When Sam Fariborz moved to Australia from Iran, she had been working as an IT manager. While she had plenty of experience and strong technical skills, the move to Australia was challenging, and in this episode Sam discusses some of the barriers to entry she faced. By attending cybersecurity events and reaching out to people on LinkedIn, Sam found mentors and peers who helped progress her career, and today Sam is Cybersecurity Services & Program Manager for Kmart group which employs nearly 50,000 people across Australia and New Zealand. Sam chats with Cole Cornford about how to network effectively, the growth of cybersecurity as a profession in the last couple of decades, the need for greater diversity within the industry, and plenty more.

Secured by Galah Cyber website

Time Stamps

4:15 - Sam’s journey into cybersecurity.

5:00 - Sam losing her confidence when coming to Australia.

6:00 - Cole has seen people from overseas struggle to fit into Australian work culture.

7:00 - Sam’s experience with racism.

8:10 -  Sam’s positive experiences meeting mentors.

9:10 - Cole’s uni address and why “career ladder” is a terrible analogy.

11:45 - Sam: a story of one mentor who changed the path of her career.

14:10 - Cole: giving back to the community that fosters you.

16:40 - How to network effectively.

17:00 - The value of attending community events.

19:00 - The growth of cyber community in Australia.

20:00 - Sam: today everyone wants  to get into cyber.

20:20 - The increasing gender diversity within cybersecurity.

21:30 - Sam: the need for greater diversity within cybersecurity.

27:20 - Sam’s experience being a woman in a cyber leadership role.

28:20 - Sam: most women feel like they need to be perfect to be acceptable.

31:40 - Sam: cybersecurity is changing every day.

32:10 - Sam: cybersecurity professionals have a positive impact on the lives of people.

Mentioned in this episode:

Call for Feedback

Hi, I'm Cole Cornford and this is Secured, the podcast that dives deep into the world of application security.

We are making a difference. That means a lot to me. Being part of a team that makes a positive impact on the security and safety of others really can be fulfilling

Content warning, some discussion topics may be uncomfortable to listeners. When Sam Fariborz moved to Australia from Iran, she had been working as an IT manager. While she had plenty of experience and strong technical skills, the move to Australia was challenging. And in our conversation, Sam told me about some of the barriers to entry she faced, but by attending cybersecurity events and reaching out to people on LinkedIn, Sam found mentors and peers who helped progress her career.

Today, Sam is cybersecurity services and program manager for Kmart Group, which employs nearly 50,000 people across Australia and New Zealand. We chat about how to network effectively, the growth of cybersecurity as a profession in the last couple of decades, the need for greater diversity within the industry, and plenty more. So let's jump right in. I am here with Sam. Sam, how are you going?

Hi, I'm very well, Cole. How are you?

Oh, fantastic, except a bit rushed. I just came from a community risk group and talked about some really important cyber controls, like patching and attack surface reduction. And then I had to rush to school because I forgot that Wednesdays is the day that you need to go to school, pick up your kids in person proper, actually get out of the car and meet other parents. So yeah, but here I am. I'm ready to go. We're going to go podcast and be awesome, right?

Same here. Ready to rock it.

So Sam, I always ask all my guests when they jump on the podcast, what kind of bird are you and why?

I am a quail.

A quail?

Yes, there is a good reason for it. My complete name is Samone, and I am coming from Persian background. And in my language, Samone means quail, so it's an easy question for me.

It's the one-to-one translation.

Yeah, exactly. Yes, exactly. Actually, quail is just one meaning for Samone. It has different meanings, but one meaning for Samone is quail.

So what are the other meanings then?

Yeah, the other meanings, it's a sky as well, it's quail. It's interesting. In your mind you might want to connect a quail to a sky, it's just different meanings. Yeah.

Yeah, flying around. Yeah. I've been reading a book which I think would be quite boring to a lot of our listeners, but I don't know, I'm a bit nerdy. It's called the History of the Peloponnesian War by Thucydides and it's ancient Greeks, and they were quite angry about having a war with Persia before Sparta and Athens started fighting against each other. So I keep learning about Persian history by accident, by reading this book. So yes, I know a little bit about Xerxes and Cyrus and ancient Persia. Nothing to do with modern.

Yeah, exactly. Yeah, we have a great history. Yeah.

