Welcome to this week's episode, of the cyberwork, with infosec, podcast. For 12 days in november, cyberwork, is releasing a new episode, every single day. In these dozen episodes, we'll discuss hiring best practices, employee engagement. Career strategies. Security awareness, essentials, the importance of storytelling, and cyber security, and answer questions from actual cyber security professionals, and newcomers. For our fourth episode, entitled, upskilling, to deepen employee engagement, and retention. Our guest speakers are jessica amato. Operations, manager at raytheon, technologies. And romy ricafort, senior director sales engineering, at comcast, business. Jessica and romy know firsthand the powerful, role and investment, in skills development, can have in engaging their employees. They've designed security, training programs around empowering their staff with an emphasis on career progression. Not just, short-term, problem-solving. For the company. In this talk they will share the strategies, that have helped them develop, and strengthen, employees. We hope you enjoy the 30 minute discussion, between jessica and romy along with moderator, jeff peters. And if you want to learn cyber security. All cyber work listeners can get a free month of access to hundreds of courses, and hands-on, cyber ranges with infosec, skills. Which is aligned to the work roles knowledge and skill statements in the nice workforce, framework. Be sure to use the code cyberwork, when signing up you can find more details in the episode description. Catch new episodes of cyberwork, every monday at 1pm, central, on our youtube channel or wherever you get your podcasts. And without further ado, let us start the show. Let's have each of you quickly, share your role within the organization. And just maybe give us a brief overview, of, of the security. And, training and development, program that you both manage uh romy why don't we start with you. Oh well thanks jeff thanks for having me jessica, hello virtually, as well, i'm romy ricklefort. I'm the senior director of sales, engineering, for comcast, businesses, west division. I roughly have about a hundred employees. That focus on sales engineering, and leadership. For, customers. From small to medium businesses, the fortune 1000. And then government and education, as well. As we think about. The security. And training, and development, program that i've put together here at west division. It really is three different parts. The first is how do you get foundational. About how do you do your role. How do you become aspirational. And how do you find ways to be able to upskill, yourself to be ready for, higher level positions, and then number three, how do we foster an environment, that allows for, people to be curious, and then to pursue, what they feel is interesting. When it comes to technology. Awesome awesome and, similar. For your program there jessica. Uh. It is pretty similar, so um, as an operations, manager, i'm involved in work for planning. So that covers, pretty much everything, for the digital technologies. Organization. Related, to staffing, hiring, retention. As well as learning. Which includes a platform of experiential, mode to what romy spoke about. So, from a digital technologies. Perspective. We are. Organization, of over 900. Uh technical, folks that are both supporting the business as well as direct programs. So there's a lot to be said there from a technical learning perspective, as well as. The other experiential. Learning, opportunities. That we like to provide, which supports, career growth and development, as well as retention. Awesome yeah so let's dig into those programs, a little bit um. You know specifically. You know i guess they're they're they need to not only provide security and tech skills but you also need to engage, and motivate, and you know ideally, retain the talent within your organization. So i'm really interested in diving into those details a bit. Around. How your cyber security upskilling, program is structured, and in particular. What has had the most impact when it comes to developing, that more long-term, employee engagement. I can start with you jessica. Certainly. So um, the the, cyber, component. Of our organization. Is actually, critical, in that we have several technical, folks that are supporting, classified, areas. Um and in that we have to meet the dod, 857a.
