Ashley Burke's Resilience in the World of Fintech and Cyber Risk

When Ashley's journey led her from environmental studies to a pivotal role in cybersecurity, it wasn't just a career change – it was a reinvention. We're thrilled to share her candid story, illuminating how she balances the demands of family life with the rigors of fintech, where she excels in risk governance and vulnerability management. Ashley's narrative dismantles the myth that cybersecurity is only for the tech-savvy, showcasing how diverse experiences enrich the field.

Our conversation with Ashley takes an honest look at the challenges and triumphs of establishing a comprehensive vulnerability management program. She discusses the importance of setting clear expectations and creating a supportive work environment, especially for those in development roles. Throughout our discussion, Ashley doesn't shy away from the harsh realities of workplace gender dynamics, recounting her encounters with toxic behavior and emphasizing the vital need for confidence and a culture of inclusivity.

Ashley's resilience shines as she recounts overcoming career obstacles, from an unjust termination to battling negative references. She stresses the power of a nurturing workplace over the allure of a hefty paycheck.  Her story serves as a beacon of encouragement for anyone contemplating a leap into cybersecurity, proving that with determination and the right support, obstacles of age and background can be conquered. Join us for this inspiring exploration of breaking barriers and forging new paths in the world of cybersecurity.

Transcript

Speaker 1: 0:53

How's it going, Ashley? It's great to finally get you on the podcast. I looked back and I think that we've been planning this thing for over a year. At this point.

Speaker 2: 1:02

We really have haven't we.

Speaker 1: 1:06

Yeah, it's always interesting to see how I fit it in with other people's schedule and my own schedule. There's always something, something that comes up, especially when you have a little one-year-old running around the house like it's like oh I guess we have to go to the doctor today. I guess we have to do whatever you know oh, I got.

Speaker 1: 1:29

Yeah, I mean I don't have kids, but I have a lot of pets yeah, yeah, right, like um, you know my, my wife, when I married her she had two guinea pigs and uh, you know so. So obviously they became my guinea pigs, um, very quickly. And you know, one of them got sick and it was like it was like a random 2500 bill, oh my goodness it's like this is a guinea pig.

Speaker 1: 1:54

We got it for 50 bucks. You know, oh my goodness, and you know. Then the second one got sick. Same thing. I'm like, oh my gosh, like it was just back to back.

Speaker 2: 2:09

Yeah, I could see that my dog has an ear infection right now and it's like it's just it's too much. But I don't think it's a good comparison in regards to children and pets, cause they're they're two different species.

Speaker 1: 2:24

You know what I mean. Oh, yeah, yeah, yeah, absolutely, I, you know, go going into going into being a parent. I didn't realize, you know it. It literally takes 100% of your when, when they're around, it's uh, it's insane yeah, it really does.

Speaker 2: 2:43

It's worth it. You know, like like they're just full of love and you pour your heart and soul into this little human that you love so much.

Speaker 1: 2:52

I think that's important oh yeah, I, I love it. I, I love being a dad. It's my favorite thing in the world. I'm so glad I'm a dad. Like I want as many kids as we can have. You know, like that's uh, it's fantastic. My boss, he actually has six kids and I'm like man, when you're gonna stop, he goes no, no, this is the last.

Speaker 2: 3:14

Two are mistakes at least he's honest.

Speaker 1: 3:19

Yeah yeah, well, uh, you know, ashley, I'm really interested in hearing your background. You know hearing where your story starts for it and security overall. You know what made you want to get into this field, what made you want to go down. You know this path.

Speaker 2: 3:41

Sure, yeah, it's a it's. So I'll be very honest. I don't have any background in this whatsoever. I went, did my bachelor's of community studies and then I went on to do my master's in environmental studies. So I'm located in Canada. I went to Toronto for my master's and when I graduated there wasn't any work in environment. So I traveled, just traveled overseas.

Speaker 2: 4:04

I partied for a year, had the best time of my life. Then I came home and I'm from Nova Scotia. So it's a province the most not the most easterly, but an easterly province in Canada. So I'm right on the Atlantic and I love it here. I need to be near the ocean. I think I'll die without it. Like that's my whole persona. It's very relaxed, everyone's really nice, like, for example, my neighbor will mow my lawn. She'll sneak over to my house and mow my lawn. Like this is just the vibe of where I'm at. So I always wanted to be back home.

