Fractional CISO - When, Why, & How to Become One w/ Ayman Elsawah - Hyperdrive Minds Podcast 10

I'm doing great. I'm doing great. I got my espresso and I'm ready to go.

Well, it's still before 12 over here. So it's 11 a.m. over here. So that's right. It's my first one of the day. So did you know espresso has less caffeine than a regular drip coffee?

I think favorite movie is Interstellar. I saw it in 70 millimeter in the movie theater.

So that was good. The soundtrack was amazing. The, you know, cutting back and forth, the whole idea, like just everything was just really amazing about it. As far as favorite band, there's no one particular. I like a lot of electronic music. So I listen, I think digitally imported, di.fm. I've been listening to that for like a long time. Or Soma, Soma FM. They even have, Soma FM has a DEF CON channel as well.

No, no. Yeah, that's interesting.

Check that out. What's your favorite sci-fi movie?

I don't think I have, yeah.

A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria.

Well, I like to use a light roast coffee. That way I'm tasting the bean and not the roast. I've actually a list of a few roasters that I put on my personal website. Because people ask me this all the time, like what's a good coffee roasting place? One of the things I love to do is just go around the country and find really interesting roasters that have good coffee. Because it's kind of like a treasure hunt to find that right coffee. I like African coffees. Ethiopias are really good. Kenya is my favorite.

Oh, I'm actually doing a whole course on this for free. I'm going to post the whole course on this. I think the one thing you can do to improve your coffee is grind your beans fresh. That's it. If there's one thing you wanted to do that would give you like the 80-20 rule as far as coffee is grinding it fresh. So getting whole beans because the bean oxidizes right when it's ground and it starts getting dull, like old, right? So you want it to be nice and fresh. I think whatever way you're brewing coffee, machine, whatever it may be, I'm not going to be judgmental. If you just grind it fresh, you will dramatically improve it.

I mean, it's the most widely distributed psychoactive drug in the world. I mean, it's a drug. It's a drug, right? So you just said, you know, addicted to coffee. So it's a drug and you have to use it wisely, like any tool in your tool set. I think I quit coffee once for 30 days. And I actually respect people that don't drink any sort of caffeine. I meet them every once in a while. I'm like, oh, are you real? Like, how do you stay alive? And, you know, so no tea, no coffee. They just don't have the caffeine. I think there's something to it. But, you know, so as long as you use it to your advantage, as far as like getting into focus mode. 7:06 For me, I love the taste, the flavor. In fact, the first espresso I brewed today, I did it wrong. I over extracted it and it tasted horrible. So I had to redo it. A little bit of a nerd in that sense. But I like the taste. I couldn't just sit there. You know, some people are looking for the caffeine, just the injection, right? For me, it's like an experience. I like to sit down, read a book in the morning, whatever with my coffee. As the caffeine hits my brain, I'm like, okay, time to write or time to, you know, do some creative stuff. You nailed it that's exactly how i feel about it what's in your background there what are all those lanyards yeah security conferences and coffee so the two things i like the most so these are all different conferences i've been to you can see the defcon badge right here i think it was last year they had the piano and then some coffee paraphernalia and you know my book over here you ever come to north carolina for

I am not, but I'd love, I've been to North Carolina, I've been to RTP. I love it. It's a beautiful place. I love how you have the beaches on one, I mean, beaches on one side and mountains on the other side. It's kind of like the Bay Area. So I'd love to come out there, yeah.

Sure. Some time ago, I read a book that said you should write a book. I'm like, well, what would I write a book about? And I'm like, do I write about cats or kids? I'm like, I don't know. And then I realized that everyone's asking me at the time, people were asking how to get into security. I'm like, oh, let me write a book about security. And so I just kind of sat down and just got all this. It's just a brain dump. It's like we sat down for coffee. This is exactly what I would say. And it's a quick read. Alongside of that, I decided to, well, I'm like, well, there's many ways to get into security, not just my way, right? 8:42 Or not just... So let me start a podcast as well. And so as I was done finishing up the book, I started a podcast to interview folks and how they got in security because there's no one way. So I started a podcast and then kind of been turtles all the way down from there. It was a fun experience, learned a lot, met a lot of really interesting folks.

