Latinflare Presents: Conversation on CyberSecurity with Ray Espinoza

Welcome to Latinflare Presents a Conversation on Cybersecurity with Ray Espinoza. My name is Derek and I'm from the Cloudflare security team coming to you live from Austin, Texas, and I will be your moderator for today. This interview is part of Cloudflare's Security Awareness Month and is brought to you by Latinflare. So before we get started, I'll provide an overview of the format. The bulk of the segment will be an interview and then followed by audience Q&A, and then we'll finish with lightning round of questions. So audience questions are taken at the end, but at any point, submit a question to us by emailing livestudio at Cloudflare .tv. So today we will be interviewing Ray Espinoza from Cobalt Labs. Ray's bio is like my 12-year-old self's wish list of what I wanted to be when I grow up. Ray is the head of security at Cobalt. It's a leading pentest as a service company. He has over 20 years of technology experience and 12 years in information security. Prior to Cobalt, Ray led third-party cloud security across Amazon's retail business, which is something amazing. Additionally, he's held VP and CISO roles with Atmosera and Proofpoint, as well as various security leadership positions at Workday, Cisco Systems, and eBay. And I think that's where a lot of our paths have crossed with previous companies. So with that, we'll welcome Ray. Hello, Ray. Welcome to Cloudflare TV. Thank you very much for having me. I appreciate it. Awesome. We are really excited to have you and have a lot of questions for you. So if you're ready to get started, we are. I'm ready to go. Awesome. So let's kick things off by hearing a bit about your current role at Cobalt Labs. Can you tell us a little bit about what Cobalt Labs does? Absolutely. So Cobalt is a pentest as a service company. And no shortage, we're changing the game on the way that pentests are delivered. And we do that through a few different ways. I had the luxury of actually being a Cobalt customer back from a previous life. So I got to have that perspective of a buyer and then see that now as a leader here on the team. But one of the things that we do, we've built a platform to enable pentesters and customers to be able to communicate more fluidly through the pentest process. We enable our pentesters to get vulnerabilities that are found during a pentest into the platform right away so that our customers can start driving remediation. Many times by the time everything's wrapped up, any critical or high severity vulnerabilities may already be fixed. And it's really through being able to work through those workflows and the integrations that we have that enable us to really stand out compared to some of the other pentest consultancies that are out there right now. So, you know, for us in the security community, we know a lot about pentesting. Can you kind of give like a high level overview of what pentesting is and some of like the, I guess, some of the jargon that goes with that so that people can kind of get a better understanding of like how specific this is and how unique this is to a company or to the security community? Fantastic question. The way that I try to explain it is that many companies have some sort of web application, some sort of web presence. And you know that we've all heard there's bad folks out there looking to do malicious things to take advantage or to hack, if you will, some of these applications. What penetration testing is, is you have a professional who focuses in this area of security and does it for a legit business. They help you find the vulnerabilities in these applications before the bad folks do. And so helping to identify these vulnerabilities, remediate them on your own timescale so that they can't be exploited or lead to some sort of data breach, which we hear way too often in the news now than we really should. So they're essentially breaking or finding the areas that are potentially breakable for a company before the bad guys or the bad people do. Absolutely. Awesome. What are some of these, like the biggest challenges in your current role? It's tough to say that there are really big challenges. At the end of the day, I'm brought in to help Cobalt be more secure, to help build trust, to enable us to really serve our customers really well. The biggest challenge that I have is staying true to myself and being pragmatic of answering the question, what does Cobalt need from a security perspective right now that's going to help serve our customers and provide the most value? And then what are our customers going to need in six months from now, in a year from now, if we start thinking about going up market and serving larger customers who have a higher level of security requirements, how do we make sure we meet their needs? So they're evaluating us based off of the merits of what we do and how we do it, as opposed to where our security posture is. I've had the honor and the privilege of building security, leading security teams at some pretty amazing companies in my career. I found a lot of consistencies in the different types of activities and programs that help them be successful in security, and I apply a lot of that here at Cobalt. But as I mentioned, it's what do we need right now and how do I distill and how do I make sure I'm partnered with the business so that I'm driving value? Gone are the days where you can be a security person where you're like, nah, that's not going to happen, no thanks, you need to go away. It's more so I need to lean in and say, I believe that we can do this safe and securely and here's how I think we can do that. Being able to always lean in and be a problem solver as opposed to somebody who says no. But it's always a balance. I think every security practitioner would always like things to be more secure and we have to figure out what does that mean and how does that impact the business and really kind of maintain that balance. And I will say, because we're a security company similar to Cloudflare, the bar is higher for us. Companies expect us to have our security programs together and more mature than maybe a traditional company our size. And that's okay, I love that. I use that position quite a bit when I talk to my peers across Cobalt as well as the rest of Cobalt's employees around their need to lean in, to buy in and their support of the security program. Yeah, you mentioned a lot of parallels between Cloudflare and Cobalt. You are offering security services, yet you yourself have to maintain kind of this high security posture. So essentially you have to be able to be champions of your own product or champions