Requirements. Which infosec, has been, really uh great in helping us do that it's a foundational, part of our program. Um allowing, our folks not only to learn. And grow their skills but also to certify. In areas that allow them to work in these areas. Uh without those certifications. They would be able to work in the closed areas. So it's it's a really, really critical, component, of both. Making sure that we have a low, learning and growth path. Uh for our folks because that's important from a retention, perspective. But also. That we are able to foundationally. Build on that, leveraging, our partners like eboza. Nice and romy your experience, with with your training program. Yeah i know and, you know i think he really touched on it when you talked about long-term, employee, engagement, and dale carnegie. Training foundation, had. A stat that 60. Of. Employees, will leave their company. If there was poor training, and so, it really does you really do have to be thoughtful, in, one as jessica said how do you become foundational. In your role how do you have everything that you need, to, outperform. What you do, and then how you actually are able to interact with your customers, but two how do you have a path a career path that allows you to, look at hey if i wanted to become, this type of sales engineer or if i wanted to be a subject matter expert, in security. Per se, here are the skill sets that i'm going to need past my role, to be able to move forward to and then again, right we need to foster that environment, where people can. Be curious, right right and, really go after, a consumption-based. Model that they're interested, in i know how to do my role, i know how to be aspirational. But, hey what if i'm really interested, in becoming a person who who pen tests right and so, some really cool things that you know. Partners, like yourself at infosec. Have that environment, to build the framework. And then also, you know have people be curious, about their learnings, as well. Yeah i'd like to talk a little bit more about that balance between you know like self-starters. And like having that career path, i know here at infosec, we did a, survey, i think it was last year around 800 cybersecurity, professionals. And the big split that we found in the data was, those who had a clear career path for those versus those who didn't so for example. I think it was 60, of the respondents, who had a clear career path rated their technical skills, and knowledge is above average.
But That number dropped to just 33, percent, for those who didn't have a clear career path. So uh you talked to romy a little bit about you know the self-starter. Aspect. Uh curious how you you balance, that with you know providing, that more structured. Um career path as you talked about for for all employees versus, um how much you rely on just them, to to kind of drive that. Absolutely, you, have to give them. What their role is and what knowledge they need in order to be able to be successful. At it and you have to have that, framework, of, this is what you need to know about networking. This is know what you need to know about security. Based on the type of customer, that you would consult, and interact, with on a daily basis. And that's key that's key for everybody's, role. Um and i'm not surprised. That you know the stat had said you know people, who knew, right what, uh the skill sets, were required. Were able to be you know higher from a job satisfaction, rate with those that were in a role and they didn't know, right hey what do i need to know to be successful, in this role so. But then again, right you have to have that, that, way for them to be able to see what other jobs are out there, if i were going to want to build my career three five years down the road, what are some of the things that i need to be studying, now. Versus. Trying to obtain a role and having not started, you know that studying. Yeah and your thoughts on that balance there jessica. Yeah, so. One of the things, that, we've, learned and used to develop our program over the last years, is the voice of learner. So, uh, one of the things we did was to really. Gain an understanding, of what types of learners we had out there i have learners that, don't take anything away, from, virtual training i have other learners that don't want to go to a virtual class don't want this classroom i don't have time for that just give me the book. So really listening to the voice of our learner and, understanding. That. Through an employee engagement, process really kind of elevated, us to really. Inadvertently. Understand. What other inkstar learners had, whether it be the time it takes, to do that having time to break away from your program to spend that time learning, um it was recognition. Of the fact that we had different learners across the organization, that, evaluate, and learn in different ways. But there was also. Understanding. How many folks out there in, you could be in your career for 20 years. And not still know what the next five steps or what the next five years look like, it may be a case where i really need to go through some experiences. To understand, where i go next, i really need to to, evaluate. And have some more learning to understand, what pat want to take because as you know in, in it. Um, or or security, in either of those realms. You can go in six different directions, you can start out as a network engineer and become a cyber ethical hacker but you have to know what the path is and the path is not well laid out from an industry perspective. So we really need to help them stitch that together. And and provide those you know i keep talking about this experiential, learning, it's providing, those opportunities. To use those skills, that they've just developed, in those learning, in those learning opportunities.
