WEBVTT 00:07.810 --> 00:12.650 So, welcome back to the Career Hacking Village here at DEF CON Safe Mode. 00:12.650 --> 00:28.230 We know lots of people are at different stages of their career, and what we wanted to do is make sure that those of you who are midway in your career, maybe later in your career, and you're really starting to get to that point where you need to start building your teams, 00:28.230 --> 00:40.770 really taking on a leadership role, and how do you do all of this while we're in the pandemic and while we are trying to figure out how to create teams in a remote environment. 00:41.070 --> 00:49.830 So, I've asked my dear friend, Mike Murray, to come back and really share some of his insights on leadership and building teams in the new normal. 00:49.930 --> 00:51.170 Mike, take it away. 00:51.510 --> 00:52.610 Thanks, Kathleen. 00:52.610 --> 00:53.970 Really excited to be here. 00:53.970 --> 00:56.450 Always great to be back on stage at DEF CON. 00:57.030 --> 01:14.230 Even in this weird year when we finally have achieved DEF CON being cancelled, and none of us get to be in the crazy heat of Las Vegas, whether we're at the Rio or the RIV, or even back to the Alexis Park. 01:14.230 --> 01:19.610 So, this is yet another format for DEF CON, and I'm pretty excited to be part of it. 01:19.870 --> 01:23.670 And I think this has been a really interesting year for all of us. 01:23.670 --> 01:29.290 I mean, 2020 just gets more strange as time goes on, and we've still got a third of the year left to go. 01:29.290 --> 01:31.450 So, lots left. 01:31.450 --> 01:36.330 And I don't know about you guys, but I am, at this point, particularly tired. 01:37.690 --> 01:57.410 Across the board, whether it's Zoom fatigue, whether it's fatigue from being locked in our house, fatigue from having our parents and pets and kids and everybody around all the time that you can never get away from, or just fatigue from being unable to socialize with your friends. 01:57.410 --> 02:08.390 I mean, I don't know about all of you, but I certainly wish we were in Las Vegas sharing a cocktail, and able to walk around and able to hug with abandon like we always have. 02:08.390 --> 02:14.470 But this is a new year, and regardless of how tired we are, things are different. 02:14.470 --> 02:36.910 And as Kathleen said, this is a talk, A, for the people who are building teams, but I also want people out there, especially if you're thinking about joining a team, I hope to present some of the things that I see as where we're going, and the way that we're going to have to build our organizations and treat our people as we go forward. 02:36.910 --> 02:44.470 But this should also reflect on when you're searching for a job, do the people that you're interviewing with do some of these things? 02:44.470 --> 02:46.030 And are they doing them well? 02:46.230 --> 03:09.430 And is it a place that is forward-thinking enough that you'd really want to join to be part of this culture of remoteness, to focus on cultures that have diverse and inclusive workforces, and that have figured out how to go from this world where a large part of our interaction style was in person, 03:09.430 --> 03:21.570 to a world where a large part of our interaction style is like we're doing today, recording a talk over Zoom and presenting it, you know, not in the same way we would have in prior years. 03:21.570 --> 03:27.590 Now, the good news about being in security, at least according to all the stereotypes, is that we're pretty good at remote. 03:27.630 --> 03:42.330 You know, the typical stereotype of the remote hacker sitting in their basement with their headphones on or their hoodie up and, you know, I don't know if you can tell, but I'm wearing my hoodie today for recording this talk. 03:43.750 --> 03:51.410 You know, we have always done particularly well as an industry with having some amount of remote work. 03:51.410 --> 03:54.730 The problem with that is we weren't ever really remote. 03:54.730 --> 04:10.210 I don't know many people who have had their entire job cycle from first interview to hiring and onboarding to being in a company for a couple of years and never being in person. 04:10.630 --> 04:18.630 You know, every organization I've ever been at, if we were interviewing for even a remote role, we would often fly the person out for the final interview. 04:18.630 --> 04:22.870 We would often fly them out and have dinner and have a cocktail and get to know them face to face. 04:22.870 --> 04:25.130 And then when they onboarded, the same thing. 04:25.130 --> 04:34.490 When I started Scope Security, my company here in New York City, what I would do is every time I hired somebody, I would fly them to New York for three days. 04:34.490 --> 04:43.970 And we'd spend the first three days sitting in a room with a whiteboard , talking through everything in the company, talking through the technology, walking through the product and all of that stuff. 04:44.030 --> 04:50.470 And we would have lunches and we would have breakfasts and we would have dinners and we would have all this face to face interaction. 04:50.710 --> 04:59.930 Similarly, I don't know any sales team around this industry that doesn't have at least once a year, you fly all the salespeople and put them in a big room and have a sales kickoff. 05:00.250 --> 05:04.610 These are all things that have just evaporated in 2020. 05:04.730 --> 05:19.810 And let's be clear, with Google's recent announcement that they're going to keep all of their people remote until the middle of next year, I fully expect that many of us are going to go at least another year before we are face to face with a lot of our co-workers. 05:20.010 --> 05:27.550 And so even the roles that we've traditionally thought of as remote are far more remote than they used to be. 05:27.710 --> 05:32.270 And that's where I think the crux of a lot of the changes come from. 05:32.270 --> 05:39.250 Because we're missing a ton of our ability to form those social relationships. 05:39.250 --> 05:43.570 I mean, most of those social bonds are what get us through tough times. 05:43.570 --> 05:46.230 I'm going to talk about that a bunch during this presentation. 05:46.350 --> 05:53.810 Additionally, and if you spend as much time on Zoom and video conferencing as I do, you know that this is real. 05:53.810 --> 05:55.670 Zoom fatigue is a thing. 05:55.670 --> 06:04.930 Your mind and your cognitive resources are not designed to sit and stare at a blank screen that's not in three dimensions for eight or 10 hours a day. 06:05.250 --> 06:10.030 We are built to be social animals, but that socialness is in person, right? 