Maril Vernon: 0:00

Welcome back everybody to another episode of The Cyber Queens Live! Today we are joined by a very special guest, someone I'm very excited to talk to. We are joined by Mackenzie Wartenbeger who is about to be a recent graduate of something called the Aquia Accelerator. I'm excited. Mackenzie, would you introduce yourself?

Mack Wartenbeger: 0:02

I started out my career in the mid-2000s as a track and field coach. I worked in the NCAA, with men's and women's track and field athletes and thought that that was going to be my career forever. I was an athlete in school and fell right into coaching and loved it, was really passionate about it. It was amazing working with young men and women who are doing this really exciting thing in their lives. But I was the classic victim of telling people, “hey, take care of yourself. Fill up your cup so you can help others.” I wasn't doing that for myself. towards the end of 2021, especially post Covid, I was running ragged, burning the candle at both ends and wasn't bringing what I needed to bring to my job anymore. I still feel really strongly that that is such a critical role for people to play and to help be a guide for young people. And my fatigue and my lack of self-care was really starting to impact how much I was able to give.I made a really tough decision at the end of 2021 to step away. I thought it was going to be a short break but it ended up being a longer one because I realized “hey, I needed to unpack the stuff I needed to get me right.” And then the scary staring into the events of okay, I'm a gym teacher essentially. I'm a university gym teacher, what do I do now? My skill set was I had a college degree but no technical background. I was working with people. I was doing a lot of recruiting. I was doing a lot of budgeting, obviously the sports specific stuff.

Maril Vernon: 0:04

I think that that happens with many people. Many people just get to a point where they're afraid to try because, what if they fail? But then it cuts to a point where staying is more detrimental than just putting yourself out there and trying.

Mack Wartenbeger: 0:06

That's a great question because it is, it's really intimidating and, I'm older, not old, but you know, I'm in my mid-thirties. I wasn't a young out of school person. And it seemed I was telling Amber DeVilbiss before we went live, I knew how to work my iPhone, I could update my MacBook, but I was not the kid taking apart computers at age nine, trying to figure out how they worked and rebuild them. I was a jock and in all the good ways and in all the bad ways too.this space seemed really foreign. I was picturing the classic guy in his mom's basement and the hoodie. That classic hacker image. But I was really lucky to have friends and family that work in and around cyberspace and in tech. And what I was seeing was they were constantly challenged. They were always learning and they had all of this flexibility I'd never had, I was on the road 200 of the 360 days of the year and working crazy 70 hour weeks, and there was no off switch. And I loved that for a long time. But what I saw my friends and family doing was having these really fulfilling careers where they were doing interesting stuff. They were living problems, they were impacting change because gosh, the cybersecurity world is exciting, what we're doing to secure many different facets of modern life and they had flexibility. They seemed to be really, really happy and rested and enjoying it. And that was the kicker for me.

Maril Vernon: 0:08

It's one of those things where there is so much opportunity in cyber for that work-life balance, for those fun, innovative projects. And I know a bunch of people are looking at us and thinking, lines of code, the terminal. SOC audit. It's not fun, but it's fun. It can be fun. It definitely feels cool to be a part of the effort. How are you liking it so far? Was it everything you thought it would be? Were there meh, I would keep this but I would leave that? What would you say to people who are thinking of coming to this industry? I was going to say thank you cyber industry for not being toxic and not being all the things I say that we are . Yay for welcoming new people. Amber DeVilbiss and I can tote it all day. We can say that this is a wonderful community and we're supportive, and we really do encourage you. And when I first started, it was hard to be a stupid person. I wanted to be like I learned about this today but if I say the wrong port, if I say the wrong protocol, if I say the wrong thing, I'm going to look stupid and they're going to eviscerate me. But, no, I really do think that’s evidence that we are just as supporting and inclusive, as I say we are. Not everybody mind you but … the people I surround myself with at least. Speaking of the breaking in part, you have done a thing that many people hope to do. I have done a thing that many people are trying to do, which is to break into cyber cold from something completely non-technical. When you did decide the direction you wanted and you started to go about looking, did you start looking at what the positions even were? How did you find the Aquia accelerator? How did you identify and see that that was something you wanted to try? Or just how did you go about the actual getting in part.

