Zoom’s Cyber Risk Manager Shares Her Thoughts on Remote Work, Industry Technology and Diversity Equity and Inclusion
R&I: What was your first job?
Oh, wow. Yeah, my first job was a typical teenager’s job at a fast-food place called Checkers. It was up the street from my house and our neighborhood. I only worked there for a few months over the summer until I was recruited by a regular. He recruited me to go work at the local dollar store. So, so between Checkers and the dollar store, those were my very first two jobs.
R&I: How did you come to your current position?
I like to say I was pulled, kicking and screaming into the technology world. My background is in enterprise risk management in the public sector. But, as a risk manager who’s worked in the industry for a while and seeing cyber as an emerging risk 10-15 years ago, I know it’s no longer an emerging risk, it’s here.
I was starting to get involved with a lot of technology risk issues and risk management issues. And so that led me to become a qualified candidate for the role I’m currently in.
R&I: What’s been the biggest change in risk management and the insurance industry since you’ve been in it?
The first thing is more on the technical risk management side. There’s been an increased focus on enterprise risk management (ERM across industries, which is more of a proactive way vs. a reactive way of managing risk.
I get excited when I see organizations implementing ERM into their strategic planning process, because I can see that they’re not only thinking about where they want to go, but also considering those things that might prevent them from getting there. For me, that’s very important, especially in the very fast-paced world that we live in now.
The second thing for me has been a much-needed and an intentional focus on diversity equity and inclusion efforts. And, not just across the industry, but specifically at the decision making and leadership levels in the industry.
Traditionally, industry leadership hasn’t necessarily been that diverse. It’s been getting more diverse, especially since I’ve been in the industry for the past 20 years.
But now there are concerted efforts that have been implemented to ensure that the qualified diverse candidates are informed about all the different types of opportunities that are available in the industry.
And I think this is extremely important as the industry and business in general becomes more diverse. As the world becomes more diverse, the business world becomes more diverse. As operations and the world around us becomes more complex, we want to avoid things like group think that prevent us from being creative and allowing for more innovation.
By allowing for more diverse candidates, you promote innovation and creativity that is needed.
R&I: What’s the biggest challenge you’ve faced in your career?
It’s probably a similar experience to other risk managers who’ve come up in the past 20 or so years, especially in the public sector. The biggest challenge I’ve faced is trying to sell the organizational benefits of enterprise risk management to the organization.
Oftentimes they want to bury risk management in a finance department or operations department. And you’re focusing specifically on things like just buying insurance — it’s very reactive, more of a traditional approach.
Or they’ll want to focus on implementing safety programs and things of that nature, as opposed to being proactive and using risk management or enterprise risk management to avoid the avoidable, or at least consider the possibilities and the potential impacts of what could be avoidable.
And so, oftentimes decision-makers make decisions that aren’t fully thought out, necessarily, from an organizational impact perspective, especially when you have an organization that has a lot of departments or silos.
Those leaders often don’t look past their piece of the pie to be able to see how that decision might impact other stakeholders or other departments. So encouraging the use of risk management methodologies for efficiency in decision-making, that’s been a huge challenge.
But I think, especially if you’re on any of the social media things like LinkedIn, we see organizations adopting the principles of risk management and enterprise risk management from a strategic organizational standpoint.
And so, that’s been a challenge, but I think we’re moving past that. Executives and organizational leaders are seeing the benefits.
R&I: Who has been your mentor(s) and why?
I really consider myself to be lucky. I’ve had some amazing bosses, some amazing leaders. I’ve had bosses who saw things in me that I didn’t initially see in myself, especially early on in my career. They appreciated my curiosity and desire to learn more. They encouraged my growth.
When I was at Alexandria City Schools in Virginia, my old boss Michael Krause told me, ‘I’m just going to keep giving you more until you tell me to stop.’ Because I was always so curious and I wanted to know how it all worked together. And so, those kinds of things have encouraged me to move on and continue to challenge myself.
Currently, one of my most supportive mentors is Soraya Wright. Soraya Wright is a career risk manager. She’s a consultant in the industry. She has many years of experience. She also now works with RIMS, which is pretty exciting too. But she’s extremely supportive from a personal and professional standpoint. So she helps me keep some balance there.
Other people I admire deeply include Kim Waller, currently with Korn Ferry and Kathy Lloyd with the City of Atlanta. These are amazing women leaders who have nurtured and supported me over the years.
R&I: What is the risk management community doing right?
Focusing on emerging risks is really huge. Looking past today and looking even past tomorrow. Looking 10, 20 years down the line to see what’s coming. I think that is very important. And that’s a big focus on risk management.
