GOTD - Omar Sangurima
===

[00:00:00] Welcome to Guardians of the Data. I'm your host, Ward Balzerzak. Each episode will explore the passions, expertise, and real-world experiences of security leaders who are helping the future of data security and governance. Guardians of the Data is made possible by support from Sentro. To learn more about our AI-powered data security platform, please visit sentro.io.

Let's dive in.

Ward: Welcome back to another episode of Guardians of the Data. My guest today has over a decade of experience in cybersecurity. Pretty sure this guy doesn't sleep. He's a cybersecurity leader, AI governance strategist, risk management expert, and he hosts two different podcasts and is the author of a monthly newsletter called The Convergence.

Currently the head of cyber governance and risk and program management in the healthcare industry, Omar Sangurima, welcome to the show

Omar Sangurima: Thanks for having me, sir. It's a privilege to be here. You come well recommended by a couple colleagues and, uh, you know, anything Jason says is, uh, [00:01:00] is the gospel to me, so

Ward: I love that. And yeah, Jason Torres was a former guest, so glad to have you on. Uh, so Omar, let's get into it. In your professional opinion, what's the biggest data security challenge that organizations are facing?

Omar Sangurima: it-- I'm gonna be pretty plain vanilla here. Sorry. I, I tried to noodle on this for a bit, but it's, it's, it goes back to inventory. If you don't know what your data is or where it lives throughout your organization, then you're doing a kabuki theater dance when it comes to doing any sort of data security.

Like it, you know, again, you can have some compensating controls, and you can make up for a lot of sins, uh, in the, in the data security space. But at, at the heart of things, you really truly need to have a good data governance strategy in terms of important to your organization data-wise. the heck out of it.

There's a lot of tools that do it out of the box, so there's really n- not that much of an excuse other than just having the appetite to [00:02:00] do it, then, you know, watching where it goes and putting appropriate controls around that. If you do that, you can, you, you c- I would imagine you could probably even save some money in the long run.

But it, the people and the process part of that are always where the sticky wickets are

Ward: Just do it sounds super simple, right?

Omar Sangurima: Hey, listen, it's, it's one of those things and, and like in the age of AI, right, I think it's gonna become even more critical where the acceleration of a bad process is gonna hurt a lot more than, uh, you may be able to sustain. Those risk tolerances and that risk appetite might not be what you're, what you think it is when AI is just really making you do bad things faster because you haven't set those building blocks up front of, you know, again, labeling, monitoring, understanding what is important to your, to your organization data-wise.

Same as regular vanilla asset management, but, but da- but now with more data,

Ward: So let's break it down a little bit because, I mean, [00:03:00] y- you've seen it, right? You're, you're in the space. You get it, obviously by, by what you just said. But we keep having this conversation. I've been having this conversation for, for decades, and I've had folks call me out where it's like, "Why are we still talking about this word?"

And I always kinda laugh. It's like, well, you know, hey, if we had this licked, if every organization had it figured out, we wouldn't have to talk about it, right? We could talk about interesting things. So with that being said, break it down a little bit more for, for the audience. How do you think, you know, what are the first couple steps folks should go through to start understanding that data inventory?

Omar Sangurima: I think one of those things, uh, you know, to, to kinda back up a, a quick second with, with why it's not licked, from what I've seen, really it's, it's that le- it's the curse of the legacy environment.

Hmm

A lot of these, a lot of these, you know, f- uh, not fly-by-night things, I don't wanna be pejorative, but like stuff that's cloud native or springing up or, you know, those new concerns, of course you can kind of do it right the first time and then [00:04:00] just, you know, not do it wrong thereafter.

I think legacy environments present those unique challenges where you're like, "Wait a second, if I'm gonna spend money, uh, you know, if I have a, a sack of cash to spend, do I wanna spend it on cool new stuff go back and, you know, if you're a Microsoft shop, right, use, use Purview and do DLP?" Like, it's just, you know, that's the...

It- it's like eating your vegetables kinda. So I

think the first few things truly to understand is to, you know, as with any security program, truly under- try to get a, a feeling for what's important to the business. you know, I, I work in a hospital, so obviously, right, in a, in a shock to nobody, it's gonna be Yeah, it's gonna be protected health information. If I said anything else, right, you know, you could probably do, "Boo this man," right? Little interludes there from, from, uh, right? Like, "Boo, get him off the stage." But, but it's... So it's gotta be PHI. But, you know, in our, in our organization, we're blessed with having a pretty [00:05:00] multifaceted organization.

I know that I was shocked when I was like, "Wait a second, my hospital has a medical school too? Oh, great." So it's... But it's understanding the core tenets of what makes the business tick, and then going, "Okay, cool. What are, um, the main components data-wise of what then makes that engine run? What, what, what type of data is gonna be the fuel for, for those gears to go and, and move things along?"

I always say that no one... as much as I love to say that I'm on our greatest team in the world, uh, you know, thank the good Lord for making me a New York Yankee, but like, thankfully, I, I ended up at, at MSK. But no one goes to MSK, uh, and says, "You know, I heard they have an amazing cybersecurity program.

That's where I'm gonna get my cancer treatment." Abso- says absolutely nobody. They go there for other reasons. We're there to support that. So it's understanding the type of data that then makes that amazing, and then starting to [00:06:00] try to work backwards on how to protect it

Ward: Love that. Love that. Find out what it is, work backwards, protect it. You know, a lot of conversations I have, and I'm sure you've seen this, right? G- given, given your role and what you do, uh, knee-jerk reactions, right? "Hey, I've got, I've got a gap," or, "I think I've got a gap. I'm going to go buy a tool," or, "I'm gonna go bring in a third party because clearly, right, clearly my issue must be technical," right?

Thr- throw something at it. Um, I heard you say, and so did the audience, something a little bit different, which I, I really wanna highlight 'cause it's one of my soapbox arguments. Understand the data, understand the business. So when you do that, is that conversations? Is that a little bit of your own OSINT?

Is that a, a mix or how are you doing that?

