Security Confidential S16 E4 Tammy Klotz

Manoj Tandon (00:01.399)
Hello everyone, this is your host Manoj Tandon. Welcome to another episode of Dark Rhiino Security’s Security Confidential. And today we have an awesome guest joining us. Before I tell you who she is, I do want to remind you that if you want more awesome people coming on the show, then you need to hit the like and subscribe button so that we can keep our viewership high and keep bringing you great content.

But today we have another rock star joining us. It’s Tammy Klotz. Tammy is a cybersecurity leader. She’s been in the business for over 20 years in IT. That’s a long time. She is currently a CISO with a global manufacturing firm. She has transformed many cybersecurity programs. She’s driven, the most unique thing is driven cultural change. And we’ll talk about that with her today. She’s championed the cause of women in technology. And she’s actively involved with groups like

WISIS and Cloud Security Alliance. She was involved with Versum Materials where she developed the cloud-centric cybersecurity strategy. And she was involved with Covanta where she built a program from scratch later serving as the CTO and the IT co-leader. Currently she’s the CISO at Trinzio. I don’t know how she finds the time to do that, but she does. And in her spare time, she has written a book,

in 2024, Leading with Empathy and Grace, Secrets to Developing High Performance Teams, which is not something a title you would expect from a sizzle. So we’re honored to have you, Tammy. Thank you for joining the show.

Tammy Klotz (01:44.152)
Thank you for having me, Minos. I’m happy to be here.

Manoj Tandon (01:47.943)
You know, we gotta ask you a brief bit about your origin story. That seems to always be a favorite. People always know how people got to where they got to. Are you a computer scientist by?

Tammy Klotz (02:02.988)
Well, have computer science degree from university. So I did spend the earliest part of my career doing some coding, but then definitely said, this is not where I’m going to flourish.

Manoj Tandon (02:07.031)
you

Manoj Tandon (02:14.633)
Okay.

Manoj Tandon (02:24.375)
How did you end up in cyber?

Tammy Klotz (02:26.894)
interesting story. So as you said, I’ve spent 24 years in technology, right? And I was at a big manufacturing company in my hometown called Air Products and Chemicals. And one of the opportunities I was tapped on the shoulder for was to take a position in internal audit. So a step out from IT into audit. And that is where I had my first

Manoj Tandon (02:48.865)
Okay.

Tammy Klotz (02:56.682)
experience an opportunity to do a cybersecurity assessment. So that was kind of the taste of the cyber world. After that, Air Products was spinning off its chemicals division, forming a whole new company. And I was approached about taking the cybersecurity leadership position at the new company. And I kind of said, okay, like, there’s gotta be more people who, you know, have more experience than me.

and the hiring manager at the time, said to me, Tammy, he’s like, you have the audit background, the controls mindedness, the policy and procedure experience. You know, the people you have respect and you understand the business. The rest of it. You can figure out while the company is going through its formation stages. so that is how I got into cyber.

Manoj Tandon (03:48.694)
Okay.

Tammy Klotz (03:52.143)
That was my first cybersecurity role in 2015. So about 10 years in cyber specifically now, and this is my third CISO opportunity where I’ve been able to lead the organization in their cyber adventure.

Manoj Tandon (04:11.287)
I like that choice of words in their adventure. let’s, what would you say about a myth that exists in this adventure, that cybersecurity, can be 100 % secure.

Tammy Klotz (04:31.436)
Yeah, no. If I would ever say that to anybody or if anybody would tell me that, I would honestly immediately discount them from a credibility perspective. 100 % is really not achievable in this space because of the dramatic changing and shifting landscape of one, what we have to protect.

What the toolkit is doing from an evolution perspective then also what the bad actors are going after, right? So it is a constant game of catch-up and stay ahead in order to Protect the companies to the best of your ability Which is not a hundred percent at any time

Manoj Tandon (05:06.411)
Yep.

Manoj Tandon (05:21.623)
And I am so glad to hear you say that, because I asked that question very deliberately. We get a lot of smaller organizations that jump on this podcast and listen to it. And the leadership team thinks cybersecurity, put a couple of technologies in place, spend a little bit of money, hit the check boxes, and now you’re 100 % secure. And then that’s…

Tammy Klotz (05:45.358)
That’s not how it works now.

Manoj Tandon (05:49.075)
Would you agree that if someone really wants in, they will absolutely find a way to do it?

