I am a cybersecurity leader. I've worked in with over fifteen years of experience in the cybersecurity space. And, yeah, I I was an English major.I am an English major. I guess it doesn't go away. Right? But, I am an English major, and I will be telling you about my unusual journey from English major to a cybersecurity leader. Because if you had told me when I was studying to be an English major that I would end up being a a CISO, I would have been like, first of all, what's a CISO, and what is cybersecurity? So it has been I really just wanted to speak to the fact that it's a nonlinear journey. So please feel free to ask me questions in the chat. Hopefully, I can get to some of them. But alright. I'm gonna get started. So it seems really unlikely. Right?

What I used to get asked all the time, what's an English major doing in the cybersecurity space? Most people didn't know I was an English major when I entered when I started working in the cybersecurity space. It is an unexpected nonlinear journey, but that's honestly not unusual as unusual as you would think in the cybersecurity space. So how does this journey come about? Right? Let me go back one. Okay. Always a little bit of difficulty. So okay. So the career arc. I have this presentation to kind of help give the overview of of what we're seeing, you know, and what what kinda happened for my career arc. This is just mine, but what I want you to be able to take away is the the transferable skills that happen in so many different types of majors, particularly liberal arts majors.

So my foundation was an English major. I went very logically from being an English major to going into publishing and doing editorial work. I didn't like the editorial work, to be honest. I I loved reading, but I didn't enjoy the solidarity of it. And so I moved into the operational side of the publishing business, so expanding my potential there. And then I started to realize I really like the operational aspects, more of the business aspects of it. I liked solving problems. So at that point in my expansion period, I made this really big decision to kind of pivot industries. I also went back to school, to be honest, for, graduate school for my business degree.

I felt that that would help me pivot better so that I can move into the non publishing space and into the broader business world. When I finished my degree, well, as I was getting my degree, I started to realize I really liked looking at things from a risk perspective, which is a lot of what I had done in the operational. First, I was part of operational, then I became overseeing operational analytics. And so I really love the challenge of the way you have to look at things and the way you have to anticipate things. There's a lot of critical thinking involved and pattern recognition. And so you start to understand the risk narrative, and so it just made sense. So I make this big pivot by, you know, doing getting some more skill sets from business school, and and I find myself in the cyber leadership space.

So I'm gonna go a little bit deeper into how this kinda happens. Right? So an English major. What what what is an English major? Where you're usually doing you're taught a lot of critical thinking. You analyze the text that you're reading. You're reading a lot of very, a lot of classic literature that has a lot of depth and meaning and symbolism. And so you get very good at understanding the subtext of a text. And it's it's really this criticality that you're taught and the argument and how to make an argument and how to communicate clearly not only in through the written word, but verbally. And how you learn to construct these arguments that becomes honestly a superpower. And you think, well, you're just an English major. And that's what I used to think, honestly.

But as I started to go through my process, I found that these critical thinking skills, learning how to articulate yourself, how to be precise about your wording and not just flip it, started to help me through my career even before I got to cyber. And it starts to get more precise because cybersecurity needs to be precise for those of you that are familiar with it. For those of you who are just coming into the cybersecurity space, there's a reason that cybersecurity has a foundation and a lot of, like, a lot of it comes from military backgrounds is because there is a lot of precision involved in threat detection and in the analytics and the risk interpretation.

So we learn critical analysis, research methodologies, and you start to see how these things help. You know, critical analysis is the core of threat modeling. You know, research methodology, this is how you understand threat intelligence. Ethical reasoning, there's cybersecurity space has expanded tremendously with privacy laws, data governance, and now we have AI governance. So all of this requires the ethical reasoning that you are taught as an English major or, honestly as a liberal arts major. Precise communication, you'll need this so much if you want to be a leader in any space because you're always gonna have to communicate up and out. And with cybersecurity, you have to communicate quite often to the board and to the audit committees. And knowing how to tell a narrative, how to tell a story really helps. Argument and logic. You are gonna have to argue.

You're gonna have to and and and when I say argue, it's like you have to debate how's the best strategy. What is you have to debate for budget. You have to create a logical process or put logic around a process. And then pattern recognition. It's really if you're thinking about it apologies. I went back out just so I can make sure I'm checking the chat. Pattern recognition is really important because it's talking about and it keeps going back. I keep going back to the beginning. My apologies. It's really about narrative. It sounds oversimplified, but it's not. Because when you're reading, there's patterns in writing. So you learn to interpret these. So the editorial work, this is where I started. And I'm not gonna go through each one of these in detail, but I am gonna tell you that this is a foundational element, and and it's the expansion of that English major into the cybersecurity phase.

So you can kinda see one to one how manuscript evaluation turns into policy and procedure review. Copy editing and proofreading turn into vulnerability assessment, fact checking, threat intelligence, audience awareness, executive communication, deadline management into project coordination. All of these keep you know, they they keep expanding on the foundational work. There's a lot of discipline in being editorial. You're framing something when you're an editor. You're helping elevate it, make it sharper, clearer, more concise. And all of that translates so well into the cybersecurity space. As I mentioned before in my career arc, I moved into publishing operations. So now I'm expanding the lens, moving out of just my, editorial context and editorial job. And now I'm looking at the larger workflow of the business. Right? So now I'm looking at true process, which absolutely speaks. And it crosses many industry lines.

So in this slide, what you can see is, like, the content acquisition, meaning acquiring the actual manuscripts, translates into process design because there is a whole process around that. It's a sub process of the larger process of content production workflow quality control distribution metrics. And those directly translate into vendor management and data analytics and change management, which anybody who is familiar with the IT space in general, change management is so critical and so important. I mean, all of them are, but change management is one where lots of times things get hung up. I moved from within that still publishing operations, I moved into overseeing the operations and kinda leading the machine. I wasn't just part of the operations. I was overseeing the operations team. And the you know, so I'm in a leadership position, but I'm not in cybersecurity yet. I'm still in the operations side.