06:10.030 --> 06:24.870 And many of us survive on that in-person, face-to-face interaction, especially the extroverts in the audience, for getting back the energy that we need to get through our days. 06:25.110 --> 06:38.670 Similarly, when you're in that informal or sort of... when you're in that remote context, the staring at a screen over Zoom, you miss out on a lot of information, right? 06:38.670 --> 06:42.930 And this is one of the things we'll talk about a lot in the interviewing section of this conversation. 06:42.950 --> 06:49.810 When you're doing an interview over Zoom, you miss a ton of influence cues that you would get if you were sitting face-to-face, right? 06:49.810 --> 06:56.610 Body language over video conference is effectively the talking head body language. 06:56.610 --> 06:57.930 It's not my full body language. 06:57.930 --> 07:04.370 You can't tell what I'm doing with my feet while I'm sitting here presenting to a screen with a microphone in front of my face. 07:04.430 --> 07:10.610 And you aren't really aware of how much information you get from that until it's gone. 07:10.930 --> 07:15.070 So let's talk about how I'm going to split up this talk. 07:15.070 --> 07:21.990 And I'm going to talk about three things that are really important and difficult in this time, right? 07:21.990 --> 07:24.330 The first one is bringing people aboard. 07:24.790 --> 07:30.810 You don't get to fly them out to the office and sit in front of them for a full day in a room with a whiteboard anymore. 07:30.810 --> 07:34.950 And because of that, we have to change our interviewing and hiring processes a lot. 07:35.130 --> 07:41.650 Similarly, when you're onboarding new employees, you also don't get to fly them to headquarters and have them sit in a room with you. 07:41.650 --> 07:45.710 So how do we change onboarding to accept this new remote reality? 07:45.710 --> 07:49.790 And then once people are aboard, how do you keep them mentally healthy? 07:50.170 --> 08:02.050 I know it's a common conversation, and I'm sure that there's going to be a bunch of other talks here at DEF CON about the mental health impact of locking ourselves in our houses like this and working all the time. 08:02.050 --> 08:10.310 But how do you create touch points in your culture and create structures by which you can keep your teams mentally sane? 08:10.310 --> 08:19.270 These are the three real phases of the employee life cycle that are changing so much right now that I want to dig into. 08:19.270 --> 08:22.690 So with that, we'll start with interviewing and hiring. 08:22.690 --> 08:24.210 We'll start with the onboarding process. 08:24.210 --> 08:36.310 And whether you're a job seeker who's going through this remote interview process or a hiring manager who's having to figure out how to modify their hiring process, this has been a really tough time. 08:36.310 --> 08:40.750 And it's funny, I was hiring a senior leader early on. 08:41.250 --> 08:44.490 Scope's obviously growing a bunch, and we're hiring a bunch of people. 08:44.590 --> 08:52.590 And I was talking to a recruiter friend of mine who is pretty thoughtful about these things. 08:52.930 --> 08:57.150 And I said to him, so do you have any advice for me? 08:57.550 --> 09:01.890 It's a big risk to hire a senior person who you've never met face to face. 09:01.970 --> 09:06.870 And his insight was, well, Mike, it's pretty simple. 09:06.870 --> 09:09.150 You either take the risk or you don't. 09:10.190 --> 09:11.970 That's not exactly what I was asking. 09:11.970 --> 09:18.050 What I was asking for was a way that we can modulate our process such that it becomes less risky. 09:18.330 --> 09:33.890 And so with that, I set out on the quest to figure out what we could start to do in our interview processes, knowing that as we're a growing company, we're probably going to hire 20 people this year, and we're never going to meet any of them face to face. 09:33.890 --> 09:42.050 So how do we do that in a way that we don't end up hiring the wrong people or breaking our particularly interesting culture? 09:42.230 --> 09:50.110 And especially, how do we make sure that we are getting the right people in the process and then evaluating them effectively so that we get them through to the onboarding process? 09:50.270 --> 10:05.950 So with that, one of the things that we really realize is that most of the things that you do in an interview process can have more or less rigor. 10:05.950 --> 10:12.750 You don't always have to be the most rigorous interviewer if you can create good bonds with the people in front of you. 10:12.750 --> 10:24.070 And I've seen a lot of hiring managers overcome bad interview processes and bad HR processes because they create such a strong interpersonal relationship with the candidate. 10:24.370 --> 10:26.550 And in the past, that was enough, right? 10:26.550 --> 10:42.210 I could overcome a lot of bad candidate experience within my interview processes by having really great interviews and creating those relationships, especially building in things like taking the candidate out to lunch and things that create that trust interpersonally. 10:42.390 --> 10:45.750 But unfortunately, that's all the stuff that's gone away. 10:45.750 --> 10:56.850 So what we realized is that rather than focus on our ability to create bonds with candidates, we had to actually add rigor to our process. 10:56.850 --> 11:07.450 Because what usually creates the trust between the candidate and the company that's trying to hire them is the interpersonal relationships with the people. 11:07.550 --> 11:11.630 Now you have to replace that by having a really great process. 11:11.630 --> 11:42.430 And so refocusing your interview process on making sure that you follow up with candidates in a timely fashion, that candidates are getting the right feedback and the right email and the right steps in the middle of the process, that you have standard questions across each of your sets of interviews so that the interviewers can focus what ability they have on creating the trust across this impoverished medium. 11:43.350 --> 11:46.470 We've had to go back and add rigor to our process. 11:46.470 --> 11:50.890 Now, the funny thing is, we're a nine -person startup. 11:51.010 --> 11:54.930 That's a hard thing to add rigor when you're a tiny company. 11:54.930 --> 12:00.670 It's one thing, you know, when I was at GE in my past, GE has lots of rigor, right? 