Zions Bancorporation EVP and Chief Information Security Officer
Current Time 0:00
/
Duration Time -:-
Progress: NaN%

How did you get to where you are today? What is your story? What incidents and experiences shaped your career path?

Summarized By: Jeff Musk on Wed Mar 11 2020
When I started college, my goal was to go to law school. And so I was an English major, and I started with this clear plan in mind and actually obtain my degree. But while I was working to obtain my degree, I started working in the computer lab on the campus at the university I was attending, and I had an opportunity after I graduated to work at the University full time in their computer department, and I thought that would be a good way to take a couple of years and save some money for law school. So I did that. And the short answer is, I never left technology. After that, it was right around the time of the dot com, and a friend of mine was working on the coast, and he invited me to come work with him and I moved to California and started my technology career in earnest there. So many of the people I work with don't have a liberal arts education background, but I've always thought that should never stop anybody who's interested in technology because there's a lot you can do in the world in terms of how you write and how you communicate. That is really valuable that many people who have more of technical education. Sometimes they overlook that side of it.

What are the responsibilities and decisions that you handle at work? Discuss weekly hours you spend in the office, for work travel, and working from home.

Based on experience at: EVP and Chief Information Security Officer, Zions Bancorporation
Summarized By: Jeff Musk on Wed Mar 11 2020
The biggest responsibility I have is making sure that the company I work for, the bank that I worked for is secure every day. And that has to do with helping the people at the bank understand this as well as working on our technology systems. So I work in both domains, both the people side and the technology side every day. And sometimes that's educating business units on how to be safe when they're working on the Internet world, In the connected world, we're in social media and everything, and sometimes that's working with engineering teams to do something like stand up a firewall or another piece of technology. So my daily time I work a regular day, probably between eight and five most days. And if there's an incident or a security event or something that occurs, I'm on call. So I always have my cell phone with me, which probably most people do anyway. But it's kind of an expectation that my work can contact me at any time, day or night and say we have a situation that's arisen and we need your help now. Those don't occur every day. They don't even occur every week. It's just the potential for that to happen. And so when I am on vacation, I try to make an arrangement with an alternate leader to cover for me when I'm out so that I can actually get that vacation. But most of the time it's a regular work schedule. Occasionally I'll travel to a conference or to another office of a company, but it's probably less than three or four weeks I figure that I'm traveling.

What are the job titles of people you routinely work with inside and outside of your organization? What approaches do you find to be effective in working with them?

Based on experience at: EVP and Chief Information Security Officer, Zions Bancorporation
Summarized By: Jeff Musk on Wed Mar 11 2020
The people that I work closely with are our technology leaders and business leaders. So, for example, one of the people I work very closely with is my immediate leader, the Chief Information Officer. And she has responsibility for every aspect of our technology world. Not just the security, but the way these systems are written and coded and how they're deployed and how they're supported. I worked closely with project teams. We do a lot of project work at the bank, so the leaders of these teams with some of them are project managers. Some of them are Directors of Programs, are their titles, and I work with business leaders. I work with, in our case, it would be bankers, people who are responsible for lending to customers and setting up deposit account for customers. We work with them some bits of educational, some bits understanding their needs so we could build better security solutions for them. 

What major challenges do you face in your job and how do you handle them? Can you discuss a few accomplishments?

Based on experience at: EVP and Chief Information Security Officer, Zions Bancorporation
Summarized By: Jeff Musk on Wed Mar 11 2020
With cybersecurity, the challenges are always there. They're never done. It's a continuous world that we're in and we're seeing new and creative ways that people are trying to commit fraud or steal data or do other things that are in the cybersecurity world and some of those challenges, we find people who are trying to use very novel technology to try to commit fraud. And so an example would be somebody who tries to impersonate a customer does an account takeover. They may even do research about where that customer shops, what kinds of spending things that customer typically does. And they may communicate in writing. Or they may even try to impersonate that customer on the phone. If they've taken over the customer's email account, they may have access to passcodes and other things that the customer uses. And so we have done that on a couple of different occasions where really it's detective work to try to see the clues adding up to try to detect these people who are misusing other people's bank accounts and get law enforcement involved it. So that's been very gratifying to identify this and take care of our customers who have been affected by it.

How do you inspire and motivate your team members? How do you foster creative thinking? How are ideas shared and implemented?