Speaker 2: 4:37

So when I came home I was working at a call center and then I networked into being a university professor. So I was a professor. I taught gender, class and race, ethics, community studies, social justice and international social justice, and I taught them First Nation communities, which was really rewarding and very cool and I taught them First Nation communities, which was really rewarding and very cool. But the issue with that is it's not full-time work, you're contractual. You teach, then you're done. And I looked for something more secure and I actually ended up in careers. So I was at a career center helping people find jobs, so literally helping people create resumes, how to network, how to do interviews, and I kept seeing IT and like developers, security analysts coming through my door looking for help, recent graduates, things like that, and I was just really into it. I thought it was very cool and I remember I put a sticky note on my computer and I said someday I will work in cybersecurity. I had it down, I knew I wanted to do it. I found it really interesting. I like the security field, I like protecting people, I like creating safe environments. It seemed like a good fit.

Speaker 2: 5:46

So I fast forward to COVID you know a few job losses, etc. And I went well, now's my time. So I literally took a few courses. I did a cybersecurity boot camp and I was like, okay, I don't really like anything technical. It turns out I'm not a very good technical person. I'm like well, how can I navigate security, because there's this whole assumption. Then security I'm wearing a hoodie, I'm typing, I am hacking which actually is not security at all and I started networking.

Speaker 2: 6:18

I snuck into a conference for students and I said I was a student, which I wasn't. I just snuck in, met a few mentors, loved every minute of it and then I eventually got hired in a fintech out of Toronto to start with RISC and from RISC I went from RISC to GRC so I was helping that I was doing like vendor management and security, and then I came into like program management and that's where I'm sitting now. So I'm doing a lot of auditing. I'm doing I'm actually in the process of helping manage a vulnerability management program like getting that off the ground, process of helping manage a vulnerability management program like getting that off the ground plus PCI DSS, doing other audits. I'm also helping manage education, like education awareness. So I feel like I came at it from a different perspective. I didn't go to school, I don't have formal education and I'm not very good at technical anything, but what I have is passion, willingness to learn and I love to build relationships, which really helps for that program management side.

Speaker 1: 7:26

Yeah, it's really fascinating. You know I've done so many of these episodes almost 200 at this point.

Speaker 1: 7:33

Congrats, that's great, oh, thanks, yeah, and you know, I still haven't heard the same background twice, right, like everyone has such a unique path into security which, you know, I think it might be even unique to the industry. Say, that is because you know, security needs so many different mentalities, so many different backgrounds, to have a different you know thought or different, you know way of thinking in the room. Um, that it will accept, you know, just about anyone from any background. Right, and I think that that's also a huge hurdle for a lot of people to kind of get over. Right in their head is like, oh, you know, I'm coming from, you know a music background or something like that. Right, yeah, how would I ever make that transition?

Speaker 1: 8:27

It's like, well, you know, and you did it a very unorthodox way, right, you kind of focused on one of the I would say one of the lesser, I guess lesser prioritized pillars of building a successful career is the networking part of it. You know, and I remember when I was starting out, you know I would be going to these talks not know anything about security, not know anyone there, and I'm trying to network, I'm trying to get my foot in the door. You know, talking to all these people that I had no business talking to, probably, you know, and just doing everything I possibly could, which is really beneficial. It's really beneficial to get that experience, to learn something new at a, at a talk that you, you know, probably wouldn't have, you know, been at regardless if it wasn't, you know, for that little nudge, um. So I, I really kind of resonate with that experience.

Speaker 2: 9:33

You know it's it's it's really unique well, a lot of people too are scared to network. You know I I'm not petrified of much, you know, maybe maybe a wasp like you know what I mean. But when it came down to it, I was cold calling, I was cold emailing. I was going to because it was during COVID. There was no in person but there was a lot of virtual events. I was going to virtual events and a lot of virtual events. I was going to virtual events and for me, I think the fear of networking simply is that a lot of people have imposter syndrome, so we don't recognize our skills and abilities and how important they are to an industry that maybe we're not in yet.

Speaker 2: 10:09

But there's also confidence building. How do I talk to someone or ask questions about something that I don't know? So we're always worried about? Will I look silly? And I don't care how I look, because I know who I am. I'm authentically myself and overall I am a nice person that will genuinely care about you. So when I make these connections it is because I'm I inspired to be you. I want to learn from you. You have something that's beneficial and I think you're intelligent. Please share it. And from that I've had multiple mentors. Now. I'm actually mentoring now, which I never thought would happen in security. I never thought that would happen and I'm mentoring. So for people who are just scared to take that leap, the worst case, your worst ever case, will be a no, that's not a big deal. If someone doesn't want to talk to you, it's their problem. Go find someone else.

Speaker 1: 11:01

Yeah, that's a really good point that I try to really drive home to my listeners is that when you approach a situation where you're looking for a yes or no answer, I I go through this all the time with with the podcast, trying to find interesting guests you know to bring on and whatnot. Right, what's the worst case scenario? If they say no, you're in the exact same spot that you are in. But if you take that risk and they say yes, you're potentially in a new spot, you're potentially moving closer towards your goal, you know. So there's no reason to kind of be afraid of that, of that no anymore.

