Building Security into the Fabric of an Organization with Marilyn Miller

Marilyn Miller: We talk about security as a team sport and a shared responsibility and accountability. I think the more that you can drive it from it's instilled in your culture and your values, you have less of a dependency then on the policing and the policy requirements of it. You still need to have those things in place. But I believe a lot in how do we educate, how do we enroll, how do we talk about the importance? How do we make it part of the fabric and culture of the company? And everybody understands their responsibility around data security and the protection of it.

Speaker: Hello and welcome to Security Visionaries. You just heard from today's guest, Marilyn Miller, chief People Officer at Netskope. Establishing security as a team sport is more than just implementing policy requirements. It starts with weaving it into your culture and values. From hiring to onboarding to employment, people need to be educated on the critical responsibilities they hold in keeping their organization safe. Before we dive into Marilyn's interview, here's a brief word from our sponsor.

Sponsor: The Security Visionaries podcast is powered by the team at Netskope. At Netskope, we are redefining cloud, data and network security with a platform that provides optimized access and zero trust security for people, devices, and data anywhere they go. To learn more about how Netskope helps customers be ready for anything on their SASE journey, visit N-E-T-S-K-O-P-E.com.

Speaker: Without further ado, please enjoy episode 16 of Security Visionaries with Marilyn Miller, chief People Officer at Netskope, and your host Mike Anderson.

Mike Anderson: I want to welcome everyone to today's episode of our Security Visionaries podcast. I'm Mike Anderson. I'm the Chief Digital and Information Officer at Netskope. I'm excited today to be joined by our Chief People Officer, Marilyn Miller. What's interesting about this is when Marilyn first joined, she was on a town hall and she was introducing herself and she talked about how she had partnered with the CIOs in her past companies as they thought about security policies and how those impacted the organization and how they could work together on that change. And it was at that moment when we thought about our theme for this year has been security as a team sport, I said, "All right, Marilyn is coming down on the podcast. We're going to talk about this." So Marilyn, welcome. Why don't you tell the audience a little bit about yourself and maybe your journey to Netskope and maybe your journey as a Chief People Officer?

Marilyn Miller: First of all, thank you so much for having me. I was very excited to be able to have this conversation with you today. So yeah, I've spent my entire career in human resources. I've been a chief people officer for probably the last decade. I grew up as an HR business partner, but I think when you get to the chief people officer side of it, you get to see all aspects of the function. When I think about what my role as chief people officer, I'd probably talk about it today in two different contexts. The first one being, ultimate responsibility, can we attract and retain the necessary talent for our stage and size and growth, the business models and how we execute the business strategy? So that's one big piece of it.
But I think the other side of it is setting the policies and the procedures as well as the culture of the company. And I think it's that culture piece, blending the talent, attraction and retention as well as the policy side of it that I think is going to be most interesting for today's conversation is how do you craft a company culture that's inclusive of all the responsibilities that each of our employees have?

Mike Anderson: I totally agree, and it was interesting when I was at Schneider Electric before this, we'd always start every meeting with a safety briefing where we talk about where is the exit, how do you get out of the building, what are all the things you need to be mindful of, especially in a manufacturing environment? And always had this ambition. I'm like, "I want to have cybersecurity be part of that safety briefing. How do we be safe at this meeting?" Remember when we're at a hotel where the exits are but also remember, put your laptop in your safe. That's one of the things I want in the safety briefing. I'm really interested in your perspective as we get more on this topic.
So you brought up a good point right there around talent. And I know that today if we look in cybersecurity IT across all positions, we have a workforce challenge trying to find the right talent, how do we retain the people we have? How do we up-skill them? How do we attract talent? Talk to me a little bit about when you're partnering up with CIOs and security leaders around recruiting talent, how are you helping them think about that problem in bringing those people on?

Marilyn Miller: Yeah, and you mentioned it at the very beginning. My own journey with Netskope started with the partnership that I had at my previous organization with the CIO. We were getting ready to roll out a whole new set of security technology inclusive of Netskope. And when the CIO came to me and said, "Hey listen, we're going to get a lot of questions around, particularly from our engineering teams of, 'Gosh, how much visibility are we going to have into their own traffic if they were using any of the company devices to check the movie schedules or online shopping?'" And so one of the things we talked about was, "Listen, what's our responsibility as an organization? Our customers expect that we keep their data secure. Our employees expect we keep their data secure. And so this whole culture of security started to reveal itself and we had to talk about it and put it in the context of the culture for the organization.
One, it's everybody's responsibility. We have a duty of care and a duty of responsibility to a number of these different constituents. How do we enroll them in being part of the solution and the decisions and the requirement and the understanding and how it does fit into who we are as a company and the kind of employer that we want to be? And so I think that's what's really shaped the way that I think about the partnerships. We talk about security as a team sport and a shared responsibility and accountability. I think the more that you can drive it from it's instilled in your culture and your values, you have less of a dependency than on the policing and the policy requirements of it. You still need to have those things in place. But I believe a lot in how do we educate, how do we enroll, how do we talk about the importance, how do we make it part of the fabric and culture of the company? And everybody understands their responsibility around data security and the protection of it.

Mike Anderson: Yeah, that's a good point. I think about tech companies, especially in the Valley area. We've got a lot of companies that are pre-IPO tech companies. The source code is the most sensitive data they want to protect. And I think about developers and if that developer that's across from me decides to leave, do I really want them taking our source code and going to a competitor or someone else, because that then impacts the value I have as a shareholder, which is part of the reason I probably came to the startup is I'm hoping there's an exit at some point, whether it's an IPO or an acquisition. When you've had those conversations with developers, has that ever been something that's come up around protecting their own, the value of what they have as a company?

Marilyn Miller: Yeah. And I think it comes from people want to be part of a values-based, mission-driven, high culture company. At the heart of that is the trust, the transparency, the accountability that comes with it, and the software developers that they want the work that they do to add value to the customers, to add value to their own career goals and enhancements. And they expect that the company is keeping that protected. It's very rare that I'm involved with the security team in the pace of the bad actors, if you will, people trying to steal our data or download company confidential, whether that's cust