Security Confidential S7 E7 Rafael Nunez

Manoj Tandon: Hello everyone, welcome to another episode of Dark Rhino Security’s Security Confidential. This is Manoj Tandon, your host, and we are honored to have Rafael Nunez join us today. Rafael is a mentor, a motivational speaker, a veteran, and an accomplished cybersecurity and information security executive and professional. He has many skills in the InfoSec arena with risk mitigation, encryption, vendor collaboration, and PCI DSS. Rafael has worked as a Senior Security Architect for Sirius Computer Solutions, also as an IT Security Manager and Principal Information Security Analyst for Lowe’s. He is the founder of RAYA Cyber Solutions and co-founder of the Carolina CISO Roundtable. Anything I missed there, Rafael?

Rafael Nunez: No, that was amazing. I’m like, man, that’s me! That was good.

Manoj Tandon: Yeah, that’s you. That’s you. And it’s a privilege to have you here. We’re really looking forward to this conversation. One of the things a lot of our listeners have heard us do on past episodes is showcase veterans because we support them. We hire a lot of veterans at Dark Rhino, and we want to help people who have sacrificed so much get some meaning in the civilian world, if you will. So, you have a little bit of that background. I’m sure there was some adversity there in the Air Force, but you also mentioned as part of your life transition that you faced some adversity which actually made you a much stronger person. Share with us a little bit about these two things.

Rafael Nunez: Yeah, absolutely. First off, it’s a pleasure to be here. Thank you so much. Your acknowledgment of veteran sacrifices really tugs at my heart. It’s very dear to me as a veteran, as someone who is connected to people still serving, and as someone connected to people that have served and have given the ultimate sacrifice. So, thank you for that. As far as that particular setback, it was losing my job suddenly and becoming unemployed overnight. The reason why that represents such a big shift for me is because the one thing that you fear the most, if it happens, you feel like, “Well, if this happened and it’s the thing I fear the most and I’m still standing, what else have I been hesitant on pursuing? What else have I been fearing in life?” Suddenly, I’m like, “What have I got to lose? I already lost that one thing I was treasuring so much.” Becoming unemployed, by default, led people to reach out to me: “Hey, Raphael, how can I help? What can I do?” One of those opportunities was some contract roles where I could deliver as a virtual CISO. Suddenly he says, “Well, Raphael, in order for us to do business together, I’d like for this to be corp-to-corp.” So, here I am: “Okay, I guess I need an LLC. I guess I need a business name.” All these things happen just by default. I never planned on it; I never planned on having an LLC a few years ago. One thing led to another. It put me in a different frame of mind, in a different billing rate, and gave me access to have a seat at the table with these companies where they were looking to me for advice. I met one of my greatest mentors during that phase while doing work for Anthony Johnson, and I just met others that opened the doors for me and allowed me to walk in the light that I hadn’t walked in before, or allowed me to see skills that I had sort of suppressed in myself being an employee and just checking the box of a role in a large organization.

Manoj Tandon: Now, do you think you would have made this transition to being an entrepreneur and independent had you not gotten laid off?

Rafael Nunez: I don’t think so. You know how they say when you’re down, the only way is up? In my country, Dominican Republic, there’s a saying that says, “Necessity teaches more than university.” I think I just saw myself where I didn’t have a choice. I was applying for certain roles, nothing was fitting, and then suddenly it was like, “Hey, I’ve got something for you.” We were going through our savings. My wife was looking at me with tears in her eyes: “Are we going to keep the house?” That sort of thing. I just started running and hustling. I was really hungry for self-improvement, for success, for making things happen, and providing for my family. I think that catalyst was the unemployment. Without that, I wouldn’t have had the business.

Manoj Tandon: So, let’s contrast this with the other side of that coin. I know from personal experience in our own family where we’ve had relatives that have lost their jobs and they were so devastated by it that they went into a downward spiral of depression and all kinds of crazy things happened that should never have happened. Heck, it was just a job. But they had such a strong identity tied to that, it was like someone had died that was close to them when they lost that. Our audience listening would wonder: how do you choose the fork in the road that you chose? How do you stay positive in dire circumstances versus how easy it is to be the victim and fall down?