12:00.670 --> 12:07.430 They have, you know, people to create rigor in the interview process where that's their job. 12:07.430 --> 12:09.470 Whereas at a small startup, you don't have that. 12:09.470 --> 12:11.470 So it's been it's been harder for us to do that. 12:11.470 --> 12:14.110 And I can't say that we necessarily do it that well. 12:14.110 --> 12:32.450 But we've been focusing on how do we add rigor to the process because we realize that we can't just rely on our ability to charm the candidate and to have really great interactions with them to create the bonds that we need and the excitement that they need about the company. 12:32.550 --> 12:35.550 Similarly, it's forced us to change our interview formats. 12:35.550 --> 12:47.250 You know, most companies I know have an interview process that involves some amount of remote interviewing, whether a phone screen or a phone screen and then a chat with the hiring manager. 12:47.530 --> 13:02.750 And then usually you bring the candidate in for one of these marathon, you know, four to six to eight hour back-to-back interview days, which is exhausting even when you're sitting in a room with a whiteboard with a bunch of people that come in and out. 13:02.750 --> 13:05.230 Over Zoom, it's not just exhausting. 13:05.230 --> 13:06.990 It's actually impossible. 13:06.990 --> 13:16.410 You know, by the eighth hour of an eight hour back-to-back Zoom day, the candidate's eyes are going to be so glazed over that they can barely form a sentence. 13:16.470 --> 13:21.550 And the last half of your interview process is not going to get the information that you want. 13:21.550 --> 13:24.750 So what we realized is we had to start breaking it up. 13:25.170 --> 13:32.950 Whereas, you know, you may have had a three-step interview process with the third step being a lot of different conversations. 13:33.170 --> 13:37.450 We've now added additional steps to that process. 13:37.450 --> 13:42.330 We're also experimenting with adding different media into the process. 13:42.330 --> 13:45.370 As an example, we know that we live on Slack. 13:45.370 --> 13:53.710 You know, other organizations live on Teams or Google Meet or, you know, Skype or whatever your preferred instant messenger is. 13:53.710 --> 13:59.230 We've started adding in attempts at interviews over those different mediums. 13:59.230 --> 14:04.330 Because if a person is going to join our team, they're going to spend a lot of time interacting with us on Slack. 14:04.890 --> 14:10.070 It would be terrible to find out that they don't know how to use Slack in their first week, you know. 14:10.070 --> 14:13.130 And we want to be able to replicate that experience. 14:13.130 --> 14:16.730 Now, you don't want to throw somebody out just because they don't know how to use Slack. 14:16.730 --> 14:21.810 I mean, obviously, there's a conversation there and a teaching opportunity. 14:21.930 --> 14:25.650 But you have to figure out how to replicate the real life you're going to be in. 14:25.650 --> 14:29.990 The real life you're going to be in is not in an office with a whiteboard for at least the next 12 months. 14:30.110 --> 14:32.750 So what is their life going to be for the next 12 months? 14:32.750 --> 14:36.450 Is it you're going to be drawing things in Lucidchart or Vizio online? 14:36.450 --> 14:39.590 Are you going to be collaborating on docs in Google Docs? 14:39.590 --> 14:41.870 How are you, you know, are you going to be pair programming? 14:41.870 --> 14:47.270 What are those things that are going to reflect that person's day-to-day life once they've joined your company? 14:47.610 --> 14:58.490 And in that time, how do we create effectively an interview process that replicates that so you can see what the candidate is going to be like in your environment? 14:59.370 --> 15:02.190 And I've sort of harped on this a little bit. 15:02.190 --> 15:04.010 And I've hit it pretty hard. 15:04.010 --> 15:12.350 But the idea of let's just get the candidate in front of a whiteboard and let's solve problems together started to become really hard. 15:12.350 --> 15:16.650 And we did... I specifically really love the whiteboard interview, right? 15:16.650 --> 15:18.810 I bring the candidate in. 15:18.870 --> 15:21.310 We will start working on a problem. 15:21.310 --> 15:26.090 I have five or six that I use depending on what the role is that I'm hiring. 15:26.190 --> 15:27.690 And let's solve the problem together. 15:27.690 --> 15:29.950 I get a sense of the person's interaction style. 15:29.950 --> 15:36.310 I get a sense of how they think, how they communicate, when they ask for help, whether they ask for help, all of those things. 15:36.970 --> 15:41.650 And all of that sort of evaporates when you can't do it remotely. 15:41.650 --> 15:50.090 I don't know if anybody's tried using the whiteboarding feature of Zoom, but I will tell you it is a poor, poor, poor replacement for a real whiteboard. 15:50.090 --> 15:55.390 And so what have we done to start focusing on how do you replace the whiteboard? 15:55.690 --> 15:59.550 We've started looking at online testing opportunities. 15:59.550 --> 16:03.050 I mentioned a second ago, real-time collaboration. 16:03.050 --> 16:10.370 If I was hiring a user interface person, maybe we co-design a screen of something in Figma. 16:10.370 --> 16:16.190 Figma is effectively like Google Docs for designers where we can basically... 16:16.190 --> 16:25.030 it's kind of like PowerPoint remotely, or not PowerPoint, sorry, Photoshop remotely, where you can basically co-comment on and co-design a UX. 16:25.030 --> 16:31.390 Maybe we work on a product spec within a Google Drive or the like. 16:31.390 --> 16:37.810 Or like I said, use Lucidchart or Visio to create an architecture and comment on it. 16:37.810 --> 16:42.990 Things that allow us to do real-time collaboration in the same way we do in a daily meeting. 16:42.990 --> 16:53.970 You know, our architecture meetings often end up with somebody sharing their screen and Lucidchart up on the screen and people drawing things and dragging them around. 16:54.450 --> 17:04.110 It's reflective of the real role that they will do, but it's also a good way to replace that whiteboard interview. 17:05.690 --> 17:14.530 Similarly, and this is the one that we've found the most valuable over the last six months, is we've added in audition interviews for pretty much everything. 17:14.530 --> 17:24.450 Basically, an audition interview, from my perspective, is you give the candidate a bit of a take-home assignment, something they can do in an hour or two. 17:24.450 --> 17:26.290 It doesn't have to be a huge thing. 17:26.290 --> 17:27.890 And then they have to come present. 17:28.170 --> 17:30.090 And they have to present their thoughts. 