Omar Sangurima: It's, it's definitely a combo, and I, I think they, they feed into each [00:07:00] other. So I'm not gonna chicken and egg it, but whichever end you start with, you want both. If I'm starting with conversations because there's somebody, you know, in a business unit that I respect comes out and says, "Hey, you know, I'm trying to do this thing the right way. I have some questions about how we're gonna protect, you know, let's talk about encryption." It may be like one aspect of the plethora of things that you need to do to protect data in your organization. They'll come, I'll go, "Here," right? "Have some coffee, have some tea. Let's chat." I love those conversations because it's, I think it's solid gold.

I come from a sales background, so you know, when, when the customers come to you, like that's, that's, uh, nirvana, right? And they're like, "Wait a second." So that's amazing. But always like to try to back that up with any telemetry I can get my hands on. And if you're running, if you're running a data program, obviously you have some sort of monitoring or, or a security program, I should say.

You have some sort of monitoring. Um, there's amazing tools. There's amazing things agents can do now in terms of giving you insights [00:08:00] and, and bringing together disparate silos of information of, of data so that you can get then actionable intelligence internal to your own organization. And if you're able to, then can use that to, A, you know, vet folks that come to you with certain issues or support arguments on either side, whether it's your own or, you know, the business is coming to you and saying X, Y, Z. Then you wanna... And, and to make business cases to potentially do spend if there is a need for it, for it at all, want the data. You definitely want the, the telemetry, like you said, the OSINT or just, you know, pulling logs and, and telling a story that supports conversations that you then have, or vice versa.

The conversations can point you to where you need to look and pay more attention. you wanna combine all that to then go the classic, right, three-pronged attack when you talk to any executives. You go, "Here's the problem, here's the solution, and here's the ask." And if you can, anything that [00:09:00] supports putting those three tent poles there, right, you're gonna, you're gonna have a nice overnight stay versus, you know, only having two and then the water gets in in part of the tent, right? Which sucks, so you know?

Ward: Oh, yeah. Oh, yeah. Many of those conversations for sure. Although, I, I don't know about you, I, I usually call-- instead of problem, I call it the opportunity, right? Sounds a

course.

Bit, little bit more positive, right?

Omar Sangurima: For sure. For sure. Abso- and it lets you, it, it gives you the idea of it's something I can grow into versus, oh no, it's something I let happen and I have to, I have to go back and kinda clean up my mess. No, it's an opportunity for growth or it's an area of opportunity. You absolutely wanna, wanna definitely frame it that way.

You're right. You're right

Ward: So I, I wanna go back to something else you said earlier, um, which I, I see this done all the time, so I'm curious your thoughts. So you, you said, uh, so you mentioned legacy environments, right, being a problem obviously. And then you also mentioned, you know, kind of [00:10:00] building it right the first time, right?

Folks that are moving into cloud or new applications or AI these days, right, have,

Mm-hmm.

Have that opportunity. Um, I've seen, I'm sure our, our audience has, has seen a lot of organizations simply doing lift, shift, plop,

boy.

Right? Like, "Hey, we need to get off this legacy system in the data center, whatever. We're gonna move it to the cloud."

And they literally just do a one for one, no optimization, no actual transformation, just here we are. Um, what do folks do with that? Other than don't, right? Other than don't do that. Um, a- any thoughts

Omar Sangurima: It's, it goes from being a digital transformation to just a digital change of clothes,

Ward: Yeah

Omar Sangurima: digital haircut. You're still the same knucklehead underneath, you know, whatever, whatever haircut you got, right? Uh, haircuts are on the brain. I'm, I'm getting one tomorrow. I need, I need one. But as-- At that point, I think then you're-- If you [00:11:00] present it, I've, I've, I've seen this trick happen successfully, um, in, in a myriad of organizations.

But if you're able to go, "Listen, instead of spending this cash on bringing in another consultancy or bringing in another set of, you know, where your, the deliverable's gonna be a PowerPoint some bullets and, and a high five," right? "And, and a smaller, and a smaller pocketbook," you can, you know, do for half and maybe give, give your folks some time to do the analysis, number one.

I think number two, as is the case with a lot of these, these situations, listen to your people. are people in your organization that know where the bodies are buried and know that if the lift and shift is just going to, again, put lipstick on the old hog, like it's not gonna do what you think it's gonna do. They're trying to tell you. I guarantee you, Ward, that there's people out there that know, "Hey, we shouldn't do this," and this is an [00:12:00] opportunity to finally un-untangle, oh no, there it went, and we're just now in the cloud, and it's just our problems but in the cloud. I think, you know, again, I, from the PPT perspective, I definitely people and process it really... as a technologist, I love tech. That's why I got into, into this thing. Tech is cool. I think it's the dark arts. But the people and the processes I think are really where a lot of the, the untapped gold can be

Ward: And I think it goes back to listening. I, I completely agree. Um, although, a- a- and again, I'm sure you've seen this a lot of times, a lot of companies are like... A- and not, I shouldn't make it so big to say a lot of companies. I'm actually gonna point this directly at the business groups themselves, right?

Like, they don't understand, they might not understand all the SINS from, from a technical basis, and they certainly don't understand things like cloud optimization and all of that, what it's like to be cloud native. And they simply say, "Hey, IT, security, [00:13:00] whomever, I need you to move that from here to there.

And oh, by the way, you need to do it by next Thursday." That's okay, right? You can do it.

Omar Sangurima: just, it's massive and I think, and, and again, it goes, like you said, to listening and, and the people in the process part of things. I, I live my life and it's a bit of like a double-edged sword. Sometimes my team is like, "Oh man, Omar's walked us into some more work. This guy, what's he doing?

Doesn't he know that we're already swamped?" But I like, like being in rooms where I'm the first info sec person to be there, right? Since like the Carter administration. I love like walking in and they're like, "Wow, you guys are still here?" Like, yeah, surprisingly, right? You know, because we're still operational, so we're still here, right?