of what you're trying to essentially preach. And if you don't, then you're kind of failing the position you're in and kind of failing your brand. So I do love that parallel comparison. How did challenges from past work experience prepare you for your current role? You have this amazing resume of experience of working from smaller companies to large companies. Can you kind of describe some of the things that you might have encountered in the past, either lessons learned or things you've been able to take and been able to improve in your current role? First, I'll say that I've worked with tons of amazing people and I try to learn as much as I can from them. I came with my own area of expertise in the way that I came up into security and I think about things certain ways based off of the experiences that I've had, but being able to learn from great management, great leaders, and great teams that I've been able to build and hire, I feel like I take all of those learnings, all of those trials, all those hardships, and you end up better because you can bring all of that experience with you and to try to apply. And whether it's a means to help justify why a specific program, a specific initiative is more important, and you have a little bit more credibility, well, it's more important because I've actually seen this type of issue occur and I've seen the impact that this has. If we don't, being able to add that data element to it, I think, has been huge and it's afforded me lots of opportunities. I've made a lot of mistakes in my career. I've made either not the right call or I made a call without the right information, and it's led to an outcome that turned into a learning opportunity for me, and those are all extremely helpful in that if you embrace failure as an opportunity to be able to learn and to do it again better, it tends to yield higher level outcomes. I don't remember, there's like this old adage where it talks about smooth seas doesn't make a skilled sailor. I think it's very similar and there's strong parallels to a security practitioner. Unfortunately, I've lived through data breaches, I've lived through large-scale security events, and I'm better for it. And I think just having gone through some of those gives Cobalt the added benefit of reaping the rewards of some of those experiences. And then again, being able to build a fantastic team like I have today, each one of them has had experiences, failures, challenges that they've been able to overcome and rise up above, and we're also collectively better because of that, and it enables us to coach and support the other folks who are newer in their security journey to help them figure out, well, I've lived through that, and so here's what you're going to want to do, or you enable them sometimes to work through that experience themselves, and you realize they're going to come out better on the other end. Yeah, I live by this quote from Esther Dyson, always make new mistakes. I feel like if you're always making new mistakes, you're constantly learning, and even though we've progressed further in our careers, we're kind of like forever scholars, there's always more to learn, and a lot of times we're actually learning through those failures too. Absolutely. So without having to sign an NDA or anything like that, can you tell us probably the most interesting scenario or something that was really challenging that you were involved in? Sure. I worked for a company in my past life where we had a business unit that came through an acquisition that experienced a data breach, and it enabled me to drive incident response for that, figure out how we drive containment, what we can learn, how to recover the data and limit the impact that it has to all of our stakeholders, and having grown up a bit in that incident response arena, that's like the golden fleece. I mean, you don't want security issues, but when you have them, you learn so much, and that was one of the ones that I've learned a lot really quickly, and again, I had amazing folks around me that were either part of the team or supporting team members that enabled us to build the right plan collectively together. We had fantastic leadership at the time, and there were a lot of calls that we made right, but it also gave us an opportunity when we lived through that event to turn back around and say, well, what did we do wrong, and where were those gaps, and how could we have detected this sooner? And every one of those were opportunities to get incrementally better over time, and again, I'm trying really hard to skate the line around talking theoretically on this type of issue without getting into specifics, but it really is those types of issues, and for folks who are new in their security career and operate in that same type of space, you dread it, but the thrill of the hunt and the rush of being able to work through that and come out better on the other end, I think it's amazing, and I'm thankful to have had to live through a couple of those throughout my career. Yeah, absolutely. You mentioned mentors previously. Have you had mentors help you along the way, and how have they been able to help you, in turn, be able to mentor the next generation of people that you've been able to work with or hire? Absolutely. I've learned tons from just about every leader, either above me or near me, and I think it's partly just my nature of always being curious, always wanting to build relationships, and love hearing people's stories. So I've had a few technical mentors early on that played pretty close to the area to which I operated in in that technical space. One of the best pieces of feedback that I got from a mentor early on in my career is I had this leader tell me, you and I already think alike. You've been here for so long, and I've been leading this organization. We think too much the same. The best thing for you to do is to go to a completely different part of the business, a non -technical part of the business, and seek out a mentor there to really help round out your skill set and allow you to think about some of these problems from a completely different perspective. That was the biggest lightbulb moment that I had really early on because I found such mentor, and she was amazing. She came from the product marketing side, saw things completely differently, completely understood our business, but saw it through a completely different lens and enabled me to take a step back and to judge different situations in different ways. I think I've used that over time, both learning what I could and establishing great relationships with some of the great leaders that I had the opportunity to work