Unconventional Career Paths to Security

Welcome Cloudflare TV viewers. Bienvenidos. At Cloudflare we have our eyes set on an ambitious goal to help build a better Internet. Today's fireside chat is a joint initiative with Security Awareness Month and Latin Heritage Month. We will be discussing unconventional career paths to security from a Latinx perspective. My name is Suzie Jimenez and I'm part of the recruiting team here at Cloudflare. Joining me today is Derek Chamorro and Alejandro Ramirez. Alejandro, will you introduce yourself to us? Yeah, thank you Suzie for the intro. Yeah, so my name is Alejandro. I work in the GRC team, more specifically in security risk management. And yeah, I joined Cloudflare in 2018 as an intern and eventually moving to a full-time role and yeah. Thank you. Derek, can you introduce yourself? Yeah, I'm Derek Chamorro. I work in infrastructure security but I kind of handle a lot of high-level architecture across security and some other organizations. I joined Cloudflare in 2019 so I feel like a veteran already and I've been loving it ever since. That's great. Thank you for that. Thank you. So, you know, I constantly hear stories of talented, you know, Latinos and Latinas not feeling ready to take on new opportunities, even why they're qualified to do, you know, the roles that they've been hired to or even are hesitant to apply to roles, yet they're fully capable of doing this job and yet they prefer to pass on opportunities, right? I had thought that's why it was important for us to have this conversation and when we look around, we don't really see role models that look like us or that sound like us and may face similar challenges in growing up in a Latino community. So as Latinos, we tend to downplay ourselves and to attribute success to luck. Buena suerte, you know, is a, you know, you just stumble upon good luck rather than focus on hard work, right? I hear a lot of, I can't afford to go to a four-year school or I can't afford to go to a prestigious college or I need to work or it's not a great investment. So I wanted to ask, how did you get started in security, Derek? Oh man, so this was back in 2002, 2003. I was working for a company, a cable company called Adelphia that later got acquired by Time Warner Cable, Comcast and so forth. So now you know that there's, you know, much fewer cable companies. But we were one of the poster children for the Sarbanes-Oxley Act that got passed, which is meant to keep companies accountable for how they maintain their financial data because we were one of the companies that was using our company as a piggy bank. So some of the security requirements around this act required us to have a security team. So I was working as like a systems administrator, very proprietary job that I worked really hard to get and one of the managers, network managers, came walking by literally looking for volunteers for a security team and I raised my hand. I didn't really know much about what security was but I said, you know, why not take the chance and it's kind of taken me from there. That's great. Alejandro, how did you get started? Yeah, well it all started when I first, actually I went to a four-year college first for a semester. I got a scholarship for playing soccer but it just, it didn't work out, you know. You know, we were traveling a lot and I was like, you know, I don't want to get, I don't want to get more debt, you know, if it's not going to work out. So I decided to move back to the bay and then while I was in the bay, you know, I started taking programming classes at local community colleges and then, you know, I started hearing more about like breaches and, you know, Facebook, like, you know, privacy concerns and I was like, I heard that they were offering classes for cyber security at one of the colleges of the Peralta colleges and, you know, I was really intrigued by it. So, you know, I took one of the classes and, you know, from the start I was like really hooked. It's like, you know, you, you know, because I only had a like high-level understanding of, you know, how computers work, the Internet work and then, you know, from in that program, you know, you get a better understanding of like, you know, what happens, you know, when you log into a website, what type of data is being tracked about you, you know, how, you know, malicious actors are able to like exploit vulnerabilities on websites. So I, you know, I got, I got really hooked, you know, just by, you know, like, you know, learning about like, you know, an offering in one of the colleges nearby and, you know, giving it a try. That's great. I love the commonality about, well, I don't know what security is, but I'll do it. Like that's fine. You know, it's raising our hand and doing that action. Right. Similar to when I got started in my recruiting career, I came in as an administrative assistant to help on a project to, you know, maintain the Excel worksheets. And all of a sudden everybody was overwhelmed at that staffing firm that I was working at. Hey, can you help us find, you know, a security engineer? I'm like, I really don't know what that is, but if you teach me what it is, I'll help you find these people. And so that's how I got started. And again, not really knowing what it was, but really curious to know, you know, what, what security meant and keeping the, our environment safe. Right. Was there any particular catalyst for taking a non-traditional route, Derek? Did you attend a four-year college or what did that look like for you? No, I mean, back when I was going to college, there wasn't a traditional path. It was, you got a CS degree. And then again, this