17:30.090 --> 17:37.370 So, whether that is a threat hunter who you say, you give them a threat actor, you know, here's APT29. 17:37.750 --> 17:41.930 Come tell us everything you learned about APT29 in a couple of hours. 17:41.970 --> 17:43.210 Or here's a piece of code. 17:43.210 --> 17:44.230 Tell us about it. 17:44.230 --> 17:46.150 Or write this piece of code. 17:46.150 --> 17:48.610 Or, you know, spin up this service. 17:49.070 --> 17:51.090 And then come tell us what you did. 17:51.090 --> 17:53.590 So that you get a good understanding of their communication style. 17:53.590 --> 17:56.070 You get a good understanding of their ability to do work. 17:56.070 --> 18:01.410 And you get a good understanding of how they're going to interact with you once they're here. 18:01.690 --> 18:05.870 And obviously, those auditions balance differently depending on who it is. 18:05.870 --> 18:09.490 If it's a sales role, that presentation is the most important thing. 18:09.490 --> 18:15.410 If it's a technical role, often the technology and the skills that they're showing is the most important thing. 18:15.410 --> 18:17.910 But they still have to be able to present their skills, right? 18:17.910 --> 18:40.280 So, across all of these, whether we're adding in initial assessments, whether we're doing collaborative interviewing over collaborative platforms, or we're doing an audition, we've added in all these steps to try and get a sense of how the person will work in the real world the way that we used to with a whiteboard interview. 18:41.030 --> 18:43.330 So, let me take a detour for a second. 18:43.330 --> 18:52.290 Because 2020 has really put a focus on diversity in a way that we haven't seen in prior years. 18:52.290 --> 18:59.100 And it's something that has been a focus of mine for a of years, though I very rarely talk about it. 18:59.100 --> 19:10.060 A big part of that is, I don't have a whole lot of experience in my own personal history that lends me to be an expert on diversity by any stretch, right? 19:10.440 --> 19:19.040 I grew up in small-town Ontario, and grew up in Canada, and I'm pretty white here. 19:19.140 --> 19:22.880 So, I'm not really the person to talk about this. 19:22.880 --> 19:25.220 But I will say, I've learned a lot about it. 19:25.220 --> 19:32.280 And I have a couple of counterintuitive points that I think I wanted to put on into this talk, because it's important to think about. 19:32.280 --> 19:40.340 Even if you're not somebody who really reflects diversity, it's incumbent on all of us to get out there and make the change we want to see in the world. 19:40.340 --> 19:55.960 And what I realized when I really started studying diversity is, a lot of the advice for when you look at diversity and inclusion programs, and when you get into the HR material, a lot of it is about showing how you're doing diversity for large companies, 19:55.960 --> 19:56.240 right? 19:56.240 --> 20:02.400 Publish your metrics, and have diversity committees internally, and do all of these things that happen at large companies. 20:02.720 --> 20:08.300 I was an executive sponsor of the diversity committee when I was at Lookout. 20:08.320 --> 20:11.320 I've done the big company diversity thing. 20:11.320 --> 20:13.840 But how do you hire a diverse team when you're six people? 20:14.080 --> 20:25.160 Because a lot of those things that you read about in the HR manuals don't really apply very effectively when your whole team fits in one Zoom window. 20:25.460 --> 20:31.560 And so, we've had to realize that the diversity effort for us is less a strategy. 20:31.560 --> 20:44.220 It's less a strategic conversation about how we structure the company's program, as it is a tactical activity of how do I get the right people to apply, and how do we make sure we hire the right people? 20:44.220 --> 20:48.200 And so, there are a few things that I really wanted to emphasize around that. 20:48.200 --> 20:59.200 And by the way, I feel free to hit me up in the Q&A, and to email me, and send me notes on Twitter, and tell me all the things that I'm not doing right here, and that I'm getting wrong. 20:59.200 --> 21:03.980 Because, like I said, I'm very committed to this, but I'm sure that I'm making mistakes. 21:03.980 --> 21:16.800 But the three things that we have learned really quickly as a small company is one of the very first things you can do to increase diversity is to focus on the language, and the job ads, and the job descriptions, and your website. 21:17.020 --> 21:31.260 It is really amazing across security, and across the job descriptions in our industry, how many of those have language that is very exclusive. 21:31.500 --> 21:34.240 And I mean, it excludes people. 21:34.240 --> 21:48.720 How many of them, you know, focus on a very particular sort of standard narrative that doesn't include other cultures, that doesn't include other life experiences, other genders, etc. 21:48.800 --> 21:58.560 And so, you can do a lot just by looking at all of your job descriptions, and all of your website, and asking yourself, would somebody who's not like me want this job? 21:58.560 --> 22:06.380 And I think that that's something that very few of us as hiring managers were taught to do when we were writing the job description. 22:06.380 --> 22:17.740 Second, the farther to the front of your interview process you can put questions about diversity, the more you are going to signal to candidates that it matters. 22:17.740 --> 22:30.820 If you go through your whole interview process and never ask a manager candidate what they've done to increase diversity in their previous organizations, they're going to get hired never thinking about whether or not they're going to build a diverse team in your organization. 22:30.880 --> 22:51.700 So, the closer you can get that to the front of your interview process, and I'll talk more about this in a second, the more you're going to signal to the candidates that, A, this is important enough for you to talk about right up front, but it's also going to allow you to select people who have answers around building diverse organizations that match the culture that you want to build. 22:52.180 --> 22:54.700 And finally, look at your pipeline. 22:54.840 --> 23:09.620 And I'll talk about this more in a second, but one of the most eye-opening things that you can do is if you have a candidate tracking system that's tracking the interview pipeline that you have, look at it and look at each stage. 