Security Confidential S5 E2 Naomi Buckwalter

Manoj Tandon:
Hello everyone, and welcome to another episode of Dark Rhino Security Confidential. Today, we’re honored to have Naomi Buckwalter join us. Naomi is a cybersecurity professional with over 20 years of experience across multiple domains, including security architecture, software engineering, and security engineering. She has worked at leading organizations like Vanguard and holds two Master’s degrees from Villanova University. And when she has time—which we’re not sure when that is—she enjoys playing volleyball.

Welcome to the show, Naomi.

Naomi:
Thanks, Manoj. I’m happy to be here.

Manoj Tandon:
We appreciate you joining us and sharing your insights with our listeners. Let’s start with a topic that’s often discussed: the perceived shortage of cybersecurity professionals.

We’ve covered this in previous episodes—hiring challenges, transitioning into cybersecurity—but despite strong recruiting efforts, there’s still this persistent belief that there’s a shortage. I’d love to hear your perspective.

Naomi:
I love this topic. I don’t think there’s a supply problem—I think there’s a demand gap.

There’s no skills gap; there’s a demand gap. Hiring managers and security leaders often don’t recognize the value of truly junior-level talent. And by “junior,” I mean actual entry-level—not job descriptions asking for five years of experience, a CISSP, and a Master’s degree.

That’s not junior.

This ties into the narrative that “security isn’t entry-level,” which I don’t agree with. There’s plenty of entry-level work across all domains of security.

Manoj Tandon:
That’s interesting. Speaking of entry points, how did you get into security?

Naomi:
I pivoted from software engineering, which is a common path. Many people transition into security from adjacent roles.

There’s this idea that you need years of help desk or IT experience before entering security, but I think that’s outdated. Technology is everywhere now, and people—especially younger generations—grow up immersed in it.

They’re already comfortable with it before entering the workforce.

I like to compare it to driving a car. You grow up around cars, you understand the basics, and by the time you’re ready to drive, you already have a foundation. It’s the same with technology.

Manoj Tandon:
That makes sense. Technology has become part of everyday life.

Naomi:
Exactly. But security hasn’t evolved at the same pace. The older generation—our generation—is often gatekeeping because we didn’t have those same resources growing up.

Now, people have access to endless learning materials, frameworks, and tools. They can learn much faster. But some people struggle to accept that because it took them years to get where they are.

Manoj Tandon:
That’s a great point. We’ve seen young talent thrive—even hiring someone who started with us in high school and is now at Okta.

Naomi:
Exactly. Kids are incredibly capable. Many already demonstrate strong problem-solving skills early on.

The reality is, cybersecurity isn’t as difficult to learn as we make it out to be. If you have a solid technical foundation and critical thinking skills, you can build on that.

We’ve overcomplicated it.

Manoj Tandon:
I agree. It’s less about difficulty and more about mindset. Passion and willingness to learn go a long way.

Naomi:
Absolutely. But gatekeeping is hurting us. Cybersecurity impacts real lives—it’s not just data anymore.

We’ve seen incidents like pipeline shutdowns and attacks on critical infrastructure. Cybercrime can have physical, real-world consequences.

We need more people in the field, not fewer.

Manoj Tandon:
That’s a powerful point. So when you step into a CISO role, how do you approach building a strong security strategy?

Naomi:
It starts with security culture.

It’s not just about technology—it’s about people, process, and culture. Security should be everyone’s responsibility.

If more people are thinking about security, you have more defenders.

You also need to build trust across the organization. Security teams shouldn’t be seen as blockers—they should be enablers.

Manoj Tandon:
That’s interesting, especially since some companies take a punitive approach, like penalizing employees for failing phishing tests.

Naomi:
That’s the opposite of a healthy security culture. If people fear consequences, they’ll hide mistakes instead of reporting them.

You want openness, not fear.

Manoj Tandon:
And communication plays a role too—especially explaining the “why.”

Naomi:
Exactly. People are more likely to follow security practices if they understand why they matter.

The issue is that many cybersecurity professionals struggle with communication and empathy. We need stronger interpersonal skills.

There’s a great book called The Smartest Person in the Room by Christian Espinosa that addresses this.

Manoj Tandon:
That ties into hiring too—bringing in diverse skill sets.

Naomi:
Yes. We need diversity of thought, not just technical expertise.

Cybersecurity teams should reflect the broader business—people who can communicate across departments, not just highly technical individuals.

Manoj Tandon:
How do you get executive buy-in for hiring junior talent?

Naomi:
It comes down to trust and timing.

You don’t push ideas immediately. You build relationships first. Once trust is established, it’s easier to introduce new ideas—like hiring entry-level talent.

For example, I requested an intern by clearly explaining the need and framing it in business terms. That made it easy for leadership to say yes.

Manoj Tandon:
That’s an art in itself.

Naomi:
It is—and it comes from experience and failure.

You can’t do everything alone. You need allies across the business—security champions who help reinforce security practices.

Manoj Tandon:
Let’s talk about “shifting left.” What does that mean in a broader context?

Naomi:
Traditionally, “shifting left” in application security means moving security earlier in the development process.

But more broadly, it means everyone is responsible for security, not just the security team.

Security teams are too small to handle everything. By distributing responsibility, you create an entire organization of defenders.

Manoj Tandon:
That helps eliminate low-hanging vulnerabilities.

Naomi:
Exactly. Most breaches happen through simple methods—like phishing.

If everyone follows basic security practices—strong passwords, password managers, avoiding risky networks—you significantly reduce risk.

Manoj Tandon:
That’s a great takeaway. Now, how do you quantify and communicate risk to executives?

Naomi:
Executives care about money and data-driven decisions.

You need to present risk in financial terms—probability and impact. Frameworks like FAIR can help quantify risk using simulations.

When you show that a $100K investment prevents a $5M loss, the decision becomes obvious.

Manoj Tandon:
That’s powerful. What about positioning cybersecurity as a revenue driver?

Naomi:
It’s absolutely possible. Strong security builds trust, and trust drives business.

Customers want to work with companies that protect their data. Security can differentiate your brand and attract clients.

However, I don’t believe core security features should be monetized—security should be fundamental and accessible.

Manoj Tandon:
That’s a fair point.

Before we wrap up, anything you’d like to share with our audience?

Naomi:
Yes—I’m launching a nonprofit called Cybersecurity Gatebreakers.

It’s focused on helping hiring managers understand how to bring in entry-level talent and build pathways into cybersecurity.

The goal is to close the demand gap and make hiring more accessible.

Manoj Tandon:
That’s fantastic. We’ll include links in the show notes.

Naomi, it’s been a pleasure having you on the show. We’d love to have you back once your organization is fully up and running.

Naomi:
Thank you—I’d love that.

Manoj Tandon:
And to our listeners, thank you for tuning in. Take care.