Speaker 1: 11:41

And now you know, I'm probably like the most annoying uh podcast host. When I decide to reach out to someone, right, like I reach out until I get a no or a yes, I'm sure it's, I'm sure it's frustrating, um, right, it's just, you know, as, as you know, someone in my shoes, right, when people reach out to me, I always try to make an effort to reach back out and sometimes I I forget. Great example you know, someone reached out to me, uh, back in, like like November to come on their podcast, and I had completely forgotten to even respond and literally an hour ago the message popped up like somewhere in LinkedIn. You know you haven't responded to this person in you know five months and I immediately responded. You know saying oh my God, I'm so sorry. You know, I read this and I thought I responded and I didn't and I completely forgot about it. And it's just. You know, it's like that social dance. You know that you're playing that eventually you get better at as you do it.

Speaker 2: 12:49

Yes, oh, a hundred percent. Like, how many times did you and I go back and forth and then forget to respond to each other and then no, I'm glad you came at me when you didn't. Do you want to come on or no? Let's get a date Like that was great. I admire that. You know, sometimes you have to.

Speaker 2: 13:05

Life gets in the way and I think that's kind of where it's at. But you try and that's how I feel with security is, you know and I say this mostly because I'm a woman in security I'm the only woman on my team right now. I feel very much minority in security and I kind of make that my platform to inspire other women, and not just young women, but older women too. It doesn't matter what age you are. The fact is you have transferable skills. You have other qualities that you can bring into the security world that maybe someone else doesn't have. Like you have your own toolbox and that toolbox is genuinely yours. No one else will solve a problem just like you. No one else will have ideas just like you. Like you're an individual. So I always kind of make that my brand right, like push to try new things, don't be scared of no's, be determined and get out there and engage and you know, if you have problems with that, there's opportunities to help you.

Speaker 1: 14:03

Yeah, that's a really good point. You know, and I feel like, with cybersecurity specifically, you know, people always think that the field is made up of nothing but highly technical people. Field is made up of nothing but highly technical people, you know, and I mean, for for a long time even like I even thought that, you know, and I was in cybersecurity and it was because I never, you know, I I didn't have like that full, uh, diverse experience, I guess, you know, and then I went to a credit bureau and, uh, you know, we had technical writers that were women. They, they knew it, you know, just as well as us. They were just focused on documenting, you know, the work that we were doing so that other people can do their job more efficiently, and whatnot, not technical, but, you know, need to be able to understand it to some degree, Right, you know, need to be able to understand it to some degree, right, and program managers and project managers, and you know there's a lot that goes on within security that I think people don't really don't really realize, you know.

Speaker 1: 15:08

So what does your, what is your day to day look like? You know, you said that you're, I mean, you said you're doing a lot from what you said. There's a lot going on, so what's your day-to-day look like?

Speaker 2: 15:22

My day-to-day is different every day. That's the thing with it that it may be helping set up a vulnerability management program. So I'm not familiar with vulnerability management, I'm brand new to this, but my skills match with setting it up and managing people and ensuring the deadlines are met. You know so more. So it's okay. What policies or procedures do we have to follow? Okay, these are your ideas. Well, I'm going to challenge some of those ideas because to me, to have a successful security anything program, team management it's about people. So if we're going to create a vulnerability management program, for me it's always ensuring that developers, people involved in that management, all know their expectations. They all have policies, procedures, but they also feel safe to talk about any concerns they have.

Speaker 2: 16:15

You know, it's no fun to go into something ever it doesn't matter if it's in security it's no fun to go into something not prepared or not knowing what's expected of you. That's no fun. So like that's kind of part of that that I'm always ensuring that these are met, these priorities are met and people are helped. You know, and for me, security isn't just technical, it's a people-centric Teams work. You know, and for me, security isn't just technical, it's a people-centric teams work together, collaborate. Security isn't every one thing, so there's that. It's also ensuring, because I work in fintech, that we have our pci, so that's going to be going to get evidence. So I'm collecting evidence from several different teams and working with auditors and you know all this stuff, but also doing phishing simulations like I.

Speaker 2: 16:57

My day is never boring. I wish it was boring, that would be great, but it never is. There's always something on the plate. I'm always having discussions and it's challenging me, and I didn't think when I went in to security because I didn't have confidence in myself that I would be as good at it as I am. I didn't think that lots of other people kept being like you're going to be great, you're amazing, but for me, I I just didn't see it until recently, and now I know like I'm doing an okay job, I'm pretty good at this and I will take on your challenges.