Tammy Klotz (05:55.202)
Absolutely, absolutely. It’s like telling your kids, no, you can’t do that. They’re gonna figure out how to do it anyway, right? And I do believe that is, if somebody wants in, they’re gonna figure out how to do that, whether that’s through physical means and bypassing physical controls, whether that’s logically being able to get in, impersonating being somebody else. There are definitely ways to get into an organization.

Manoj Tandon (06:03.147)
There you go.

Tammy Klotz (06:23.79)
and with the right tools, with the right time, which includes a lot of patience, in some cases, people will be able to get in. It’s a matter of how well we, from an organization perspective, can detect that they’re there and how quickly we can isolate and remediate their presence in the environment and then recover from any damage that they’ve been able to do.

Manoj Tandon (06:50.485)
Resilience is what it sounds like to me.

Tammy Klotz (06:53.518)
Absolutely. It’s not, it’s not, you know, the per variable. It’s not if it’s when it’s going to happen, but it’s how you respond. and that very much speaks to, you know, kind of life situations as well. Bad stuff happens to good people. What you do with that, how you react to it, how you handle it is, you know, will speak to one, your character.

Manoj Tandon (07:11.243)
Yes.

Tammy Klotz (07:20.174)
as well as your ability to cope and recover from such. you know, the acknowledgement of that, I think is so pertinent to cyber because you can have two companies that are infiltrated by a bad actor and one company is going to handle it one way and another company is going to handle the exact same thing in a very different manner.

and the impact to their organization is going to be very different.

Manoj Tandon (07:51.369)
That’s right. You know, the statistic that continues to prevail in the SMB space, and I know Air Products by and large is not SMB by any stretch of the imagination or is your current role, but is that six months post breach, most medium businesses are out of business. And that’s they’re done with. which really takes us into

Tammy Klotz (08:01.545)
No, no.

Tammy Klotz (08:11.726)
Sadly, yes, yes.

Manoj Tandon (08:21.471)
you know, this whole notion of, I’d love to get your thoughts on risk-driven versus compliance-driven security. And for the audience, I’ll give a little bit of context here. So there’s this idea that, okay, I meet the HIPAA standard or I meet the PCI compliance standard, and I’ve checked those boxes or I meet CMMC, whatever your relevant standard is. I’ve checked those boxes and therefore,

Tammy Klotz (08:28.59)
Yeah.

Tammy Klotz (08:44.878)
Mm-hmm.

Manoj Tandon (08:50.243)
I have built my cybersecurity program and I’m done versus a risk driven, which is how do we make money and how do we make our revenue chain a lot more resilient?

Tammy Klotz (09:04.846)
Mm-hmm. Mm-hmm. Mm-hmm.

Manoj Tandon (09:07.145)
What are your thoughts as someone with so many years of leadership experience on both these approaches? Because a lot of times leadership equates them together.

Tammy Klotz (09:13.859)
Thank

Tammy Klotz (09:18.424)
So I’ll start with one, being compliant does not mean that you’re secure. The check the box exercise is simply that, right? And if tested with regards to what your control structures are, are those controls working? And demonstrating the effectiveness of those controls is going to speak volumes to whether you are secure or not.

There are definitely things in the industry that people put a lot of weight on from a compliance perspective, whether that’s a SOC2 type two report that speaks to your point in time testing of your security controls or whether that’s ISO 27001 certification. All of those help your credibility from a, is what we’ve been able to demonstrate in our program.

I think, you know, the downside of a lot of that is it is point in time. So until we get to a much more robust continuous monitoring of controls in a organization or company, that compliance element is a little bit weak from that perspective. I often will refer to my role and others in similar roles that our job is not

a technical role within the organization. Our job is a risk advisor to the other senior leaders in the group. And this comes into your point about, how do I drive productivity? How do I increase revenue? And how do I balance that with being secure? So a lot of times there are conversations that need to ensue that say, okay, so here are the boundaries in which I will

determine what is or is not acceptable from a security perspective. And those are hard, fast rules. So for example, you must have multifactor authentication, non-negotiable, you gotta have it done. But there may be some other things that, okay, so you wanna bring in a new technology, it is potentially going to expose data that is considered IP of your company.

Tammy Klotz (11:35.63)
And then you engage in a conversation of, okay, so are we willing to take the risk of that data exposure? Who has access to it? Who might be able to have access to it? What happens if that data is actually compromised? And then you engage in a conversation with the business leader that says, are we willing on behalf of the organization to take that risk? So it is not my sole decision. It is a joint decision between

me and the business sponsor that says, yep, we understand and we acknowledge and this is what we are or we are not going to do. And in the instance where there is acceptance of risk, documenting that and obtaining sign off becomes extremely important. So in the event down the line, something happens, there is information available, evidence available of what the agreement actually was.