was, you know, a long time ago. And now when I look at, you know, the, the, the different courses and the different, you know, paths that a student can take is they're really well-defined like security courses that somebody can take. And depending on the security domain you want to focus on too. So me, it was more just, you know, organically growing within a company, kind of understanding what, what the overall technology was. And I think that was the biggest differentiator is like, you know, once you understood the technology, you could start looking at kind of what might've been deficient or what wasn't, what wasn't there, or you know, if a specific application or service was vulnerable. It took a lot more diagnosing as opposed to having a lot of the tools that we have available today to be able to do it for us. So for me, it's just the fact that there wasn't a lot of resources there for me to learn from. And a lot of it was kind of learning on the fly or learning through mistakes. Yeah. Alejandro, what about you? You mentioned earlier that you had gotten a scholarship playing soccer, but you felt it wasn't the right path for you. So what was that catalyst that made you want to pivot and change and go back to, to moving to the Bay area? Well, I mean, I just wasn't really sure what I really wanted to study. I was doing like general eds and then I knew I just needed soccer. It wasn't, I wasn't going to be a professional soccer player. And I was like, you know, it takes a lot of time. And I was like, I really want to focus on something, you know, I like and, you know, but it's something that, you know, I could have a future on. And then, so like when I moved back to the Bay, you know, I also didn't want to get so much debt, you know, if I wasn't sure what I really wanted to do. So, you know, just exploring, you know, taking your time to like explore, take different classes, you know, community college has like a much like lower financial risk versus a four-year college. So, so, you know, I took my time out exploring different classes and eventually, you know, found out about the cybersecurity program and, you know, it was a great match. You know, I, I was super shy and, you know, I was trying to sit in the back of the classroom, but within the program, I felt so, I don't know, welcome and, you know, like super interested in, in the field. So, you know, I started like getting really involved and, you know, I think, you know, just, you know, don't feel nothing like the pressure to like pick something right away. Right. And, you know, just taking your time to like find the right path was definitely the major, I mean, the biggest catalyst. Sure. So I, I'm a daughter of an immigrant and nobody in my family went to college and I was one of the oldest, right? And so was there anybody in your family that is in security or technology that kind of sparked your interest or motivated you? Did you have anybody in your life that mentored you into this type of career path? What sparked your interest is what I'm trying to ask. Derek? Yeah, no. My mom was one of them. She, she worked on some, you know, she worked on, you know, old mainframes. And so she kind of sparked a little bit of my interest, but you brought up a really good point about how, you know, a lot of our, you know, I'm son of an immigrant, you know, a lot of our family, a lot of my family came over too. And, you know, in a Latino household, a lot of them feel like they're only capable of doing something specific because that's the only thing that they would ever get. But the one thing that I think feel, I felt like it was ingrained in all of us is this concept of goodness. If you have this ability, and if you have this will to be able to do more, then you should do that. So while I didn't have a lot of examples of being able to do that, I did have, you know, you know, some good teachers that kept motivating me to do more and do more and do more. And so, you know, that's, that's, you know, I didn't have, you know, great examples of people being specific in security, but I had a great example of people saying, Hey, listen, do more technology. That's, that's a good point that you bring up that even though I didn't have that example, either, what I did have a good example was a strong work ethic, right? You work hard, you're on time. And, and you don't, you don't, and I don't know if it's just to my family, but you don't challenge the status quo, right? And so you kind of just do what you're told. And so, but I was curious, and I wanted to know, well, why not? And why are things done this way? And you start just asking and, and being curious, right? Of, well, why can't I ask questions, if I don't feel that this is right. And I think that a lot of us learn how to speak up or challenge when we're in a school environment, right? And that's where I found my voice. Alejandro, would you say that taking this different route gave you an edge or an advantage into landing in a, in a job in cybersecurity? Yeah, I mean, I mean, definitely. Because I mean, you know, you don't feel like as pressure, you know, just to get a job, just because, you know, you have a ton of debt that you need to pay off. So, you know, you can, you have that more freedom to like, you know, is this really what you want to do? And, and then, you know, like, if you're, you're really enjoying it, you know, you don't go for it and, you know, apply and, you know, you know, don't, don't, don't feel the rush, you know, like getting a job just because, you know, you have all this debt behind you. I think that's the main. Yeah, sorry, like, that's, I think that's the main advantage of, you know, not