Speaker 1: 17:33

I might not know everything, and that's okay, but I'm going to learn as I go and if I have questions I'm going to ask, and I've you know, I've worked for some companies before where that was kind of the culture, right, when people were afraid to ask questions to certain people because you know they would be undermined in some way, you know behind closed doors, without them even realizing it, or whatnot, and that's yeah. And that's always a terrible environment to really be thrown in, especially as someone that's just starting out. Oh wow, you know, this was on a team where we were all very, you know, early on right, Like half of the team just graduated college, oh wow, and you know the other half of the team had just started in security and so to be thrown into that environment it's like man this can really sway me away from cyber security altogether yeah, oh, 100.

Speaker 2: 18:45

I remember when my so when I first got into this, I did um, I was asked to do a presentation and it was just kind of not technical. It was a presentation about transferable skills, because I have this career background. That's what I've been doing is transferable skills how do you take your skills and utilize them somewhere else. So I did this whole presentation and we're talking about feeling like maybe you don't want to go in security and for me this will be a bit graphic, but it'll make sense. I'm not going to go in full detail, but as I did that, someone stole my presentation and they drew, like you know, very provocative, mean things on my presentation. They wrote curse words, you know, like very sexualized, rude comments on my presentation, to the point that, being a woman, this is my first ever presentation in security where, being a woman, I almost felt like, okay, if this is what this environment is, I don't want to be here, I don't want to be in this. You know, like that's not a very accepting environment.

Speaker 2: 19:48

But I did end up, you know I turned it around, but they drew very bad drawings and then I eventually said if you're going to draw it, draw correct. You're a horrible artist, you know, and everyone laughed like do it right the first time, so either way. Then they got kicked out and that's where I kind of turned my presentation around to why it's important to recognize that this is what women can go through, why it's important to understand that being a woman, being a minority, being, you know, someone not usually found in the field, can be challenging. And I feel very grateful because my whole team is so supportive and they're dynamite and they constantly are pushing and they have my back all the time, like I'm very lucky and I love it, you know, but some people they just leave because they they don't feel that connection or being welcome yeah, it's, you know it's, it's uh, it's crazy the things that, like, women have to put up with or not have to, but you know what I'm saying, like what they go through in the workplace.

Speaker 1: 20:55

Um, I, I've had on, you know, several other women and they all have, you know, different stories. Some of them, you know, have really good stories of not, you know, uh, encountering any of that or anything like that. But you know, it's so childish, right, like it's so childish, right, like it's beyond childish even. It's like why, like this is another professional, right, like she knows her stuff in her area, she's not trying to venture out, she, she's, you know, staying within her bounds, not saying anything incorrect, and you're giving them a hard time for no reason.

Speaker 2: 21:30

Even if they didn't stay in their bounds or whatever. That would be what I mean. Like there's, we have discussions.

Speaker 1: 21:40

Don't go to this lens like silly stuff, you're right oh, yeah, yeah, I mean I, I, I want to, I guess, clarify, like the bounds statement, right, the reason why I said bounds is because people in the community can like, when you're out of your depth, right, and you're not, you know, an expert in some area, it opens the door for people to criticize you, right, not that you shouldn't talk about it, not that you shouldn't ask questions about it or anything like that. Um, but I'm saying, like, you didn't even open the door for anyone to do this and they kind of kicked it down. You know what I'm saying. So, like it's not, I didn't want that to come off as, like you know, oh, they should just stay within their area.

Speaker 2: 22:25

No, no, I got it and I think, but it's not at all. Yeah, and I think but it's not at all.

Speaker 1: 22:32

Yeah, to have those, but it is important to have that fostering environment and it really was like that one, that one experience really could turn a person off, you know yeah, I mean, honestly, if that happened to me, I mean I probably would like just walk off stage right, like I I honestly I don't know how I would handle that Like that would be, I would find a new career, probably if it was early on too, like oh yeah, I'm, I'm not, I'm not going back there, I'm not going into this career, that's just, but that's just me. You know, I really give you a lot of credit for sticking with it, because, honestly, I probably wouldn't have stayed with it.

Speaker 2: 23:14

A hundred percent. I remember once. So it's interesting. This is I love talking about this because I'm very passionate about it, but also a lot of women go through similar things, but they never bring it up because it's there's a fear of this. Oh, if I talk about my experiences or if I cry, I'm weak, and it's like no, you're not weak, you are a human. Your feelings are valid, everyone's feelings are valid. Leave it there.

Speaker 2: 23:37

I remember, even outside of security, like so, I have IBS, so I'll get a bit bloated, and people will come up and touch my belly and be like when are you having your baby? Oh yeah, like when are you due? Like I'm not thank you, or I respond go, I'm just fat. Like, leave it alone, you know. So there's just these weird things that happen that I was not prepared for entering the workforce.