Manoj Tandon (12:33.463)
that I’m so glad to hear you describe that in detail because that oftentimes we see the the sizzle relegated to a tech function and they don’t get access to the boardroom to actually have that conversation of risk and get those sign-offs and really get a chance to say this is what really could impact us from a resilience perspective.

Tammy Klotz (12:47.15)
Mm.

Manoj Tandon (13:03.319)
active.

Tammy Klotz (13:04.012)
Yep, absolutely. And it’s certainly true. know, every industry has a different set of risks. My entire career, I’ve spent in manufacturing. So when you’re, you know, securing a number of facilities worldwide that are making, you know, product in several of my years, it’s been chemical manufacturing. So making chemicals that can be used for the various means.

or things that can cause the plant to blow up and potentially cause loss of life, those are very different conversations that you end up having to have from a, know, what is the risk? It’s not only brand, it’s not only financial, it’s not only business disruption, it’s, you know, reputation, is loss of life potentially in some situations as well, so.

Manoj Tandon (13:36.757)
Yep.

Manoj Tandon (13:58.679)
Okay. Which then brings us to AI. We can’t go anywhere without AI. I’m sure it’s gonna find its way into our water faucets at some point. So AI and cybersecurity, personally, I think we haven’t even lit the candle as to what’s possible, but what you’re seeing on both the bad actor side and then…

Tammy Klotz (14:03.981)
Hmm.

Mm-hmm.

Tammy Klotz (14:10.506)
Yeah.

Manoj Tandon (14:27.561)
unleashing the technology internally to your data. Your thoughts on that, on how’s that changing the cybersecurity landscape or making your job easier or more difficult?

Tammy Klotz (14:32.238)
Sure.

Tammy Klotz (14:40.482)
Yeah, and I think it depends on which side of the coin we’re talking about. we’ll take the part of, okay, so how do we use AI for good in the cyber industry, right? So when you think about things of incident detection and incident remediation, what are the things that we can teach the models that say, if this is the condition that actually exists, I want you to automatically remediate that. I don’t have to have people do the investigation, the analysis, because it’s a known entity.

That happens in our world, but there’s many other cases where it does not. But how do you supplement your human capabilities with that additional thought process to troll through data, to look at trends, to look at behaviors that potentially can start to tell the story of something that is going on? So there’s definitely a place for it from a, I’ll say an incident management and remediation perspective.

If you go to the flip side of that coin and you start talking about, well, you know, how does this make my job harder? Well, in a lot of cases, if you think about things like deep fake, you know, it’s just the next level of impersonation or phishing or vishing or smishing, it whichever one you want, right? But, you know, the simplest things of, you know, one of the big detection points for

Manoj Tandon (15:59.425)
Yeah.

Tammy Klotz (16:07.214)
phishing emails was improper grammar or improper capitalization, the wrong words, whatever. Well, AI makes that go away, right? So it makes everything a little bit more believable, which then there’s things from a tool and a technology perspective. But what I tend to do a lot in my organizations is very much focus on that human awareness side of it. I’ll often say,

Manoj Tandon (16:10.186)
Right.

Manoj Tandon (16:17.473)
Right.

Tammy Klotz (16:35.438)
to my teams that you know that the typical response is that your people are your weakest link but I like to turn that on its head and make the people the strongest link and teach them what are the things that they need to look for, what do they need to be on alert for, talk to them about things that actually do happen within the company and outside of the company because

If you can make it personal, it’s going to have much more of an impact on them as well. This isn’t just about my company’s data. This is about my mom’s or my grandmother’s, know, finances that potentially could be, you know, at risk in those situations. you know, teaching people to what to look for, what to be aware of and how to ask those provocative or, you know, questions that may not be obvious, I think is key. And then

you know, showing them what some of these examples actually are as well. You know, we had a video by our CEO in October for Cybersecurity Awareness Month, which was a legitimate video, right, recorded by him. But one of the thought processes, and we didn’t follow through on this, but

Manoj Tandon (17:48.278)
Okay.

Tammy Klotz (17:54.648)
Well, let’s do another, let’s do a deep fake video and see how many people actually pick up on it. Because that’s when you start to question those things. And then what are the new techniques that you need to learn? know, hold up a newspaper. Well, who has a newspaper? How do you prove it’s today’s date? Who’s the person that you’re talking to? You know, those types of things. So it’s different skill set from that perspective. And the bad actors are, you know, they…

you know, are like salivating over some of this stuff because there are new ways for them to get in to trick, to impersonate folks. that’s the whole point of our, yeah, yeah. And that’s what we talked about earlier. How do you stay ahead of that? And that’s part of our challenge.

