✊🏽 ✊🏾 ✊🏿 Why We Matter: Fireside Chat with Julian Waits

Hi, this is Joe Sullivan from Cloudflare. I'm here with Julian Waits. Hey, Julian, thank you for joining me. Joe, thank you for having me. We're here as part of Cloudflare's Black History Month effort. And really, we're just two friends. We're going to talk about kind of topics that are important to both of us, I think, security and diversity. So let's just jump right in. Why don't you tell everybody a little bit about where you are right now, professionally? Sure. So professionally, I work for a company called Devo Technology. Devo is in the security logging and analytics space. We compete in that space with other large companies like Splunk and Elastic and others. We're a startup. The company's doing really great right now. And I run federal for Devo. And I have the title of GM of Cyber. Awesome. That's a cool sounding title. Yeah, I like it. So I think we've met in a couple of different contexts. We've met in the context of our professional work. We're both working in cybersecurity. But we also met at an ICMCP event. And so I was hoping you could tell us a little bit more about that organization. I'm happy to. So the organization's name is the International Consortium of Minority Cybersecurity Professionals, ICMCP. I dare anybody to say it 10 times really fast. But our whole purpose and the reason that it was started originally by Devin Bryan, who's the CISO at MUFG and is also African-American, was because we got tired of going to really high-end meetings talking about cybersecurity stuff. And I'd always be the only one who looked like me. There would be very little, if no, female representation in the room. And quite frankly, there wouldn't be a lot of people of color in general. Most of the people would look like you, Joe, as you can imagine. And so we decided to start ICMCP now about seven years ago to provide education, awareness, scholarships, mentoring, really whatever it took to help people become aware of the career of cybersecurity and the fact that there's just not enough people for the fight. And there's more than enough jobs to go around. Yeah. Now, one of the interesting things I remember I was talking about in the past was you specifically chose, when you started this organization, to focus on all minorities in the profession rather than just Black, I guess, cyber professionals. Correct. Why did you do that? So it goes back to some of our core tenets, right? Initially, when we first conceived the organization, Joe, we actually thought about making it Black only. And then I thought about many of the people that I was mentoring at the time. And so here's how the story goes, right? Devin and I talk. Devin says, hey, this is something I want to do. I've talked to a few people about it. Initially, we thought about making it Black only. And then when we talked about it more, if we went right back to the core of what we were trying to do, which is increase the pipeline of people coming into cybersecurity, Black only wasn't enough, right? Female representation was low. Latino representation is low. Other races or ethnic groups are low. And so we decided to open up to everybody. The funny thing is we always made it also a point that we wanted to have whites on our board, specifically to help guide the organization, but also provide that face, like the one you provide at Cloudflare and others, to demonstrate that white men specifically understood that it was very important that we have diverse environments. Yeah, there's a bunch I want to unpack on that. So let's talk for a minute about the role of allies. Why do you think it's important for allies, so white men like myself, to be part of this conversation and be part of the effort? Well, Joe, you heard me say this because when you and I met again, it was at the ICMCP West Coast event. And you may remember there was a young man up talking about the fact that he couldn't find mentors. And he specifically said, hey, Julian, I can't find Black mentors. And my response to him was, especially since I'm in my mid-50s and I'm from New Orleans, all my mentors were white, the initial ones. When I started my career at Texaco in IT, and I was a jazz performance major in college, and I wasn't that good, so I had to figure out how I was going to make some money. And so Texaco was gracious enough to allow me to work in a computer department. And one gentleman one day, I'll even say his name, his name's Wayne Jones. He's one of the managers in the IT department. He walks up to me, and he says, excuse me, Julian, I'd like to have a conversation with you. And I said, yes, sir. And I thought I was in trouble for something. He says, look, I really think you're unique. I think you're a really smart kid. I think you got some things to learn about politics, because I was pretty brash when I was younger. I'm still brash, I guess, but I'm smarter about it. And he took me under his wings. He helped me understand how the department worked, what the goal of the department was towards the business. And more specifically, he helped me understand, really think about what I wanted to do as a career. Because at the time, I was just thinking about a job. I wasn't thinking about a career. Wayne helped me cultivate the concept of, where does Julian want to go with his career? So allies are key. One of the reasons we have ICFCP is because we don't believe there's enough Blacks, Latinos, and