You're welcome. But then you, you're in these rooms, and again, and this is tough to do, and sometimes it's tough to sell both to my team because again, like I said, I get us more work, or even sometimes up my, up the chain, like, "Omar, why is your [00:14:00] calendar just bonkers?" Sometimes you have to, you know, again, right, do the deposits in the, in the friend bank. I may be on three or four of these calls where I'm even questioning like, "Why am I here?" They're talking about amazing stuff at the hospital, great, but why am I here? And then maybe it's that fifth call I'll hear something that somebody says about some wacky stuff that's going on or some proposed changes that they're thinking of that they may not have thought to bring info sec in on. And word, there it is. I saw around the corner. Now I know that they're thinking of... Maybe, maybe all I do is buy us an extra week. Maybe it's two Thursdays from now is where they wanna do that, that lifting and shifting and the securing. But that is where the investment goes into. On top of all the maybe the more woo woo stuff that I believe in, and I think we agree here, of relationship building and, you know, get, developing that, that [00:15:00] bi-directional trust.

I don't discount that, but sometimes, you know, hard-nosed business people will. Cool, let's put that aside. But the practicality of knowing that something's coming around the corner, I pride myself on coming back to my leadership and my team and going, "Hey, y'all heard about XYZ? Can y- they're, they're thinking of doing it."

"When?" "Oh, like next month." "What?" And then, but that bought us time that we didn't have. And then as long as you're able to subtly or smoothly inject yourself in their process, not come in like the police, 'cause then, then I'm never getting invited back again,

Ward: Right. Right

Omar Sangurima: But come in and go, "How can we help you? I'm gonna, I'm gonna kill some blockers for you," right?

This ticket or that process or, "Wow, that person in IT was, was kind of a bum to you the last time you tried this. worry about it. I got him," right? And then like, you know, 'cause they're my homie, then suddenly everyone's a lot friendlier and it's a lot less friction. There you get invited [00:16:00] back again or you get invited on the design and ideation phase.

That's how you shift left You do it through tech, sure, but you do it through relationships far faster

Ward: So what I'm hearing, bottom line for, for everybody in your organization that's listening, is put more meetings on your calendar. That's what I'm hearing.

Oh

need to be in more meetings.

Omar Sangurima: Somewhere my, my wife just dropped a dish. I don't know if you heard that. I, I know I

Ward: Did not. Did not

Omar Sangurima: she d- no, she just dropped a dish hearing

Oh,

just

more

like, "This is..." E- e- exactly. No. There's a... Oranges are suddenly rolling on my, on my driveway,

Ward: Oh, man

Omar Sangurima: you know.

She's, "Yeah, man, it's, it's, it got real dark here for a second."

No.

Ward: mean, kidding aside though, I, I actually agree with you. So I was kind of in, in the same boat. Um, you know, try, try to get involved into many things as I can, but it's a delicate balance, right? Because you have, obviously there, there's your day job to actually do, get things done, move the risk needle hopefully [00:17:00] down, right?

That's all of our jobs in, in cyber. Um, but you can't just go have one-on-one conversations and understand what the heck's going on. You have to be in some of those bigger conversations to at least listen and say, "Oh, shoot, this thing's coming."

Omar Sangurima: absolutely. And then, and again, provide value and, and be there as an advisor. That's, uh, going back to the sales background. I made many more sales by just listening, addressing problems, not necessarily trying to sell, because that's gonna shut people down. I, I equate that to if I come into a meeting and I'm like, "You know what? You're doing that wrong. dare you set this up? What type of encryption is this? Ugh." Right? And spitting. Like, who, who wants to work with somebody like that? And I think that we, uh, the industry does it to itself a little bit sometimes. Um, and, uh, and I really do, I'm very judgy [00:18:00] about even dyed-in-the-wool security folks who like, you know, off of calls or whatever, like start kinda down talk or talking down about users.

Ward: Hmm.

Omar Sangurima: That for me, that's a red flag and I'm like, "Well, okay, I know how it is to work with you," and, and I'm, I, I wonder how, how secure your organization truly is if this is how, like you go about supporting the people that you serve

Ward: Yeah, that's, that's a very good, very good point. So let, let's go back. So you mentioned, you know, visibility being, being a key part of understanding what's going on. What, what should come next after the visibility piece?

Omar Sangurima: I think then you, um, think you have to experiment. I'm a big, I'm a big believer, uh, the, the research, the researcher in me, um, you know, uh, I'm sad that I've only published the one thing, right? And, and, and I'm even more sad that, like, it's the, it's the cure for insomnia, right? My dissertation can put anyone to sleep, I think 'cause it's really, it's pretty terrible. All right? My mom tried to read it twice and [00:19:00] she's like, "Mijo," like, "this is tough," right? Um, so, uh, but I think experimentation, the, the-- I love whenever I hear a, a new tool or implementation plan involve we're gonna hit monitor mode before, you know, and, and so maybe it has like a longer tail on the left before we start enforcing. I go, now we're cooking with gasoline. They get it. Let's get after it." And, you know, it involves a little bit more planning. You have to kinda see further around that corner a little bit more. But I love the, the going at it and, and with, with that let's prove hypotheses. Let's not go in with a presupposed I've come from the mountain with the tablets and I know how this goes. You may very well have that experience, and now this is a crazy word, but I'm getting to that point in my career where I have a little bit more years. I'm like, "What happened?" You know, I, I saw, I saw a picture of myself like when I first met my wife the other day and I'm like "Who's that child,

Hmm.

Uh, in, in that photo?

That's not me. Uh, what [00:20:00] happened?" Uh, but, um, I ha- I have a bit more of that experience. But you still have to come in with, uh, the, like the wipeout mindset or the beginner's mind or the beginner's eyes and go, "Let's, let's experiment and see." I have some tools in my tool belt that I think could maybe solve some problems, but if you go in there with a solution in your mind, you may be right, great, but then again, you're killing the vibe of, oh, these folks are here as co-creators. So I think obviously, you know, you wanna listen, you wanna talk, you wanna have the-- but then also having that of let's try this. try this in a pilot form. think about this. This is how I'm thinking about it. Does this make sense? Oh, we don't know? Let's, let's do a, a, a, let's put it out in a controlled environment and, and talk about it.

And, and then observe and use actual data to then inform the next step. Let's iterate. I don't wanna say the A word because I get, I get marched out of certain

Ward: Don't do it. Don't do it.

Omar Sangurima: man. [00:21:00] say a nimble approach to implementation, I'll say. See? Right? I play enough, uh, Dungeons & Dragons where I can come up with, uh, uh, enough names for dexterity, right?