Speaker 2: 24:04

But if I'm bringing that back to my team now, like I was very clear with them, all of my experiences, bad managers I've had, like my, because I still have imposter syndrome, and you know, every time I do something, even if I do it well, I wonder did I do it Well? Was that good enough, though? Really it was, and I'm getting immaculate compliments all the time. Oh, you did great. But your self-doubt still kind of leaks in. But my team has been dynamite. You know, I was open with them about my experiences and they are like they're. They're supporting me, they're like my little cheerleaders, you know, you got this. Oh my God, this was so good and it's really beautiful to have. And they're all dudes, like they're all men, and it's amazing. Right, it's something I didn't always have in my career, so I'm grateful for that.

Speaker 1: 24:53

Yeah, it's, you know, you, you, you touch on a lot of things there, so you know. I think the first key point might be that you're open, you know you're, you're very honest about you, know your own skill sets right and where they lie and potentially even your own insecurities with it right. Because I remember when I was trying to get into security right and I just took the security plus book and opened it up and I was like how in the world am I going to learn all of this?

Speaker 2: 25:23

You know like.

Speaker 1: 25:23

I got my bachelor's in criminal justice. You know like and it wasn't until fairly recently that I didn't have imposter syndrome anymore. You know like, I always felt like like oh, I'm a fraud, right, like they're going to find out that I'm a fraud and if I say the wrong thing or do the wrong thing, like they're just going to get rid of me, you know, and that's going to be the end of this run, right Like I. I had that literally up until probably two years ago, maybe maybe two years ago maybe even sooner you know, and I've been for 10 years- Wow.

Speaker 2: 26:05

So for eight years of your career in security you had imposter syndrome. Wow, I guess that speaks numbers.

Speaker 1: 26:14

Oh yeah, absolutely. You know I think it's important to to mention. You know everyone goes through something like this right, like, if you're not, I feel like if you're not going through imposter syndrome at some point in time in your career, you're probably not pushing yourself outside of your box. You know you're probably not pushing yourself outside of your comfort zone and I feel like it's more prevalent when people are really trying to do something that's new. You know that they haven't done before, they didn't even think that they could do, and they're trying to do it anyways because, like it's just stuck in their head and it's like I have to try. If I don't try, I'm going to regret it.

Speaker 1: 26:53

You know it's like that. You know that, that voice in the back of your head. Same thing with the podcast. You know, like I used to have a little bit of imposter syndrome. You know, talking to someone, you know that might be the founder, ceo or cso of a company, and now it truly doesn't matter to me what the person's title is, like it, it does not matter because they're all people.

Speaker 2: 27:13

This is this. Is it that right? Everyone's a person. And, on top of that, that cso was where you were. You know what I mean. It's not like they were born, they went and took education. They just became a cso. Like that didn't happen. They had to go through trials, tribulations, had had to learn, and that's why I think that's an important perspective to look at. You know it's everybody started somewhere.

Speaker 1: 27:38

Yeah, yeah, I, uh, I have a good friend of mine that you know, when I, when I got nervous talking to people, he would say oh well, you know, are they like from a different species, like, are they human? You know, do they bleed red red? You know, and obviously all the answers are yes and he goes well, then, what are you nervous about? It's just another person and he, he made a.

Speaker 1: 28:03

You know it was a really good way of thinking about it, you know, because at the end of the day, we're all just people. We may have different titles and whatnot, but we all have our own story, our own path. You know that we went down right and I, I, I own path. You know that we went down Right and I, I, I hope my conversations, you know, with you and with other people will help someone, you know, kind of realize that and and understand that they can do whatever they, whatever they set their minds to. You know they can do it, no matter how big of a jump it is, which you know, with, with, with, with you going from the career center right into cyber security. I mean, if I were to, if I were to guess, you know a hundred times right where you were going to go from a career center.

Speaker 2: 28:44

I never in a million years would have guessed cyber security yeah, and it's kind of funny to me because I had a manager that, oh, we just did not get along, we did not get on at all, threatened to make me cry, like just not a good manager, and I think this is going to sound ridiculous, but I'm actually grateful for that experience because it made me push myself more, like I was pushing myself to prove to that person that I'm not a huge fan of you know what?

Speaker 2: 29:12

I'm better than what you think I am. I'm more than what you think I am and I'm going to prove to myself that you're wrong. And that's been in the back of my head the entire time while I was pursuing this career. I'm like I'm going to prove this guy wrong, and I know it's not the best way to do it, but it was the kick that I needed. You know, that person influenced my, and the fact that almost like they tore me down wasn't what I needed. So in the back of my head I was like no, no, no, no, I'm going to prove this person, I'm going to do what I want to do, I'm going to get there. And then I did and it was a huge accomplishment.