Yeah To, follow up on that i'm curious if you have any, sort of like structural, or process, advice, it sounds like you guys are doing some interesting things but, do you have uh, you know like meetings, that are, a structured approach you know besides. Kind of that uh. I'm not sure how you got that data whether it was by interviews or surveys or whatever but, uh just curious any advice for people who are listening who you know they kind of want to do similar things that you want to do but they maybe. Want some rails, so they know you know how to follow along there, let me start with you jessica. As you can imagine, with an organization. Of 100 people a survey, isn't necessarily, going to be the results, that need it, so i leveraged, uh the the section managers, i leveraged, individualized. Interviews i kind of used a blended, approach to collect the information. And then really kind of looked at where were our gaps where were the opportunities. Where we as the leadership, team, could expand, upon that to make it easier for a learner, or an individual, to understand, what path to take. So, over the last, two years we've probably spent a lot of time really kind of building up the program. In terms of providing, those opportunities. But also, the identification. Of those, strategic. Learning. Uh are those strategic. Career, paths, so we even restructured. Parts of our organization. That are so assist, admin could actually aspire, to become a strategic, architect. And actually. See what that path looked like and what those roles were to get there so we really looked at ourselves, inward. From a structural. Perspective. Um, in the programs that we're supporting, and the different projects, we're supporting, is the strategic. Lifting then how did we we leveraged, our leadership, teams to really help us, collect that information. Um as well as, leveraging. Direct, opportunities, to interface with our, new, individual, learners, i really felt that the time the event with them. Was critical to really understanding, a lot more from an employee engagement, perspective. It was not only, gee one of the things that i'm going to tell my manager. Versus one of the things i'm going to tell this person that just really wants to know. Um, how i feel about my learning path how i feel about role development. And we really leveraged. All of those pieces. Put together to build this program. Yeah awesome, and uh, and robby do you have any uh kind of similar advice in terms of you know structure, or process for people who are looking to implement this. No, and really comprehensive. Awesome job that you guys have done there at raytheon, jessica. Um, you know we we took a similar, approach. And we worked cross-functionally. You know here. Uh within the company, of of, getting hr, to lean in getting our l d group to lean in but we also took third parties, into account as well. And talk to them about. You know where is your industry, going and what are the trainings that your people are taking. In order to, stay up right with with, um the current, technology. Trajectory. And so infosec, i mean you all have been a really good partner, when it's come to as we've laid out you know what an se1, does through an se5. Our most senior, positions. You know how do we map that to, what, outside, world looks like, and then how do we start filling out coursework. Of, you know here's where, we are presently. But here is where, the marketplace. Is going, and then we have to be able to map. Right what expertise, sets are going to fit within each of the five organizations. And be able to lay out class work especially in a portal like info sex and be able to prescribe. Some of that. And then and then be able to say hey if you want to go after a particular, role, here are some of the things that will want you to train early on, to be able to prepare yourself for that and it brings me to a quote that i always give to my sales engineers, which is, it's better to train for an opportunity. And not have one, then have an opportunity, and not be prepared. And so, as leaders, we have to be able to give people that avenue, to be able to study, and know that hey as jessica, said, this is what it's going to take to get to, you know this type of role in the company. Starting, at a systems. Analyst level. And then, give them the ability to self-start. And start doing that work on their own. Yeah yeah that's that's great advice, um i'd like to dig in a little bit to you know obviously this whole session is about engagement, and retention, so, uh you know it's one thing to have that cyber security training and those clear career paths. But curious if you guys have any other professional, development. Opportunities. You know that help contribute, to that engagement, retention, beyond cyber security training. Let me start with you.
Uh jessica, We do so we actually, have an in-depth, employee engagement, program. And what that program does is you know folks walk into the door very, beyond, technologies. On day one and they go through new higher orientation. Teaches them kind of things you need to do to get through your first week and then they start their on job training it might be some shadowing, it might be taking on some, some quick opportunity, depending on the situation, you know some cases they might be waiting for clearance, so you gotta give them some work to do. Um those shadowing opportunities, allow us to do that but really what we do is we pull them back in. After they're 30 days usually within their first 90 days, and and i use the word assimilate, for lack of a better term but really try to connect them with the with the function of the organization. They're working in, so it goes far beyond, the employee, orientation. And really kind of brings them into gee, i'm i'm working, in one directorate, out of nine. Um, in digital technologies. So. How, and what, do the other directorates, do and how do i interface with that we bring the leadership, team in for a panel discussion, raw open panel discussion, people can ask direct questions and get some face time with their leadership. We bring in the organizational, change management, different components, around digital technologies. To help folks that might be assist admin who's you know working in his lab and doing his thing but now i'm going to understand, how, this director, and that director had helped me piece together a solution, for customers, so it really helps them connect the dots in the organization. They work in. And. Really defines. Different components, and pieces they're hearing from their leadership, team and flow down, on, what you know the difference between a buzzword. And something that's actually actionable, that i can take, we at the same time, leverage, those employee engagement, opportunities, to again, learn about our people. It's really a people first focus, and understanding. How do we you know keep the best and retain the best talent, well you do it through employee engagement, you do it through really understanding, and listening to the voice of your people. And then. Also, using that as an opportunity to provide these natural, networking, opportunities. So at raytheon, you're coming through the door you're learning your job you're drinking from the fire hose. We're then taking you back and realizing, this is a lot to take, in let's help you understand the next piece to the puzzle, let's help you understand what it means to drive your own career, and when you hear hr talk about that, and you know i want to, pull a thread on something romy, said, you know it's not only, critical. That the folks like infosec that we're working with are our partners but that we also have that partnership, within the functions of our organization, that's leveraging talent acquisition, that's leveraging. Our hr business partners, that's, leveraging, the folks in the different mission areas to really, help us. Bring these people, up to a point of comfort, so they're six months in and they feel like they maybe been here for a lot longer, they're not still drinking from the fire hose at that point they're not trying to swallow the acronym, soup as we joke here.