Yeah, well, kudos to you for getting 10 episodes out. Many people don't get past episode two or three. So kudos to you. There's so many podcasts out there that never made it past three or four episodes. What I've learned, silence is gold. So my podcast was audio. And I learned this trick, I think it was from Malcolm Gladwell, like in his masterclass course. That just to sit there and allow silence to do the talking in today's world we're we have these uncomfortable silences but when you're there especially in an audio podcast when you're interviewing someone and you allow you ask a question and you just sit there a little bit as after they've answered it and just let that silence like just sit there you'll find that they just start spilling more information 10:09 Right. They open up a little more. It's fascinating. It's fascinating. So that was one thing I really learned. I learned how to be a better listener. It's been a great experience.

Yeah you know sometimes we underestimate our listeners i have to tell you like an episode sometimes it ran long it's like too long i'm like oh this is nobody's gonna listen to an hour and change and then you find that people just binge all these episodes and they have no problem with these long episodes i'm like fascinated So don't underestimate your listeners, your viewers. It's the content. In fact, a lot of times, it doesn't matter about the background. It doesn't matter about whatever. It's the words that they want to hear. They want to feel the emotion or the conversation or the information, whatever they're looking for, right? 11:20 Some people are looking for entertainment. Some people are looking for knowledge. A mix of both.

Yeah.

Oh, top five. Okay. I think getting into any new field one is to learn the language so understand the language so that means you're going to have to consume a lot of media news podcasts video movies just understand the language you need to know the terminology And that is going to lead to the next step is getting into the mindset, the mindset of a security person, right? Do security in your own home, right? Think securely. I mean, do you have 2FA set up on your accounts? Are you living and breathing security, right? 12:21 So it's kind of like method acting, like start getting into it. And then take an inventory of your skills. The third thing would probably take an inventory of your skills. Understand yourself. I think this is good for any job seeker. Know yourself. Don't underestimate all the experience that you've had throughout life, whether you're an Uber driver, Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 13:02 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria.

Oh, okay. Well, once upon a time ago, I was a network engineer and I wanted to be, you know, I was on the CCNA, CCNP path and I wanted to be a CCIE. Ccie is like this uber certification in network land cisco land that like you know was this coveted back then still is i guess coveted certification if you're ccie you're like top of the food chain so i'm on this path and you know of course in networking security is still a component right firewalls and network security and everything is still a component so that was always part of my job anyway 14:12 I met a CCIE and I told him of my career plans and he goes like this he goes why would you want to be a CCIE I'm like because it's amazing he's like well it's boring like what and so he goes it's boring once you create the network and everything like that then you're done and that's it I'm like huh really and for me I always I had an itch of just like always being challenged learning I don't want to Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, 14:55 And sure enough, it's been true. And so I switched. I started studying cybersecurity. I started looking for a job. I found the security analyst job. I had to take a pay cut, right? Because, you know, I was like a senior network engineer. And now I'm like a lowly security analyst. But it was worth it, right? I had to find something and work my way up from there. Security analyst, security engineer, senior engineer, architect. And then as a consultant, I was helping companies on the side with their security programs from compliance, PCI, security awareness, everything like that. 15:29 And I saw a need out there that there was a need for startups to have security people, but they couldn't afford security people from a full-time basis. So I'm like, well, there's this fractional COO model, fractional CMO, fractional CFO. There's got to be a fractional CISO model. And it was still early. It was still the early days and just started pursuing that. And here we are.

Yeah, so, you know, several years ago in my security journey, I discovered AWS and the cloud. And I was like, wow, this is amazing. And so I decided not to look back A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Ayman Elsawah, Adrian Sanabria A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Ayman Elsawah, Adrian Sanabria 16:32 And so I created Cloud Security Labs, a place for me to work with companies that are in the cloud and kind of generate ideas. Now, fast forward, it's now expanded to a fractional CISO model. Where I work with companies as a fractional CISO. And a CISO, Chief Information Security Officer, right, is a person that's responsible for security at a company. But I do it on a fractional basis. So what do I do? Do I cut myself in half and, you know, distribute myself to different companies? No, what it means is that smaller companies, so it could be a SaaS startup, maybe 50 people, maybe 250 people, whatever it may be, they need a CISO, but they don't need everything from a CISO all at the same time. 17:13 Some days they may need security awareness training, other days they may need compliance, other times they may need sales enablement, working with customers to get security checks across the finish line, things like that. And so here we go. And so I've been doing that full-time now. I've been doing the fractional thing full-time, kind of weird, right, for five years, and worked with big companies and small companies, and now I'm even training folks on how to be fractional CISOs, because there's a lot of CISOs out there