Based on experience at: EVP and Chief Information Security Officer, Zions Bancorporation
Summarized By: Jeff Musk on Wed Mar 11 2020
I have a very collaborative approach, and our team is very team-oriented and consensus-driven. So in this world, we can't really afford to just take one person's ideas and think that's the way it's going to be. We have to elicit different viewpoints from different people who have different experiences. Sometimes it's different life experiences to get different views. And so my way to inspire people is to ask lots of questions. I'll ask people to make sure that they understand the idea I'm trying to convey, and then sometimes I'll ask them if they can put it in their own words, and that helps them on and I to be aligned in what we're doing. Also, sometimes listening just when you're in a meeting with somebody, especially if it's a one on one meeting, I tried to make sure that the other person has plenty of opportunities to share their views and really listen to what they're saying and not try to be thinking about what you're gonna be saying next.

How do you set targets for your team members? How do you measure their progress? How do you incentivize them to meet their targets?

Based on experience at: EVP and Chief Information Security Officer, Zions Bancorporation
Summarized By: Jeff Musk on Wed Mar 11 2020
I think they should set their targets right? A good way to think about this is I set the what or organization often corporate strategy sets the what of what they should be doing. And then I invite the team members to structure their own how to do the work. So I might say we have to stand up this solution and it has to be stood up by exceptions. Such a date. That's what. But I wouldn't tell them. You have to use this person doing that and this person doing a different task, and I'm going to stand here and micromanage it every way, a measure you are, what I'm telling you to do. I view my role more as making sure I'm helping them to stay on track, and so we'll talk frequently about what they're doing. They shouldn't have to wait until a monthly status meeting to tell me something is in need of help. They will come by my office or send me a message in teams or email and say we need another date on this. Again, I'll just ask lots of questions. How is it going? Give them an opening if it's going well that that's a short conversation. If I could help them in any way, then we dive into that. But they're setting the targets and then my job is are they accountable to those targets? And have they done what they said they were going to do? That's the way that we do this rather than me coming up with everything in measuring it and micromanaging it.

What qualities do you look for while hiring? What kind of questions do you typically ask from candidates?

Based on experience at: EVP and Chief Information Security Officer, Zions Bancorporation
Summarized By: Jeff Musk on Wed Mar 11 2020
I look for a lot of engagement and curiosity. If people are genuinely interested in what we're doing and they're curious and they ask a lot of why questions. And what about this? Those are great indicators in an interview. I always have at some point during the interview, oftentimes it's at the end. What questions do you have about this role or about anything we discussed? And it's a little disappointing sometimes when the candidate says "No, I don't have any questions." because I would think if I were interviewing at a company, I would have used every opportunity to learn as much about that company as I could. And maybe if it's an hour-long interview, I'll just ask lots of questions. And so I expect people that I'm working with to also be curious and ask questions because it will help them to understand what they're getting into. Other questions that I ask people are, I'm really less interested in them, demonstrating that they can answer a technical question. I want to see how they apply their knowledge. So I'm looking for people to give me an experience of at a time when you did something like this and a lot of times those questions, people think, "Oh, it's about technical questions. But if I don't have a lot of experience, how do I answer that question?" The type of questions I answer the experience could be life experiences. Maybe you had a very challenging professor at the university. How did you deal with that? Did you talk to that professor? Did you work with them and try to come to an understanding, or did you just kind of try to endure right? And if you're in an experience where you can say I approached the professor, it wasn't the easiest thing to do, but I discussed how I was feeling and we were able to come to a better outcome. That's a good data point for me. I would hire a candidate who does that over somebody who has three years of work experience but never bother to tell their leader in the workplace how they felt.

What is a typical hiring process for a job like yours? What are the titles of people who interview? What questions usually get asked and how to handle them?

Based on experience at: EVP and Chief Information Security Officer, Zions Bancorporation
Summarized By: Jeff Musk on Wed Mar 11 2020
The job that I have right now, a lot of people who I'd be interviewing are executive leadership of members of our executive leadership team. So I interviewed with our Chief Executive Officer, our Chief Operating Officer. I interviewed with the leader of our Audit practice. These are senior leaders who were trying to understand how I would fit into the leadership team and the types of questions they ask are very geared around, how I have led and what I would do in leadership situations. Technical understanding is important, but when you're talking about a leadership role, they're most interested in how you work with people and how you can deal, with like a tense situation. So if I remember my interviews, there were a lot of questions about this is a very tense situation I'm going to describe to you. How would you handle that? How would you prevent it from getting worse? How would you work through to the right resolution? Those are the types of topics that they're they're interested in.

What are different entry-level jobs and subsequent job pathways that can lead students to a position such as yours?

