [37:56.520 --> 38:01.760] I spend a ton of time with the people I work with. But what the social bonds that you create [38:01.760 --> 38:07.080] in good times actually do for you that is most important is when things break down, [38:07.080 --> 38:11.320] when stress is happening, when you're in the middle of incident response, [38:11.320 --> 38:19.240] when your whole product goes down and nobody can figure out why, when a customer calls you [38:19.240 --> 38:24.260] and is unhappy and you have to figure out a solution right then, those are the times when [38:24.260 --> 38:29.840] you don't have time to build goodwill in that. And everyone's at a high stress level. Everyone's [38:29.840 --> 38:34.520] on edge. Those are the times that your social bonds and the social cohesiveness of your [38:34.520 --> 38:39.200] organization save you from the little misunderstandings. And so the time that you [38:39.200 --> 38:46.640] spend building social bonds in non-work interaction, conversations as you walk down the hall, [38:46.640 --> 38:52.480] conversations in the kitchen, you know, let's go get coffee next door. All of those little things [38:52.480 --> 39:01.040] put in the bank goodwill and trust and ultimately psychological safety that saves you when things [39:01.040 --> 39:06.940] go wrong. And this is exactly what we're missing right now. This is exactly what we're failing to [39:06.940 --> 39:14.860] get. When work becomes effectively transactional because our Zooms don't allow us to have those [39:14.860 --> 39:23.000] social times, we've basically set up a situation where it doesn't affect us on the normal days. [39:23.000 --> 39:28.340] It doesn't affect us badly that we barely know our coworkers when everything's fine, [39:28.340 --> 39:34.780] right? On every iteration sprint planning, everything's great. But when things go wrong [39:34.780 --> 39:40.560] and people haven't built that trust, that's when things break down. And so in this new time, [39:40.560 --> 39:46.360] as leaders, but also each person, we need to think about how do we create that non-work [39:46.360 --> 39:51.120] interaction for our teams and replicate it intentionally. And it goes back to what I was [39:51.120 --> 39:55.540] saying about onboarding. You should be thinking, if you're, you know, if you have a team of people, [39:55.540 --> 39:59.700] you should be thinking for each of those people, what social relationships are going to matter [39:59.700 --> 40:03.960] most when things hit the fan, right? Could, you know, if it's a team of developers, could be [40:03.960 --> 40:08.600] another developer, could be a QA person, could be a member of the customer support team. [40:08.600 --> 40:13.820] And then you have to sit down with that person and force them to create opportunities to create [40:13.820 --> 40:18.460] those social bonds. And, you know, one of the easiest way to do that is just to force them to [40:18.460 --> 40:23.840] have 30 minute one-on-ones with that person every week or every two weeks or every month. And yes, [40:23.840 --> 40:29.420] it is, it is forced. It is not organic. It is going to feel weird and uncomfortable. [40:29.720 --> 40:33.220] And it's especially going to feel weird and uncomfortable for you because you should be [40:33.220 --> 40:40.360] doing it for yourself too. What other people in your organization are important for you to be [40:40.360 --> 40:44.860] having those social bonds with when things go wrong? Who are you going to need to rely on? [40:44.960 --> 40:51.280] And so who are you going to need to build trust with in advance? And so we need to start forcing [40:51.280 --> 40:55.380] ourselves to put ourselves in the situation to have those conversations. Have a one-on-one with [40:55.380 --> 41:00.580] that person, you know, say it's your QA person. Put a one-on-one on the calendar and just talk [41:00.580 --> 41:05.280] about your families. Talk about what happened that weekend and talk about, you know, whatever [41:05.280 --> 41:10.580] you would talk about if you went to get coffee and you were sitting in the office. Because it's not [41:10.580 --> 41:16.580] wasting time. It's your ability to put those things in the bank that will save you when things [41:16.580 --> 41:21.820] go wrong. And it's not about Zoom happy hours or game nights. Don't get me wrong. I love those. [41:21.820 --> 41:27.520] But it's about creating those bonds of trust with those people that you're going to need