Um, But really, acclimate, them and engage them, with natural networking, opportunities. Understanding, who their partners, are and really understanding. Their organization. As a whole and how they fit, into that organization. Yeah yeah that's that's great advice um. Curious to hear your perspective on that romy if you have a similar approach if you do anything different. Yeah you know i mean. Functionally, right i don't cross. A lot of different. Organizations. When it comes to. The people that i build the programs, for. But you know when i think about sales engineering there's two aspects, of it one is the engineering, part which we've been talking about. For most of this webinar, thus far for but there's also what we call essential, skills. Or aka, soft skills, my my leadership, team told me to ixnay, soft skills and only call it essential skills moving forward, so. You guys let me know what you think but you know the essential, skills piece helps round out the sales, portion of the sales engineer, and, it really is you know what is your business acumen, financial, acumen how do you communicate. With other people. Do you have presentation. Skills, and do you have executive, presence. When you're in front of a fortune, 500. Cx, level type leader, and those are the kinds of, other pieces, right it's not just about can i build a network can i secure the network can i consult, my customer, into things that they haven't thought about yet and, and what they need to be thinking about to run and secure a network but it's it's how do i resonate, with them how do i, interact, with them how do i interact with other employees. And so those pieces, um we partnered, with the linkedin learning, to be able to provide, you know sort of coursework, right prescriptive, coursework but also. In those pieces of ways to find your own curiosity. And how to be a better writer or how to be a better presenter, or storyteller. For our folks to move after and jessica, you know, really touched on something. We also, take our sales engineers through something called insights, and what insights does it's it's a very long survey, that, makes you look internally, but it gives you blind spots, and it gives you the ability, to know, hey, this is my natural, tendency. And my natural, tendency. Is is sometimes more to be very analytical, or very, you know outgoing. Or very. You know not very data driven about you know the things that i'm going to go after but i'm going to go after it with a lot of, uh zest and gusto. And so. As as you work with other people and you figure out, you're going to team people together it's good to get perspective. Right of you can't have all data analytic, people, in a particular, pod, to get something done you need, different, types of people to be able to make sure that the team works there, and that you're thinking of the way, other people think not just. How similar, people think, about how to solve a problem and some those are some of the things that we've launched here. Um besides, the technical, training aspect, as well. Awesome yeah you brought up data driven and maybe i'm one of those data-driven, uh people, because i'm always really interested, in like the metrics, around the success we talked about a lot of. A lot of interesting ways to engage and retain employees, but you you put these out there you implement, them um. How do you track that are you regularly, reporting, it are you tracking certain things, um. Any advice there we could start with you romy. Yeah, i think. Jessica. Mentioned, you know the voice of the employee, and so we, we take a regular. Survey, we call it net promoter, score and we have enps, so that's the employing, promoter, score. And it goes through just, checking, in on your employees, and making sure that they full, feel fulfilled, and fulfilled, in their roles. And, if they're not, you know what are some of the things that you can do to start to react is it is it. Small, in nature, or does it seem widespread. That's one place to, look, we've worked with our l d partners.