Rafael Nunez: I was always secure in this umbrella of working for the government, being active-duty military. It’s almost like they say it takes an act of Congress to fire a GS employee. So, that safety net where everything was always going to be okay, suddenly it wasn’t. I think I wasn’t always positive. I was hopeful, but I wasn’t always positive. A lack of options will make you really decisive. Decision-making is a gift in itself, and a lack of options leads to better and quicker decisions. If anything, you can fail faster. When you look to yourself and you’re like, “I’m the provider.” Yes, my wife works, but I’m the primary provider here. I don’t have the option of resting for a couple of days or sleeping on it. I don’t have the luxury of maybe being depressed. You’ve got to go. So, that lack of options is what instilled in me the need to research, connect, stand out there, and show up more boldly. Had I had options, a couple of job offers or things like that, I would have just gone back to the corporate world and fallen in line. I wouldn’t have been as aggressive. So, it sounds like a good story after the fact, but I wasn’t always positive. I really wanted to just hunker down, be depressed, succumb to that, cry to somebody, look for excuses, look for the reasons “Why me?” But I didn’t have those options.

Manoj Tandon: So, what would you tell someone that’s down on their luck right now and trying to lift themselves up and maybe make a career change to cyber, if you will?

Rafael Nunez: I would say that while their situation may be unique, because no one knows what they’re going through and how they ended up there, whatever they’ve been through, someone else has been through and they’ve overcome it. They are still here. As long as you are still here, as long as you’re on this side of the dirt, you still have all the potential to go.

Manoj Tandon: That’s awesome. I love it. You want to be on the right side of that dirt. As long as you’re there, it’s very true that no matter how bad your circumstance, I can almost guarantee there’s somebody else on this planet that’s got it worse.

Rafael Nunez: Absolutely. We don’t always have to wait for those moments of rock bottom to acknowledge how precious this life is. I have a couple of friends my age who have gone into cardiac arrest over the last five years. These guys now live life tremendously. They travel, they take time to be present and everything else. That’s their story, but we don’t have to wait for those circumstances to shift and acknowledge how much is available to us, how abundant this life is to make things happen.

Manoj Tandon: Yeah, that’s a very cool attitude and it’s really a very positive place to be. I think you’re going to attract that which you want to become or that you become. If you maintain that mindset, it’s there. Speaking of which, one thing that I found interesting in reading a little bit about you was you mentioned this thing called the “imposter syndrome.” What the heck is that? Sounds really cool, but can you explain it?

Rafael Nunez: Yeah, I do want to empathize with most people because the moment we give something a label, we have to acknowledge it because people are going to resonate with it. Imposter syndrome is this belief where others may acknowledge you as a rock star, but you don’t think you’re good enough. You don’t believe the acknowledgments or the accolades you’re given. Or if you walked into a role, you’ve been promoted, or you’ve gotten a certification, you think you’re a fraud and that truly somebody must have made a mistake. Sooner or later, somebody’s going to tap you on the shoulder and say, “Hey, time’s up. It’s not you. We got you.” That’s how I would describe it.

Manoj Tandon: So, can people confuse that with humility or being humble?

Rafael Nunez: To an extent. Sometimes people know how good they are. “I am a badass. I am this good at this.” And it’s more like, “Let me suppress that so I can remain approachable and coachable.” But rather than just describing imposter syndrome, I think that at times it’s the acknowledgment of your work. If you haven’t put in the work, imposter syndrome will tap you on the shoulder all day long. But if you can say, “Wait a minute, I studied, I prepared, I put in the work,” then yes, you can walk into your glory. You deserve it.

Manoj Tandon: I guess the other question that comes to mind is: is there anything wrong with believing that you are that good or that you are the best at something where you do have a special skill?

Rafael Nunez: I wouldn’t say that’s wrong. What is wrong is to acknowledge a label that describes you and then use that as a safe haven and remain there. Understanding what the problem is isn’t good enough; you still have to solve it. You can’t just say, “Oh, that’s what’s wrong with me,” and stop there. Knowing isn’t good enough; we have to tie that to action.