Mack Wartenbeger: 0:12

Yeah, great question. I think the biggest thing is I lead with gratitude and I had this incredible network that I lucked into. I've got a family member that works in the cybersecurity space from the private side and my brother and he connected me with operators, Caroline Wong, who's at Cobalt, and a couple other really awesome influential folks that just made time. These are people that don't need to make time for ex-college track coaches to ask questions. And it was awesome, especially you having me of these really strong women answer questions and make time to meet up on LinkedIn and have quick phone calls and give guidance. And I was able to network with the folks at Aquia and was lucky enough to, I think, be in the right place at the right time. At the advent of this accelerator program, and having cool conversations about all right, I've got a skillset, I was managing groups of people for 12 years and I'm a decent communicator and I've done the whole leader thing before. And I think those things can be really useful for a cybersecurity operator. But I'm missing this body of technical know-how, and I am grateful that the folks at Aquia were like, “hey, we can teach you that. That's a learned thing. We've got the resources to turn you into this.”

Amber DeVilbiss: 0:14

I preach this all day long. I mean, the same thing for me, right? I was a waitress when I first got my job as a compliance analyst for a cybersecurity firm out here that was brand new. And I had a girlfriend of mine who was a recruiter, and we both ended up in between jobs at the same time working for a company called First Data, which hopefully you guys have all heard of. But yeah, we worked there together and she goes, you know what? Because I said, I'm just going to go back to waitressing, it's fine.whatever. And. No, no, no, no, no. I have this new recruiting job. I can find you a job and it's amazing. I'm almost what? This is awesome. And I remember I had no idea what compliance analyst means but I will go there. I'm telling you…. Brian was one of my first bosses, this industry. I have this whole thing where they support women. It's fantastic. But he gave me a chance. He took a huge shot on me, and I remember at the end my recruiter friend told me as feedback. You said awesome way too many times… because nobody on his team is this pumped about this job. And I was ….we never need that. just being able to have your background, be different. I mean, you have to think differently. If we're going to get ahead of anything in this industry, we need change constantly. Everything else is changing and we're trying to adapt to it.

Mack Wartenbeger: 0:16

That's the scariest part. And what's awesome is that between LinkedIn learning and Pluralsight and all these great services, there's a ton of resources out there. A ton of resources but it was intimidating. You're like, “Ooh, what's Python? Yikes. Do I need that?” I thought Amazon was just where I set up my subscriptions to get my groceries and stuff. I didn't realize Amazon Web Services was a thing. That was quite the rabbit hole to go down. But I think this skilling up happened. I had this false impression that everyone was just going to speak code as their primary language, and I always have to come in and know all of this stuff. And that was really intimidating and really scary and I think that's a big reason why GRC has been such a great place to start because it is that human language piece. I can write, I can do all this stuff and it was after the intro. The technical part is still scary, but what I'm discovering and Maril, you were great about this, we had a conversation about this a couple weeks ago. No one knows everything. It seems everyone knows everything, but no one knows exactly.

Amber DeVilbiss: 0:18

I think that's important. I remember it's funny because it feels like you and I are similar. I came up in the compliance world too and honestly, I'm glad I did because I don't know if I would've gone straight into network security… because my parents have done this for a billion years. And my dad has always been a network, hands on, physically hands on keyboard, hands on, building everything from the ground up guy. And to me, I was like oh my God, that's boring. I would never want to do that. And I'm glad I went into the side that I did because I don't think I would've stayed otherwise. That fits my personality more. But I al. I had that imposter syndrome where I was like oh God. People already probably think I'm just this joke anyway. Now that means I have to know everything. Everybody here knows everything about every part. And that is such a misconception. And one of the things, and we can talk about that later, but one of the things we focus on now, with the nonprofit that I run, is helping kids even understand that getting into cybersecurity or getting into tech doesn't mean that you have to know how to code. I don't know how to do a single thing, not one single thing. I've taken Python classes, stuff like this. I've done it with my son who's 10-year-old and I'm still like Nope, I'm good on this. This is not my strength, nor do I want it to be. Unless you're a million years old and you've been doing nothing but that specific domain and topic forever, I don't think anyone expects you to be like, “Hey, hey, hey. You're the new Google Maril. Did you know that?”