females in the industry. So that definitely means there's not enough to be the mentors that are needed to help people come into this industry. It's a family affair. We need everybody in this, or we're never going to win this fight in cybersecurity defense. Okay, I see what you did there. So what would you say to someone who's thinking about being an ally, but is nervous about it? I remember the first time I walked into a minority cybersecurity event as an ally, or thinking about it. And you're kind of afraid that you're going to say the wrong thing. You're also not used to being the minority in the room. What do you say to those folks who are afraid to take the first step? Because we want them to take that first step. So I think it starts with an education, right? You're unique, you know, especially with your background as a U.S. attorney. So you've seen a lot of stuff. But I'm going through this with a friend right now, who I will call ally, but a white guy who's a CISO, who wants to do more specifically, not just with ICFCP, but also in his role as a CISO and with his department. And the discussion we had was this, is once you can understand both sides of the coin, meaning, especially, and I talked about this before we started this video session, when you go back to the things that have happened over the last two years, especially with take Black Lives Matter and Blue Lives Matter, and then the All Lives Matter thing, there literally is truth to all facets of that. But the truth then has to be guided by what's the overall principle of what you're trying to achieve. And so what I told him, I said, and we talked about Black Lives Matter, which I'm a huge supporter of. And I told him, I said, it's not Black Lives Matter in spite of, it's Black Lives Matter because those are the ones that are being suppressed right now. Those are the ones that are being oppressed right now. And so when he and I had that discussion, all of a sudden he felt like it was his commitment, it was something that he needed to do to move this forward, which as I know, it's something that's in your heart. And so, but the other thing is, is to have friends like me, who are willing to have this discussion with you, because you're right. When you go from an environment where you're used to being a dominant culture, and all of a sudden, you're in a minority, that's a huge change. I remember the first time I went to Germany in my mid 20s on business. And I went in this one room in Stuttgart, it was a cafeteria for, well, it was Hewlett Packard. And I walked in the room, and I was the only person of color out of like a couple of hundred. And coming from the southern US, that is not an experience I had ever had. And I was like, Oh, my God. And then I just played it off and walked in and just started talking to people. But it was it was a humbling moment for me. And it was a little scary at first, actually. But you know, you get over it, you move forward, and you get the thing done that you need to get done. Right. So I see him see. Yes, it does not roll off the tongue. No, it does not. And I've told lots of people about the organization, but it's been quite a success in seven years. Can you talk a little bit about the progress and why you think it's been so successful? I will talk about it because I'm very proud of what we've been able to accomplish. So when we first started, right, there were four or five of us that were the nucleus of the team. And we all kind of had differing approaches and things that were important to us. For me, what was most important to me were students kind of coming from the college realm about to take that first job. For Devin, you know, that was important. But for him, it was also transitioning adults. He's he, you know, for Larry Whiteside, who's one of the founding guys, he's a he and Devin are both former military. And for them, it was also people that were transitioning from the military into the workflows. So we put that all together. And, and, and Eric Parmenter was there with us. And one of the things we decided that was that was most important at the time, because we didn't have the facilities to provide education was to be able to pay for education for others who potentially couldn't do it for themselves through scholarships and grants, and to provide mentorship. And those are still our two strongest programs we now do for lack of a better term, you know, career improvement discussions or career counseling, like what, you know, we have one lady who recently, she was a she was a nurse. And she's in her 50s now, but she moved from being a nurse to a cyber professional in the hospital. I think she now has a director's position, if I'm not mistaken. And it's through people like her name in Maryland that really encourage us. When we started, we started with well under 100 people. Now we have several 1000 who've gone through our programs and who attributed some of their success to ICMCP. And so we're very grateful for that. For those of us who are thinking about someone who would be a candidate to get into that kind of support process, where would we? Who's a good candidate? And where do they start? So I would tell you almost anybody's a good candidate. The first thought is, is because we focus only on cybersecurity, not not generic it or other organizations for that. But if it's cyber, then it's either there when it can be in any career today. I mean, like I said, Maryland