Manoj Tandon: And tying it to action sometimes means you’ve got to get comfortable with being uncomfortable. I find that to be one of the hardest things to instantiate in a human being: getting people comfortable being uncomfortable. Do you have any suggestions on how you actually do that?

Rafael Nunez: I think it’s understanding that the one thing you’re putting off isn’t going to go away. Avoiding things isn’t going to help; going through things is what makes us grow. Discomfort is part of growth. People can know things, they can understand their purpose, but it doesn’t get any easier. You still have to work. Whether you’re a content creator, a professional, or a superstar athlete, you still have to work. Understanding and acknowledging what needs to be done isn’t good enough. It’s always marrying ideas and initiative with action.

Manoj Tandon: I think that’s really good, sound advice. I hope our listeners can make use of that because it’s important if you’re going to achieve excellence in something. So, let’s switch gears a little bit to cybersecurity directly. You mentioned that it can take an entire village to keep your data safe. Why does it take an entire village? And for small-to-medium businesses that can’t afford the village, how do they keep their data safe?

Rafael Nunez: The reason I say we’re all a village is because people get fixated on one role. Some people think, “If I’m not a hacker, I’m not a true cyber guy.” But we need each other. One person may be given the hammer to break in, another provides the governance and legal framework to make sure it’s authorized. Everyone plays a role. Third-party risk auditors, IAM specialists, governance professionals—all of it matters. Some of it sounds unsexy, but it’s absolutely necessary. Identity and Access Management, Privileged Access Management—these are all critical. We all make a sound contribution. You can’t have one without the other.

Manoj Tandon: Do you think maybe there’s too much compartmentalization in cybersecurity?

Rafael Nunez: One hundred percent. When you speak to a large organization, you may have eight people show up to talk about one discipline. In a small-to-medium-sized company, you might have one person owning three disciplines. That guy is fierce because he knows the environment intimately. One of the biggest constraints isn’t always budget—it’s people. Resource allocation becomes critical. You may only have three locks for twenty doors. Where do you put those locks? You have to use your people wisely and avoid burnout. Managed services can help because you’ll never beat the SLAs of a good MSSP without huge costs.

Manoj Tandon: What about the employees themselves? How do you bring them into the security pool and create a culture of awareness?

Rafael Nunez: Employees are probably the most underutilized asset in cybersecurity. I like how security awareness training is shifting away from “gotcha” tactics toward helping people understand the adversary mindset and how cyber threats affect their personal lives and families. We’re creating advocates. Security has shifted from saying “no” to saying, “Let me help you go faster.” That shift creates awareness where average users start noticing suspicious things and speaking up.

Manoj Tandon: We see it all the time. Over 80 percent of cyber breaches are due to human error.

Rafael Nunez: But humans are also the primary users of systems. We often say “human error,” but maybe it’s just human nature. Humans are opening doors, accessing systems, and interacting with data. That’s part of being human.

Manoj Tandon: That’s actually a very cool mindset shift. A lot of cyber training doesn’t really get into the psychology of the hacker and the human, and that’s the root cause of so much of this.

Rafael Nunez: Exactly. We can’t hang up the human at work and suddenly become robot cyber professionals. Human behavior follows us online. Attention to detail, negligence, habits—they all matter.

Manoj Tandon: That was worth the price of admission for this episode. A lot of people think cybersecurity is just technology and controls, but if you’ve forgotten about the human part of it, you’re not going to have a very effective security program.

Rafael Nunez: One hundred percent. Ultimately, what we want to do is help people make informed decisions. I can’t train people for every scenario, but if I can get them into the habit of making informed decisions, then I’ve done my job.

Manoj Tandon: Let’s talk about vulnerabilities and prioritization. How should companies practically approach vulnerability management?

Rafael Nunez: One thing I hear a lot now is grading vulnerabilities based on exploitability and relevance to your specific environment. But honestly, the biggest issue is the disjointedness between teams. Compliance says vulnerabilities exist, Security validates them, Engineering gets the patches, and nobody is aligned. You end up with thousands of vulnerabilities and teams not communicating. Start with better collaboration and communication. That matters more than obsessing over a specific tool.