Yeah, I don't do hourly. And I encourage other folks not to do hourly as well. Because doing hourly, you might as well go work full time, right? Right. And you at least you get like equity and things like that. But instead, you know, doing more value based pricing. And so that's a core component, in my opinion, of being a fractional CISO. Some companies, a lot of companies actually, will just take hourly, multiply it and say, okay, here's the monthly retainer, here's the number of hours you get, and then use it or lose it model. 19:14 But at that point, you're kind of like a lawyer. For me, there's a whole thing about being, about not doing hourly, right? When you're not doing hourly, one, the client knows what they're getting. Right? It's just a fixed cost. They're not going to get surprised how many hours it's going to take you to do this or that. You tell them, this is it, this is what you get, et cetera, et cetera. And you can do that for, say, a particular project, like an internal audit. If you need an ISO internal audit, it's a flat price. So it's up to you to be efficient and as fast as possible to get it done.

Yeah, yeah, that's a good one. So first of all, they need to have had some sort of experience managing, I guess, anywhere from 50, 60, 70% of a security program at one company or several companies. If they don't, then, well, there's another course for that, for like getting security management, right? So that's one thing. Two, is this a temporary thing or is this a lifelong thing? Lifelong meaning like the next three years, right? And do you want to just be a solopreneur, just a one-person shop? Or are you trying to grow like a big business and hire people and do that whole kind of agency model? 20:39 So those are the few things that I ask prospective students as far as like what you're looking for from a fractional CISO.

Yeah, so I have a hypothesis that CISOs have a limited lifetime rate, right? So from what I've observed, and of course there's all exceptions to the rule, but a CISO will typically have About three tenures of two to four years each of CISO leadership. And after that, they kind of burn out. After that, like, you know, I want to do something else. I want to sit on the beach. I want to be an advisor, whatever it may be, open a coffee shop. I don't know. 21:30 And so that's what I've noticed. And not only that, now the CISO job is getting harder and harder with the SEC suing people and personal liability and everything like that. A lot of people are scared of being CISOs. So they're coming to me or I'm finding out that they want to be fractional. They want to do the fractional CISO because the fractional CISO, you get to do the work for a company. You get to change clients or you have multiple clients. You get that new nuance, right? You get that dopamine with the novelty of having a new client every so often. And then not much of the responsibility because you're working with an executive or a founder on that side, on the client side. 22:05 And so you don't have a giant responsibility. Sometimes you do. There's something called like you could be the named CISO, which is also fun to do on a particular basis. So that's my hypothesis. I have met CISOs that have disproved that hypothesis. And it's really interesting. They have a really good outlook on life or on security. They get it. They get it that the CISO, and this is core of any CISO, Knowledge is that they found the balance maybe they found that right company maybe they found the executive team to work with because there's a lot of things that contribute to CISO burnout CISO burnout is real i don't want to downplay it there's a lot of reasons for that a bad mix of culture toxic environment weird expectations from a security perspective

Yeah.

The funnest part about being a fractional CISO, you're working with people that like want to do security. They want to implement security and they're just coming to you with like open arms and you're walking in as an expert, giving them all the guidance and they appreciate your guidance. They love your guidance and they take it and they run with it and they implement it like, okay, what's next? I love that part. It's very satisfying. I love working in startups. My focus area is B2B startups. Working with startups, they just have their own culture. 23:58 I know startup culture and they appreciate that because sometimes you have a bad fit. You'll have like an enterprise CISO that tries to do the fractional thing with a startup and it's just a bad culture fit. So I just, I love working with startups and people that have this like can-do attitude and there's always a new challenge and Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 24:30 And so I had a new appreciation for how to be a good student. I think the best reward a teacher can have, and I think every security person, a good security person is a good teacher. Every teacher wants to have a good student. And to be a good student, you're attentive, you're listening, you're taking the advice coming back, right? I mean, even like if you're a coaching client, if you're a coach for whatever business or sports, and the person's not listening to your advice, right? VCISO, vCISO, vCISO, vCISO, vCISO, vCISO, vCISO, vCISO, vCISO,