23:09.680 --> 23:24.560 If 90% of the people that get in-person interviews, or 95%, I've been in places where 100% of the people who get in-person interviews are white dudes, well, guess what your team's going to end up as? 23:24.560 --> 23:26.160 It's going to end up as a bunch of white dudes. 23:26.160 --> 23:32.800 If your pipeline is 90% diverse candidates, you're going to end up with a diverse team, whether you like it or not. 23:32.940 --> 23:38.120 Who ends up in your interview process is who you end up hiring, period, full stop. 23:38.200 --> 23:43.900 And so if the beginning of your pipeline does not look diverse, the end's really not going to. 23:44.120 --> 23:48.120 So with that, I have two pieces of more tactical advice. 23:48.120 --> 23:50.500 One is my absolute favorite new question. 23:50.500 --> 23:54.780 This question is the question that has moved to the front of our interview process. 23:54.780 --> 23:59.040 And if I could actually put this on LinkedIn and make it a qualifying question, I would. 23:59.180 --> 24:02.060 I don't claim credit for this. 24:02.060 --> 24:04.560 I was talking to the folks over at Gapjumpers. 24:05.100 --> 24:07.260 Talk about a really neat organization. 24:07.260 --> 24:15.500 Gapjumpers is a group of folks that are doing some really interesting work around diversity, and specifically diversity in the hiring process. 24:15.540 --> 24:17.940 And one of their founders gave me this one. 24:17.940 --> 24:25.580 What actions have you taken, or wish you had taken, to advocate for and support diverse and inclusive cultures and teams in your previous roles? 24:25.980 --> 24:31.960 And by asking that question up front... and by the way, the answer is not always going to be a great one. 24:31.960 --> 24:37.400 And especially if you're asking this of a junior engineer, they might not have a good answer. 24:37.500 --> 24:39.820 But do they have things they wish they could do? 24:39.820 --> 24:41.440 Do they have things that they wanted to do? 24:41.440 --> 24:43.400 Do they have things they've seen done well? 24:43.400 --> 24:48.240 This starts a conversation that helps you to understand who the people you're interviewing are around this. 24:48.240 --> 24:59.700 And it really helps you to identify people who are going to support the culture you're building, but also that are going to be allies for you as you grow. 24:59.960 --> 25:06.500 And so we've started asking this very, very close to the front of our interview questions... our interview questions and panels. 25:06.660 --> 25:17.520 Like I said, if I could, I would put it in the qualifying questions to even apply right next to, right next to, are you authorized to work in this country? 25:17.520 --> 25:19.460 This would be a question I would ask right up front. 25:19.740 --> 25:27.740 Because by asking this, we are signaling like, hey, by the way, when you get here, you're going to be expected to do this. 25:29.060 --> 25:37.620 And so I don't know if you realize that all of these things that I've just put forward are ultimately the same thing. 25:37.620 --> 25:42.320 I've actually created all of these ideas around a single idea. 25:42.320 --> 25:46.980 And it comes from Richard Thaler's work around default choice. 25:47.540 --> 25:53.380 I was talking to a friend of mine who runs HR at a Bay Area startup. 25:53.380 --> 26:05.960 And she said, my fundamental job is to make it so that right now, the default choice for most of our engineering managers is to hire a white male. 26:06.020 --> 26:10.460 My job is to make the default choice to hire not that. 26:10.460 --> 26:21.700 Because we know that it's, you know, if I, if I pull a candidate, if I pull a pool of 100 engineers in the Bay Area, there's going to be a lot of white males in that, in that random sample. 26:22.060 --> 26:37.440 If I can force us away from the default choice that is currently the default choice, and create a new default choice to create a new way of operating, then we're going to get the decisions we want. 26:37.440 --> 26:50.940 Similarly to the way that with Thaler's work around 401ks, that if people if, if the default choice is not to enroll in a 401k , something like 65% of people don't enroll in a 401k. 26:50.940 --> 27:01.320 If you make the default choice that they're defaulted to a 401k, and they have to enroll in a 401k, or they can opt out, something like 65% of the people enroll in a 401k. 27:01.320 --> 27:14.720 By setting the default choice, which is what all of these functions that I've that I've just talked about are doing, they are creating a situation where diversity is the default choice, we're able to actually modify the behavior of people in our organizations. 27:14.720 --> 27:24.740 And I think if we thought about how do we modify the default choice more effectively, we would end up with a better outcome in much in many of our cases. 27:25.580 --> 27:29.000 So with that, now we've hired a bunch of people, right? 27:29.000 --> 27:33.820 We've we've made offer letters, they've quit their jobs, they're about to start. 27:33.960 --> 27:43.500 And this is the point where I'd be normally buying plane tickets and having people come show up and I'd be giving them their laptop face to face on the first day. 27:44.160 --> 27:48.340 Unfortunately, that's not exactly the world we live in anymore. 27:48.520 --> 28:03.080 We don't, you know, no longer do we get to do the fly the person here, sit them in a room for five days and indoctrinate them for for 40 hours and have cocktails with them after that and take them out to dinner every night. 28:04.460 --> 28:09.500 That doesn't get to be how we do this anymore, because we're not able to do it in person. 28:10.440 --> 28:25.300 And because of the challenge of Zoom fatigue, and the challenge of basically sitting someone in front of a video conference for eight hours at a time, we have to realize that onboarding has to change. 28:25.300 --> 28:39.360 Onboarding can no longer be a monolithic entity where you start talking at nine o'clock on Monday and you stop talking at five o'clock on Monday and the person has set up their benefits and their laptop and all of that. 28:40.980 --> 28:46.320 Because of this new world, we have to we have to realize that you have to break it up. 28:46.320 --> 28:46.980 Right? 28:46.980 --> 28:58.660 That means you have to change formats, you have to have multiple media, some things can be in documents, some things can be email, some things can be over Slack, some, you know, Zoom is still important, you still will use Zoom. 28:58.680 --> 29:15.720 But often we can we can do things like videos, or one-on-one mentorship, or, you know, breakout rooms, or just go read this book even to replace that monolithic put a person in a room situation. 