was practicing nurse. So they can be in any career, they just have to have the desire to want to do cybersecurity kind of work. The first thing we tell people is there's so many different disciplines in cybersecurity. Don't lock yourself into digital forensics versus incident response versus level one SOC person. There's so many different things that you can do. Let's have a conversation about what you think you want to do in cybersecurity. And then from there, it's icmcp.org if you direct them our way. And the first thing they want to do is sign up for the mentor protege program. And right now, we still don't charge for memberships. But the key thing is, is is to get a mentor as quickly as possible to have the discussion like I was just talking about, to really direct your efforts. Because the mistake I see a lot of people making, no matter where they're at in their career, whether it's somebody coming out of college, or somebody who's a, you know, mid career transitioning person, is they make cybersecurity this big, mystical, difficult, complicated thing where everybody walks around with hoods on their heads. And they don't realize the simplicity of some of the jobs in cybersecurity, and how where you may start in one place, where your career takes you is a whole different story in terms of where you end up. Yeah, I think that's such a great point. Like you mentioned that you focused on studying music, and I studied politics, and we both ended up in cybersecurity. And so many of our peers, you could say the same thing. Well, in our case, it's the truth. Yeah. And so you can't let like the education you've had to this point, limit what you want to do next. That's a really important thing. But then the other side of it is, I think you make a great point about the breadth of roles in security. I think that's one of the things that's held people back is the fear that they're not technical enough, out of the gate, and that they have to immediately jump into being able to write code or analyze some output of some system almost instantly. I completely agree with you. It's so Joe, it's so funny. I talked to, I'll use the term kids with some young adults. And I go, Oh, you know, cybersecurity, I think I'm going to go into engineering because that's easier. And I'm like, what? I'm like, can you see red, blue and green? Yes. Can you write legibly it so people can understand you? Yes. Are you smart enough to ask a question when you know something's wrong? Yes. Okay, great. You're a great candidate for cybersecurity. Yeah, it's just, they make it so difficult. I mean, I couldn't believe somebody said, I think it would be easier to become electrical engineer than do cybersecurity. And that's just not that I would discourage them from becoming an electrical engineer, by the way. But with that said, that's just craziness. Yeah. Yeah, it's funny. You mentioned that someone who transitioned from being a nurse, because on my team, when we talk about the values we want to have and how we do security, we frequently refer to ourselves more as we say, like, we're, we're not hackers. We're teachers and nurses. Our job in cybersecurity is like, because if you step back and you think about it, like, what is our mission at the end of the day? Is it to break into something? No, it's to stop somebody from getting hurt. And so often that's through teaching them the right way to behave. You know, don't fall for that social engineering attack. Something we were just talking about before this call. Or if they fell for the social engineering attack, meeting them with empathy and helping them clean up. Right? I love that. So is it a hacker mindset? Or is it a nurse and teacher mindset? And I think oftentimes when we hire in our profession, we forget that. And we hire people who don't have a bedside manner, who aren't there to help. And I think that might undermine, sometimes I wonder if that undermines diversity as well. Because it does, it does, in my opinion, I think, again, this is, you know, the, even when you talk to people who aren't in the industry, you're looking for the person in the hood who does all of this stuff that we were just talking about. And it causes us, even me, I've been guilty of it. And you've heard me talk about this before. I ran a company that was in the antivirus space. And one of my friends, who also was an employee of the company, we were out having drinks and pizza one Friday night. And I was talking about the lack of color in the company. And he literally says to Julian, that's because you don't do enough for diversity. He says, you know, you talk black and brown, but you still hire white. And there was a white guy telling me this. And so I'm like, you know, Joe, I was literally after a couple of beers, I was like, what? I can't believe you just said that to me. And then when he gave me specific examples of some of our recruiting practices, I went, wow, I can't believe I've been guilty of that. That, you know, I took all of the norms that I had learned through my career about how you hire people and what you do, which were not designed around diversity or inclusion. And, you know, I literally went back to the human resources department, because this is a Friday night that following Monday. And I said, I don't know how we get there. But we got to do a better job of this. And you guys got to help me with it. And I told everybody, I said, I was the worst offender. And