Yeah. So what got you into cybersecurity? So tell me about your journey.

Honestly, I didn't expect it, it happened, let's say. I started my whole journey career in IT, I started as a services desk person after university and then moved to more infrastructure kind of person working in network, in system admin domains prior to coming to Australia and prior to moving to security. When I came to Australia, I lost my whole confidence. In my last job in Iran, I was an IT manager, but here I felt like I'm in the middle of a black box. I lost my whole confidence, I couldn't communicate with people.

Although I knew everything from technical perspective, I knew English, I wasn't speaking English for years, but the overall cultural change and cultural shock was huge for me at that time. So I decided not to go through interviews for jobs and I started looking for volunteer jobs. And I was lucky enough that I found a technical IT operation engineer volunteer job, and my journey in Australia started from there. I got involved in a major accreditation project. It was about 27,001. Wow. Can we cut here?

It's something I hear a lot actually is moving to a foreign country and people struggling with getting roles because they're different. And I know a lot of people, especially in application security, there's a lot of people who've moved from India I know who've come here and then they know the tools extremely well, they're very smart people, they're solid software engineers, but the cultural barriers and not willing to go out and have drinks to people after work or not knowing that they can say no to requests from people because a lot of the time they just say yes and then just don't deliver upon it because it's culturally rude to say no. And even communication, racism still persists to this day and I still see a fair bit unfortunately in my career and I'm sure that you would've had to experience a fair bit of it too.

Absolutely, Cole. I am not going through all the details about the bad experiences I had here because I had fabulous experiences as well. I don't want to just look into the empty half of the glass, but it's absolutely here as well. It's hard to get into the job, especially when you're a female, it's getting harder and harder, makes everything actually harder. And when you're a migrant, it's just, oh my God, you need local experience. And even when you gain that local experience, it's still hard to continue because I think people have bias. You still have bias on different, if I know it's not recorded, I can talk about it for hours, but when I'm thinking we are recording something, it's so hard to talk about it.

I understand. But yeah, there is a lot of bias out there and it's still services every single day and people are not aware of it, so I think it's actually quite courageous for you to go out on a public forum and say that you've experienced this and it still persists. But like you said, not all bad things. What are some of the great things that happened in your career?

I met wonderful people who have been really helpful. I'm still in contact with them, we are friend now actually, and they help me a lot in different ways. They help me a lot on understanding the business, they help me a lot in terms of understanding the technologies here, understanding, "Okay, what path I need to take?" Basically, their role have been like a mentor for me. And I would say that's the most great part of being in Australia, meeting great people, working with caring people, working with people who really want to see me as a successful person. And I do appreciate all the help that I get from people around me. Yeah.

I did a speech at my university a few weeks ago. I don't know why they asked me, but anyway, they did. They said, "Hey Cole, you can be an occasional speaker." And I was like, "What is an occasional speaker? I'll say yes because I don't really know what that is." I looked up and the last occasional address was given by Julia Gillard, who is pretty well known in Australia.

Wow. Yeah.

And I felt that I didn't quite live up to that expectation, but anyway, I went and did it. And one of the things that I said is that I think that the metaphor that we have of having a career ladder implies that the ladder is quite narrow. And to climb up it, you have to climb on other people's heads. And I don't think that's a very appropriate metaphor anymore because almost all of my success comes from having other people push me up a hill. And I think that I'd like the hill analogy a bit better because different people have different hills.

Some people want to have a hill that's the size of Everest and they can work to be a prime minister or an astronaut or whatever. And then some people are pretty content with just having all the local short climbs and that's okay, you don't have to aspire to be the best cybersecurity professional or whatever. Main thing is that everyone has their own hill to climb and the hill is not a ladder. You can help other people climb up the hills, right?

Yeah, no, that's right. That's right. Yeah.

So I'm glad to hear that you've had great mentors in your career because I certainly had some myself. Without kind of naming people, I've had a fair few in my time when I was at the tax office who basically taught me that warmth and kindness are really important attributes that'll get you a lot further than being technically correct and methodical and just elitist. It's just never going to get you anywhere.

I've had other people change my perspectives about how we do cybersecurity based on business risk and business outcomes, not necessarily on just pure technical brilliance. And then other people have just encouraged me to take risks and do things differently because running a podcast alone, it's like, "Well, why would you start a podcast? You already have risky business and other big security podcasts. What's the point of running your own?" It's like, "Well, I like talking to people. I don't think that that market's being serviced all that well. So let's go out there, try something new. So having the courage to take risks.