Speaker 1: 29:51

You know, it's interesting that you bring that up. I had a very similar experience early on in my career, and I don't think I've really talked about it on the podcast. You know, so early on in my career a contract had ended kind of abruptly with a company. They extended several times, little did I know they were going to go bankrupt within a year and so they canceled the contract and within like a week or two, maybe three, I had another job. I didn't know it at the time, but this company, and specifically the hiring manager over the department, had a fantastic history of hiring people and arranging the contract in such a way where they can terminate you for any reason without cause within 90 days.

Speaker 1: 30:38

And I didn't I didn't, you know, understand that. I figured it was, you know, a normal thing, cause I'm so early on in my career. Um, I figured, well, what am I going to do in 90 days? That'll get me fired. You know, like I'm going to be learning about the company and what to do and all this other stuff, and so I didn't think anything of it. Well, you know, he, he gave me these three or four major projects to do, and I mean when you set a goal in front of me, like I, I just march towards it, like it doesn't matter what happens, I just go towards it until I hit. Until I hit it, you know, like I'm never late on deadlines or anything like that, I finished the goal, the, the projects, two weeks before the 90 days and, you know, the following monday I'm like oh right, and come to find out.

Speaker 1: 31:28

He has a history of doing this, where he purposefully hires people to do projects that other people don't want to do and gets rid of them at the 90 day mark or right around it. You know, and uh, that was, that was a huge thing for me. So I'm already hurt, you know, from that perspective. And it's the holiday season, so literally in the holiday season, if you get fired, you know you are waiting until January to get a new job because a hundred percent of companies are posting but no one is really hiring.

Speaker 1: 32:01

You may even interview but no one is hiring. Right, and you know, I'm a new grad from school, I have bills to pay, I have a car loan, I have student loans, you know all this other stuff. So it was extremely stressful for me at the time and I interviewed with you know another company. Eventually I got the job with this company, but he requested to speak to my previous manager and my previous manager it came down maybe a year later into this new role. It came down to my previous manager had said I don't think he's cut out for IT. I don't think that he should be in this field. He should probably find another place to work. Well, my new manager had said anyone that'll say that about anyone regarding it doesn't know what the hell they're doing, and so I completely disregarded everything that he said.

Speaker 1: 32:59

And I was like man, like that, you know, not not only was that a really good thing for him to to do, it really spoke to his character, but that when he told me that, when my new hiring manager told me that, probably a year later, you know, in my, in my yearly review, um, like that lit such a fire under me. It's like, oh, he, oh, he thinks I can't, he thinks I can't do this. Oh, okay, I'm going to go get my master's, I'm going to go get my PhD, I'm going to go be, you know, in charge of, you know, one of the world's largest automotive manufacturers, their cloud security environment. I'm going to manage all of that. You know, like all those things Like it.

Speaker 1: 33:40

Just it just takes me straight back there, like I get, I'm getting fired up just talking about it, cause it's like man, how dare someone tell me I can't do it? Like, like what? Like what are we talking about right now? You know that was, that was such a a transformative you know, experience and time for me, because you know I went through such great struggle for two and a half months trying to find a job. I mean, it was literally. It was literally the Monday after Black Friday, the Monday after Black Friday, you know Thanksgiving. It just happened right before my benefits were going to kick in.

Speaker 2: 34:18

Oh, it was right before your benefits. That's why they did it A hundred percent. They don't want to pay you benefits.

Speaker 1: 34:23

Yeah, yeah, Well, you know, he, he, he had a history of doing it and once I like knew more people in the in the field, like they told me, like you know, there's a lot of staffing agencies here in Chicago and none of them will work with him because he has that history of doing that. And they all say, like it's not fair to our employees because if they're doing a stellar job they deserve to at a minimum be extended, but this guy won't even extend them.

Speaker 2: 34:53

Or at least get a good review when your contract's done. Like you know what. To be honest, it sounds like. It sounds to me like you. You had a good miss on that one.

Speaker 1: 35:05

Yeah.

Speaker 2: 35:05

Yeah, it does, because that's a toxic environment. You don't need to be in that.

Speaker 1: 35:12

Right, it's interesting when you're earlier on in your career it's so hard to identify those toxic, bad situations. Yeah, you know, because you don't really know what to experience, you don't know what to expect, you don't have the experience to to. You know, compare and contrast, right, and uh, it's just really. It's really interesting because, like you know my current employer, um, you know they just said this pretty. You know my current employer, um, you know they, they just said this pretty recently. You know, like, yeah, we don't pay what the market pays, right, we were not able to do that, but people stay here because they like it here.