Manoj Tandon (18:27.615)
Yeah. They can scale.

Manoj Tandon (18:36.929)
you

Manoj Tandon (18:40.501)
And you know, it’s interesting to hear of the 160 some odd guests we’ve had, this has been a recurring theme. And hopefully the industry is starting to, what you are just saying is starting to catch on with it, is that people are your biggest asset and they’re often the most underutilized asset. And if I was to summarize what you said, most people are very reasonable. And if you can explain the why to them, as opposed to being the department of no.

Tammy Klotz (18:58.67)
and

Tammy Klotz (19:07.618)
No, yes.

Manoj Tandon (19:10.705)
yeah. Well, no, you can’t do that. Well, yeah, I’m at Starbucks. I’m going to use their network to hell with you. I don’t care. Okay. You’re telling me I can’t, I can’t do my job this way. Well, my bonus depends on it. So I will do it the way I need to do it. Right. you, instead of doing that, teaching them why and allying with them can actually make all the difference. It’ll have a bigger impact than any technology that could ever be deployed. don’t know.

Tammy Klotz (19:16.908)
Yeah, yeah.

Tammy Klotz (19:27.0)
Mm-hmm.

Tammy Klotz (19:31.288)
Yes, absolutely.

Tammy Klotz (19:40.302)
I agree with you 100%. And the more that you can instill that thought process with your people, the more they can become an advocate for you. I want people coming back to me and going, but I did this. This is what could happen. And I don’t want that, right? So if you get them thinking about that, that’s a huge win.

Manoj Tandon (20:03.613)
I agree completely. Getting into, know, again, AI, one of the things that it changes also is all these government regulations that are out there, whether it be GDPR or the California Privacy Act or the New York, I mean, there’s all kinds of candy cane flavors floating around out there.

AI makes it almost impossible. It makes it impossible to forget your data, right? Because once you train the model and you say, Sally did X or Sally likes X and I’m picking on Sally, don’t know why, but okay. You can’t unteach the model that, right? So if Sally says, I want to be forgotten, there’s no longer a row or a column in a database where you can say,

Tammy Klotz (20:36.046)
and

Tammy Klotz (20:43.52)
Okay.

Tammy Klotz (20:56.866)
Forget Sally.

Manoj Tandon (20:57.973)
Yeah, forget Sally. You know, what do you think that’s going to do? And for that matter, what’s the role of government in cybersecurity? I guess it’s a two-part question here.

Tammy Klotz (21:10.25)
Yeah, you know, so it is interesting. think what I’ve seen historically since the advent of GDPR, you know, Europe has done, you know, a more continental type approach to a lot of their legislation from that perspective, whereas in the US, it’s definitely been not at a national level. It’s been state based with a variety of different variations, which makes it even more difficult, right? So

Some of the guidance has been, we’ll find the most stringent and comply with that and then you’re good for all the others. And that works in some cases, but not all the time. Same thing is now happening with AI. There’s an EU AI Act, right? So much like GDPR, it’s in its infancy. How is it going to be governed? How is it going to be managed, penalized? We don’t know, right? So the fear becomes like,

how do we position ourselves for success so that when the next piece of legislation comes down, that we’re compliant? And we don’t know that, right? So it is a constant guessing game in that situation. you you asked me about, you know, what does the governmental component of this looks like? I mean, I think there’s definitely a role, you know, if you think of things like needing to protect the critical infrastructure of

Manoj Tandon (22:18.689)
Yeah.

Tammy Klotz (22:37.326)
the united states right or of the eu there are definitely things that I think you know are warranted from a protection perspective, you know, Doing it in a in a fashion that is not enforceable Makes that even more challenging right? It’s it’s just you know, think of it not to minimize it but think about it from a corporate policy perspective

If you put a policy in place that says thou shalt not, but then you do nothing to monitor when it’s happening and there’s no penalty for doing it, why have the policy? I think that’s a very analogous comparison is if we’ve got guidelines in place that are not regulations, it makes it that much harder.

for all of us. But there are significant fines that come with some of these and I think that’s part of our challenge as CISOs as well is making sure that one, we’re staying abreast of it, two, educating our internal leadership with regards to what the potential implications are and then how we prepare for them. I remember when GDPR was just a thing and having a conversation with my internal counsel and it was really around

Well, they could never do that. How are they going to penalize people for that percentage of their revenue base? And I’m like, OK, like I’m telling you what it says. Right. But how do you balance that with things like cybersecurity liability insurance providers or internal companies who are self-insured? How do you manage for that? Right. And unfortunately, you know, sadly, in a lot of cases, it’s really

Manoj Tandon (24:02.325)
Right.