And, You know we've created a portal that allows, people to be able to check off when they've finished. Uh some of their foundational, training and aspirational. Training as well. Has links into infosec, and infosec's, administrative, portal is great you get to see how much time people have spent in the portal what trainings they've taken. And so that marries with, what we've done with learning and development. And then ultimately, it's you measure retention, i'm measured on retention, how am i keeping, my employees, because it's really expensive, to onboard, somebody new. And so it's your job as a leader to make sure that. If people are leaving they're not leaving because they're unhappy, here they're leaving because they're being promoted, into another organization. They're leaving because you upskilled, them and now they've left for a, a, different company hopefully not a competitor. But you know those are the things that we look at as, exit. Interviews, happen is you know, why are people leaving or are they leaving right what is your attention right for your employees, especially, pre-covet. Was a very competitive, market. Yeah and jessica do you have any particular metrics, that that you. Monitor. Yeah we. We look at a lot of those metrics, not only do we really look to have an understanding. Of diversity, inclusion. Across our organization, and that's not just a metric or number gee how many. This diverse, group but versus another diverse group did we hire, it's where are we looking for the talent, where are we pursuing, the talent to ensure that we have the best talent across the board, in addition, to that we're looking at our attrition and retention, rates but we're, we're parsing, it out we're looking for trends, and specificities. You know obviously, somebody that. With the current pandemic, situation, we're in. Somebody. Needs to move back texas to be with their family that's not something we can resolve, somebody that's looking, forward to tired. Go to the next echelon, of their life not something we can resolve. What we can do is look at and understand, trends and we use our change advocacy, network. Um which is a culmination, of both change advocates and frontline, frontline leaders or frontline strategists. To really understand. The, underlying. Things the things they don't tell hr. Don't tell their manager so our change advocates is another leadership, group, that is really looking to bring down the flow down help under, unders, help people understand, the flow of where we're going is an organization, or a function. And the frontline, strategists, are really our, folks that are, they're the boots on the ground they're your peers they're working with you day to day but if they start hearing about issues around or bubbling that up to the leadership team that's what they signed up for is from strategists.
So Again we're leveraging, our people. Um surveys, are great, um and usually go out once a year maybe after. Particularly. Information, that day but, you know, we really want to hear the voice of the people we really want to understand, when there's moral issues and we want to get in there and we want to fix it we want our leaders, engaged in those, activities. So. The metrics we use are kind of a series of different metrics we're looking at how long does it take to onboard how long does it take to hire. Um and making smart decisions, about, leveraging, that information. To make different decisions about the approach we take the hiring whether we know a virtual, career, fair, um as opposed to individual, hiring, for the number of requisitions. We might need to fill that particular, month. Great so really it's pulling. I, the, last thing i want to add to that it's really, not just having your data driven metrics it's how those metrics tell you the the health of your organization. And what's the story you're trying to convey if the stories, we're trying to convey is that, gee we have a lot of internal, churn because people are being promoted, and moving on to new positions, because they have a role development, path. That's great news, if if, the story and the metrics are telling you that you're losing, good people talented, people. Up for something you could have avoided then there's a problem when you address it. Yeah that's that's great practical advice. We, have about five minutes left here so i want to make sure we, get to you know some good takeaways, or practical advice, that you know people can, can take to implement in their to their own program so. Um. Curious if there's any, kind of aha moments you've had or lessons that you've learned along the way or maybe one thing you wish you'd known when you started your program, that you know you'd like to share with people let me start with you jessica. So, uh i think our big aha moment was really that there's nothing more powerful, than the voices of our employees. And in making sure that they have a safe vehicle to voice their concerns. And voice. Um. What their wants and needs are, and then what do we do with that information, so it's no good if you collect the data and then you do nothing. So it's really, listen to your people. And then, take actionable, things, even if they're small things. A little bit of change is better than no change at all especially, when it moves in a positive, direction. And then, check back in. So if you don't check back in to see if you pick the right thing or you took the right path. Um, you're going to miss that opportunity, and those opportunities. Are going to be more powerful than what anybody's, going to put down on. Paper. Great any any any great uh advice from you romy. No i love that you you definitely have to. Keep employees, first, right when when