We have to be able to look past to see what might be coming and consider how that might impact how we’re doing business. And then, also again, focusing on that diversity equity inclusion as the world around us becomes more diverse and our workforce becomes more diverse at all levels.
R&I: What could the risk management community be doing a better job of?
Promoting more work-life balance. We are worst-case scenario thinkers. So, we’re the ones that are thinking about what could happen, what could go wrong.
Oftentimes we get stuck in that. And then oftentimes we don’t have enough resources. And so promoting additional resources to address these risk management issues that are coming up that’s something that risk management could do a better job of.
R&I: How would you say technology has impacted the risk management profession?
Technology has impacted every single thing that we do. Technology has been an emerging risk. It’s allowed us to form more in-depth and detailed analytics of likelihood and impact outcomes. We have certain methodologies that have now been created to help assess the impacts of risk management on an organization’s bottom line.
I think technology’s ability to collect the data, to perform the analysis has been significantly impactful in the industry. It’s not just what I think from a probability standpoint, or doing a heads-and-tails analysis.
It’s being able to collect that data, analyze that data, seeing what the trends are, and then identifying where specifically your areas of concern are, and putting programs and remediation plans in place in order to address those things.
So I think that technology has a huge benefit, but there are also some negatives. Traditionally risk management requires people. It requires a lot of relationship building.
Now that we’re hopefully coming out of the pandemic, one of the concerns I have is will people still stay at home and do all of these meetings and collaboration via Zoom meetings?
Or will people be pulled back into of those in-person conversations? Because I do think that there is a difference. We all love our tools and our toys, but there’s some benefits to relationship building, as we look to identify and manager our areas of concern.
R&I: What unique challenges do risk managers face as the use of technology accelerates due to the COVID-19 pandemic?
This was huge when I was at the City of Chicago, because we were trying to figure out how do you allow employees to work from home? And so, you had to consider, for an organization that didn’t have a work from home program do you have the right hardware software? Is it up-to-date? Are people properly trained so they don’t click on the wrong thing? How are these things being funded and paid for? How do you make sure people are working while they’re at home and not sitting watching soap operas during the day?
So, there’s lots of challenges. And there are solutions to that, but some of those could impede upon an individual’s privacy.
So if I’m allowing an individual to use their personal device and work from home, am I allowed to install monitoring software on their personal device, while they work from home, in order to monitor their work? Or are they even allowed to access our network? How do they access the network in a safe way?
So there’s all kinds of implications that technology has really accelerated. And I don’t think we saw all of that coming with the work-from-home scenario. So it’s really all in the cyber stuff and the cyber vulnerabilities and things of that nature that have created the biggest challenge.
It’s just trying to work through all of that and determine how do we get the job done, but also ensure that we’re not infringing upon anyone’s privacy, so that we’re still doing things safely and efficiently.
R&I: What’s your favorite book or movie?
This is going to be really corny, but it’s Trading Places with Dan Aykroyd and Eddie Murphy. I watched that movie when I was a kid. It’s centered around the holidays, so it’s really fun. It’s a comedy. And it is just super funny to see how opportunity can impact things.
And then it’s kind of a risk management exercise. Right? It was a risk management exercise. They took a risk and thought they were playing a joke on somebody and then they got played.
R&I: What is your favorite drink?
I’ll go with something that I shouldn’t be having, and that is Coca-Cola. I’m from Atlanta. I grew up drinking Coca Cola. I love Coca-Cola, but I know it’s not good for me to drink all those empty calories, especially, as I sit more while working from home.
R&I: What have you accomplished that you are proudest of?
I’m always moving forward. I’m always progressive and trying to ask what’s the next move? Where can I make the next biggest impact? Being focused on that and sticking to my guns. I don’t like to be told ‘no.’ I like to always push myself. I think that the fact that I’ve been willing to move to advance my career has been helpful. I’ve made some sacrifices, but I’ve also benefited a lot.
And I’m proud of that. I would say my accomplishment that I’m most proud of is my professional career. It’s not too shabby.
R&I: What is the riskiest activity you’ve ever engaged in?
That’s an easy one. I am a horrible driver. I’m somewhat of an aggressive driver… especially in my younger years. And it’s funny, because I used to teach defensive driving many years ago, and you’re trying to encourage folks to incorporate all of the defensive driving techniques into their day to day.
I’m more reserved now, because I’ve gotten older. But yeah, in my younger years, especially, I would say driving was my riskiest activity, and maybe a little aggressively. I like to get to where I’m trying to go. &