taking that traditional route. Yeah. Are there any younger family members demonstrating interest in your career path for either one of you? I know I was able to influence, I have a younger brother who, you know, I was seeing that he was gravitating towards computers and playing games. And I said, you know what, you should turn that into a career. And having already been in the IT recruiting, you know, path, I was able to see, you know, the, all the technologies that were up and coming, specifically security. And so I encouraged my brother to, to major in what information technology was, what they didn't have like a cybersecurity degree or anything like that, but he did gravitate towards, you know, hacking and security. And so I was actually able to influence him now. You know, he moved to Austin, he was able to land a job in cybersecurity. And so I'm proud to say that, you know, with my struggles and my adversities, I've been able to influence somebody and now they have a great career as a security engineer at a different cybersecurity company, which one day we will bring them to Cloudflare, but that's a different story. Derek, do you have anybody that you've influenced that you feel like you made a difference? Yeah. Family wise, my sister-in-law, I know she is taking a really big interest in kind of like the analytics from security. So watching events come in and being able to determine, you know, what might be malicious or not. And she's definitely taken that path. Aside from that, you know, I've been happy to be a mentor to a lot of people that have, you know, have interest in the community, interns or new hires that have joined the company to kind of give them, you know, the lay of the land. And like, this is what we see. Cloudflare is a very unique company too, from what we see from a security perspective. We see things at a global level. And so, you know, I like to think that, you know, we are seeing things a little bit differently than most other companies. So it's a unique aspect of being able to work here and being able to see people grow and do that. So, yeah, it's, you know, I feel like I have the mentorship from both worlds from, you know, personal aspect from family and also the personal aspect I take with the people that join the company. Alejandro, what about you? For me, I mean, I have a really small nephew. So I think, you know, he's still pretty young, but I mean, I know that my dad definitely influenced me, you know, just because when back in Mexico, I grew up in Mexico until I was 16. And, you know, my dad had a small convenience store on like office supply store. And he had, you know, he got a computer as a gift from one of his American friends that was living in Mexico. And, you know, from there, you know, I got exposure to technology. And, you know, he was also really like into like gadgets. So he had like a palm, like, you know, I've been back in Mexico before, you know, like people knew about any like touch, like devices. So I think like he definitely influenced me to, you know, just, you know, like, you know, work on your habits and then, you know, like, you know, develop it into a career. You know, he's done all kinds of jobs, like he's had a taco business, he's been a taxi driver, he's been a server at restaurants, but you know, he's always, I mean, he didn't study like marketing, but he's been always like working on, like, you know, growing into developing his career in technology. And he works for the city of San Francisco as an IT. So I think that, I think, you know, it definitely influenced me a lot. That's awesome. You know, that's a great segue into our next question. What are some things that we can do to make this career path attractive to Latinx youth, right? Like, how can we reach parents to let them know that this is an option? Because I know when I was growing up, college wasn't an option for me. Like I graduate, the goal was graduate high school, get a good job, and you stay there for a long time, and you build your family, right? And so I would have wanted someone, well, let me go back a little bit. I did have someone in my life, which was a high school teacher who mentored me and kind of guided me like, hey, you know, college is an option for you. Even if it's one or two classes a semester, my plans were to graduate college, move out of my house and get a job. But she just kept instilling college into my life, whether it was a one to two classes each semester. So I want to know, what do you think we could do to reach parents and let them know that this is an option for them? Is there anything that you can think of that we can do to help influence? Yeah, I always say that security is a global problem. So it affects, it doesn't affect, you know, one color of people, it doesn't affect one country, it's a global problem. And it's always changing. I think it also sparks a lot of curiosity. So one of the biggest things I say is that, you know, us as a global company, we have peers that work all over the world. And it's interesting, because one of the few times I get to use Spanish in work is by speaking with my peers overseas and speaking with my peers in different countries, and understanding what the problems are over there. And we realize that it's, you know, it's a common factor that security is constantly evolving, technology is constantly changing. And this is one of those fields that you can kind of pick the path you want to and really put forth a lot of effort and be very successful in. And again, that curiosity that it sparks, I think, is always something that keeps this field not boring, you're never really bored. And so, you know, I know, as a