Mack Wartenbeger: 0:22

Yeah. And the red teaming is sexy. The whole blackhat/white hat. I mean, that's just cool. And that's the shiny glittery piece. You’re Googling cybersecurity roles, it was like oh yeah, that sounds awesome. But I would've had to have taken a bootcamp. I would've had to have poured myself into learning this. And then I probably wouldn't have been a very good pentester. Because I didn't have any of the background you were saying. And I think when you're thinking about the compliance piece, nobody likes compliance. Track coaches don't like compliance. Nobody likes compliance. Everyone is like “Ooh, the compliance guy, run away.” But it's been such a great place to learn and you said, Amber, getting that foundation, building that base. And I feel really great that Aquia is excited about me working as a GRC analyst but then also it's pushing me to continue to flex and continue to grow tech up, skill up. This is just the ground level but you have to have that. You can't go super skilly in my opinion, you can't go super skilly and then think that the rest will just fill itself in because it's false.

Maril Vernon: 0:24

I say it's not for everybody but anybody can do it. Owing back to the technically required skills, everyone's like “God, I want to be a hacker like you, but I don't know, Python's going to take me two years and its going to take me two years to do this.” I'm like I didn't have any of that when I started. None of it. And I do this job every day that's not required. We have perpetuated these false things. You don't need all that stuff to start. Maybe you need that stuff to be really, really good later on. Absolutely. But to get started, absolutely not. And speaking back of the accelerator, my mother, I submitted my mother to the same program. We're going to run another cohort that Mackenzie's about to graduate. Because I'm sick of seeing her toil in these customer service jobs where they don't appreciate her and her work ethic and I'mmom, you're brilliant. Anything that you've put your mind to learning, you've learned. She learned medical billing and coding because she thought she was going to do that. I'm like that’s something I can't do. You can totally keep up with this, I think and I think you'd love it. She was all no, I'm not technical like you and your father, Maril. I can't do that. My dad's a SCADA engineer and I can't do what my dad does but he can't do what I do either, we're fine. But I'm like mom, you totally can. You bring a strength. You can learn this. You can understand it. You can bring what you have already and you can just build on top of that. If you take nothing else away from this episode, please just understand that whatever soft skill foundation you have, there's a place for you in tech. There's a place for you in cyber and you can build upon that knowledge later. And I'm going to take this opportunity. It's a really good place to just brag on the Aquia accelerator just a little bit. I wouldn't normally plug my own company much, but I am proud of these guys that I work for. My founders are Chris Hughes, John Sasser and David Maskeroni. And, I am just proud of this program they put together because it's one of the only ones like it that I've seen. And they are a group of really good gentlemen, and I'm thrilled to work for them. It took a lot to pull me away from my red team role, but they were the three who could have done it. The Aquia GRC accelerator is a program. Aquia is meeting a demand for more cyber professionals with its accelerator, which is a trained to hire program, specifically targeting individuals who may not otherwise have means to access further education or the qualifications necessary to be hired in a cybersecurity capacity.

Amber DeVilbiss: 0:28

I mean, I haven't. I think it's amazing that you're putting all that together. I think before all this existed, I found something that was helpful that was Cybrary. It used to be free, now there's a paid thing for it. But that's about the only other thing that I've seen. But even still, I mean, they don't, do paid internships and stuff this and then hire you and do all that. That's amazing.