How does it work? Like, you know, because I looked into the recruiting business for a little bit when there was a period of time where I was trying to expand my company and I hired a person that had a lot of recruiting experience. The industry is kind of cutthroat. I think the business model for it to work, you have to be exclusive to the company or they have to hire you exclusively. So I'm curious what the business model would be. You know, when you go to client X, Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria.

So if you if a client hires two agencies for recruiting, what often happens is the same candidates get reached out to at the same time. And it's just like it's kind of like a race to get to the candidate first. So there's got to be A better way like okay you go from the east coast you go west coast like something like that or maybe get two agencies one that have specializations on the business side if i was a recruiting business which i would find it quite stressful launch all the search capacity only to not get the deal it seems like a lot of work to not get 28:33 A deal at the end of the day. I don't know.

Oh, yeah. Yeah. There's a lot of five days on site kind of stuff. I'm like, yeah, I don't know. Mind boggling to me.

You know, honestly, in security, you kind of need to be onsite at least two, three days a week. Right. All the startups right now are like going back to five days. So I'm seeing a lot of five-day, which is fine. I think four days would be better because traffic here is crazy. But as a security professional, you need to be in the office because there's a lot of drive-by requests, right? And there's a lot of drive-by. And so when you're a security person trying to improve or establish or improve the security culture, being there is a big thing. There's a whole playbook I have about just being there, being available, because a good security professional, you want to be approachable. 30:21 The successful security people are approachable. The ones that are not successful are the curmudgeons and the ones that like people are afraid to talk to and everything's a no and you have to make people jump through a million hoops to do something

Yes. Are you feeling that as well? Oh, man, 100%, 100%, especially as a single dad. There's a lot of pressure. So, you know, sometimes we throw ourselves into our work and there's a lot. There's a lot you mentioned there. So one, my thing I'm trying to do this year is do more with less. There becomes this diminishing return where like you work 8, 12 something hours, you don't get that much return for all the hours you put in, right? And you hear all the different mantras, work smarter, not harder, this, that, blah, blah, blah, blah, blah. 34:02 And all of us are trying to escape this rat race Like i don't know how what happened here but now we're like how did we get caught in this rat race as a business owner i talk with my business owner friends because entrepreneurship is a lonely journey by default it's a given and so it's good to have the support structure talk with other folks and sometimes you talk to other folks And a lot of times other especially agency owners bring up this notion like why are we doing this like what's going on and it always seems like the grass is green on the other side so the full-timers look at the entrepreneurs and say oh look at what they're doing and then entrepreneurs that look at the full-timers oh they got it easy and everybody has like a side hustle right and then their side hustles have side hustles so what is it like it's like this itch to like do more like so one 34:53 And maybe we're getting a little philosophical here, but we could bring it back to security. Like we're trying to secure the soul, right? Secure the person. We have this thing about being productive. Like you just have to be productive. And if you're not productive, then you're a loser. Right? And we need to undo that learning. Sometimes it's okay to just sit down and be present with your kids and just be there and whatnot. So we're kind of addicted to productivity. But at the same time, we want to have a comfortable living. We want to make money. 35:24 We want to have stability. We want to have our vacations and whatnot. So how do we break free? I think one of the good things is to do some planning. One of the things that just helped me recently, I planned out my three, five, 10, 15, 20 year goals. And not goals like you break it up into three things. Who do you want to be? What do you want to be doing? And what do you want to be like? What do you want to have? Sometimes the grind is like really crazy.