Yeah, it's inspirational with what you've been able to achieve. And nowadays, you are working as a deputy CISO kind of group managery thing, right?

Yes, I'm cyber executive services and program manager for Kmart Group. Like I said, I've had great mentors in my life helping me, and I would like to talk about one of those experience that I had because it changed my whole career. Sometimes one simple question, one simple advice can change everything for you and I had a great mentor and I'm still in contact with that person. I contacted her in LinkedIn. I use LinkedIn a lot and I usually ask my mentees to use LinkedIn as well because I'm a true believer in using that tool and using that platform basically for career improvement, getting in touch with industry people, people in the industry. And I contacted a person, a lady in LinkedIn, and I asked her for a coffee catch up. I use it a lot just randomly contacting people on LinkedIn. Yeah, sounds not good.

No, I do it too, but half a time people look at my profile now and they say, "He's a salesman, so I'm just not going to accept anymore." So it's all good.

No, I love interactions, I love talking with people, so I do it a lot. I contacted that person, asked for a coffee catch up, went to see her. And first catch up, I thought, "Oh my God, I really want this person to be my mentor." And in that first meeting I asked her, "Can you be my mentor?" And she said yes. Fast-forward a few months later, I received the job offer. I went to her saying, "Hey, I have this job offer. I don't know if I should accept it or not," and just simple questions.

She asked me, "Are you excited?" And I said, "I am not really excited." And she said, "If you're not excited now, how do you expect yourself to be excited and have that fulfillment in future?" And I said no to that job offer and it changed my whole career, really. But what I'm saying is even with just one simple question, with just simple advice, we can change people life. That's why I'm always seeking for advice, that's why I love touching with people, I love connecting with people and meeting them.

There you go. So everybody, you should all add Sam on LinkedIn and say hello. She will go have coffees with literally everybody, so-

Oh, no.

Be a mentor to the world. But I know that I've had plenty of coffee catch-ups of all sorts of different people. Really early in my career it was just with university professors in my family or whatever, and middle career and so on it was just in various different directors and people who founded businesses or head of executives and stuff and just talked a lot about all sorts of things. It was like, "Why am I struggling with dating? Why is that so hard?" And it's just like, "Okay, well, here's some genuine advice about what you need to do. Maybe you need to think about these other aspects of your life if you want that one to do well."

Or it's like, "Why am I having so much issue with progressing at this place?" And it's like, "Well, maybe you've been in the same technical role for so long and you're not actually pushing yourself, you're not developing the skills that you need to get to there." And nowadays, I think a lot of people see me in a leadership position in that I run a few community events in Newcastle. I run a podcast, I have my own company, and I pretty much say yes to whoever wants to talk to me on LinkedIn as well and make the time to actively contribute and give back to people because I figure that it's kind of our duty and our responsibility as the people have been the beneficiary of others that we do the same moving forward too.

And another thing I guess is if you encounter someone that really inspires you and makes you just excited to work with that person, you need to follow them around and be with them, right?

Yeah, that's true.

Yeah. I know that another thing is it's scary on LinkedIn to just go and approach people. You are probably going to get rejected a lot more than not.

Oh, that's true. That's true. You're not getting response from everyone you're contacting, messaging. That's absolutely right. I can't remember how many people I contacted early days when I started actively actually working on my LinkedIn profile, but just a few people responded back, which is great. I could make lots of great relationships and friendship with those people, but yeah, that's right, you're not getting response from everyone. Yeah.

I think one thing that maybe a lot of people don't do is how to network effectively. And I think the two things that are superpowers for me is if you go to community events and pull your hand up and just do things, people notice and then they will tell other people about it as well. And that is a great thing, assuming that you do something meaningful and useful for people, not just turn up and be an asshat.

Yeah. No, Cole, that was another actually activity I used to do a lot basically. I remember those days every day might be a bit, I exaggerated here, but at least a few days in a week, I used to go to security events after work. I used to do it a lot because I wanted to build that connection with people. I wanted to understand what's happening in industry. I was new to Australia, I wanted to understand Australian businesses, I wanted to understand who is running the show here. And that was another approach that I took those days. I'm still doing it, but in a better way, in a more moderate way because I'm super busy with actual work I'm doing. I don't have that luxury of time of those days. But yeah, that was definitely another approach.