I'm of African descent. And so I'm ashamed of that. But you're going to all help me turn this around. And we never quite reached the numbers that we were after. But things started to change, the complexity of the company started to change because of it. We're very qualified people who came in and did, you know, kick ass work for us. Nice. What are some of the things that we should all be thinking of that you learned from that process? How can y'all do better at diversity hiring? I'll tell you, one of the things is also something I'm guilty of. Most people don't know this, but I'll share it here. I actually don't have a college degree. I was a jazz performance major and a religion minor because I was studying to become a Baptist pastor, take over the church that my dad was pastoring. That didn't work out either. It kind of kicked me out. But in any event, when I first got hired into Texaco, I was a security guard. And I decided to take a couple of computer science classes because, you know, in the late 80s, this whole concept of a personal computer was just becoming a thing. And I thought, if I'm not going to be able to do the jazz career that I really wanted, I've got to do something that I'm good at. I had a good knack for math and science. So I thought, hey, computers would be the thing for me. And I started taking a few computer classes and then Texaco gave me a full time job. And so the way I thought about it at the time is either I can finish my music degree and become a music teacher. And in New Orleans, a new teacher in the elementary system at the time made about $19,000 a year. And instead, I started with a job at Texaco paying $43 ,000 a year without a college degree. It wasn't too hard of a decision for me. So the first thing we did is we kind of said, hey, we no longer said that a college degree was required. We put it was desired. And we actually meant it. And so we were willing to look at people who, let's say somebody had gone through the Security Plus, the Network Plus, the CompTIA stuff. They had a couple of years of real hardcore work behind them. Why should we block them because they don't have a college degree? And then there were other people with less experience, but still showed a real knack for what we were doing. Because everything we did in a company of 500 people wasn't just cyber oriented work. It was all types of things that we needed in a software company. But it was really relaxing those guideposts that say, here's the things that we have to be strict about. The other thing we did is we started recruiting from what I would say nontraditional universities, HBCUs, which is something I hadn't done while I was the CEO when I first went to ThreatTrack. And we changed those policies. And then I started talking to other peers in the industry, companies that already had diversity inclusion programs. And I would ask them, what are you guys doing that we're not doing here? And then encourage the people who ran our HR department to spend time with those people, which was immensely helpful to us as well. What about once you started to build a diverse team inside the company? Did you have to change anything about how you operated to help everybody else embrace having a more diverse team? So that was a tough lesson specifically for me to go through because I thought it would be easier. So to your point, it's not just about recruiting a diverse talent. Now how do I build an environment where people who are diverse feel comfortable with the rest of the people on the team? Like you when you walked in the first ICNCP meeting or whatever it was when you did it. And so we had to start educating our employees around diversity and inclusion to get people to buy in. There's study after study that talks about how diverse teams generally produce at a much higher level than non-diverse teams do. If everybody thinks the same way, if everybody looks the same way, typically you don't accomplish as much as you can from having a diversity of thought. But now we had this whole diversity of ethnicity and cultures. And that was one thing we really had to deal with. And I think part of that was because we were based in the South. I would hope that it doesn't, I mean, maybe everybody goes through it. I don't know. But we had some issues that we had to educate those who were already in the company about how do we make this comfortable for everybody? Because a lot of the employees, like for instance, one thing I'm staunchly against is quotas. We had this misnomer through the company that there was some kind of quota system in place. And what I really was instilling was more the Rooney rule from professional football, where it's, hey, look, we don't have enough Black coaches. And I'm not telling you have to hire Black coaches. But if you got a new position coming up, at least one of those candidates needs to be a potential candidate to take this job who's Black. But I'm not telling you have to hire them. And so we started doing more things like that. But quotas to me, they have counterproductive things that happen in the company, especially culturally, because I don't want any white guy to feel like they can't be promoted because a woman or somebody of color has to be hired. That's a demotivator for diversity inclusion. They need to understand how hiring these diverse candidates help make us all better. Right. Hopefully, that's helpful. I love that. So yeah, it is. Now, you