Mack Wartenbeger: 0:32

I mean, I think that's been great. All those concerns, those initial concerns have been chilled out and calmed because everyone's like hey, let's huddle for 15 minutes. I can tell you about what being on TO3 is . Let me tell you about all of these different things. Hey, here's a 15 second explanation of what Kubernetes is so that you don't sound like a goober the next time you're talking about it with someone. I think that's been awesome. It was really intimidating, really nerve-wracking, but it has been such an incredible opportunity and I come to work and it feels good. It feels good to be learning and growing and, and have such incredible support from a cool org and outside of it too. I will say that there's a lot of issues in every organization and we need to make it easier for all kinds of people to pursue their career paths but I've been overwhelmed by the support and all the really positive feedback I've gotten from everyone at Aquia and outside. It's been awesome. Good question. Yeah, I mean, I think right now it just feels great to be paying some of the generosity and some of the support that I've gotten forward. It's awesome to feel like hey guys, let's crank on these things. Let's build these security document profiles. Let's get these policies and procedures in line. Gosh, go compliance, go. But it's great. And that feels really good right now just to be contributing. I think you know, Maril, you said it, Aquia is a small org. I mean, I can remember our first one-on-one conversations when you were like I'm going to help you, I'm going to take you under my wing and we're going to get this sorted. It finally feels good to be able to say, okay, I've got this. I'm going to build this disaster recovery plan. It's not going to be perfect but it's going to be good and it's going to be a start. That feels great. Yeah. I'm really excited to start to address the technical side. That's a piece that I think early days it was just this drinking from the fire hose, trying to get as much exposure to everything. And as I've honed in on GRC and compliance, I think I've shifted some of the technical things to the background I can gain, at least approaching the mastery of the smaller parts of GRC. I'm excited to ultimately circle back to that. I do want to have more technical skills.

Maril Vernon: 0:36

It’s a beautiful answer. I love that.

Amber DeVilbiss: 0:38

I was going to say a lot of that is what I would ring home with as well. But another important thing to me and this is actually something that even though I've been doing this for 14 years, one of my best girlfriends spoke to me yesterday and she was no matter what at the end of the day, whenever you're freaking out about how does the world see me? Am I good enough? Am I this, everybody is great at something. I don't care who you are. Every single person is great at something. And it's about being honest with yourself but also being honest with any potential employers or anything else. Here's what my strengths are. Maybe I'm not super technical or whatnot because I came from coaching and doing all this other stuff but here's the value points that I will bring to add to the team.I will add to the success in this way. And any great leader's going to see that and be like oh, that's perfect because it's crazy. Again, I used to think that in this industry, soft skills were just a given and that hard skills were things that were valued. But it's almost taken a turn. Because you can teach anything to anybody for the most part. But you can't teach people that drive. You can't teach them perseverance. You can't teach them the personality that it takes to be successful here and to help other companies be successful thereafter.

Mack Wartenbeger: 0:40

Well, Amber, you nailed it. I think, know yourself. The biggest lesson I learned is that I had to take my own advice and take care of me and make sure that I was feeling I was getting what I needed to be the person I wanted to be. And cyber certainly met that need. I think also bringing it back to gratitude and just relying on a network, building a network, investing in a network and also really feeling appreciative for those hands that are pushing you forward, that are helping pull you up, that is cool. And I think everyone says like oh, the power of networking. You've got to build your…. Maril, you're such an incredible brand builder and that's awesome. But even if you're not a Maril because there's only one amazing Maril.

Mack Wartenberger: 0:42

The Cyber Queens. But yeah, just knowing who your people are and not being afraid to accept the help and then ask for the help is huge. And then in terms of the industry, it's about not being intimidated. It's about taking that first chance and feeling comfortable. For me, feeling I was in my career, I was doing really well, it was hard to take that step back, eat that humble pie and beI'm an idiot. I know nothing. Pretend you're talking to a five year old. That's where I'm at. And I had to get really comfortable with that. And I didn't think that I had this whole persona as this really capable person that knew everything and didn't need a lot of help. And asking for help was really, really tough. I think it's really hard for women in any space to admit that they don't know something because we're constantly afraid that that's going to mean people discredit us and discount us. And getting confident and secure enough to say like yeah, I don't have any idea what you’re saying. Can you say that all again but slower andI'm dumber? I need you to break down more for me, that was huge. And it's not as scary a place as it seems to both of your points. You don't have to be the hacker in the basement with the hoodie up, on me crazy hackathon.