So how did you find these community groups coming straight into Australia? Did you just go to Google and search cyber meetups or something? How did you find these groups?

Yes, meetup application was the first starting point for me those days. Another way was, again, coming back to LinkedIn, I use LinkedIn as a source of getting information about all these community events. Yeah, just two basically.

Yeah. And did you end up doing any presentations or did you just mostly go and network with people?

No, I didn't. It was mostly about connecting with people. And now that I'm seeing some of those events now are big events. They started a few years back with a small group of people, but now they're running very big here in Australia and some of them went international as well.

Yeah, I think about when I first started going to some of these events, it would've been 2014, 2013, we had a coders group, all Linux user groups, and then we moved to Canberra. We had like Rox Mon, Rox Con and BSides Canberra had just kind of started and it was at the Rex Hotel. And then a few years later it was at the Epic showground. And then three or four years after that, it was at the National Convention Center of Canberra and it's like, "Hang on a second, the order of magnitudes gone from 50 people in a room to 3,000 attendees this year apparently." So I think there's been a tremendous growth in the amount of people that are interested in pursuing cybersecurity. It's now a profession less than just a bunch of nerds who just want to understand how stuff works. Have you seen that kind of transition over time?

Absolutely. Definitely, I can see more people interested in cybersecurity. Every company I'm going, I can see that pretty much all the IT people are interested in cyber. That's a trend I'm seeing everywhere. Everyone wants to get into cyber. And previously we went to the events, we could see just maximum 20 people, 30 people attending those events. But now if you go even for the smallest events, you can see more than 30 people sometimes attending those events, so I definitely can see the shift here.

And I want to touch on another aspect of this shift, which is about having more women and having more females in these events, because one experience I had previously those days was I clearly remember that I was the only woman attending that event. I believe that was an event from ASD or an organization like that facilitated that event and I was the only woman in that event, and it was so scary and frightening really for me to go to people and say hi. And I was just listening to the speaker, not talking with anyone. And very carefully, slowly I started talking with people in that event.

But now that I'm looking into the events, I can see much more women attending the events coming into the industry. We have great groups of women supporting each other and working with each other to add more diversity to cybersecurity. We need definitely more diversity and inclusion to cybersecurity. And I'm not just talking about having more women in cyber, I'm talking about having a diversity thought in cyber, we need people with different backgrounds, we need people from different technical backgrounds, we need developers coming to security, we need people from infrastructure, even from other sides of the business, finance, even marketing. We need that diversity of thought more in cybersecurity because we are basically facing with hackers, we are facing with those people at the other side of the fence that are from different thoughts.

Yeah, ultimately cybersecurity is a business risk and something that businesses need to make decisions about. And businesses are not just IT systems, they're people, they're processes, and sometimes technology is involved as well. And I think a lot of technologists forget that that is the third part of the business. The most important thing is businesses are built by people to serve people, and it's very rarely that businesses are built because they want to do cool techy stuff. It's some kind of outcome for it. And I know that traditionally a lot of cybersecurity has come from, like you yourself came from IT service help desk and infrastructure and networking before moving into it, but I'd say that there's a lot of people who definitely are coming into the sector from all sorts of backgrounds nowadays.

I was at one of my client's offices recently and I met one of the senior executives there and they came from primary teaching backgrounds and then came into cybersecurity and they basically figured that one of the reasons that was really difficult to influence culture and stuff is because there was no standardized method for actually approaching an awareness and training it like a syllabus to approach it. And in a way to actually get this ingrained in people and assessed over time, which is something that came from their education background.

And one of my close friends who was on the podcast, Toby, he said he studied gender studies at university before he realized he couldn't get a job, but I'm sure that that would've helped him have an extremely different perspective coming into security than someone who just went, "All right, computer science, Java, C#, software, kernels," and then suddenly they end up in the workforce and the grad program and to talking about Fortinet, but they're never talking about, "Why do we need firewalls? What does it actually mean for my business? Isn't this actually causing a user experience problem? Why are we doing this?" So that diversity of thought is really important.

Absolutely, yes.