You know, a dexterous way, right? Uh, you know, but I just think if, if you have more of that mindset, like, and I think we lose that in the enterprise, especially as you scale

Ward: Yeah, I, I mean, I've seen that a number of times, and I, I wanna go a little bit deeper on what you just said, 'cause I think it's very, very critical, and I've, I've dealt with a lot of teams. It's usually the exec- e- executive decree of, "I hear you, just do this thing," right? "Just prevent the data from leaving.

Just put DLP in blocking mode. Just do this." And totally with you and on board, right? Those of us that have been around the block a time or two, we have seen things, both good and bad. But even I, after doing this for 20 years, I would not go into any organization and say, "Hey, congratulations. We're gonna block [00:22:00] all emails with PII tomorrow," right?

Because that should never happen, right? So let's, let's go ahead and do it. Nothing bad will come of that.

Um hits and everybody wants to shoot you.

Right. Yeah.

Omar Sangurima: think about that,

right?

Ward: get out of the, get out of the organization. You know, the next day I'm, you know, I'm unemployed, right? 'Cause now I, I blocked the CEO's email for a supercritical, you know, M&A activity and, and now that didn't happen for some reason.

But, you

Yep

coming back from that, so again, I'm with you. I think a lot of the boots on the ground, I guess we'll say, they often struggle with, "Here's what I wanna do," right? They get the, the monitor, uh, the whole scientific method, right? Come up with an idea, test it, prove it, come with data driven. But they're dealing with the just do this thing.

So in your experience, this is outside of data security now, this is just, you know, 101 in my opinion. How should those [00:23:00] folks politely push back and say, "I hear you, however..." Right? In- insert your, your tidbits. What do you think? How, how should they approach that?

Omar Sangurima: I've, I've gotten some good success with two things, um, you know, to, to get away from the hippo, right? The highest paid person in the room, uh, issue there. You have to And one, one is a short term, one is a long term, right? So I'll go, I'll go short term first. them the why a, in a polite way. Like, "Okay, cool.

What's the outcome that you're trying to achieve here?" And un- and, and there's ways that you can do verbal jujitsu even with a high-powered executive where you can kinda maybe feed the ego a little bit and go, "Man, that's a brilliant idea. Tell me how you came up with it. Like, school me. This is amazing." And then you can tease out the why of what they're really trying to achieve. there's a m- and because we all know this, they're getting a mandate from someone,

Mm-hmm.

Right? Like isn't, isn't the [00:24:00] old s- saying goes, even the CEOs then has, you know, like board or the customers or their bosses, and then it's a giant circle of everyone just hitting each other in the head with rubber hammers, right, some days.

Mm-hmm.

Like, so, so y- y- you wanna say, "What, so what's the mandate? What, what's the problem you're trying to solve?" It very well could be, and you hope in certain organizations, many, most I'll say, I'm not gonna be cynical, where they may have a good answer, right? DOP may be the thing that we should be doing in this case.

Now how you do it, the context might be, might be, you know, off or the potential vendor that they're just like enamored with because it's their familiar, you know, they, they had a great solution over here. So tease that out, try to get, try to get the why. And then, you know, always show that you're on the side of, "Hey, I'm, I'm gonna deliver those outcomes.

You're coming to me to solve a problem. You wanna put something on my desk. Leave it with me, boss, I got it." then that I think dovetails into, but what you need to adjoin with that is a [00:25:00] reputation of being an absolute killer. And what I mean by that is, you leave something with me, I get it done, right?

Like it's just, uh, the, the whole John Wick thing. Like he's a man of sheer will, right? Whatever you leave on my desk, I will f- I, I have a network, I have, you know, uh, AI now. Like there's many ways that I can supplement, you know, the many gaps in my own knowledge or my own ability. I will find a way to get this thing done for you. Leave it with me, and thank you for letting me know what the bigger picture is so that I can tailor that, you know, killing stroke of whatever we're gonna do to hit the outcome, not just, you know, do the, not just do the, the mandate. You know, you're, you're probably familiar with the concept, right?

Commander's intent.

Mm-hmm.

Let me know exactly really kind of what, like a bit, you know, again, don't have to tell me the whole plan, I'm not, I'm not a general. I'm not trying to, you know... But give me a little bit of that flavor, and then if you have that [00:26:00] reputation of anything left with, Omar or anything left with you just gets done doesn't blow things up and doesn't, you know, end up with three emails of like, "He was a bull in a China shop," right?

I'm never, I'm not, that never happened with me. But like over time you get, you, you find the way to finesse that but still be a hard driver. then, then what that opens up, Ward

Mm-hmm.

The ability to, a couple of times, if needed, push back and go, "Listen, you know my reputation. You know I'm a, I'm a doer, right?

You're the person, you're the person you come to when you need something done. And you know that I'm on the side of the mission. You know that I'm on the side of your outcomes. I wanna make you look good. But you also hopefully pay me to be a little bit blunt. Trust me here. I gotta tell you, I don't know about this." You could get schooled there, right? There may be an aspect that you don't understand, right? That they have the visibility, uh, across the different parts of the business to, to inform, and then you're like, "Oh, boss, I didn't know that." they go, "Oh, wait a [00:27:00] second." You know? But you have to have those two things there. You have to have that, that, that reputation and that, those receipts, and then you can have-- You, you've bought yourself the ability to push back a little bit

Ward: Love that answer. And, uh, I, I, I like how it got to w- one of the places that I hear a lot, you know, when, when I ask similar questions of other high performers, they're like, "Oh, I have a plan," right? Like, that, that's-- I, I feel like that's the crutch a lot of folks go to. Like, if I have a plan, you know, whether it be a full-fledged project plan or a high level do A, then B, then C, a lot of people say, "If I have a plan, then I can have a successful conversation," and, and hopefully to, to your point, politely push back or understand the acceleration or whatever.

But

Mm-hmm.

What I heard from you is a plan is not good enough by itself. It's an important aspect, but by itself it is not really worth a lot.