Yeah, you know, I was telling my kids that learning how to drive is going to be like an unknown skill, like actually knowing how to drive. Like in the future, when all the cars are driving, And then someone's like oh you actually know how to like physically drive like a car you know that's going to be a skill the same thing is communicating knowing how to speak and talk to people is going to be a skill that many people are not going to have a lot of kids don't have that right now because they're on social media so much i restrict you know my kids are not on social media and i really restrict their screen time and everything like that i tell them like listen you're going to have these abilities you're going to be able to speak to people 37:48 A lot of folks can't even have a conversation. A lot of people your age can't have a conversation with someone else, let alone an adult. That's going to be the differentiating factor. Back to what you said about what works and what doesn't work. I learned a lot in the past year or two. Sometimes we do things, but we don't step back to see if these things are working out or if they're helping us. For i think in 2023 or 2022 i put out a lot of videos on linkedin and there was a lot of videos and getting impressions and whatever but that was the wrong metric and so that's where i learned late last year about the funnel like there's top of funnel middle funnel bottom of funnel and so i was doing a lot and just like a marketing basic and so i was doing a lot of top of funnel stuff but not middle funnel or bottom of funnel 38:34 Definitely not bottom. I wasn't closing. So there was all this effort I was doing, but I was looking at the wrong metrics and kind of like insecurity. If you're in security, you're running a security program, you want to find the metrics that are valuable to you. And I always tell folks, there's this one metric that's beautiful, that's kind of hard to measure, but it's a beautiful metric. Are people coming to you with security concerns? That's how you know, because what's that metric measuring is security culture. A company with good security culture is going to, by default, inculcate security internally, right? 39:05 And when you internalize security, like you internalize any goal, you're going to be working towards it. So you want that engineer to bake security in on their own and not because you push them to, right? So anyway, getting back to like business, another thing that I think this recession is teaching folks, and this was the mantra I was going by 2023 is smooth seas don't make a sailor. Somebody told me that quote before and I'm like, wow, that's fascinating. Because a lot of times in 2021, 22, we had it easy. 39:39 We had it easy. Jobs were plentiful and everything like that. But now you have folks that are struggling and really working hard. But what that's going to do, these challenges are going to force you to kind of be more creative. You're either going to fail, you're going to keep doing the same thing and just hit your head on the wall, or you're going to be creative, pivot, maybe learn some new skills, whatever it may be, to move forward. As a result, I had to learn more sales, right? Like better sales tuning, better marketing, just like tuning my engine. 40:09 For every challenge, if you embrace that challenge, you can pass it and it'll actually help you in the long

Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 42:11 And sometimes it could feel like a hamster wheel trying to create content, create content. And so you have to step back and say, what is this content doing for me? And how can I be more purposeful for it or with it? Just like everything you do in your business. Why do you, why do you have it? Why do you even have a business, right? Sometimes you need to step back, say, why am I starting a business? Am I just doing it so I could check a box and say, I'm an entrepreneur now? Like what's, what's the point, right?

Life is one big experiment.

To be honest like most of my business has been referral based okay so i think the best thing is to just do good work and be very personable and keep your relationships warm and nice reward people that refer clients to you right with extra work and whatever it may be give like so people in general so i think starting off with your business If people get more from you than they're paying you, that's a good thing, right? So that's a start. Letting people know that, hey, I'd love to get a referral. 43:45 I'd be happy to give you free services or an assessment. And then just some regular tactics. I think responding to emails and sales things really quickly is helpful. If you're on a sales call, just being forthcoming and just generous with helping them on their journey, on their security journey. Some other BD tactics, just emailing old contacts, emailing old clients, letting them know that you're open. I think this applies to anyone either looking for a job or looking for clients. 44:16 Post a useful article on LinkedIn once a day, comment three times on three different articles with something Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Send the signal out there because what's going to happen is when people know that you do something and they see that you're helpful, when someone else asks, hey, I'm looking for this, they'll think of you right away.