Manoj Tandon: That gets into friction between departments. How do you lower that friction and avoid situations where CISOs become scapegoats?

Rafael Nunez: Most seasoned CIOs understand that the CISO is there to do the security job. But cybersecurity exists to support IT, and IT exists to support the business. Understanding those relationships is critical. If a CISO doesn’t have the authority to make meaningful changes, then eventually that relationship won’t work.

Manoj Tandon: Did the Target breach change the industry from your perspective working at Lowe’s?

Rafael Nunez: Absolutely. It changed budgets, headcount, and visibility for security teams. It shifted everything. It’s unfortunate that it took a breach to create that awareness, but it definitely changed how security was viewed.

Manoj Tandon: Apparently Target had alerts in their SOC that were ignored. Has SOC fatigue improved since then?

Rafael Nunez: Honestly, we’re far from eradicating SOC fatigue. There are more tools and more screens than ever before. The fatigue is still there, maybe even worse. That’s why MSSPs have become so successful—they can centralize expertise and leverage lessons learned across many clients.

Manoj Tandon: Third-party risk is another huge issue. How do companies realistically manage it?

Rafael Nunez: You have to ask, “What’s the real risk?” Not every vendor requires a 100-question assessment. You have to classify your data and focus heavily on vendors that actually touch critical information. Sometimes the risk is manageable with simple controls. You can’t treat every vendor equally.

Manoj Tandon: Let’s talk about Zero Trust and SASE. What’s your take?

Rafael Nunez: A lot of people cringe when they hear “Zero Trust.” The important thing is understanding that neither Zero Trust nor SASE is just a tool. They’re long-term strategies. SASE and Zero Trust work together. Zero Trust contributes to a SASE architecture. Without strategy, tools alone will fail every time.

Manoj Tandon: When it comes to failure, should companies be afraid of it?

Rafael Nunez: Failure is inevitable in some capacity. It’s not a matter of if but when. The question is how you prepare for it. Incident response plans and disaster recovery shouldn’t just exist on paper; they need to be exercised realistically and intentionally.

Manoj Tandon: There are companies that have leveraged catastrophic events to create stronger security cultures. You can’t eliminate all vulnerabilities, but you can optimize risk.

Rafael Nunez: Exactly. Companies sometimes become overwhelmed by long lists of initiatives and end up doing nothing. Start somewhere. Whether it’s cybersecurity or personal growth, consistency matters. Learn something every month. Trust the process.

Manoj Tandon: Let’s bring that down to the personal level. How do you avoid the victim mentality when you fail?

Rafael Nunez: I think it’s understanding that things don’t happen “to” you; they happen “for” you. When your flight gets canceled, you think the universe is against you, but there are 1,500 other people experiencing the same thing. Someone else probably has a much worse problem. Believing that challenges happen for you is what keeps me resilient. The absence of trouble means you’re not out there living. If you’re failing, it means you’re trying.

Manoj Tandon: That’s a very good answer and great advice. We’re coming up on the hour here, so I want to give you the floor for the last couple minutes to talk about anything you’d like our audience to know.

Rafael Nunez: First of all, thank you so much for the opportunity. It’s a privilege to be selected to be on your podcast. I love what you’re doing. The questions were phenomenal. I’m in the Charlotte, North Carolina area, and if I create a video or message that inspires or encourages you, reach out. I only talk about things I’ve actually experienced or overcome myself. I’d also like to acknowledge that any strength I’ve found in my life has been through faith, my spouse, and great mentors like Christopher Zell and Anthony Johnson. Those gentlemen really helped shape my mindset in cybersecurity and in life.

Manoj Tandon: Brilliant. Well, with that, Rafael, thank you so much for being on the show. It was a pleasure. I hope people find a lot of encouragement from this conversation. And to the audience: send us your feedback. Let us know what you thought—good, bad, or indifferent. We’re always looking for feedback. Thank you everyone, take care, and have a great day.