Omar Sangurima: No. You have to, you, you, you have to have the receipts and you have to have the, the, the ability to show that you, [00:28:00] you can be trusted. Trusted in a, in a broad sense, like trusted to get stuff done, trusted to only push back. You know, I, I keep the internal rule of, you know, I think it's maybe attributed to like Bezos or, or AWS where, um, I'll push back twice, right? because I feel like, you know, you know, I, I loved Socrates growing up, you know, maybe people around me would be like a little too much sometimes, right? This guy, when you argue with him, he won't stop. But, but truly in a, in a business setting, I'll push back twice. it's still, no, we're doing it this way," then I will-- then you will have... You know, there's no better zealot than a convert, right? That old saying. Like, then I'm just gonna, and I want it to be known gonna execute and that I'm gonna drive. Now, if it goes sideways because-- I, I also don't gloat, though.

Yeah.

Be the person to-- especially rubbing an executive's face in it.

That's, that's gonna be a Pyrrhic victory at best. But they're gonna remember that you brought it up. They're also gonna remember that you had the [00:29:00] grace to not, you know, yell at them about it after. Then the next time when you do push back, potentially you'll have a little bit more traction. But you know, that takes a little bit of time, obviously.

Ward: I think it goes back to calling out risks ahead of time, right? You know, bring, bringing it back to DLP just 'cause it's a conversation I've had over and over. It's like, uh, "Yes, boss, we could do that. However, comma, here's, you know, the potential outcome." Not saying it's 100% going to happen, but it's, you know, likelihood.

Here's the likelihood of this thing happening and here's the impact of that thing happening.

Omar Sangurima: Absolutely. Give a range. Give a range and then be an advisor

Ward: Absolutely. Absolutely. Well, Omar, it's very apparent you've been doing this. I mean, you haven't been in the industry super long, but you've got a lot of experience under your belt in that time. So what was your journey? How did you get to where you are today?

Omar Sangurima: I, I wish I could say, like I had a, you know, a grand like Damascus moment or whatever, right? But, um, but it was really, [00:30:00] Career switcher. I wasn't, you know, born with the, the keyboard in my hand. Uh, I envy some of those folks, uh, that I see right across the table from me sometimes when they're like, "Yeah, you know, I did this and then I did this and then I did this."

I'd be like, man, if I'd done that I'd, I'd have like 25, 30 years under my belt. It'd be amazing, right? That'd be phenomenal. But, um, you know, I, I still, you know, pulled a lot of the tricks that I had from my previous life in sales, uh, you know, out of the bag there. But, um, I was a financial advisor. I think I was like in my mid-20s. Um, you know, I went to, I went to business school right after school, right after undergrad. Uh, and as, what is it Scott Galloway says, right? Business school is where people-- Uh, people go to business school 'cause they don't know what they're doing, they just know they don't wanna be doing what they are doing at the moment.

So that was, that was true for me. I won't say, you know, uh, for anyone else. But, um, and then it's just funny, like it's top of mind because I feel like, like we were talking about in the green room, I feel like a lot of the stuff from the MBA [00:31:00] stuff I'm using now more so than a lot of other tricks in, in the bag.

Um, it's-- Life is funny that way. But got the MBA, didn't like what I was doing financial advising-wise. It just, it wasn't what I thought it was going to be. Um, and at that point my family was like, "Listen, whatever you pick next, uh, get your feet firmly planted on the ground." Right? There's a, there's a saying in Spanish, you know, you know, "Planta tu firmemente."

Like, get... Like, "Whatever you choose, Omar, please." My mom was very, was very nervous at this point. She's like, "I have a flighty 25-year-old on my hands. What the heck am I gonna do?" So, you know, I, I figured out, I figured that tech, regardless of the path, would never be boring. And as we both know, oh goodness, right?

May you live in interesting times. Sometimes it's, it's too non-boring. It's too interesting sometimes. But, you know, started, started really hitting, hitting the books there. Um, you know, from how I grew up, my family was all about, you know, education, education, education. So ended up starting, uh, to get the master's [00:32:00] degree in, in IT even like maybe a little bit before getting the job in it.

Um, which, you know, I, I look back and say now it's helping me, right? 12 years in or past 10 years in, but I, you know... My wife, if she hears me, she was right. I, I, I got ahead of the game a little bit too much there. I kinda preloaded myself a little bit there because after, after that, um, I got right into a doctorate program too.

Um, that's a funny story. My, my wife didn't know. Uh, she was my girlfriend at the time. She-- We had talked about me get- going for the doctorate in IT, and she's like, "Ah, I don't know if you need it," right? Like, "You're just starting. Like, I get where you're coming from. Maybe later," right? And then I left the convo with her as like, "Sure," and then I, I started it anyway.

Um, No, no, but get this. Word. She, God bless her, and I only learned about this, I've been with her 13 years, and that was like maybe three or four years into our relationship. I only learned this aspect of what she was thinking last year. She thought I was, she thought I was cheating on her

Mm-hmm.

Because she's like, "Suddenly you're not available on the [00:33:00] weekends. your texts are very short. Like you're b- like you're just, you're somewhere else." And she was like... I go, "Chris, really?" She's like, "Bro, you don't understand. Like you, you just, you disappeared." I was like, "Well, I was going to school." She's like, "Now I know that," but the conversation was we weren't doing that.

But, uh, you know, um, got my first job, uh, via networking. It was through a, a buddy at, uh, jujitsu, uh, who's-- He was working at a physical security company that was trying to expand into cybersecurity. Uh, I, know it back then, but it was a great point into understanding security as a whole versus just cyber. Um, which again, is like helping me now, right? Shout out to the facilities folks at, uh, at MSK. They're an amazing group of people, and the fact that I can talk BMS systems or like physical access control systems, they're like, "This guy, he's not... He's cool, right?" I'm like, "Yeah, man." Um, you know, I can, you know, talk about all that stuff.

Um, and then, uh, [00:34:00] I uh, went to Baltimore, um, th- thinking I was gonna get into the NSA. my father was a, was a, uh, member of the Communist Party in, uh, in Ecuador, and I found that out, during the vetting process.

Ward: Ooh

Omar Sangurima: yeah. Yeah. I was like, you know... My, my, my funny story there is like, "Hey, you know, you're the NSA.