And women as well, it's a significant issue. I have seen it improve. It's something I'm hyper aware of and want to do what I can to help improve representation there as well, especially amongst women in leadership positions. Because I think AWS sent us a survey a few months ago and it was like 18% of the workforce is women or people who identify as women. We're never going to reach parity, but we do need to work on improving that. And that number slides dramatically as soon as you go into leadership. And I think that if women don't see other women in leadership positions, who are the role models and mentors that you're going to aspire to be like? So we need to do what we can to elevate and help other people move there and look at ways to actually remove impediments and obstacles and reasons to make people want to not be in the sector.

Like in Newcastle, we have a community group called Women and Gender Diverse People, and I've been to it a few times. And one thing I can tell you is that being the single one or two men in a room of 40 to 50 women or gender diverse people is probably exactly the same feelings of like, "I am out of my comfort zone. This is not my environment. I do not belong here." And you would've had exactly the same going to those initial cyber meetups too as well.

Yeah, that's true. That's completely true, yeah. And I believe there is much more impact on not having female leaders in decision-making roles because ultimately we are building solutions for just 50% of the population here. If we are not having females on boards, if you're not having females in senior management levels, we are not that much thinking about if our solutions, if our products are fit for our women and females as well, as well as men, and sometimes it get lost, really.

What I'm trying to say is the benefit of having females and women in top management, senior management, and board levels is not just for the sake of taking the HR criteria and goals and just saying that, "Okay, we have 50% women in our organization." The impact is much more important than just the number.

Yeah. I think that if anyone's looking at doing tokenization, that is literally the worst approach because then that person's going to feel even more isolated. I feel like the hardest one is to go to zero to one, and then having that one person feel that they're a meaningful contributor to the team and that they were hired for their expertise and for being able to perform that role really well and not being just a number, because if you are just a number that I imagine a lot of people feel really, really upset about that and probably look for roles elsewhere, ones that actually appreciate their talents and expertise, yeah?

Yeah.

So how's it feel being a woman in leadership actually for yourself? How are you inspiring the next generation of ladies to move into cybersecurity leadership?

I've been trying to be more present and be more involved in different community conversations and be a better supporter for women in technology. I made it my goal and my mission, let's say, a few years back. Each year I spent some time just for mentoring programs, just for helping women in technology, helping women in general to get into the workforce. And most of the time what I'm seeing is people, again, same as my own personal experience, they lost their confidence. And what I'm trying to do is I'm trying to help them to regain their confidence, that level of confidence that they need to work.

And something else is, most women, they feel like they need to be perfect to be acceptable, but that's not the case. And sometimes they feel like they need to tick all the boxes, then they are a valuable member of the team, but we know that is not true. So I made it my mission to help those women to understand their values, to regain basically their confidence and come back sometimes coming back from the leaves, the long leaves, back to the work again, and building that connectivity, building that connection again with the industry, with the technology people. I try to connect them sometimes with different people that I know in industry, and yeah, that's my way of helping women at the moment.

I think it's good for people are listening to this to just go and have a chat to any of your colleagues who happen to be women or people on LinkedIn, go message them, go speak to university professors who are researching this subject. There is a lot of content out there about how we have been trained to write job descriptions that are suitable for men. And so like you said, if a woman applies for a job, she ticks nine out of 10 boxes when a man who may get the job may think he only gets three out of five, three out of 10 and just say, "Yeah, whatever, I'll see, give it a go anyway." And obviously that you just lose a tremendous amount of candidates at that point when they would've been suitable for that role.

And bias in language and words, and also not appreciating the kind of skills that separate men and women. So I know women are generally extremely, much more studious and levelheaded than men in a lot of situations and good at remaining calm and collected, so that could be your next SOC manager, a calm and collected woman who's ready to go and just have a look internal as well. You don't have to go, you can find other people in other disciplines and bring them across to cyber, get that diversity of character in, yeah?

Yeah. And one more thing, Cole, especially about the women in leadership positions. I feel like we want to see everyone as the same personality, type of personality, but we have to accept it that women have a different way of leading teams and have a different way of leadership, and they take different approach in comparison with their men colleagues. So we shouldn't actually put the lens of men leadership when we are looking into our female leaders because they have their own way of leading and they have their own way of management, and we shouldn't compare it in the same way.