with, but also identifying folks. You'll be in a meeting, and you'll see somebody demonstrate a really great trait. Maybe they have great presence, or they have a gift of being really clear, really succinct. I'd find myself seeking those folks out, trying to grab time, grab a coffee, grab a beer, have a conversation with them, and figure out what I can learn from them, and how can I take some of those bits to help improve myself while staying true to who I am, but adapt and get a little bit better. I think it's been huge. I mentor both folks here at Cobalt on my team. I have a few folks who I'm mentoring that are interning, essentially, in the security team, and then I also invest some of my time through otherwise mentoring folks external. I find myself very similarly quoting my dad, of quoting some of my previous mentors of things that they've said, because a lot of the situations that we go through are pretty similar. If that little nugget of information that I've received or an experience that I had can help somebody get better, it's my responsibility to be able to get that to them. It's one of the things that I love and enjoy. I feel like technology is something that's easy to teach, but there is a different skill set that is something that is not necessarily hard to teach, but something that gets overlooked. In your career, you've been very involved in technology, but also playing a role of firefighter and politician, selling the idea of why something is actually really good or why something might be needed in the firefighter because you're literally out there putting out fires. Real quickly, how have you been able to help other people learn those other skill sets that are not necessarily technology-related, the soft skills on how to effectively communicate, how to communicate an idea, how to calm a room? It's a fantastic question. The one thing that's really interesting and really cool is I'm a father of four. Each one of my kids learns differently, listens differently, responds to different things. I found that same parallel in the work environment in folks that are either on my team or that I'm mentoring. One of the first things that I try to tell anybody that I'm mentoring is to do a little bit of self-reflection of who you are, what are your strengths and some of your weaknesses. One of the activities that I give to just about every mentee that I have is go out and seek feedback from folks that you've had trouble communicating with. If you couldn't get on, you couldn't get on the same page, you felt like the relationship is strained, reach out to them and ask them for some feedback of what they think of you, how can you improve. Then the same thing, who are folks that you work with really well? They tend to already be your champions. They may be friends. Some of their feedback is usually a little bit biased, but that exercise has been solid gold for just about everybody that I've given that to. It was given to me at one point, and it was hugely valuable. I found that I needed to be more succinct, that folks would get lost in my message because I was too wordy and I was struggling with why can't I get my position sold? Why can't I bring folks along for the ride and help them see my point of view? Some of that self-reflection gave me an opportunity of where am I weak and where can I develop and spend some time. Then those strengths that I do have, I'm going to continue to work on those as well as opposed to putting them to the side. That self-reflection piece has been huge. Nothing prepares you to talk to people in different ways compared to parenthood. I heard a joke, you can be as tough as you want or you can be as hard as you want, but when a two-year-old hands you a toy phone, you answer it. It helps you adapt to all these situations knowing that not everybody is going to be able to get it the same way that you do. Absolutely. Do you consider yourself a cybersecurity evangelist? If so, how do you get people to care about it as much as you do? I would say so. I feel primarily it's my responsibility. The world is continuing to rely on data, on technology as a whole. There's been much that's been made around the skills gap related to cybersecurity. I fell into it based off of an opportunity from a relationship that I had at work where at least I exemplified some qualities that they thought would be interesting. I find so many folks don't even consider it as an avenue to be able to go into. When I was at a previous organization, we used to do recruiting at some of the colleges. I went to Cal Poly San Luis Obispo and I jumped at the opportunity to go back and help folks understand that not only is the company a technology company, but cybersecurity is absolutely a valuable field where you have the ability to make really good compensation, but you have the ability to make things tangibly better. You can make the world a better place. For folks that are seeking out those types of interests, typically they go to maybe a firefighter or they go to something a bit more tangible that they've seen. I try to help at least demystify a little bit of what it means to the cybersecurity field as a whole and some of the different roles that folks can play. I've had folks say, I love cybersecurity, but I'm not technical. I talk about a lot of the non-technical folks that I work with who are critical to our success that are directly attributed to the cybersecurity maturity of our company and companies past. A lot of it is just driving some of that awareness and using whatever platforms I have, even this one today, to be able to share that message that it really can be for everyone if there's an interest. Absolutely. Some people think of security as being a checkbox, as something that you, it's an assessment or something on a piece of paper that's saying that you've done this. What's one thing you think that people don't get about why it is so important? I'll go back to one of the comments that I had made. We think about all the data we store in our phone, all that data that gets put into what we call the cloud, and many people not even really understanding what that means. At the end of the day, whether they understand it or not, we want to instill a sense that it's important that their data be protected. It's important that the companies who are providing these services for them are protected really for their benefit. That does go beyond a little bit of a checkbox of, well, we're going to do a pen test because this compliance framework says so, or we're going to do this one activity because there's some sort of checkbox that says we need to do it, and as long as we do it, we're okay. A lot of that