You can tell I haven't talked to this man in like five years." Like there's no... Like, but look, please, look, look it up. Um, you know, so, so that, that didn't pan out, but I ended up switching more from like, uh, uh, like physical security and, and kind of pen testing, vuln scanning into GRC, 'cause I was working at a law firm then. And then from there, just been GRC ever since. I came back up, uh, after eight months in Baltimore. I came up, uh, lucked into the role at Memorial Sloan Kettering, and then I've just been a GRC person ever since. Did contract risk here, uh, and then just branched out into like program management, you know, data [00:35:00] governance, uh, all that fun stuff

Ward: Growing, growing, and more growing. I, I love that. I love that. And, you know, I, I actually circled it when you said it earlier. I wanna, I wanted to come back to it again. So the sales background, where, where did that come from? Was that in the, the accounting or

Omar Sangurima: Right. My-- It's-- I always say that, you know, like, uh, I don't wanna rag on my dad completely, right? RIP. You know, died, died during COVID. Um, uh, because he wouldn't stop being a... He, he had a business, like his retirement business was, um, uh, he ran indoor soccer gyms, like in, in, in New York City. Um, you know, which because apparent- I, I didn't know this until, like, I learned it through him.

You could like rent, um, uh, public school gyms on the weekends to do events and stuff. So like, so he, he, he always rented this one public school gym. Um, and, uh, he didn't stop doing it during COVID he got COVID and died. Uh, I mean, that, that's, uh, listen, you know, we're a big soccer family, right? Like, you know, you see Messi, you see a couple soccer balls there.

So we love, we love us [00:36:00] some soccer. He loved it too much, right? Didn't love him back for, for that winter. Um, you know, RIP there. But, um, you know, so I ragged him a little bit, but h- for him, it, he was a negotiator He, he looked at a negotiation the way that like some people look at a meal. loved it. He loved like he could just, you know, he'd rub his hands together whenever like...

A-and again, at like random times. Not when like you think a negotiation's gonna happen, so it's like buying and selling, but like for him, life was a negotiation, I swear. And so I saw that. I saw like the, the fire it gave him and then, um, and then he, so, you know, obviously picked up a couple, couple tricks here and there. I took a trip to China and North Korea as a teenager, and I was part of a, uh, a team. Obviously, you know, I didn't just pick up at 15 and say, "I wanna go to the bad Korea," right? Uh, you know, so like this seems cool. I, it's cheap flights, like, uh, but, um, so but I remember in China, I w- I eventually became the go-to person for [00:37:00] the, the haggling

of the buying and selling of the tourist stuff, right?

And, and, you know, and understanding like, "Oh, you want, you say that this is this many yuan, but like I have a couple of American dollars. Like, can we..." And so eventually it just came in and like I don't know if you've ever been overseas there, but like they'll sell you like amazing tapestries at like the dinner table.

Like you'll go to a restaurant and then there'll be like an amazing like tiger painted on, you know, the like those scrolls sometimes. And so, you know, so like randomly in, in between eating, be like, "Omar, man, I wanna get that for my family." I'm like, "Okay, cool." And so like I got, it, it just, so I got the bug for like selling and kind of bartering and haggling there as a teenager and then got into sales.

Uh, my, my first undergrad degree was actually philosophy, which definitely made my mother cry. So then I went back for bus- I went back for business. Definitely. My mother was like, "What did, what did I, what did I do wrong?" Um, you know, I w- I, uh, you know, shout out again, I... But I always liken that to like if I hadn't been a coward, maybe that, that'd be the [00:38:00] way I'd go, right?

'Cause I loved, I loved undergrad. I, I studied abroad for a little bit. It was amazing. Um, as a TA, right, in, uh, in Vienna. Uh, uh, had no business teaching back then. I was, I look back, I'm like, "How did they..." But I loved it. Um, but then I went back for, for, uh, for a business undergrad and then went to business school and then did, you know, sales, financial, did the financial advising.

I caught the certification bug, Ward, I think

Hmm

when, um, when I was, uh, you know, I, I got my Series 7 and, my Series 66, I believe. Yeah, for like initial, you know, um, like sales of, you know, stocks, bonds, all that fun stuff as a, as a, as a financial advisor. Um, and I, I beat them both on my first try Which I, I guess back then, like I, you know, again, I didn't know it was a big deal. Um, I just... What I remember about the process the most actually is like, you know, I was living at home at the time, and my mom used to make these amazing huge sandwiches while I was studying, and I would just sit at the d- at [00:39:00] the, at the table for like eight hours learning about finan- like, I had no business.

Word. I didn't, I didn't know nothing about that, about the securities industry. And then I'm like, but, you know, a man of sheer will, right? Going back to the John Wick thing, just like,

Mm-hmm.

Know. And then with, with these, you know, triple decker Dagwood I don't know if you remember the,

Oh yeah.

Bumstead.

Yeah,

Oh yeah

And like these, these bad boys were, were like, uh, you know, donkey chokers, right? Like the, the, the old saying in, in Britain. Um, and I would just eat and then studied and got 'em. And just that sense, that dopamine hit there, um, you know, even when I made the transition obviously into tech, right?

Tech loves it some certs. and Omar, Omar loves, Omar loves that dopamine there. So, um, so yeah, I, you know, again, growing, just adding stuff there. So

Ward: Love it. Quite, quite the background. And I want to ask, you mentioned certs. I want to ask now, and I'm only asking this because I was just having a conversation last night actually on LinkedIn, funny [00:40:00] enough.

Omar Sangurima: Oh, boy

Ward: There's a lot of folks trying to either get a new job, right, they're unemployed or, or what have you, trying to transition, or they just got out of school and, you know, God bless them, they're, they're trying to get into the industry.

It's that old experience versus certs type of... And I'm not asking for you to weigh in and all that, but I am curious. So as, as you're looking for new team members and hiring, like what are you typically looking for in, we'll say that more junior type of individual joining your team?

Omar Sangurima: Sure. So for, for the junior, and it's funny because like I'm hiring kind of a mid now, so it's, it's this-- So that's top of mind, but like I love that you, you teased out the junior. And I was about to say Ward, I thought we were friends, right? If you're gonna hit me with like which experience

Ward: Yeah, which, which one? Give us which one?