Yeah, I have to say that my best managers were definitely women, so shout out to Fiona and Erica, I hope you two are listening because I really appreciate your guidance and mentorship.

I wanted to cover some of the more technical parts of what you've been doing because it's a cybersecurity podcast too. So what kind of part of cybersecurity makes you really excited?

Cybersecurity is a constantly evolving landscape, is changing every day, and this dynamic environment keeps me on my toes and requires continuous learning and adoption, which I really enjoy it. And another exciting thing about cybersecurity is we are solving complex problems in cybersecurity, in puzzles, and getting involved in investigations. Investigations on cyber attacks, which is exciting, and we are making a difference. That means a lot to me. Effective cybersecurity measures can protect significant financial losses for companies, and being part of a team that makes a positive impact on the security and safety of others really can be fulfilling.

Those are all great reasons. So it's basically all the reasons that I'm in my discipline within application security, which software engineering moves a bit faster than cybersecurity does, but so applying cyber principles to software engineering, it makes me really excited personally, I love the rate of change and constantly keeping up with it. The purpose thing is really important to me as well, because if I look back on my career, I started in basically the government and I was effectively protecting Australian citizens from cyber adversaries. That was really important to me.

I moved into banking and I was protecting the financial safety of people around Australia as well. Moved into tech and it was globally protecting people who were petitioning authoritarian governments and wanting to change what they're doing. And recently with my own business, it was, now I have a slight idea, which is probably a little bit silly, but I love it anyway, which is to effectively securing a software that powers Australia, and I jumped into it because no one else is really tackling application security across the entire country.

There's lots of pockets of good little work where people are struggling internally and stuff, but I figured that why don't I just go out there, really raise the profile and of this issue and do what I can to just help organizations around Australia and potentially to globe, but I'm going to start domestic first, because I'm a true blue Aussie. So you've got to have that purpose inspiring you in your career, yeah?

Absolutely, yes. Yeah, it's important.

Cool. All right, so I've got a couple of fast questions for you. So question number one is if you were to give a book to someone, what would it be and why?

Wow, that's a difficult question.

Tough one.

Yeah, because I love books, I love reading books. And it depends on the person. If I know the person and if I know the person's interest, then I would go with that person's interest, definitely. But if I don't know that person, again, it depends if the person is working in technology, I usually, I would say Phoenix Project probably for people in technology. And for people outside of technology, I would say Untethered Soul from Michael Singer. Yeah, that's a book in the spirituality domain.

So why would you give each of those books out? I love learning about books, that's why I ask guests about them all the time. Even if I don't have the time to read every book, I will still try.

Phoenix Project probably because that was one of those books in technology that I read, which resonated with me a lot and I could relate to all the issues, challenges that they wrote in the book. That was the reason for Phoenix Project. And Untethered Soul because it was touchy a lot when I read that, it was during the pandemic here, probably that's why I still remember it. I think everyone should read it really. It's talking about how we can manage the voices that we are having in our mind, how we can heal basically the wounds that we have. Yeah, all Michael Singer's books are great books if someone is interested.

All those inner demons that we have that are telling us every day that you're not good enough to do this kind of thing, or you're not smart enough to get a CP or you can't go and do this presentation in front of these executives because you're just not a good communicator. Taking those fears and challenging them and having a process to deal with them, it's a really good thing to bring up.

Yeah.

Yeah. And I always like recommending The Phoenix Project as well for people who are looking at careers and AppSec because a lot of the challenges that are brought up in there around DevSecOps and why cybersecurity never seems to work. It helps people kind of put things into perspective about the outcomes and challenges that businesses are going through and then what kind of security controls and measures that teams have been trying to take to meet that challenge. So always recommend The Phoenix Project for people wanting to learn a bit more.

Cool. So Sam, thank you so much for coming on the podcast. Really appreciate your time. Where can people reach out to say hello to you and maybe have a coffee?

Oh yeah, definitely. I'm always open for good conversations with people. Thank you so much, Cole.

No worries. Have a good one.

You too. Thanks.

Thank you for listening to this episode of Secured. We hope you enjoyed today's conversation. Don't forget to follow the podcast on your favorite platform and leave us a review. Want some more content like the above? Why not subscribe to our newsletter at galahcyber.com.au/newsletter and get high quality AppSec content straight to your mailbox. Stay safe, stay secure. I'll see you next episode.