goes into the details of, well, how are you doing this? What's the driver? Why do you believe it's important? If I can go that extra mile and say, beyond just doing it is good or it's cool, it provides this specific value. I'm huge on logic and huge on data, so that's my tendency is to always try to go there first. That's really where I typically end up going of, well, what's meaningful for you? What's your lens look like? Then maybe I can reposition similar to what I mentioned, the messaging for my children. If I know you have an interest or you see things a different way, I might be able to tailor my message to make it easier for you to understand if I have a better understanding of the lens that you're viewing it from. That, for me, I think has been huge. It's funny because some areas, aspects of security have become easier to convince, but things like pen testing might be a little bit more challenging. I've always used the examples. You don't buy a house without getting an inspection. You want to see what's behind those walls, but are you really ready to be able to pull behind those walls and see what's out there and even determine whether it's bad or not? This is the benefits of actually leveraging a company like yours is that we're not experts in everything, but you've selectively been able to coalesce these experts that are capable of being able to analyze the things that are behind those walls or in your roof or in your basement or whatever, and they're able to tell you exactly what could be wrong and, if anything, give you a little bit more trust in the home that you're purchasing or the company that you're trying to run. Absolutely. I absolutely love it now. You're kind of like an early trailblazer in the space and presented some sets of unique challenges. Since this is presented by Latin Claire, we're talking to you not only because you're a prominent figure in the security community, but you also are a Latinx person. And Latinx people, their hint there, still growing segmented technology. Have you ever felt any pressure that you felt was due solely to being Latino? Is there anything that you feel like you had to do more of because of having a Latin background? Absolutely. It was really easy multiple times. Again, I've worked with great people. The one thing that I feel like is slightly skewed is I grew up in a neighborhood in San Jose that was extremely eclectic. If you look at our class picture for kindergarten, there's just about every background and race and ethnicity there that I grew up with as a small child. That was just my day-to-day, so I didn't really see that difference early on. It wasn't until you start to grow and you start to see, well, there are differences, and there are times where I am treated differently by different folks, especially in a professional setting, realizing that I'm the only Mexican manager here at my company, or I'm one of two. I think that there was always that unconscious pressure that I think that I had of, well, I need to make sure that I continue to do well more for my family and for my peers and to make sure that they were successful. It's tough when I think about it. I don't know if it'd be fair to say for all the entire Latinx community, I always felt like I had that weight on my shoulders because I don't think that that's completely accurate. I've definitely always been aware, and I've been aware that I've been treated differently at times either by different leadership teams or different individuals and coming to grips with what that means and feeling a little bit of my chip on my shoulder. Well, I need to prove that I belong here in this room. I think that carries over even now. You step into a new position, a new company, and maybe there's a little bit of imposter syndrome of, I want to make sure that folks realize that I belong here, that I've earned my shot, and I'm providing value. I think I've always had a little bit of that inside of me, and I've always been a person who strived to be really good or the best in a lot of areas. I think those were all things that were always in play, but I've always been aware. Whenever I would find other Latinos, Latinas out there who were interested in security, of taking time to help them understand what could be available and realizing that there's a responsibility for me to share the message, my story, how I got into it as a means to hopefully help other folks understand that they can get here too or hopefully exceed what we have. You brought up actually a really great point. Growing up in a Latin household, people might not be aware that we're usually told to appreciate what we have. Don't ask for more. Always be grateful for what you have because that's just what was expected. It almost helped to create what I almost refer to as Latin imposter syndrome because as one starts to grow and get ahead, we feel like we should be more thankful of where we are instead of pushing ourselves. Have you ever felt that? If so, how does one overcome that? It helps give perspective as far as how we were raised and how we've had to break those barriers. It's always a challenge. I'm thankful that I had a loving and supportive family who from a young age could always tell me that I could be whatever I really wanted to be and realizing that I haven't had the same experience, either experienced direct racism or something else the way that my grandmother has growing up or other folks in my family. On one hand, there is that thing of be appreciative. When you don't have much and you fight for what you have, it becomes much more meaningful of the little that you do have. To feel a lot of satisfaction and get a lot of value from. I've always been pushed a little bit too. My grandmother, my mom, my dad, you can do this. You can be so much more. It's the same thing that I feel for my kids of trying to help them break out of their own zone and help them realize you're capable of so much more. We're taught to think here and we're rarely taught to think bigger than that. It really is that balance. I am lucky that I have some to say you can be more, you can be better, you can do more, seek that out. I think maybe that's part of the work ethic component and a little bit of the chip on my shoulder of yeah, I can do this. I need to do this so that I can show them that they were right and make them proud. I think there's a lot that swirls in the back of my mind. Maybe more as unconscious thoughts based off of how I was raised rather than direct drivers. That's great because you have this self-motivation factor that allowed you to be able to push back and at the same time, you also had a lot of support. That's really good