But the leadership skills you learn in any leadership position will, of course, translate. But they also bridge into the risk management space. And at the end of the day, a lot of cybersecurity people don't like to admit this, but the cybersecurity is all about risk management. I mean, let's be honest. You're mitigating the risk of a cyber attack of a threat actor. And so the strategic planning, the cross functional leadership, the budget oversight, and the budget and resourcing oversight is a real challenge in today's climate, especially for cyber. They are cutting cybersecurity teams like crazy. They wanna move all the AI, and it it just can't happen that easily. So being able to to really know how to ask and manage your ask for resources and manage your budget has become so critical. Risk identification.

Again, that's what I was talking about. Cybersecurity is about risk management and continuously improve improving. I didn't make I didn't say anything about the stakeholder reporting because it's kind of a given. You always have to be reporting out. There's tons of regulation now that's expanding and putting more of an onus on cybersecurity leaders and even holding some of them personally accountable. So you are not only managing risk for your organization, but you are managing your own career or career risk. And I don't say that to be scary or to freak anybody out. I say that because it's an important element that you need to know going forward. This is this is a value proposition. And when I mentioned earlier ethical decisioning, this is why. You know, it's it's very much about brand.

Everything that can go wrong will. You have to learn how to take things in stride. And so you see this this bridge happening. It's about, you know, finding escalation paths and making sure you know who the owners of these risks are. So we go here we go from the leadership in that operational space to the big pivot. And that pivot is into banking Because it's an enormous difference in to go from publishing to banking, obviously, is a massive difference, and that's why I went back to school. That doesn't necessarily and I don't want you to go away thinking, oh my god. I have to go get a graduate degree. No. What what I went back for was to get a new skill set or and or new knowledge that could help me pivot out of the existing industry that I was in.

Because I knew my knowledge base the English knowledge base had the English major knowledge base had helped me tremendously. But now, I needed more in order to make this big industry jump. That could be classes. That could be a certification. That could be a boot camp. It will require more knowledge as if you don't have a background in cybersecurity to start to understand that space. That's a given. It doesn't need to be a graduate degree. I just wanna be clear about that. So in the banking, I start to learn about the risk framework or the triad, of risk that identify, control, report. In cybersecurity, you learn a different triad, which is confidentiality, availability, integrity. You can see where these all kind of align a little.

So we're dealing with these triangular frameworks that are very important to govern a space. Again, we go back to the English major translating to the banking skills. Reading really helped me become very good. The the the the close reading and the language mastery that happens with being an English major really helped me become better at creating controls and defining risk and defining the narrative. The research skills that you inevitably learn in school with any liberal arts degree just help you look at everything much more analytically. So that way you know what you're looking for. You find it. You get to it. You just become better at researching in general. And then the writing clarity, of course, lends itself to actual risk reporting. This goes hand in hand, obviously, the writing clarity with the risk narrative.

Because defining your narrative is really important, especially to your leadership team. So cybersecurity leadership. Here I find myself. And to be honest, I didn't realize I had arrived here. I'll go into a little bit of depth. So at the bank that I used to work for, where I went into operational risk because I had a background in operations, is where I started my cybersecurity career because I had to start talking with several different tech teams because that was the underlying infrastructure of the of the entire general ledger that I was supporting from a Sarbanes Oxley perspective.

And it made a lot of sense, and I started going deeper and deeper. And then I started to find myself going into the cybersecurity space, how to defend, how to and it was a very natural transition for me because I was already thinking critically from a risk perspective about controls. How do we make sure nothing bad happens? How do we make sure we're reporting correctly to our regulators at the bank? And so this becomes a very natural progression for me because cybersecurity is all about defending. Right? It's about taking defensive move maintaining a strong defensive posture while at the same time knowing when to make certain offensive moves. And so, you know, I find myself going into this space and I love it. And I think, ah, I found my space. I'm not gonna lie to you.

It's a little difficult navigating it sometimes, because it was a tremendously male dominated space and that can have its own nuances. But I was really passionate about it and I really loved it. And so and I felt all that foundational element. It took me years before I could reflect back and see that I had kind of been building towards this. Because before, it used to seem like my journey went like this. And and it didn't make sense, and I was jumping around. But when I really looked at my journey, it was a very methodical, you know, I was following the passion. I was following what I was interested in. I can't emphasize that enough. Follow what you're interested in. I love what I do. Yeah. I don't love it every day.

There's some days that you're like, oh my god. Why do I do this? But, you know, I love talking about the governance. I tell everybody I'm a risk nerd. I love talking about the risk, the compliance. I actually have a brother who's in cybersecurity, and we completely kind of nerd out when we're talking about that. So these are all really critical areas that had built up. And it became just like my passion. And so what I the whole point of this is to tell you that even though you think you're so far away from cybersecurity, I had an art degree major, I was a studio artist, or I was a liberal arts, or what whatever, It's about the skills. The skills translate. You just have to be able to connect them. And so this slide is to show you that the discipline's identical. It's just the domains that changed. And so all of this core foundational skill that you've had in whatever you studied or whatever your past experience is, you can map to cybersecurity skills.

You know, there is, like, this is an English skill to cybersecurity analog mapping, but it's there. It's and it's so important. So this is the path that's a superpower, thinking the narrative, seeing the system, bridging the world, you know, and and being able to explain the story to people. So where I came from, word analysis and research. Where I stand now, risk, governance, compliance, and leadership. It's just