Tammy Klotz (24:22.958)
part of…

How do we protect what we don’t know and we can’t? That’s an impossible task.

Manoj Tandon (24:35.895)
Absolutely. I think what about the notion of, you know, we’ve convenience for security and we’ve trained everyone that everything on the internet is free.

Tammy Klotz (24:36.206)
Thanks

Tammy Klotz (24:51.694)
Mm-hmm.

Manoj Tandon (24:55.037)
It’s is an, this is probably a bad question, but I’m going to ask it anyway. What about introducing the notion of, it’s not free. And instead of cracking some of the data that’s traditionally been done, and that’s a major source of revenue for a lot of companies is to supplant that with charging the end user for using the service.

Tammy Klotz (24:56.494)
Yeah.

Yes.

Tammy Klotz (25:03.842)
Mm-hmm. Mm-hmm.

Tammy Klotz (25:23.438)
Yeah, I think that’s an interesting point. If you think about the cultural shifts that we’ve experienced, the population today is definitely more of an immediate gratification expectation because everything is so readily available and accessible and you can get an answer pretty quickly if you need to.

Just because it’s on the internet doesn’t mean it’s 100 % accurate or true also. Well, and I think, you know, it’s interesting because people have asked me kind of my position on AI and are we going to block it? Are we not going to block it? I’m like, AI is not going anywhere. It’s been here. It’s just, you know, getting a lot more attention these days. And it’s no different than when

Manoj Tandon (25:58.405)
don’t say that. That can’t be true. It’s always true. I read it on the internet.

Tammy Klotz (26:22.7)
the internet started, right? It changed the way we live. It changed the way we work. AI is doing the exact same thing. So you can resist it if you want, but you’re fighting a losing battle. So figure out how to accept it and bring it in within the right guard rails to make sure that it’s not being abused and misused as well. So.

Easier said than done, obviously, but definitely, you know, fighting the force that is not gonna go away is a waste of time.

Manoj Tandon (27:01.749)
I like the pragmatic approach. I’m sure people appreciate it. And I think it’s a great segue. We can see in your background, by the way, the beautiful poster that is leading with empathy and grace. Yeah, there it is. We can see it. It’s a very interesting title coming from a sizzle. Okay.

Tammy Klotz (27:04.27)
Hmm.

Tammy Klotz (27:13.934)
So the boost is in there.

There it is, yep.

Tammy Klotz (27:26.808)
Hmm. It is.

Manoj Tandon (27:30.975)
What is the role of empathy and grace? Because usually we think of both those terms in a very different context and you’ve put them in a leadership skill context,

Tammy Klotz (27:42.702)
I have, yes. And, you know, it’s interesting because when folks learn that I was writing a book or going to publish a book, you know, the first thing I got was like, is it a cyber book? And I was like, no, it’s not a cyber book. It’s about leadership, right? And I think, you know, the…

The empathy and grace words are very touchy feely words or they’re soft skills, which I despise. So I will refer to them as critical or core skills because it speaks to your ability to relate and be resilient, I think is certainly key. And how you address

individuals within your organization and getting into one of my favorite quotes is getting into somebody else’s movie so you can understand what they’re going through, whether that’s a personal situation or whether that is a professional situation, where are the pain points, what is preventing you from getting your job done, active listening and

you know, coming back to them with, okay, so what I understand from our conversation is that, you know, you’re struggling with X, Y, or Z. And, you know, it’s definitely getting them to understand that you do have a vested interest in what you’re trying to help them accomplish. You can understand what their business requirements are, but then they’ll listen to you when you talk to them more about, okay, so

Manoj Tandon (28:58.295)
Okay.

Tammy Klotz (29:18.252)
This is the risk that comes with that. And these are the things that we need to think about from a security perspective. So how do we bring those two together and have a much more effective conversation? So that that speaks to kind of the empathy part of it. And then, you know, the grace comes in when, you know, I’ll I’ll take a little bit of a different twist on this is that, you know, from a from a technology perspective, there’s a new stuff all the time.

Manoj Tandon (29:32.471)
Okay.