later on. [41:27.520 --> 41:34.700] So, in conclusion, and just, you know, sort of putting a bow on it, the fatigue that we're all [41:34.700 --> 41:40.960] feeling from isolation and from social change and from COVID and from everything are real. [41:41.380 --> 41:46.220] And yet we don't get to kind of put it back in the bottle. The world's not going back to the way [41:46.220 --> 41:51.800] it was any time soon. You know, there may be pieces and pockets and parts, but as a whole, [41:51.800 --> 41:56.620] we're going to live remotely for a while. We're going to learn to have remote teams for a while. [41:56.620 --> 42:01.260] We believe some people, we're going to have remote teams forever. Right? And so, it's going [42:01.260 --> 42:06.200] to change how we hire. It's going to change how we onboard people and make them part of our team. [42:06.200 --> 42:10.760] And it's going to change how we keep them part of our team. And the sooner we start adapting to that [42:10.760 --> 42:14.860] and the sooner we start creating these new habits, the less they're going to feel weird, [42:14.860 --> 42:18.560] the less they're going to feel forced, and the sooner we're going to be able to create [42:19.160 --> 42:25.580] an opportunity to build a great culture in this world. And so, we have to be intentional. We have [42:25.580 --> 42:30.900] to be intentional about creating the quality of information, especially in the interview process. [42:30.980 --> 42:35.820] Right? If you know that you're only going to get from here up on somebody, you got to find a way [42:35.820 --> 42:40.140] to get more information about them that you would normally get from their body language through [42:40.140 --> 42:44.720] other means, through either additional questions, additional time, additional interactions, [42:44.720 --> 42:51.340] however you want to do it. Similarly, we have to replace the ability to interact [42:53.060 --> 42:58.220] in ways that deliver information. Right? We used to onboard by just sticking people in a room. [42:58.220 --> 43:02.900] Now we have to go multimedia. Now we have to come up with multiple channels and do a whole [43:02.900 --> 43:07.320] bunch of different things. And finally, we have to figure out how to be intentional about creating [43:07.320 --> 43:12.760] the social bonds that hold our team together. Right? I talked a lot at B-Sides last year about [43:12.760 --> 43:17.960] how to build great cultures. This is culture building. Right? How do you build a culture [43:17.960 --> 43:22.360] in this new time is something we're all going to have to figure out together. And I hope that [43:23.100 --> 43:28.120] next year and the year after at B-Sides, DEF CON, Black Hat, et cetera, there's a lot of people [43:28.120 --> 43:34.420] that have better ideas than me. Because I'm obviously talking about this as I'm figuring [43:34.420 --> 43:38.360] it out. Right? We're building the race car as we're driving the race. And I hope that a lot [43:38.360 --> 43:42.840] of other people who come up with a lot of better ideas that I can learn from as well. [43:42.840 --> 43:51.560] With that, thank you so much. I hope we're having good Q&A. And feel free to email me, [43:51.560 --> 43:56.180] hit me on Twitter, hit me on LinkedIn, however you want to find me. I'm around. This is stuff [43:56.180 --> 44:01.420] I love to talk about. So, find me and let's chat about this. Let's chat about medical cybersecurity [44:01.420 --> 44:06.780] because I love to talk about that, too. Obviously, the scope logo on the CT scanner there. [44:07.220 --> 44:11.360] But yeah. Anybody wants to hit me up, please feel free. [44:12.080 --> 44:19.380] Mike, thank you. As always, love hearing your perspective and how you inspire people to [44:19.380 --> 44:25.660] be better leaders, be better managers, and overall be better people. And it was so great when you [44:25.660 --> 44:31.940] announced last year at B-Sides Las Vegas the beginning of scope security. So, that was [44:31.940 --> 44:37.100] fabulous. Thank you for that. And I know we're having some really great conversations going on [44:37.100 --> 44:42.880] in the Q&A. Please do follow up with Mike. Definitely interested in always hearing people's [44:42.880 --> 44:48.380] perspective and having a great dialogue. Remember that we have career coaching and resume review [44:48.380 --> 44:54.600] going on. And look forward to seeing everyone at our next presentation. Thanks so much.