kid, I was always the kid that was bored, you know, sitting in the back of the class, you know, wanting to move on to the next thing. I never get that sense of wanting to do that here. I'm always, you know, inspired, and I'm always in awe of, like, everything that we can do, and the things that are yet to do as well. So I think that's one of the biggest things that we can say is that, you know, it affects everybody, and especially affects, you know, you know, like cultures. Agreed. Alejandro, what do you think? Yeah, that's a great point. I think, yeah, I mean, I think the one of the main reasons I really enjoy cybersecurity is that a lot of the ways that you learn is through, like, a gamified, like, challenges. So, like, in my program, like, we always, in the cybersecurity program at Emory College, you know, like, it's a community college program that has a lot of, you know, great resources. You have people from the industry volunteering to teach. So it's like, you know, you know exactly, you know, what's going on in the field. And then one of the things I like the most is having, playing the Capture the Flag games. They have national competitions, and, you know, I think a lot of kids nowadays like gaming. So I think, you know, for me, it was, like, super fun, because, like, you get to, like, chat with people, get really into the games, and, like, learn as you're playing. So I think it was, like, a super fun way to start your career. And, you know, you make a lot of friends. And, you know, it's very enjoyable. And, like, you know, like Derek said, you know, it sparks that curiosity, which, you know, just always keeps you, like, you know, interested in learning more, and, you know, continue practicing. Yeah, I agree. I would love when we are back into an in-person, right, is to, you know, bring your child to work, right, or being able for them. I think one of the advantages, or one of the silver linings behind COVID-19 and all of us being home together, you know, I have two younger ones that are still at home. They're 10 and 11, is that they were able to see what my job is every day. And they were very curious about what I was talking about in explaining the company and our successes, right. And they were able to mimic my younger daughter, was able to, like, mimic and say, this is mommy on the phone. And just I think that's one of the silver linings. Derek, I don't know if you're a parent or not, or what kind of influence you've had on your children when it comes to technology. And I always reinforce, like, hey, you can make a career, you know, this little TikTok dancing, you know, there's an app that goes behind that, that you can help build or secure, create content. I have a four-year-old daughter, and at four years old, she knows how to take pictures on the phone. She knows how to open up different apps. She knows how to search on YouTube, which is scary. But I think it's at that level of curiosity that gets sparked from technology is what makes, you know, kind of continuing on what Alejandro said, is, like, makes us feel interesting. You know, it's constantly evolving. And watching, you know, your kids, you know, who, you know, you watch them take their first steps to now they are acting like teenagers when it comes to technology or knowing how to, you know, search for something on TV or whatever, it blows me away. And what it makes me realize is that they are, you know, they have this sense of curiosity when it comes to holding a device. And as soon as they start learning how to use a device, you know, it empowers them to kind of continue on. And that's why, you know, I feel pretty confident with the youth of today as far as them, you know, sparking this level of curiosity. But also what makes it relevant with security is understanding technology. If they understand the technology, they're going to understand, you know, how to, you know, be better security stewards in the future. Yeah, I, if you weren't in security, what would you be doing? Alejandro, you go first, because I don't hear what you have to say. Well, for me, like, one other thing I wanted to study was physics, like being a physicist. I was fascinated by it. But then also, I think, like, nowadays, like, I think a lot about, like, digital well-being, you know, just not from the cybersecurity side of things, but also, you know, just from just like, you know, human well-being, like, you know, mental health. And then also, you know, understanding, like, how you're being influenced by some technologies that abuse, like, techniques to, like, manipulate people, right? So, like, being able to, like, you know, like, turn off your notifications, you know, use social media, like, in a way that benefits you without, like, like, falling into a lot of the techniques that, you know, take advantage of, you know, like, your attention, or, well, in short, you know, like, moving to, like, like, digital well -being. I think, I don't know if you understand, I don't know if you're aware of that term, but something that's been coming up lately. Yeah, yeah, that's real interesting. Thank you. Derek? Yeah, I want to see you write a book then, Alejandro, because I think that would be a bestseller. I would definitely read it. No, me, totally going down the non -technical route, I love cooking. I would probably open up a food truck and just, like, you know, be serving food. You know, it's, like, it's my downtime, like, you know, when I'm done with the day, the best thing I like doing is just being able to, like, make food, make dinner, make dinner for the family, and, you know, because there's not a technical aspect of it, you know, especially, like, you