Tammy Klotz (29:45.684)
And part of my team’s job is to make sure that they’re staying abreast of what is happening in the industry. What are the new tools? What can they do? What can’t they do? And allowing people to take risks if they want to try something new. And letting them know that it’s okay to take a risk. You can’t do it without any research. That would be foolish on both of our parts.

Manoj Tandon (30:10.177)
Right.

Tammy Klotz (30:12.578)
But in the event that it doesn’t pan out exactly the way that they expected it to, is it’s not a penalty for taking a risk, but it is employing the concepts of grace to understand and explain to them, okay, you know, I get what you were trying to do. It worked, maybe not exactly how you expected, but giving them, you know, that space to be able to explore, understand, and in some cases fail.

so that they can learn from that and giving them that, giving them, grace is a hard word to replace with something else. Giving them the allowance, giving them the space, giving them the opportunity to explore and try new things I think becomes extremely important.

Manoj Tandon (31:02.487)
How is grace different from another word that was circulated in the 90s quite a bit was empowerment.

Tammy Klotz (31:14.636)
Hmm. I put those in.

Manoj Tandon (31:16.149)
Right? Let your employees feel like they’re empowered. And then there were all the Dilbert cartoons that said, well, if you have to use the empowerment, then you’re probably not an empowerment culture.

Tammy Klotz (31:22.166)
Yeah.

Tammy Klotz (31:28.854)
Now, I honestly don’t put those two words together at all. So from me, an empowerment perspective is really providing the opportunity for folks to lead a project, to introduce a new piece of technology. The grace part of it is on the other side is that instead of being so critical in the results or the expectations is really like

talking it through with them and say, okay, so what did you learn from this situation? How could we do it different next time? That’s not empowerment. That’s more about, okay, so this didn’t go well, so what are we gonna do better next time? And not penalizing them for that. So I had a call earlier today with somebody who’s been doing some work for me and she’s had some struggles and contract dates were missed and so we…

We kind of talked about it and I said, look, I said, you know, I understand what’s happening right now. Right. And from my perspective, the deadline, you know, there’s a little bit of opportunity for negotiation there. So I’m going to give you the grace in that situation to come back and let’s reset and we’ll deliver against a new set of timelines. So I’ll give them an opportunity to do that once. But if that becomes a trend,

then we have to have a very different conversation as well.

Manoj Tandon (33:01.751)
See, in many respects, this approach of empathy and grace is really dependent on the culture of the organization. Right? So if, how do you fight that? Because I can’t believe that every organization is set up to be able to offer this degree of latitude.

Tammy Klotz (33:13.666)
Very true.

Tammy Klotz (33:25.582)
Very, very true. And it is going to be very culture dependent, right? And I think part of the challenge is if you enter into a company that maybe was more kind of accepting of that style, that approach, and then there’s business conditions that take that company down a different path and the vision and the mission of the organization change, and that is not tolerated as much.

Then there’s more of that internal soul searching that needs to happen is where, and it goes back a little bit to what I said before, it’s about establishing your boundaries as an individual and what you’re willing to accept and what you’re not willing to accept. And in those situations, sometimes having to make hard decisions if the culture of the company is not something that you believe that you’re going to be able to thrive and survive in.

in a particular situation, was like, can’t do this anymore. I need to move on. And being able to be honest with myself because of the implications it was having on me as an individual was extremely critical for me, but it was definitely a hard conversation to have with myself in those situations. So you do need to be willing to take that into consideration that one, if the job you’re interviewing for

doesn’t offer you something that is going to work with who you are as an individual, maybe you don’t even want to consider working there. Maybe the money’s great and the team is great and all of that, but if the culture isn’t there, then for me, that’s a big decision point. And then on the flip side is if you’re in an organization and things change dramatically as a result of whatever changing business conditions there are.

figuring out for yourself, again, what I can tolerate, what I can’t tolerate, and when I need to move on.

Manoj Tandon (35:25.323)
Have you ever sat in front of the board and explained how your approach with leadership and grace would actually make them a lot more resilient?

Tammy Klotz (35:35.885)
Mm.

Probably not exactly in those terms, but I think, you know, when you…

Manoj Tandon (35:44.275)
I oversimplify everything, so please excuse me, Tammy.

Tammy Klotz (35:49.026)
I think the one example, the concrete example I can share with you on that is, when you’re talking to the board, they know that there’s a risk in the cyber world, right? They know that they need to be concerned about it, but they’re not gonna understand the technical details. So you need to be able to relay that to them in such a fashion that they can understand. So my best example of that is when I worked at Covanta, which is now re-world.