probably, it sounds like had to walk into some uncomfortable situations in your career. You've had a lot of stops on the way, and you've made yourself very successful. What are the things that you think you found inside yourself that allowed you to push and push and push and get where you are? Well, so first, I got to credit mom and dad. So my parents, I came from a very poor background in New Orleans. I mean, when I say very poor, real poor. But it was always important to them that I never allowed that to limit me, that I always spoke up for myself, and that I understood whatever it was I was trying to get, and I wouldn't let anybody deter me from it. So it's funny, while I've dealt with direct racism at work on very few occasions, it never became, and racism is a strong word, I'll call it unconscious bias, because that's the biggest culprit in corporate world, in my opinion. When I raised money for my first startup, Bravium, and it was basically planes, trains, and automobiles to go meet with VCs, you know, West Coast, Austin, Texas, Washington, DC, Boston, I did the whole circuit as a first time CEO, where I was taking a technology out of PwC, that PwC was going to still help support. So you would think there's a lot of goodness, VCs are just going to jump all over that. And, you know, Joe, there were several meetings I went in where I had talked to those individuals on the phone. And it wasn't obvious, I guess what my ethnicity was when we were talking. And when I showed up in the room, I could see in their eyes, there's no way I'm giving that guy any of my money. And it was obvious. And but the deal was, is I still did the plane, trains, and automobiles. I still understood what my parents had had put inside of me. And then these two venture capitalists, I didn't say their name, since they're, they're still both good friends, Paul McGullis and Rick McGill. I mean, sorry. Richard looked at me and they saw more than just a first time CEO, they saw more than just a black guy, what they saw was a business opportunity, that if we played our cards, right, could grow to be something very big in the market around it GRC, because this was right after Sarbanes-Oxley and everything had come up. So I thank God for him. But it's, that was one of the times in my life where it was obvious to me, especially after the pre conversations. And I walk in the room, and no conversation had occurred yet. And I could see on their face, no way. Wow. Yeah, do the meeting anyway? Or did you just, you have to meaning, you know, the thing I tell minorities, especially blacks, you know, first of all, for all of us, the last two and a half years has been a reeducation of Julian whites, I have made a tremendous amount of assumptions about where our society was, especially after having our first black president and Obama, whether you liked him or not, he's still president, this country voted him in, I thought we had reached this, you know, to use the German term is zeitgeist, you know, the spirit of the world, where all of a sudden, we understood that we're all one. And then you go through the last two and a half years, and I feel like we regressed 3035 years in time, in terms of understanding where a lot of my fellow Americans actually believe about me, as an individual as a black man in this country, to stand for some of the stuff that was going on. And so with that said, it goes back to the perseverance that my parents taught me, my father was born in 1929. My mother was born in 1931. They saw a lot of real hardship in their lives. Yet, to their credit, they never once said one racist thing to me. Whenever they mentioned white or black, it wasn't, you have to do this, because white people have it. It was you have to do it because you need to do the best that you can do. And today, it just happens to me that white people have it because here's what I don't like talking about both sides of the coins, Joe, is when blacks are also equally racist. And whoever's watching this, if you're basing your career based on what you think some white guy can do, or some white woman can do, or some other person that you put in a dominant sense, stop doing that. It's about you and what you can achieve, not what somebody else has done. It's not, to put it this way, I said a lot at our conferences, I don't blame white guys for being in the position that they're in. Thank God for them and thank God for where they're at. What I will blame them for is if they see the situation and understand that diversity isn't necessary, and then they won't do anything about it. But I'm not going to make you feel guilty because of what you have or what privilege you may have been given. That's not bad. What's bad is if we don't find a way to share. So perseverance is the most important thing. Wow, that was powerful. Thank you for sharing that. And we're literally just about to run out of time. So I can't think of anything more powerful and better to end on. So I'll just end by saying thank you so much for joining me for this conversation. I always learn when I speak with you and I look forward to working together with you going forward. So thank you so much. It's always an honor to be doing anything with you. You're just a great guy. I have learned so much from you about our craft. And I thank God for what you do for diversity and inclusion everywhere you go and everything you touch. Thank you, brother. All right. Thank you.