you think about your organization. And what are your priorities. Um, you know when the pandemic, started for us it was employees. Then our customers. And then you know let's make smart. You know, decisions, for the business. But when i think about training programs, and i just think about development, in general. You know the mindset, i like to bring and the mindset i like to bring to my team is. It's not a destination. It's a journey, and and once you figure out and. And i always, challenge my employees. You finish. This training and i go, well what's next, you know congratulations. I love it that is amazing. But you disciplined, yourself, to be able to take the time to to get, something. Awesome. Right underneath, your belt that you can put on your resume, or, be great at your job at but, now that you've done that what's next learning shouldn't be hey i did it or like now i know security. There is no end and and i think what people have to realize and is what leaders have to realize, is that, we always have to be planning, for the future, we always have to be looking to see what's next, where the marketplace. Is going. Are we prepared, for where the market's going, because if we're not then we need to start putting the things in place now, to be able to compete in that market space because. Technology, changes, very quick and if we can't pivot as an, organization, quickly with it. We can move to irrelevancy. Fast and so i think as people realize that hey just learning is a journey, it's not a destination. Um. That's that's sort of not the aha moment but a, great moment, to, to continue, to know, uh throughout your career. Great um we just have a minute or two here but i wanted to touch, briefly on some of the changes, you know potentially, due to the coronavirus, or the pandemic, you guys both brought that up, uh just curious if you have any um, anything that's changed with your program or any challenges, or takeaways. Related to you know how obviously you're you're implementing, these, engagement, and retention, programs, currently.
Uh Romy want to start with you. Yeah i'll make it brief since we don't have a lot of time and i'd love to hear what jessica has to say, uh we, we had a program, to work on essential, skills, we were going to go out to each market and have each of the cities, engineers, work together, but we can't do that now with a pandemic, and what we've decided, is instead of doing virtual, classes, of people who already know each other, it gives us now the ability, to, mix and mingle cohorts, in different cities, to get to know each other and see what the talent level is like in some of the other cities in our west division, so, i'm really excited, about that and being able to bring other engineers, who haven't gotten to work in, the past together, to work together now so, it's going to be a great journey. Lots of other things we've done since the pandemic, but definitely want to hear what jessica has to say. So i, think uh one of our big wins this year. Um. In terms of what we changed, in working through the program is we were able to actually carry out a full internship, program. With, uh 90. Of those interns. Um, being remote. And with a lot of fear several were, afraid, the intern, program would be cancelled, much like their peers. But, we actually, carried out a successful. Program, we were able to. Uh bring folks, on remotely. Um, and even keep some of them on part time. Where their, their schooling, going back to school was going to be remote, and so. One of the things that we took away from that was ensuring, that you still provided. Vertical networking, opportunities. You kind of pivot and change. What the state of how things are and we were able to pivot pretty quickly. And carry out a successful, program, and from that we learned a bunch from them they learned a bunch from us. And, it really they still got to work on some pretty great projects, and and do some really, really impactful. Things, that. Support the businesses, and support our programs, so. Really, again, uh. Leveraging. The current state of things and, how, how we approach, that. Again listening to our people and understanding, what their concerns, were and embracing, that in the end when they came back to, present to our leadership team ask them openly.
To Share concerns, were and what the risks, or what they felt about. Uh covet, being an impact. And and potentially, being, remote. And some of them being, juniors, some of them being you know freshmen, and sophomores. In college. Um still being able to carry out what they felt was a meaningful, internship, was was a huge win for, us. Thanks very much for checking out upskilling, to deepen engagement, with jessica and romy, join us tomorrow, for building stronger, teams, career path development strategies, with guests, katie boswell. Director of kpmg. Cyber, and jason, jury, lead associate, at booz allen hamilton. They'll discuss strategies, for building your cyber, security, talent internally. And providing staff with progressive, career path opportunities. Cyber work with infosec, is produced weekly by infosec, and is aimed at cyber security professionals, and those who wish to enter the cyber security, field. New episodes of cyber work are released every monday on our youtube channel and on all podcast, platforms. To claim one free month of our infosec, skills platform, please visit, infosec, institute, dot com, skills. And enter the promo code cyberwork, all one word all small letters, to get a free month of security courses. Hands-on, cyber ranges skills assessments, and certification, practice exams for you to try. Thanks for listening and we'll see you back here tomorrow, for more cyber. Work. You.
2020-11-17