to hear. Having kids and what can, from a parent's point of view, from a Latinx parent's point of view, can you do to encourage early technology interest in your children? You have four kids. Are they interested in technology? Not to call them Neo-Luddites and they're only reading books and stuff like that. Obviously, we live in a world that's very technology -focused. All of my kids are fairly well-versed in technology. My two oldest children, my oldest is 22 years old and I have a 21 -year-old who's soon to leave to the Marines. My 21-year-old was the only one who showed any sort of interest in a very light way around cybersecurity in general or maybe technology as a potential profession. Now, he's going into the Marines. He tested really high on the ASVAB score and is now going to focus in electronics. I think he's trying to figure out exactly what that means. There's a little bit of that. I think part of what I try to instill is the Internet's fantastic, but it's more than just video games. It's more than just Minecraft. There's a lot of things that are bad out there. It's a small amount of awareness that the world is not all good and fluffy without trying to scare them, but helping them understand that there's a responsibility that they have of their own presence. My 14-year-old is on social media and I'm helping him understand that that comes with responsibility, but there's also threats and risks and there's things that happen, cyberbullying and whatnot. Driving a lot of awareness, I'm helping them understand that there's a world outside that they need to be aware of without scaring them, but my seven-year-old has a completely different message of you just need to be safe because there might be bad people out there. I struggle with it all the time. My wife and I are constantly trying to figure out how do we provide enough space for them to enjoy the life that we've built for them and allow them to be kids, but also make them aware that they can't go blindly into all these things because there are risks and there are issues that they may fall into that it's our responsibility to prepare them as parents. It's always a balance, man. I think it changes year over year as they get a little bit older, more mature, you can be a bit more honest. I wish I can say my 14 -year-old has a coding class either on his schedule or at some point here really soon as a fellow Pythonista. I'm excited to bond with him on that to be able to help him. We'll see, but there's a lot of screen time here, maybe more so than what we hope. It's helping them understand what that means in the grand scheme of things. The day that my daughter picks up her Python for Kids book is the day that I probably become so elated. I'm like, oh my goodness, it's happening. Absolutely. Latinx gente are typically family first. How do you balance home obligations with work ones, especially being in the position that you've been in who may have to work emergencies? What's your work-life balance been like, especially with the company that you lead? Absolutely. First, I'll say that my wife's incredible and she's absolutely a fantastic partner and my best friend. I think collectively, we're always trying to do the best job that we can for our kids and for each other. A lot of that means when we're together as a family, we're present. There's chill time when we're together, maybe we're on our phones, and there's time when we're focused and together. We're trying to enjoy that time. I feel like I owe that to my wife, I owe that to my kids to give them that time and attention. On the flip side, now that my kids are doing virtual learning, distance learning, I tend to be extremely busy in the morning because Cobalt has an office in Berlin. I have team members in Berlin, so my mornings are usually pretty busy. We've sort of divvied it up where in the morning she helps my 7-year-old get on his Zoom meeting and helps make sure that he has his schedule. At times when I start to get breaks, I step away from my computer, I make sure that he feels supported, and I'm there to give him that time, that love, that attention, and the same thing with the rest of my kids. We're trying to figure out that there's that balance. Helping them also understand they've seen me be on call ever since they were babies, even before they really knew what was going on. I think they've always accepted that element of that's part of dad's job. I feel like I offset that by trying to be present with them when we're spending that time together. It becomes more the opposite of hey, this is family time, put your phone away. Let's enjoy this time. Let's do something else. It's a partnership. It's something we have to stay conscious and aware of. It's something we put a lot of time and attention to. I'm thankful we have family nearby, my mother's nearby, my brother's nearby, making time to spend with them, showing my kids it's important to spend that family time. It's huge, it's everything. The small trips we do together as a family, getting some of the extended family together and enjoying that time, those are the things that shaped a lot of who I am and had positive impacts on me. I want all of that from my kids for them to be able to see and enjoy the same thing. That's a beautiful thing, man. I'm going to take that to heart, too. Pivoting a little bit back, we talk a lot about Latinos in the industry, but Latinas and security specifically are few and far between. First, you have Latinas on your team, and if so, what unique perspective do they bring? On the security team specifically, no other Latinx folks at all. I do have several females who are interning on the team right now and giving them the opportunity to learn and grow and to get exposed to some of the security work and have taken a specific effort to provide opportunity to other women who are interested in cybersecurity and giving them time, support, attention, mentorship to help them grow. I do have a fantastic partner who's a Latina who works for Cobalt who came from the immigration defense paralegal and came in that immigration defense and fell into security based off of happenstance. We were just talking about this specific thing of how did we come to security being able to support each other as Mexican-Americans and the responsibility that we feel to help others understand the different opportunities that are here. I feel like the challenges again are very similar of giving folks the opportunity to understand that there's a profession here, there's a career that can be built, and it likely isn't just what you think. It's not just what you've heard or what you've seen. There's tons of different facets that