Omar Sangurima: was like, "Listen, man, I'm gonna have people pop out of my bushes like whatever answer I give," and just like, "Ah," [00:41:00] you know, give me the Nancy Kerrigan.

Mm-hmm.

No, leave me alone. My, my knees are bad enough as it is. Um, but for juniors, truly, and this is, you know, this just happened. We, we did hire a junior in my group, but for the A&T side. I'll remember, um, an awareness and training person that had a GitHub. My CISO was like Right? And, um, and the-- And it, it's a funny story because it was, um... So it ha- like the way the PDF printed of, of their, uh, resume, um, like it w- didn't have the hyperlink for the, for the GitHub. So we could tell she had one, but then yeah, like my CISO and I OSINT'd the heck out of finding it. We're like, "We have to..." You know, she, like, "What's the name?" We didn't wanna like ask her about it to like make her nervous before the, before the interview.

But then, you know, because, because my CISO is an alien, uh, out of, you know, SIGINT in the Air Force, uh, he, he found it pre-pretty quickly. I, I don't know what they feed those boys in [00:42:00] there. It's boys and girls in there. They're any, any, any person, really any person out of the service that goes into cyber I've seen is an absolute savage.

But like, know, man. Mike Zoomack, shout out. You're, you're, you're an animal. But, um, it's, it's that. Uh, it's more portfolio. It's more show me how you get in, into things. And also even, you know, and that's kind of like a, you know, that's, "Portfolios are so hot right now" word, right? Like, uh, like, but, but so I get that.

But also even on the interview, show a willingness say, "I don't know," or, "I got..." You know, and, and maybe pivot it to something where, "Here, this is something I did learn." Um, you know, if you're getting, A, if you're getting interviews for junior roles and they're legitimately junior roles, uh, tell people about them because like I feel that the industry is being absolutely terrible to its own self, right?

It's, it's kind of like biting its own neck at this point. I don't know what we're doing. It's not gonna, it's not gonna end well. I know that. But [00:43:00] that aside, um, if you have that willingness to show and go, "Hey, you know, I don't know that, but I can learn. Here's what I did learn," that seems interesting. Uh, another piece, and this is again like another in the room tip that I'd have for somebody in the junior, in the junior role. This, this move actually won me, I think, uh, a callback, I think, to like... I got deeper into a process than I should have, I'll say that. 'Cause

at, back when I tried to apply, I was applying to things I had no business applying to. I just said... But of the ones where I got further was I answered the question, and this is a question I use now, "Where do you get your news for cyber?" It for-- because for me, and I think that it was explained to me that way and, and, and I, I internalized it, was like it shows me like are, are you-- do you wanna be a tourist? Do you wanna like get into this? Is this something... Or is this something that like you like learning about and hearing about and engaging with in your free time?

Again, not work-life balance is important, I'm not saying, you know. [00:44:00] But just like, again, I'm a soccer fan, you know, I, I get at The Athletic, right? And I, I like, you know, like I, I get news about soccer. That sort of thing, right, where it shows like do you have an affinity for it? Do you have kind of a love for the topic?

Are you curious about what goes on? That can carry me because as my current boss says, I love, you know, my entire leadership team, right? Not just my, my, my CISO, but my director. Hire for fit. You can teach skill. And if somebody has, you know, if somebody, if I can nerd out with somebody over Darknet Diaries, right?

And like go, "Wow," like, "Yeah, isn't this dope?" Like, "This is crazy." Well, I can teach you whatever you need to know for the role, and if I can't, then I don't deserve to be on that side of the hiring table

Ward: Great. Great tip for everybody out there and, uh, definitely aligned. I think there's a lot of folks, I mean, there's, as, as heard from yourself, as heard from other guests I've had on there, there is not one right path i- into [00:45:00] cybersecurity. We all started somewhere. Uh, but a, a big commonality I'm, I'm hearing from a lot of the leaders is it's not necessarily I'm gonna go get all the certs.

It's not necessarily I'm gonna get all the degrees. It's not necessarily I'm gonna find a way to get, you know, five to 10 years of experience doing something like it. It's a lot of, um, you know, being inquisitive, right? With, with, you know, where you get your information. It's, uh, networking, crazy enough, right?

Talking to folks and doing all that. Um, and I think the portfolio one's an interesting one that is definitely becoming hotter these days. Um, my two cents that I gave to somebody that when they brought up their portfolio was, uh, first awesome, right? Glad, glad you have it. That's, that's, that's amazing. Um, but make sure you're also showing the, the real quantifiable outcome of, of whatever you did.

So you, you created that application, that [00:46:00] widget, that thing, big thumbs up, amazing. But what was the so what? Like, you did this project. What was the so what? What, what, what actually came out of it that, you know, brings value or brought value to it?

Omar Sangurima: And, and answering that question is gonna be so vital throughout your entire career. I, I chuckle because that is the phrase that my entire leadership team and myself, uh, always presuppose and also slightly dread whenever we're pitching something to the CISO. because you gotta think of it, he's getting asked the same thing.

That's where I had my empathy for the executive team. Uh, he's always an- there, there's always a mandate he's answering to or she's answering to or what have you. But it's always, and we'll do this now, we've internalized it among the directorships here. We ask each other and we're bouncing ideas. H- so what? the outcome? What's the juice? What, what's it gonna... How is it gonna move the needle in a place, again, not navel-gazy to just the tech, [00:47:00] as you said. You built the thing, but what could it potentially do? if you talk about, "Hey, I know that like it would need this aspect that I couldn't build to then deliver business value," saying that, especially as a junior, Ward,

Yeah.

And I wanna talk to that person

Yeah.

They get it.

Ward: Yeah, and even if you don't hire them, right? They, they've just made a, a network connection and, and you may, uh, you know, give their name to someone else at that point that that's hiring for it. That's, that's where it comes from. So I wa- I wanna give you a chance. You've got two different podcasts.