Manoj Tandon (35:50.324)
Yeah.

Tammy Klotz (36:17.006)
We were an organization that burned, incinerated household trash and converted it to energy. So fire, fire was a huge risk for us just because of the nature of the business that we were in. So when we were trying to build the business case for network segmentation to protect our OT environment, I capitalized on that, right? And we talked about the fact, okay, so if we have a physical fire at one of our facilities,

Manoj Tandon (36:25.268)
Okay.

Tammy Klotz (36:46.946)
The likelihood of that being able to spread three states away and cause a fire in California when it was happening in Texas or whatever, it was highly unlikely, right? However, if I don’t do network segmentation and I don’t isolate the network at plant A and we find ourselves in the middle of a ransomware attack, that’s…

potentially has the ability to spread across our entire network. And therein lies the difference. Without putting those boundaries up, I didn’t have the ability to contain the fransomware, the fire, and it would spread pretty rapidly, which is very different than a physical fire. So it used the business model, it resonated, and it explained the concept of network segmentation in a very applicable

know, analogy for them.

Manoj Tandon (37:48.075)
That’s a very good example. Thank you for sharing that. On the teams that you have managed, cybersecurity is unfortunately a place where there is, it’s prone to burnout for a host of reasons, right? Your approach to leadership there with empathy and grace, have you been able to affect changes where

Tammy Klotz (37:49.708)
Mm-hmm. You’re welcome. You’re welcome.

Tammy Klotz (38:05.401)
absolutely. Yep.

Manoj Tandon (38:17.671)
It’s much more people become, they own their responsibility much more, take greater pride and are able to reduce the burnout factors. it?

Tammy Klotz (38:31.658)
So the answer to that question is yes, but I also believe it’s dependent upon the individuals that are on the team and what type of relationship you’re able to cultivate with them from being built on the elements of trust and respect as you formulate those relationships.

If somebody is approaching that state of burnout, you’re typically going to know because you’re in tune with what your employees are able to produce, what their normal kind of behaviors are. So things are going to jump out to you if you’re in tune at that level with your employees. So to the extent that, you know, somebody is no longer producing that was producing or not as producing as much, the recognition of that.

and providing that safe place for somebody to come to you and be able to say, look, things aren’t going well right now. Or me actually being able to proactively reach out and go, hey, is everything okay? And making sure that people are taking the time for themselves. And one of the challenges I think we run into often is that we stress and we stress work-life balance, work-life balance, work-life balance.

But the recognition of my work-life balance can be very different than somebody else’s definition of what their work-life balance actually is. And not requiring everybody to conform to what your standard of work-life balance is. So understanding from them what makes them tick, where they get their energy from, gives them a different, I think, appreciation.

not only for the work that they produce, but when they’re actually producing it as well and giving them that grace to be able to perform in the best possible scenario that they can.

Manoj Tandon (40:33.377)
have you seen that by taking such an approach, I’m sure other employees and team members are gonna notice that as well. Because something like this is a cultural shift. Do you see people become much more proactive in bringing real issues to the table?

Tammy Klotz (40:42.126)
Mm-hmm.

Tammy Klotz (40:53.902)
I would say yes. One of the things when I onboard a new team, have a who am I presentation that I do and I talk about what my expectations are from a work style perspective. And one of the things I emphasize is if something is bugging you, you need to bring it to me. Don’t let it fester because the accumulation effect is real. And you’re

There’s going to be things that get piled onto your plate, piled onto your plate, and it’s going to be the simplest thing that tips you over the edge. know, it’s like you’re having a really bad day. You go to the grocery store, the guy doesn’t give you the right change, and you like flip out on him. And it had nothing to do with the amount of change. It’s everything else that happened during the course of the day. So being proactive about, you know, what their concerns are, where their issues are.

And bringing them forward is something that I address in the very beginning of any working relationship with a new team in those situations. And I think it does get recognized by others. were impacted by CrowdStrike earlier this year and people were panicking what’s going on. And it was really about getting the group together, telling everybody to calm down.

Let’s think about what’s actually going on here. How do we structure our approach and how are we going to report progress? And the simplest thing at the end of each of those status meetings was thanking everybody for their efforts. We know this is hard. I appreciate what everybody is doing and we’re going to come back in four hours and see what progress we’ve made. So it’s a very intentional approach to recognize the efforts of what the team is doing.

And it just builds a safe environment so that when messages that are not positive have to be delivered, they’re received much differently if you’re coming from that type of foundation.