Based on experience at: EVP and Chief Information Security Officer, Zions Bancorporation
Summarized By: Jeff Musk on Wed Mar 11 2020
There are a lot of ways to get here. There isn't one single path. And I think that whether you're talking about cybersecurity or information technology generally, the important thing is to do a lot of different things in your career. So if you start out in cybersecurity and you're interested again, the leadership aspect of it you should try different roles. You might come in as a penetration tester or as a cybersecurity risk analyst, and then from there, after a couple of years, you might be able to become a cybersecurity incident response engineer or an application security engineer and gain some hands-on experience with that technology. And after you've done that, then you might do a rotation in information technology network engineering or application development to get an understanding of how the information technology functions. So when we look at people who are leaders in the cybersecurity or information technology space, we're looking for people who have done multiple things and held multiple different specialties.

What were the responsibilities and decisions that you handled at work? What major challenges did you face in your job?

Based on experience at: Lead Systems Engineer, The Home Depot
Summarized By: Jeff Musk on Wed Mar 11 2020
That responsibility was about the decisions for that job were mostly about the technology we deployed and how to go about addressing those technology problems which are cost and speak to market and reliability. So we would look at the systems that we have employed, and we would look at how much they cost, how reliable they are, what their response times are, and we would select those technologies and implement them in retail stores in terms of what's the best solution to meet that triangle it needs.

How did the school prepare you for your career? Think about faculty, resources, alumni, exposure & networking. What were the best parts?

Based on experience at: MBA, Brigham Young University
Summarized By: Jeff Musk on Wed Mar 11 2020
It was a program that really heavily emphasized teamwork. And a lot of the people who participated were not right out of school. They had professional experience. So it was a night school program. So for two years, we worked with people who were working full time in the industry, and I almost learned more from the group of students that I was paired within my team. Then I did from the coursework and the faculty. They were great advisors in counseling because they worked for large companies like Intel and Nike and Novell. These companies gave them a lot of perspectives that I still rely on today because I got a lot of value out of those relationships.

How did the school prepare you for your career? Think about faculty, resources, alumni, exposure & networking. What were the best parts?

Based on experience at: BA, English, Brigham Young University
Summarized By: Jeff Musk on Wed Mar 11 2020
The best part was critical thinking and the ability to communicate right, And I have stressed this with the people that I work with, being able to communicate clearly and be able to write well, it's something that my undergraduate experience helped me with clarity. And without that experience, I don't think that I could have had success in any of the subsequent work that I tried to do because thinking about a problem and being able to articulate it. So I had faculty that coached me on my writing for assignments as well as a kind of capstone work that we were doing for my degree. Those assignments were very memorable and helpful in the sense that I began to write and think more critically than they had before.

Would you like to share something that is not on your resume? This may include your passions, facing setbacks or adversities, a unique experience, or an unexpected help.

Summarized By: Jeff Musk on Wed Mar 11 2020
I don't have anything that I really feel which would be a life experience here, but more of a philosophy in terms of everybody that I've encountered that has been a great mentor to me, both in and out of the workforce. The making money and getting a very prestigious title in a corner office has been far off the radar, the people that I've learned in those from the philosophy of what energizes you and what drives you. And I have found that the experience of helping other people learning with other people and looking at new problems has been far more rewarding. and then just well here's a bonus, or here's a promotion and here's a title. Those things come because I believe people who get them. It comes because they understand that solving problems in helping people are the fundamental aspects of success in business. And so having good mentors fortunately early in my career, that helped me understand that has really made a big difference.

Do you have any parting advice for students hoping to get to a position such as yours? What 3 dos and 3 don'ts would you suggest?

Based on experience at: EVP and Chief Information Security Officer, Zions Bancorporation
Summarized By: Jeff Musk on Wed Mar 11 2020
Okay so be open to new experiences. Do try new things, even if they're scary or unfamiliar to you and do be curious about every opportunity but to learn whether it's directly in your field or not. Some of the best things that we learn come from crossing our what we think about every day, whether it's our major, our job with something else that doesn't it sort of first seem to be related. For the three don'ts? I would say, Don't lock yourself into a rigid career delay. Our economy is going in the way the world is going. None of us are going to be doing the same thing for 30 years anymore. There may be just a very few exceptions to that rule, but in general, most of us will be doing different things throughout our lives. And so don't assume that you're going to get a degree and one thing and then immediately go to work for a big company and that thing and stay that way. You need to be open to other avenues don't short change yourself. Don't think because I have an English degree, I can't do computer science or coding. I don't think that because I have a computer science degree. I can't do marketing or creative aspects, right? The things that make us successful are where we focus our attention. Not what the piece of paper that we graduate with says and having that different experience will be helpful. And don't expect that which way things were going to go. I say all of us, but especially those who are in school. Now life is gonna be very different in a few years, and so don't lock into a fixed idea of the late. You're gonna live your life because I think we're all gonna need a lot of flexibility.