Tell us a little bit more about those

Omar Sangurima: Um, yeah, it's, uh, it's, it's wild times. It's fun times. Uh, you know, as, as you probably know, you get to talk to cool people. I hope, I hope I'm, I'm one of them

Ward: Oh, yes. Absolutely

Omar Sangurima: trying my best. I'm Dustin, uh, I'm gonna tell my wife about this, and she's like, "You mentioned North Korea, right? Like, that's your thing of like, like you're unique."

But, um, you know, the two podcasts, one of them is a cyber metal podcast. I do that with Allison Laderman. [00:48:00] Um, I just, I've had great, uh, success with folks in the biz, uh, with lawyers, uh, transitioning to cyber. Two people on my team, uh, one of my first mentors when I got to the hospital was a lawyer. Shout out to Arielle there. Um, learned a lot from her, uh, on, on the contract risk team the, you know, like the proto third-party risk sort of thing that we were doing back then that like, you know, I'm, I'm building out now. Um, but yeah, lawyers have an amazing and unique perspective on things in cyber I think, uh, needs to be amplified. I just love, you know, kind of sitting, sitting with her, learning from her, and, and talking to cool people with her and hearing like how her, her angle is there. Um, it's also part of a, a nonprofit that we're starting to try to get off the ground to, solve the, the pipeline issue with, you know, how do you get those three to five years of experience if you never get the three to five years of experience chance, um, uh, that, that suddenly [00:49:00] somehow has now become part of junior roles? That's something that like I will probably get into a fistfight with people over. Like, that's one of those things that will get me like that wrath-y is like, that's not a junior role. Three to five years of experience is not a junior role. It's not. I'll, I'll fight you. Uh, but, uh, the other one is, uh, for the GRC Engineering Club and, um, that, that club, AJ Yawn and Abdi Mohammed, like, uh, you know, Zinet Kamel, like, you know, same as portfolios, GRC engineering's so hot right now.

I think it's having, it's having its moment. I think it's, it's long time coming. I love what I'll say this, seen my LinkedIn, have a ton of certs. I took one of the certs that the club put together, which had a practical component of you had to put a portfolio piece together and, and, and it was, you know, in order to, um, uh, automate and streamline the collection of evidence for, uh, you know, to answer auditors' questions there on a GRC program. [00:50:00] Um, for me, that was a water-- like it was a big watershed moment for me. I felt, I felt super proud. Like was finally, finally GRC is getting its own like, uh, OSCP, right? I, I feel like it's like a, you know, you put hands-on and you got hands-on keyboard. The club is amazing. I learned from all those folks on the Slack there.

Um, and like I said, I, I get to talk to cool people. I think one of the ones that, that resonated with a lot of folks was, um, I got to talk to Tom Cornelius, one of the creators of the secure con- uh, SCF, the Secure Controls Framework. Um, like it's just cool people. I get to sit like... know, regardless of what I am on LinkedIn, I don't think they would have, you know, talked to me.

It's such a great thing where I can just go like, "Can I connect?" And, "Oh, by the way, do you want to be on a podcast?" Like people say yes a lot more than, you know, they don't say yes to this, right? They say yes to like, "I can talk to you on the And I get to talk to some amazing like luminaries and teachers, know, and then I get to kind of like, you know, mainline my learning, right?

It's, it's a, it's a bit of a hack [00:51:00] that way, man. And, um, so I, and as you can probably tell, I just like talking to people,

Ward: That's awesome. That's awesome. Well, Omar, what's the, what's the best way for folks to get connected with you? Is that gonna be LinkedIn, or what other channels do you have?

Omar Sangurima: 100%, it's gonna be, it's definitely gonna be the, the LinkedIn. Um, the LinkedIn. See how, see I'm, I'm getting old, Lord, goodness, right? Like, you know, catch me on the Facebooks. Uh, but no, it's definitely gonna be on, on LinkedIn. Um, you know, I sometimes there's, there'll be times when it's wacky, uh, and it'll be a bit of a delay for me to get through, but I do spend a good time on like Saturday mornings having coffee and, and making sure that, that, that I, I go through my, my inbox. Um, you know, I'm, I'm open to talking to people for mentorship as well, 'cause one of the promises I made, uh, when I was coming in was, you know, if the universe granted me the, the way in, I was, I was gonna help people, um, as much as I could to, to break in. And now, you know, the stormy seas, right? As we know, the market is bananas, so anything I can do to, to help out there.

Um, if you, if you go in and you're trying to [00:52:00] get a master's or a doctoral thesis in IT or cyber and, and you need somebody to fill out a survey for you, I remember how crazy it was, uh, to get data saturation for mine. So I'm more than happy. You just, just say what it is and send me the link. I'll do it. I, I promise you'll get one N- uh, data point from me, uh, 'cause that was terrifying, right?

I remember I, I got all the way there and it's like, "What? Hold on. There's another stage here? I gotta get 200 people to answer this survey? I'm never graduating." So, you know, I'll, I'll always do some- anything I can or switch after. But LinkedIn's gonna be, be the way or, you know, pop in to hi at the GRC Engineering Club podcast.

Like that's the probably Slack. On that Slack I'm pretty active as well. So yeah, come, come say hi.

Ward: Excellent. Well, Omar, thank you so much for joining today. It's been a great episode

Omar Sangurima: Ward, it was an absolute pleasure. Uh, I, I hope I'm as good, uh, as, as, uh, Jason Torres' was. Um, but if I was better, please let him know.

Ward: Oh, I will, I will definitely let each one of you know. Uh, different story for each, right? We [00:53:00] gotta keep the competition going for

Omar Sangurima: But, uh,

back and forth.

And I'm, I'm, I'm grateful to him for, for connecting us, and anything you need down the road, just, just ping

Ward: Amazing. And hey, big thank you to the audience who's listening. Hope you enjoyed the episode today and learned something. Please tell others in your network to follow and listen. Been another exciting episode of Guardians of the Data. See you next time.

That's a wrap on another episode of Guardians of the Data. Thanks for tuning in. For show notes and more, visit guardiansofthedata.show. Guardians of the Data is made possible by support from Sentro. To see how we help organizations discover and classify all of their data accurately and automatically while quickly achieving petabyte scale data protection without the fuss, please visit sentro.io.

Catch you next time