29:15.720 --> 29:20.980 And I mean, otherwise, you're just going to end up with exhausted people who haven't learned anything. 29:21.540 --> 29:24.280 Ditto, logistics start to get hard for onboarding. 29:24.280 --> 29:39.320 I mean, one of the things that we we've realized, and I have people in the US and I have people in Canada, it was really easy when I flew them here to New York to hand them all a laptop that we had, you know, bought from the store in advance and preconfigured. 29:39.380 --> 29:43.960 Now I have to figure out how to get those laptops configured and to their house. 29:44.060 --> 29:44.540 Right? 29:44.780 --> 29:48.980 Simple, something that should be simple logistically starts to become difficult. 29:49.000 --> 29:51.980 How about how do you buy lunch for everybody on their first day? 29:52.160 --> 29:55.680 You know, do I get their home address and have somebody send them Postmates? 29:56.000 --> 29:59.420 You know, how do we how do we even do something that simple? 29:59.420 --> 29:59.520 Right? 29:59.520 --> 30:03.640 How do you have happy hour on on their first day? 30:03.640 --> 30:06.360 Like, how do you socially onboard these people? 30:06.360 --> 30:09.140 These are all things we've never really had to worry about, right? 30:09.140 --> 30:14.880 The default action has always been, oh, I will just fly them here, we'll stick them in a room and we're all good. 30:15.540 --> 30:16.640 The default has changed. 30:16.640 --> 30:22.820 And so now we have to be thoughtful about not just the logistical part of the onboarding, right? 30:22.820 --> 30:25.820 Not just how do I teach them where Jira is? 30:25.820 --> 30:28.580 And how do I make sure that their laptop connects to VPN? 30:28.600 --> 30:32.200 But also, how do we socially integrate them into the team? 30:32.200 --> 30:32.300 Right? 30:32.300 --> 30:41.900 A big part of that onboarding process at most companies is when you put all those people in a room , you create an immediate social group. 30:41.900 --> 30:50.940 I still have relationships with people I onboarded at Lookout and people I onboarded with at GE, even though they weren't on my team. 30:51.260 --> 30:51.640 Right? 30:51.640 --> 31:03.300 We have traditionally used that onboarding process because, you know, as the meeting breaks up and people go to the go get coffee in the kitchen, they start a natural conversation. 31:03.340 --> 31:05.420 These are things that don't happen over Zoom. 31:05.460 --> 31:14.920 So as part of the onboarding of your employees, you have to sit and think about what do I do to socially integrate them normally? 31:14.920 --> 31:15.300 Right? 31:15.300 --> 31:16.600 Do we take them out to lunch? 31:16.600 --> 31:18.260 Do we do happy hours? 31:18.260 --> 31:20.020 Do we play games? 31:20.020 --> 31:23.780 What is the thing that we normally do to socially onboard people? 31:24.000 --> 31:31.280 And then how can I create that same thing, knowing that the mediums that we have don't enable that? 31:31.280 --> 31:34.420 So, for example, I'm a big fan of happy hours. 31:34.420 --> 31:38.080 I love taking, you know, taking the team out to happy hour. 31:38.100 --> 31:45.820 The best part about it is you can have big group conversations, but you also end up with a lot of one-on-one conversations. 31:46.340 --> 31:52.160 The problem with Zoom, for example, and frankly, any of them, I use Zoom as shorthand, right? 31:52.160 --> 31:53.080 It could be Teams. 31:53.080 --> 31:54.100 It could be Google Meet. 31:54.100 --> 31:55.220 It could be Hangouts. 31:55.220 --> 31:56.140 It could be anything. 31:56.140 --> 32:05.280 But the problem with it is what you have in a video conference interaction is very different than what you have in an in-person organization. 32:05.440 --> 32:08.140 Because even if you have like a suppose you have lunch meeting. 32:08.560 --> 32:10.120 We have 10 people on Zoom. 32:10.120 --> 32:11.120 We all have lunch. 32:11.120 --> 32:15.400 If we had those 10 people around the table, we would talk as a large group for a while. 32:15.400 --> 32:16.340 Somebody would present. 32:16.340 --> 32:17.400 Somebody would talk. 32:17.900 --> 32:22.240 And then you'd see all of these splinter conversations that would happen. 32:22.240 --> 32:26.180 And those splinter conversations are often where the most important relationships are formed. 32:26.240 --> 32:31.840 You know, we're sitting around the table and I start having a small side conversation with the person next to me or the person right across from me. 32:31.840 --> 32:34.500 And the people next to me are doing the same thing. 32:34.500 --> 32:38.860 Those conversations can't happen over video conference. 32:38.860 --> 32:52.460 And nobody has yet created the Zoom equivalent that allows me to be sitting in a large group meeting and have a side conversation with some other person on Zoom without effectively talking over the speaker of the meeting. 32:52.800 --> 32:58.380 And so you have to be really thoughtful about how do we create those things. 32:58.380 --> 33:08.780 You know, if we normally do happy hour, it's great that we do remote happy or like a Zoom happy hour, but how do we create the opportunity for all those people to have side conversations? 33:09.040 --> 33:16.320 And so in, you know, one of the things that I've been forcing people to do is have a ton more one-on-ones, especially with new people. 33:16.380 --> 33:22.240 You know, have one-on-ones with your new staff, you know, every day for the first month. 33:22.500 --> 33:32.100 That's actually something I've been doing is as I've been bringing some people aboard on my staff, I'm literally the first 30 days I meet with them every day for 30 minutes. 33:32.480 --> 33:42.340 That's a lot of time, but it replicates a lot of the conversations we would have had naturally as a side conversation in a meeting that we don't get to have anymore. 33:42.340 --> 33:46.200 And similarly, you have to be able to do that with your team. 33:46.200 --> 33:49.440 You have to be able to think about what are those social interactions? 33:49.440 --> 33:52.520 What do they look like when they're done well? 33:52.520 --> 33:58.060 And how do I hold my organization accountable for doing that with the new person when they come aboard? 33:58.140 --> 34:00.660 And by the way, this feels forced. 34:00.660 --> 34:09.840 This feels really uncomfortable to basically force everyone to have, you know, five one-on-ones a week with people where they normally wouldn't have. 34:09.840 --> 34:12.920 But you're replacing the informal hallway conversation. 