Speaker 1: 35:53

And you know that really rang true, because I've been so many places that were just miserable, you know you, you you hated going to work and everyone, you know everyone was in it just for the other guy, you know not, not not trying to be there, you know, for the company or anything. It's like man, he's going through this too. I'm going through it. If I leave, he's not going to have anyone to lean on, you know. But that sort of thing, it's just interesting how you know that doesn't even come up, you know, in your head when you're going through something like that or at least not for me.

Speaker 2: 36:31

I think that when you're happy at your job, that doesn't come up anyway. So whether you're a paid market value or not, like if you're happy and you feel that you're valued in your organization, that's enough to keep you. Now, I mean, it is nice to like make money, don't get me wrong. Money is great, but also that doesn't just define or dictate a good workplace. You need to feel valued, you need to feel like you're growing, and I think that that's very important. So that's also. I'm huge on expectations. I just have to say it. Like I'm huge on defining and utilizing expectations. No matter where you're at, let's have expectations of your work, expectations from my company. What do I expect from my company? What does my company expect from me? How about my teammates? And so it sounds to me like you have a very transparent organization that has set good expectations, so you know what you need to be successful and that ultimately makes you feel valued.

Speaker 1: 37:27

It's important yeah, it's um, I've I've been in situations where I haven't had that, and it's always you're always wondering am I doing good? Am I am I delivering, you know, on this thing or whatever? Um, because you know, like I said before, right, like when I'm given a goal, I just march towards it until I'm done Right. So I have finished projects, you know, months earlier than what people expected of me. And here I am, you know, not doing that much work afterwards, right, and I'm feeling like, well, did I do good? Did I do right? Am I supposed to be doing something else? You know, it's uh, it's an interesting mindset, I guess it is.

Speaker 2: 38:11

Yeah, I think it's important though, and I mean I guess it would be, if you finish projects earlier, then cheers, I mean. So, yay, you have a little bit more time. That's okay. As long as your organization doesn't care, I think that's wonderful. Yeah, you know you. So be you and do what you can.

Speaker 1: 38:30

Yeah, that's a good point. You know what are some unique challenges that you encounter with your role. You know it sounds very diverse. You obviously don't come from a technical background. What are some unique challenges and how do you overcome them?

Speaker 2: 38:46

So it's the technical, it's 100% the technical stuff. You know, as I'm in meetings, they're talking about servers and I'm like what are we talking about? Like I know what a server is, but how? Or they're talking about AWS, or they're talking about Kubernetes. Then we're talking, like I can code, I can do HTML CSS. I don't like it, but I can do it. So when I'm talking with engineers who are doing that part, okay, I can understand, I can even read your code, it's okay.

Speaker 2: 39:19

But when we're going into, like you know, any of the vulnerability management platforms we're using and they're talking about, okay, well, here's our top 25 vulnerabilities, this is how we're going to remediate them, and I'm like can you just talk to me, like I'm five, just for a couple minutes? You know, and it's not because I don't want to learn that, just I feel like it's so much information thrown at me that I don't get time to process it and I'm kind of a visual and a slow learner. I like to engage and ask questions and I like to learn about something, a theory, a perspective. You know, what does it do? How does it do it? Why do we do it? And in a lot of meetings there's none of that. It is being thrown at me a hundred percent%. So that's my biggest challenge. But I literally am just, I'm not scared to ask questions and I utilize my team. So afterwards I'll message my teammate and be like okay, so what was this, this, this and this? I don't understand this. And then he has this ability, he's just a natural educator. So it's really wonderful. So he'll educate me.

Speaker 2: 40:20

And I'm also in an incident response planning course right now. So that's pretty interesting. But there's a lot of challenges in that because, yeah, it's like business continuity management, which I really love. But then it's also bringing in the technical part of OK, if we have this kind of you know incident, this kind of you know incident, so let's just say there is a ransomware attack or there's these kinds of attacks, what teams and how are you managing that through a technical response? And that's me still trying to navigate that technical side. Will it slow me down? No, it won't, because I'll learn, I'll engage, I'll figure it out, I'll ask questions, I will Google it. But you know, it still is a big challenge for me.

Speaker 2: 41:04

I think my other challenge too is there's so many moving parts to my role. I'm managing a lot of different things all at once that I have to remind myself to slow down. You know, today actually was a very ridiculous, crazy day and I'm doing three different things. New policies came in Okay. Something to do with an audit came in. I'm doing that. Oh, now, look, there's a phishing thing that I have to write, and there's just consistently something. So I have to remind myself A not everything has to be done right away, it's okay. If it's not done the same day, I'll survive. B take a step back. Make sure you eat, because I, like I'll work sometimes so much I forget to eat. So I just have to remind myself it's okay, you are a human, you don't know everything, you're brand new, like you were a baby in this, and it's okay. You're gonna take baby steps and then you're gonna walk, then you're gonna run. So I'd say that would be my major challenges, but saying it it's not going to slow me down, joe, I'm going to keep going.