Manoj Tandon (42:56.599)
Tammy, you’re humanizing the situation. That’s at the end of it and treating people like people, as opposed to compartmentalize robots.

Tammy Klotz (43:00.576)
It’s what I do, yes.

Tammy Klotz (43:10.21)
Yeah, it’s not rocket science. That’s what I always like. It’s crazy to me in some cases that it’s so foreign to others, right? Because we all are human beings and that’s what we deserve. And it’s a two way street. It’s about respect. It’s about not taking advantage of situations, you know, because there can be other situations where it’s like, you know, she does this empathy and grace thing so we can, you know, do exit. But that’s not how it works either, right? Don’t abuse.

that privilege either.

Manoj Tandon (43:42.241)
So, you know, speaking of foreign and tech, women in leadership roles in tech. Your thoughts on what, your advice to women who are looking to move into much more leadership oriented roles in tech, what should they do? What should the industry be doing? What’s your advice as a leader?

Tammy Klotz (43:48.866)
No. Yeah.

Tammy Klotz (43:58.594)
Mm-hmm.

Tammy Klotz (44:08.406)
So one is to focus on your confidence. As a female in tech, in cyber, you know what you are capable of, but we tend to be our own worst critics, right? So my classic example here, and I’ve said it before, is that when looking for a new opportunity, gender comes into play because women will typically want to be able to check every box.

that says, I’m a good fit for this position. And if they don’t, they don’t apply. Conversely, our male counterparts will say, well, I got three of those, so of course I’m gonna apply, right? And it’s men are from Mars and women are from Venus. We’re just, we’re wired differently, we’re made differently. So my encouragement to anybody that I mentor or coach is to really think about, where do you believe you can make the most difference?

And if you don’t check all the boxes, it’s okay. Your primary goal when applying for a job is to get the interview. Getting the interview once you’re there is to convince them why you deserve the position. And that is the magic that happens, right? And coming in prepared with a level of confidence that demonstrates what you’re capable of is…

going to speak volumes to the individual on the other side of the table.

Manoj Tandon (45:38.332)
And getting the interview is the challenge. You see, there’s a lot of cynicism that’s developed, especially people who are coming out of college or coming out with, you know, basic degrees that are trying to get their first role, that it’s just robots that are evaluating. There’s no humanity to this anyway. So how

Tammy Klotz (45:48.428)
Mm-hmm.

Tammy Klotz (46:00.674)
So that speaks to the thing that you cannot do enough of is networking because there are automated scanners that are looking at resumes. So getting a job through a LinkedIn post is probably not realistic, right? It’s gonna be about who you know and who can get your resume to the right person to actually be seen within the organization. So.

networking and you kind of rattled off some of the stuff that I do in the very beginning of our time together. And it is about developing that personal brand for yourself in a like group, a like-minded group of individuals and developing some mentorship capabilities with, you know, more senior leaders in the org who can help guide and direct you. I think those are, you know, two very key elements.

Manoj Tandon (46:53.943)
That’s, you know, that is advice that’s as old as people have been looking for jobs, right? So, well, Tammy, we’re at the hour and we want to make sure we give you a minute here to plug anything you’d like to plug. Are you doing your book, your any appearances, anything that you would like our audience, floor’s yours.

Tammy Klotz (47:00.894)
Absolutely, absolutely, yes.

Tammy Klotz (47:16.206)
Yeah, so I just, you know, I would encourage everybody the book is available on Amazon. If you’re interested, go take a peek, write a review. I would love to get a couple more reviews out there. I’ll be doing some book signings coming up in the new year. The details of those will be published and announced shortly on LinkedIn. So LinkedIn is the primary place to find me and what’s going on at this point. So go out there, connect, follow me and see what happens.

Manoj Tandon (47:46.571)
Fantastic. Well, Tammy, it’s been an honor to have you here. Thank you for gracing us with your presence. you know, and don’t be a stranger. Should you have anything new coming out, please do let us know. We’ll let our audience know. you know, great work on the book. I’m gonna go get a copy myself, see.

Tammy Klotz (47:51.95)
You are very welcome.

Tammy Klotz (48:02.136)
Awesome.

Tammy Klotz (48:06.402)
Thank you. Please do, please do. Excellent. Awesome. Well, thank you for the opportunity. It was a great conversation. And I look forward to what comes next. And I’m here if you need me. All right. Awesome. Thank you so much.

Manoj Tandon (48:10.367)
All right.

Manoj Tandon (48:20.097)
Sounds great, Timmy. Take care. Take care.