34:12.920 --> 34:18.780 You're replacing their ability to just sort of stand up in their cube and ask over the cube wall. 34:18.780 --> 34:29.660 You're trying to create a situation where we replace those social interactions that happen organically within the office with an actual forced interaction. 34:30.200 --> 34:35.620 I too know it feels forced and not organic, but it's kind of what we got, right? 34:35.620 --> 34:39.560 We don't have the ability to do the things we've always done. 34:39.780 --> 34:44.320 And similarly, and so you sort of get the transition, right? 34:44.320 --> 35:00.080 We're doing those things to onboard people, but a lot of those same activities go into maintaining the health of the team and the health of the culture, because you don't anymore have the random sitting down next to each other at lunch opportunity that we used to have. 35:00.080 --> 35:15.140 You know, one of my favorite things when I've been in previous jobs is just to walk into the kitchen with food and see who's sitting at what table and go sit at whatever table and have whatever conversation I have that day with whoever's talking, right? 35:15.140 --> 35:20.980 And I'm an introvert, by the way, but that's how you create really strong relationships within an organization. 35:21.060 --> 35:25.820 Well, how do we do that same thing in this world? 35:25.880 --> 35:29.480 And I think there's a couple of things that we have to be very cognizant of. 35:29.480 --> 35:35.460 First off, and you know, it's the old, this meeting could have been an email idea. 35:35.560 --> 35:42.460 We have to be really ruthless about information format and information delivery. 35:42.920 --> 35:57.500 If I know that I'm in an office and I have basically unlimited face-to-face time without exhaustion, which as an introvert, I don't, I only have a certain amount of time I can be face-to-face before I have to put on headphones and not talk to anybody. 35:57.760 --> 36:11.060 But in general, even me as an introvert, when I'm in a room full of people, I can be pretty, you know, I can be pretty good and know I can have as many conversations as I want and I'm not going to be exhausted. 36:11.060 --> 36:15.900 In this new world, the hours we spend on video conference are a finite resource. 36:16.040 --> 36:30.360 So, if I schedule a whole ton of meetings that could have easily been an email or a Slack, suddenly I'm eating up time that I could have used for a more important face-to-face meeting with those meetings. 36:30.360 --> 36:49.960 So, in order to keep our culture strong and in order to keep our ability to have those social conversations and to have those in-person conversations when they're needed, we have to start being ruthless about saving our time face-to-face for the things that matter and finding a way not to do that. 36:49.960 --> 36:52.000 So, I've been doing a ton more with Google Docs. 36:52.000 --> 36:58.240 I've been doing... I've even been writing long emails again, where I've gotten away traditionally from writing long emails to my team. 36:58.240 --> 37:01.640 That was a very 2008 sort of strategy. 37:02.380 --> 37:16.340 I've started doing more longer emails, documents, a ton more on Slack, because I realized that I have to save up the Zoom face-to-faces for things that require that. 37:16.340 --> 37:21.420 And especially, especially for the social connection. 37:21.780 --> 37:30.640 Now , if you read the story, you know, there have been studies over the years about the amount of time people spend at work not working. 37:30.640 --> 37:38.360 And they're always presented in the traditional, they're presented as people wasting time. 37:38.620 --> 37:42.580 I've never believed that the time at work not working is people wasting time. 37:42.900 --> 37:50.620 Because fundamentally, the social bonds that you create on your teams, they're not as important... they're not important in good times. 37:50.620 --> 37:51.280 Don't get me wrong. 37:51.280 --> 37:53.080 I love being friends with all my team. 37:53.140 --> 37:56.520 I love loving the people I work with is really important. 37:56.520 --> 37:58.780 I spend a ton of time with the people I work with. 37:59.180 --> 38:16.700 But what the social bonds that you create in good times actually do for you that is most important is when things break down, when stress is happening, when you're in the middle of incident response, when your whole product goes down and nobody can figure out why, 38:16.700 --> 38:27.000 when a customer calls you and is unhappy and you have to figure out a solution right then, those are the times when you don't have time to build goodwill in that. 38:27.100 --> 38:29.320 And everyone's at a high stress level. 38:29.320 --> 38:30.800 Everyone's on edge. 38:30.900 --> 38:38.300 Those are the times that your social bonds and the social cohesiveness of your organization save you from the little misunderstandings. 38:38.300 --> 38:51.060 And so the time that you spend building social bonds in non-work interaction, conversations as you walk down the hall, conversations in the kitchen, you know, let's go get coffee next door. 38:51.120 --> 39:02.060 All of those little things put in the bank goodwill and trust and ultimately psychological safety that saves you when things go wrong. 39:02.200 --> 39:05.240 And this is exactly what we're missing right now. 39:05.240 --> 39:07.640 This is exactly what we're failing to get. 39:07.640 --> 39:23.000 When work becomes effectively transactional because our Zooms don't allow us to have those social times, we've basically set up a situation where it doesn't affect us on the normal days. 39:23.000 --> 39:28.820 It doesn't affect us badly that we barely know our coworkers when everything's fine, right? 39:28.820 --> 39:32.960 On every iteration sprint planning, everything's great. 39:32.960 --> 39:38.480 But when things go wrong and people haven't built that trust, that's when things break down. 39:38.480 --> 39:50.060 And so in this new time, as leaders, but also each person, we need to think about how do we create that non-work interaction for our teams and replicate it intentionally. 39:50.060 --> 39:52.520 And it goes back to what I was saying about onboarding. 39:52.520 --> 40:01.980 You should be thinking, if you're, you know, if you have a team of people, you should be thinking for each of those people, what social relationships are going to matter most when things hit the fan, right? 40:01.980 --> 40:08.600 Could, you know, if it's a team of developers, could be another developer, could be a QA person, could be a member of the customer support team. 40:08.600 --> 40:15.040 And then you have to sit down with that person and force them to create opportunities to create those social bonds. 