make up security that really are for anybody and it's really do you have those personality traits, do you have the willingness to work and to learn and have a great attitude and help others around you. Those are more of those soft skills, the intangibles, where if we can put a monkey on the moon, surely we can teach somebody security, but you can't teach them to be a great person to want to help others around them win, develop, and grow. I've always seeked out folks who demonstrate those types of traits, male, female, Latin descent, or of really anything in providing them opportunity to be able to grow and give them the opportunity to shine. I'm thankful. There are definitely not enough. It's funny at times when you meet somebody else who is of Latinx descent, immediately you gravitate towards them and you're like, hey, what do you do? You're looking to share that story. I know we have mutual friends and mutual coworkers. It's awesome to be able to do that. Again, that goes back to what I had mentioned. I feel like it's my responsibility to spread the good word as much as possible. Elizabeth, who I'm mentioning, who I work with now, she's a UC Berkeley alum. She spoke here at the Latinx event there at UC Berkeley and also feels that same sense of responsibility of driving awareness, that there's opportunity here for the folks who may not even realize that it is. You mentioned that. I think the biggest barrier is not necessarily the fact that there are not people that are interested in this. It's more or less letting them know this is an avenue they can take. How do you recreate an awareness campaign to let the Latin community know that this is actually something that they can do? Because we are really good speakers if we want to. We can have those soft skills. If anything, by being bilingual or trilingual or whatnot, we have additional skill sets that make us a little bit more attractive to potential companies as well. Even beyond seeking them out and driving awareness, I think it's pushing some of my peers that are other managers, leaders at my company and other companies to put more weight into the exemplification of those traits of success rather than do they look like me, do they think like me. Thought diversity has been huge. I think some of the biggest gains that we've made in the teams that I've either led or been a part of have been because we come from completely different backgrounds and experiences and we really feel like we're stronger together because of all the different experiences and perspectives that we have. Absolutely. You can completely attest to this. Security people often have to deliver less than stellar news for improving a company's security posture. At times, we're really not the most welcome community in the room. Pen testers also usually work behind the scenes. A lot of their work is done off hours or on time. They might not have a lot of visibility. With having pen testers from Latin American countries, are there any unique ways in giving them more visibility potentially to help with this brand awareness campaign that this is an avenue that other Latinx folks can take? I would say, for one, I think giving them the opportunity to speak I think is huge. Giving them the opportunity, if they're part of a group, of empowering them to be the one who's providing the updates to the customer specifically. Here's the approach that we're taking with our testing and here's the areas that we're covering so far. Either looking for feedback or being that voice and giving them the opportunity to do that I think is huge and encouraging that to occur. Delivering news, providing perspective, or sharing bad news, it only gets better through practice, through repetition. I think it's really driving that encouragement that I think has been... I've been given that opportunity. Thankfully, I've had leaders who saw the same thing of, here's some nuance and here's some things to think about. Now go and do it again. Maybe if you fail again, come back and let's figure out what we learned. I think it's a lot of the same. Helping them understand to embrace their native tongue and try to figure out if it's English speaking, to give them an opportunity to be able to practice and also maybe provide some context. A lot of times what I found is I've had somebody come to me and say, my English isn't great, so just bear with me. I'm really going to try to explain my position. If you have any questions, please stop me. I love that they were able to preface that up front because a lot of times you demystify or you break it down a little bit. It becomes more of a supportive engagement and discussion as opposed to, I don't know if I like the way that you said this. Maybe you can say it better. I get to throw that out of the window. I encourage that a lot with some of those folks who are non-native English speakers especially because I do find that it does make the conversation maybe a little bit easier or you put the person in a position where they're supporting as well as listening. Absolutely. I feel like the goal would end up being is that you want them to be better speakers. You want them to be able to present their research. You want them to be able to speak at conferences and be able to put down this amazing compendium of work that they have on paper and be able to let the audience know what their thought process around with that is. The only way they do that is practice and mentorship. Practice of failing at times, learning from those failures and getting better. Absolutely. Back to you. When you were younger, was this your dream job or did you have a different dream job in life? I think I've had different dream jobs along the way. I was joking not too long ago. There was a time when I was really young. I loved the thought of space, being an astronaut. I had heard the term at one point, the cosmos. I was like, oh, so cool. Then I heard a term of somebody being a cosmetologist and being really young. Six or seven years old, I'm like somebody who works in the cosmos. That's so cool. I used to walk around as a small child saying, I want to be a cosmetologist. I would get laughs from my parents or some of our extended family. I'm like, what? Then somebody finally told me, that's a hairdresser, somebody who cuts hair. I'm like, no, no, no. That's funny. You don't understand. I understand. No, no. Realistically, that was what I used to tell folks that I really wanted to do early on. I then saw the movie Toy Story when I was 16. Blew my mind of being able to do computer animation. I've always been fairly computer savvy. My dad was an electrical engineer. He taught me how computers work really early