From a CISO perspective, I think they're still banged up about the SEC, all the things that happened. These breaches are getting worse and worse. The supply chain attacks. We have, you know, CDK. I just talked about CDK and Change Healthcare. They're being subpoenaed. They're stressed out. I think the societal pressures. Right now, a lot of folks are just staying put right now. Before CISOs and just security leaders in general used to be able to just click a button on LinkedIn and find the job within a few weeks. But now it's getting harder and harder. 46:03 It's a lot more competitive. CISOs are getting laid off. So for the past nine months to a year, at least, companies that were planning to go public and hired CISOs and built a security function have let them go. Or companies that are public already, they have this like mature security function, maybe like five, 10 people. And they realize that there's this top person that in their mind, you know, is getting paid a lot. And the biggest cost of company is... Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah,

Right now, the whole tech industry has a contraction. Right now, people are very strategic in how they're hiring. You have people that are now doing the jobs of two, three other people, maybe four even. I've talked to people, not necessarily in cybersecurity, just in tech in general. They are keeping A large amount of direct reports and they want to have like one guy has 14 people reporting to him and he wants to keep that because it's going to keep him valuable if he had two managers two direct reports and then that rest of the team is reporting to those two he then becomes less valuable and they could just like chop him off and so the whole tech industry right now has gone through a contraction it's kind of like back to 2000s 48:02 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, All these things. So like I'm seeing job roles out there, like a security engineer that has to do security engineering, infrastructure engineering, also compliance and a few other things. Well, that's actually a security engineer and a head of security, right? So that's the jobs of two people. 48:33 I don't know any security engineer that wants to do compliance stuff and update policies and whatnot. But they're throwing these things onto folks. But then also it's opening opportunity for fractional CISO folks because a lot of fractional CISOs can function from a security architect all the way to GRC head and compliance manager. Right. They have that flexibility.

I don't know. That's a good question. But, you know, back to your point, it's kind of become like a super storm. We had the pandemic, right, that made everybody used to getting remote only. Now we have the high interest rates where money is now not cheap anymore. And all these things that have kind of flattened the tech field and all these things are coming together. Where can the American worker find jobs like the tech worker? Well, you know, according to that CEO of Nvidia, he says to be specialized, to have some specializations of skills. So before, you know, you could just have, you could be a computer science person with some generic coding experience, but now you need domain experience or domain expertise on top of that to make you valuable. 50:05 So I think that's going to be the key. I did want to ask you a question. Sure. There is something that I saw in this article about like the job market these days. Can you explain ghost jobs? What are the motivations for companies to put ghost jobs out there? And what's going on with that? I love your inside perspective on things.

Yeah.

Yeah, it seems like they want to make themselves look better. I can't imagine searching for a job, applying to a job. I mean, it's bad enough the work that you're supposed to go through to try to apply to one job. People are applying to hundreds of jobs right now, but there's thousands of candidates that are out there in the market. It's just so bad.

I don't know. I feel like it's going to introduce bias.

For me, I've never been on the HR side. Well, I've never been on the pure HR side. I've been in the hiring management part. I want to know where the HR person sees the answer to that.

It's a requirement. I don't know. It's a requirement by law. They actually have to fill that information. From what I understand, they actually have to collect it because they have, especially government, any company taking government funds, they have to prove the job opening A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria.

I like rock climbing, indoor rock climbing, so that's been fun. I need to do some camping this summer. So what about you? What do you like to, what hobbies do you like to do?

That's funny.

Do you go by yourself? Because I have a motorcycle license. I've had it for my whole life. And so every once in a while, I'll rent a bike. I kind of find riding by yourself kind of boring a little bit. You just go by yourself. Is it the road that does it for you? Like what does it for you?

A long period of time it's brutal more like torture than yeah it's brutal yeah when i rented the bike for a couple days i'm going on a bridge and the bridge is freezing i'm like this isn't fun but i imagine like optimal weather having someone else riding with you either with you on the bike or another bike a friend alongside with you i think makes it more fun i don't know i'm curious what your feedback would be

Yeah. My friend, I asked him one time, I'm like, you know, I have a quandary. I'm like, I want the fun of a motorcycle, but the convenience is like, you know, you can't listen to anything really or whatever it may be. He's like, get a convertible. That's smart. And so, yeah, I got a stick shift convertible. And so it's like the best of both worlds. You know, in California, it works out really good. Last night I was coming, I was sticking to bridge. It was kind of late. And I had the whole bridge to myself, the top down, the weather was beautiful. 57:53 And I'm like, I just turned off like all the sound and I'm like, just kind of took it all in. It was, it was really fun. It was really fun. So I kind of enjoyed it.

There you go. Yeah.

Yeah, I would love to.

Yeah, same here.