40:15.300 --> 40:22.560 And, you know, one of the easiest way to do that is just to force them to have 30 minute one-on-ones with that person every week or every two weeks or every month. 40:22.560 --> 40:25.580 And yes, it is, it is forced. 40:25.580 --> 40:26.820 It is not organic. 40:26.820 --> 40:29.420 It is going to feel weird and uncomfortable. 40:29.720 --> 40:34.680 And it's especially going to feel weird and uncomfortable for you because you should be doing it for yourself too. 40:34.740 --> 40:42.900 What other people in your organization are important for you to be having those social bonds with when things go wrong? 40:42.900 --> 40:44.860 Who are you going to need to rely on? 40:44.960 --> 40:47.920 And so who are you going to need to build trust with in advance? 40:48.300 --> 40:54.280 And so we need to start forcing ourselves to put ourselves in the situation to have those conversations. 40:54.280 --> 40:58.180 Have a one-on-one with that person, you know, say it's your QA person. 40:58.180 --> 41:01.540 Put a one-on-one on the calendar and just talk about your families. 41:01.540 --> 41:08.760 Talk about what happened that weekend and talk about, you know, whatever you would talk about if you went to get coffee and you were sitting in the office. 41:08.980 --> 41:12.260 Because it's not wasting time. 41:12.260 --> 41:17.720 It's your ability to put those things in the bank that will save you when things go wrong. 41:17.720 --> 41:20.200 And it's not about Zoom happy hours or game nights. 41:20.200 --> 41:20.860 Don't get me wrong. 41:20.860 --> 41:21.820 I love those. 41:21.820 --> 41:27.520 But it's about creating those bonds of trust with those people that you're going to need later on. 41:27.520 --> 41:40.960 So, in conclusion, and just, you know, sort of putting a bow on it, the fatigue that we're all feeling from isolation and from social change and from COVID and from everything are real. 41:41.380 --> 41:44.580 And yet we don't get to kind of put it back in the bottle. 41:44.580 --> 41:47.740 The world's not going back to the way it was any time soon. 41:47.740 --> 41:54.080 You know, there may be pieces and pockets and parts, but as a whole, we're going to live remotely for a while. 41:54.080 --> 41:56.620 We're going to learn to have remote teams for a while. 41:56.620 --> 41:59.580 We believe some people, we're going to have remote teams forever. 41:59.880 --> 42:00.080 Right? 42:00.080 --> 42:02.580 And so, it's going to change how we hire. 42:02.580 --> 42:06.200 It's going to change how we onboard people and make them part of our team. 42:06.200 --> 42:08.740 And it's going to change how we keep them part of our team. 42:08.740 --> 42:22.880 And the sooner we start adapting to that and the sooner we start creating these new habits, the less they're going to feel weird, the less they're going to feel forced, and the sooner we're going to be able to create an opportunity to build a great culture in this world. 42:23.000 --> 42:25.280 And so, we have to be intentional. 42:25.280 --> 42:30.900 We have to be intentional about creating the quality of information, especially in the interview process. 42:30.980 --> 42:31.100 Right? 42:31.100 --> 42:43.760 If you know that you're only going to get from here up on somebody, you got to find a way to get more information about them that you would normally get from their body language through other means, through either additional questions, additional time, 42:43.760 --> 42:45.960 additional interactions, however you want to do it. 42:45.960 --> 42:55.500 Similarly, we have to replace the ability to interact in ways that deliver information. 42:55.500 --> 42:55.600 Right? 42:55.600 --> 42:58.220 We used to onboard by just sticking people in a room. 42:58.220 --> 42:59.660 Now we have to go multimedia. 42:59.680 --> 43:04.160 Now we have to come up with multiple channels and do a whole bunch of different things. 43:04.220 --> 43:09.840 And finally, we have to figure out how to be intentional about creating the social bonds that hold our team together. 43:09.860 --> 43:10.160 Right? 43:10.160 --> 43:14.440 I talked a lot at B-Sides last year about how to build great cultures. 43:14.840 --> 43:16.780 This is culture building. 43:16.780 --> 43:16.900 Right? 43:16.900 --> 43:21.640 How do you build a culture in this new time is something we're all going to have to figure out together. 43:21.640 --> 43:30.080 And I hope that next year and the year after at B-Sides, DEF CON, Black Hat, et cetera, there's a lot of people that have better ideas than me. 43:30.820 --> 43:34.920 Because I'm obviously talking about this as I'm figuring it out. 43:34.920 --> 43:35.040 Right? 43:35.040 --> 43:37.360 We're building the race car as we're driving the race. 43:37.360 --> 43:42.840 And I hope that a lot of other people who come up with a lot of better ideas that I can learn from as well. 43:42.840 --> 43:45.540 With that, thank you so much. 43:45.680 --> 43:48.920 I hope we're having good Q&A. 43:48.920 --> 43:54.680 And feel free to email me, hit me on Twitter, hit me on LinkedIn, however you want to find me. 43:54.720 --> 43:55.640 I'm around. 43:55.640 --> 43:57.260 This is stuff I love to talk about. 43:57.260 --> 44:00.100 So, find me and let's chat about this. 44:00.100 --> 44:03.780 Let's chat about medical cybersecurity because I love to talk about that, too. 44:03.940 --> 44:06.780 Obviously, the scope logo on the CT scanner there. 44:07.220 --> 44:08.420 But yeah. 44:08.680 --> 44:11.360 Anybody wants to hit me up, please feel free. 44:12.080 --> 44:13.480 Mike, thank you. 44:13.480 --> 44:23.960 As always, love hearing your perspective and how you inspire people to be better leaders, be better managers, and overall be better people. 44:23.960 --> 44:31.460 And it was so great when you announced last year at B-Sides Las Vegas the beginning of scope security. 44:31.460 --> 44:32.700 So, that was fabulous. 44:32.700 --> 44:34.000 Thank you for that. 44:34.020 --> 44:38.200 And I know we're having some really great conversations going on in the Q&A. 44:38.200 --> 44:39.960 Please do follow up with Mike. 44:39.960 --> 44:45.600 Definitely interested in always hearing people's perspective and having a great dialogue. 44:45.600 --> 44:49.660 Remember that we have career coaching and resume review going on. 44:49.660 --> 44:53.600 And look forward to seeing everyone at our next presentation. 44:53.600 --> 44:54.600 Thanks so much.