Speaker 1: 42:06

Oh for sure. Yeah, you know it's. It's interesting when you're learning, when you're kind of learning from from zero. This is probably true for any any you know career, specialty or whatnot. You know, when you're starting from zero, it's like you're drinking, you know, not from a fire hose, it's like you're drinking from like a dam you know that allowed the water to go through.

Speaker 2: 42:30

Right, like that's what it is it's like man, can I just get a?

Speaker 1: 42:33

drop. Can I get one drop?

Speaker 2: 42:37

And then because when you're new, you want to like am? I'm not a people pleaser, but I like to do things well. Like I am, I don't want to have to keep going back and redoing stuff all the time, like that's just not my plans. So when I do it, I want to do it well. First or second time done so for me. I'm just, I'm taking it all in and then I'm organizing in my head and that's I. That's where the overwhelmingness is coming from right, because, you're right, I'm having a dam thrown at me and I have a straw. I will just try to suck this. That's not going to work.

Speaker 1: 43:13

Yeah, it's really interesting, but I've found that if you just stick with it, eventually it'll click. I remember for me it took probably two years in IT before what I was doing clicked Like, oh, this is a server, this is a container, this is how it runs, this is how it interacts with each other. It took me probably two years of literally doing it every single day to actually like understand, you know? And then it just repeats Right, because now you have that new foundation, all right. Well, we're going to put some more stuff on top of it and you're going to learn that. The time period may be, you know, shorter than than two years, obviously, but you know, you're going to learn that and you're going to feel like you don't know anything. You know zero.

Speaker 2: 44:11

You're going to wonder why you're learning it, you know and I feel too, because I transitioned to security when I was 37. So I'm 40 now and there's some PII for everyone. There you go. So I'm 40 now and there's some PII for everyone. There you go, whatever, okay. Well, I'm 40 now. So I'm finding my learning has changed since I was in my twenties, you know, and it's also my priorities have changed since I've been in my twenties. So that too, as you age and progress, that you start trying to figure out okay, how do I learn something, how do I grasp that? I'm not a little whippersnapper anymore where I can just pick it up and be done with it. I have to overthink it now and then put it back in there again, and sometimes it just leaps. It's interesting as you age and you try to learn.

Speaker 1: 45:02

Yeah, it's fascinating how the brain works, you know, I try to, I try to, you know, push myself um every year a little bit right to learn a new language or learn something new, because I feel like that keeps me a little bit sharper, you know. But, yeah, like you have to, you have to understand really how your brain works, how how you learn things, how you retain information, and you have to learn how that changes constantly too, so that you could really stay on top of it.

Speaker 2: 45:38

And even how to focus, focus on these things that you don't really know or you're. You're semi interesting, but you don't have the passion I'm not as passionate about you know a server as I am about the program of the server, like the people being involved or the organization of it. So how do I take that passion and navigate to something that maybe I'm not as passionate about?

Speaker 1: 46:01

Yeah, absolutely. Well, ashley, you know we're at the top of our time here. Navigate to something that maybe I'm not as passionate about. Yeah, absolutely, well, actually, you know we're at the top of our time here. I feel like you go for another hour, right, so that just means I'll have to have you back on. But, yeah, absolutely, you know if, if you want to, you know you can share with my audience, like where they can reach out if they wanted to. You know, connect and, you know, maybe learn more. Do you have a place like that?

Speaker 2: 46:29

I have LinkedIn right now, so you can just look up Ashley Burke, it's B-A-C-S-M-E-S, so B-A-C-S-M-E-S and feel free to connect. Just I asked if you want to connect with me on LinkedIn. You want to have discussions. When you send me an invite, can you just put how you heard about or how you connected? Because if I just get random invites, I don't accept them, so that's all I ask everybody.

Speaker 1: 46:52

That makes sense.

Speaker 2: 46:53

But thanks for listening. This has been really fun. It's nice just to kind of have general discussion and show that security isn't just technical. It's a wider perspective than that and there's so many ins and outs of it. So thank you for letting me do that.

Speaker 1: 47:08

Yeah, absolutely. I think it's really important that people hear that right, because, like you said before, you always think it's a highly technical role, that you'll never be able to bridge the gap, that you'll never be able to get there. But you know, obviously you got there and I think you know my audience hearing that story, you know, may very likely help them. You know, achieve the same thing.

Speaker 2: 47:35

I hope so. Any help is good. Help right and don't let your age get in the way.

Speaker 1: 47:41

Absolutely that you can do it at any age. That that's, that's very true. Well, thanks everyone. I hope you enjoyed this episode.