know, nothing's ever exact. It's always a taste. So, at the end of the day, I'd like to disconnect and just be able to make food. If I could do it for business, wow, that'd be awesome. That's awesome. Yeah, I think I would probably be teaching. In fact, when I took the advice of the teacher, I started to go to community college and take those one or two classes, but, you know, I had the necessity of making money, so I needed a job, right? So, I answered an ad in the newspaper to help answer phones, right? And that is actually how I got started in security. I started working for this entrepreneur who had this vision, you know, three or four years later of, you know, let's start an online company, and I want you to come alongside me and help me operate this startup. And, you know, the thought was, like, well, I'm still in college. Like, I want to be a teacher. And, like, but no, you know, so there was this struggle of, like, do I continue in this path or do I make money and learn this new Internet stuff that I keep hearing about and starting an online company? And so, I took a big risk and I forsook my career in teaching and I started the startup world. But it's been the best decision, right? You know, I made a lot of mistakes. If I could go back and change anything, I think it would be don't be afraid to make mistakes because I always had that, well, what if I break something? And what if, and I think if I would have taken bigger risks, there would have been more of a big reward later. Like, things went well and, you know, I'm here now, but I think that's what I would have done differently. Derek, would you have done anything different, you know, as you got started? It's weird, but I probably would have, wouldn't have been afraid to make so many mistakes. It's funny because a quote from one of my favorite poets is Esther Dyson, always make new mistakes. That's how we learn. That's how we innovate. That's how, you know, we learn to overcome a lot of fears. And, you know, when I was working that first data center job, there was this massive, that massive, massive outage. And, you know, I'm here running to the data center and my counterpart is walking and I'm running in a panic and I get to the data center and I'm just like, you know, all panicked. I'm young. And my counterpart there, you know, puts his drink down outside of the data center, walks in and it's just taking his time. And I'm looking at him like, what are you doing? And he goes, well, while you're panicked, I just took the time to think about all the problems that could have been, you know, I didn't struggle to, to, to, to think about the problem as soon as I got here, I spent that time doing that. So making new mistakes, as well as having a greater sense of patience and knowing that, you know, you know, you do have the time to be able to fix a lot of these problems that you encounter. So those are the two things. Yeah. What about you, Alejandro? Well, I think, yeah, I mean, just definitely like, just not been, well, sorry. I think, okay. Like, I think one of the most, one of the things that we should, I could have done is, you know, like get into computers at a, like a lower level. But like when my dad had a computer, like, you know, I had, I had the access to the computer, but I was mainly like focusing on like playing games at a higher level. So I wish, I wish I could have, you know, learn more about like how those games were working, like, you know, like how to program the games. And I think, I think that would have helped me a lot just because like, you know, I know, you know, staying at a higher level, you know, you don't, you don't get to like understand like, you know, behind the scenes, like how things are working. Sure. I get it. So we're hitting our two minute mark and I want to close with, is there any advice for anyone interested in starting a career at, you know, at Cloudflare or starting a career in cyber? What would you have to give them? What type of advice would you give them? I would say, don't be afraid of things like imposter syndrome. You know, a company like Cloudflare, we work with a lot of advanced technology. Growing up in a Latino community too, there's also this sense, as we alluded to, of not being good enough to do anything more. So use that as almost like fuel in order to be able to, to give this, you know, don't be intimidated to come to work for, you know, you know, you know, technical companies, you know, we have everybody that starts here, I feel starts the same way. Wow. There's a lot of stuff that's going on here, but we're all given that time and we're all getting that patience to kind of understand how the technology works. And especially in security, we're constantly growing here and we're always recruiting and we're always looking for new people. And so please, please, I would always say just apply because I guarantee you'll enjoy being here. Thanks. Alejandro, any advice you would give somebody? Yeah. I mean, check out any local programs, any local cybersecurity classes that you can take, you know, like it's a good way to check out like this world. And then also join cybersecurity clubs, like getting involved, you know, play capture the flag game. There are a lot of resources online, hug the box, you know, get exposure into this field. And, you know, if you like to, you know, keep on like, you know, working through your career and start playing. Yeah. From a recruiter perspective, I would say find a mentor, network with people in the industry and research and do the work. Don't be afraid of hearing no. Eventually you'll hear a yes. Thank you everyone for joining us for this great conversation.