on. They were a safe place, safe for me to use and to grow. I went into college thinking there wasn't one upper division course for computer animation. I'm like, well, I might as well do computer science because eventually I'll be able to do that one course. Turned out I didn't love programming. That just wasn't a fit for me at the time. I fell back on my roots of, well, my dad taught me how computers work, what RAM is, how to swap out RAM, what a hard drive is, when it fails, what to do. I moved into more of that IT track and technology track and infrastructure operations before going into security so it's been a revelation of things over time. That's one of the things while I tell my kids now, don't feel bad if you don't know what you want to be. Even my 22 -year-old, he's like, I should have this figured out. I was like, when I was 22, I thought it was going to be something different. Now, here I am driving in a different role. Live life, learn from it, and keep going. Cosmetologist to computer animator to cybersecurity. Little did you know, you could have your own YouTube channel as a cosmetologist now and be retiring. Just a quick housekeeping reminder to remember to submit your questions to LiveStudio at Cloudflare TV if you have any questions for Ray. What advice would you give your college graduate self? It's a culmination of a lot of what I've said already. Seek out and learn from just about everybody that you can. Don't expect that you know everything or that you're expected to know everything just because you graduated from college. Seek out mentors, seek out tons of advice and perspective. Find those nuggets that really fit. Take with a grain of salt maybe the things that don't and be true to yourself. Have that hunger, have that drive. The folks that I've hired either as interns and then turned into new college grads, they were really those ones who were hungry. They had a chip on their shoulder. They were all about learning. I look back now and I have great relationships with some of them. To see their continued success is fantastic. I don't think it's unique that they were able to find success and they were able to exemplify and grow their careers by seeking out mentorship and continuing to develop themselves and coming with the mindset of, I already know this, I should be given this but be more so of a servant type of approach of what can I do more for myself and my team so that I can learn and rise from there. That's some of the advice that I tend to share. Awesome. What was the first thing you bought with your own money? The first real thing that I bought with my own money was my first car. My parents helped a little and a little by maybe half but I had a job and I was saving money and I was spending a little bit here and there but the fact that I used some of my own money to buy my first car, I cherish that car. I maybe didn't take care of it as much as I could have because I didn't understand how engines work and all this. But I held that in such high value because I put my own money into that thing and I felt really good about that. Nobody tells you when you buy a car you really have to change the oil every 5,000 miles. It's like lesson learned. All of a sudden you're driving on the turnpike and your car breaks down. Not to say that was my personal experience but it happens. I had a similar discussion with my dad. The check engine light came on six months ago and now it just won't even move and I'm here on the side of the freeway and changing the oil. That's something I had to pay attention to. I thought that was just something that I had to literally open the engine and see if anything was wrong. Did you know that was something you had to address? Absolutely. If you could be an expert in something else, what would it be? I had the opportunity to coach my son's football teams. I love coaching in general. It's consistent with the theme. I love helping other people develop and win. When they succeed, I enjoy that. It's the same feeling I get when you take the training wheels off of my son's bike and I finally let him go. He goes and he's excited and he does it. Having the opportunity to impact other young people like that is huge. I don't want to be a Tony Robbins but I do love coaching football. I think if I can be an expert in the X's and O's beyond some of the knowledge that I have now, that would be awesome. If I could provide the same quality of life for my family, I'd love to be able to coach full-time football. I competed in strength sports and being around those folks helping them develop and win. Having a deep expertise there to really help folks get better, that would be pretty awesome. That would be awesome. Would you be more of a Bill Walsh coach or a Mike Dicka coach? I think definitely more a Bill Walsh type of coach. A student of the game, a teacher, and really help build these folks, build their confidence. There is elements of Mike Dicka for sure. You can be rowdy, you can really get folks going. I think there's definitely a time and a place for that. My nature is more so teacher, friend, listener, to try to help drive support. I can see you being a lot more even-keeled with those small bursts of, like, go do it! More from a rowdy perspective, you really want to encourage them to go out and perform their best. Maybe I'm underselling it because there's definitely times where I'd walk off the football field and my voice is pretty hoarse as well. I'm sure as heck cheering our kids on and whatnot. There's quite a bit of that. You have to make sure they're listening, that's why. Absolutely. On a non-work level, what is something you're really good at? On a non-work level, I think I've always prided myself. I could be average in anything else, but I'm never going to be average in being a good dad. Even more so here, and the lessons learned through marriage of being a great husband and a great friend and a great support. I pride myself on that. I'd say I'm a pretty damn good dad. My kids echo a lot of the same and it's pretty meaningful to me. It's everything to me. I think I'm underselling that by saying it's pretty meaningful. There's lots of other skills that I enjoy. I dabble in the guitar and I play off and on. A little bit of coding here and there. When it comes down to being the rock that somebody needs, being a listener and a supporter, that's where I feel I excel really well. That's awesome. On the opposite end, what's something you're really bad at? Singing. My 21-year-old son, the one who's leaving for the Marines soon, he was a musician. He could pick up any instrument and just play really well. He was a part of Santa Clara Vanguard, this world -renowned drum and bugle corps. He would pick up the drums. He would pick up the guitar. I taught him how to play the guitar early on. Soon he was lead guitar and I was rhythm. I'm like, no, this isn't supposed to work this way. He was never a great singer, but he got involved in choir and he took lots of lessons. He became an okay singer. I, on the other hand, have never tried, but I still love it. I do it more for the fun of it, but I'm a horrible singer. I'll go along with it. We karaoke and everybody's into it. I'm going to do it. I'm going to have fun with it, but I'm just not good. That's okay. I think everybody realizes after enough alcohol, anybody can be a great singer, especially karaoke. Absolutely. That's awesome. What's the best advice you were given and who was it from? My dad. He would always tell me ever since I was young to have balance. Balance is the key to life. I didn't see it early on. I was all in on friends, all in on relationships, all in on different things. He would constantly tell me, son, you have to have balance. The older I got, the more meaningful that became. I find me pairing that back a lot to my kids as well. Seeing them walk, making some of the same decisions I made, having some of the same experiences, maybe even some of the negative learnings or outcomes. Talking to them about balance and making time for your family as well as your friends. Balance in video games as well as your studies. I think it was the best piece of advice that I've always gotten that I will continue to share to everybody in my family because I don't think we hear it enough. Even at times now, sometimes having a type A personality and wanting to dive all in, I have to check myself at times and say, could I spend a little less time in the gym and make sure I have quality time with my wife and quality time with my kids. It's still the best single piece of advice I've been given so far. I can tell. You speak really passionately about that. In turn, it helps you become that anchor for your family. You've already been able to see how it's paid dividends. You've been able to see the successes that your children have and your family in general. Kudos to you, man. That's awesome. That's really awesome. What's a good family tradition that you have? Growing up in a Mexican household, tamales at Christmas is still one of my favorite things. One of the best things we do in our family right now, my wife is Polish as well. One of the traditions we've taken on during Christmas is making pierogies from scratch. It was always awesome to have homemade pierogies, homemade tamales, and then my mother-in -law would make a roast or something else. There was always this mix. My family is still pretty diverse. My sister-in-law, we had lumpia and we were rolling lumpia as well as making pierogies. That tradition, I think, of just the holidays of making either of those things, but especially pierogies I love the act of doing it, but it's still very meaningful for them. They'll spend 5 -10 minutes and then they're cool. That's part of the tradition and it's there. For me, for my wife, it's super meaningful that we continue to do that. I do miss at times making homemade tamales. It is rough when it's just myself or even just a couple of us, but just those traditions are awesome, amazing. I understand the importance than they were, but I still always loved them as a kid. Being there, laughing, joking with the radio on, all our family around. We're washing the corn leaves and then spreading the moss. It was less about the work put into it but more of the time that we spent together. That's the same thing we have making pierogies. That's awesome. Separately off topic, I'm going to get that tamale recipe for you. I've experimented with a few and maybe my manteca portions are a little off. Let's coordinate that. We have about 5 minutes left. I feel like we should do a lightning round. Want to do a lightning round? Let's do a lightning round. Dogs or cats? Dogs. I'm a dog person myself too. Bike or scooter? Bike, but I feel like scooter would be more fun. Practical, bike. How do you like your eggs? Over easy. And every day. Every day. Eggs every day. Eggs every day. Awesome. Are you currently reading any books now? I have just finished a book for my daughter. It's from David Goggins of Don't Hate Me. I'm struggling right now with the name and of course it would escape me right now. But David Goggins, his most recent book, Fantastic Amazing. It really focuses a lot on mental toughness. When you think about some of the crazy things that people have gone through, it really puts things in perspective. The things I've gone through aren't that bad. Or they could be worse and have somebody fight through all that adversity and become a Navy SEAL or an ultramarathoner or become the best in everything you set out. That book was empowering. I tend to like to read as I get in bed. Reading a book like that gets you fired up. This isn't working for me here. I need to be coming down off of the day's high not getting pumped up thinking maybe I can do a triathlon. This guy did it. It would be a fantastic book. Can't hurt me. I'm an ultramarathon runner too. I read the book. Can't read that at night. You just stay on edge. It's 1 o'clock in the morning. If he can do it, I can do it. It's going to take a while. Exactly. I'm going to try to get these in before time runs out. Does pineapple belong on pizza? My wife would say so. I'm okay with it. That's a modern answer. Awesome. To make my team happy because this is a huge debate, I'm going to ask Is a hot dog a sandwich? It's a hot dog. It's clearly different from a sandwich. Why? Because the bun comes apart and you get to add lots of stuff. Granted, my argument is maybe not as strong as what I would like it to be, but to me it's that the bun is an open face like a hot dog does. A sandwich is really I can cram and close and get it down in there. Fair enough. There's been some research papers on it so I'm going to debate that. I would love to. We'll leave it at that. Ray, from the bottom of my heart, thank you for spending your time today sharing your career insights, lessons learned, personal family perspective. It's been amazing. Seriously, I'm really happy that you were able to spend some time with us. Also, thank you to all of you for supporting us by participating in today's event. We hope to see you again at future Cloudflare TV and Latinaflare events. If you're interested in working at Cloudflare, from cs9Cloudflare.com. Again, Ray from cobalt .io. Cobalt.io or cobalt.io? Cobalt.io. Cobalt.io. Awesome. Everyone have a great week and we'll see you next time. Thank you, Eric. You