Talent Development in the Cyber Era

Ann Johnson: Welcome to Afternoon Cyber Tea, where we explore the intersection of innovation and cybersecurity. I'm your host, Ann Johnson. From the front lines of digital defense to groundbreaking advancements shaping our digital future, we will bring you the latest insights, expert interviews, and captivating stories to stay one step ahead. Today I am joined by Robyn Frye, the vice president at Workday. Robyn has spent the last 20 years working in security and compliance consulting and is currently the vice president of Cybersecurity Governance, Risk, and Compliance at Workday. She received a bachelor of science in business administration from Cal Poly San Luis Obispo in California. And in her free time, Robyn enjoys working from her current home of Auckland, New Zealand. Welcome to Afternoon Cyber Tea, Robyn.

Robyn Frye: Thanks, Ann. It is so wonderful to be with you today.

Ann Johnson: So, Robyn, we are going to dig in to diversity, inclusion, talent development in cybersecurity, but before we get there, I want to talk a little bit about you. So can you tell your listeners what sparked your interest in cyber and briefly how did you come to the role that you have today at Workday?

Robyn Frye: Sure, I am happy to share a bit about my story. I grew up in the heart of Silicon Valley. So, you know, at a young age, my friends and I were tinkering with emerging technology. I remember asking for a modem for my birthday present in the early 1990s so that I could chat with my friends online. These were definitely the days well before that AOL, Instant Messengers, let alone today's Snapshots or TikToks. At university, as you said, I studied business, and I was really drawn towards the challenge of information systems and studying that concentration, where I was actually one of just two women in my class. So after university, I started on the auditing and consulting side of security. I spent 13 incredible years at Ernst & Young, now EY, a place where I learned what exceptional quality, teamwork, and people leadership looked like. Ultimately, motherhood caused me to rethink the consulting lifestyle, so I jumped at the opportunity to join Workday in 2015, because I knew I would continue to be challenged as the company rapidly grew. And nine years later, I am just so grateful to be in a leadership role, serving a global cybersecurity team, doing critical work to protect our customers' most sensitive data.

Ann Johnson: That's fantastic. I love the fact that you had a passion about information systems and that ultimately brought you into working into the cybersecurity field. Let's unpack, though, a little bit about the industry, and particularly about diversity in the industry. The state of diversity in cyber varies, I know, from region to region, but we know that cyber has long been a male-dominated industry at every level. And while there has been steady progress in the past several years, I recently read a study that stated women fill just 21% of cybersecurity leadership roles and only 17% of board member positions in cyber. So as you think about your position at Workday and the overall industry and the talent within your team, how are you thinking about this challenge and how does it inform some of your priorities?

Robyn Frye: Ann, I couldn't agree more. You know, gender inequity, especially in cybersecurity roles, is a real problem. I believe the challenge needs to be addressed on multiple fronts. First at that organizational level, where the investments and the expectations are set. And also at that line leader level, where tactical progress can be made. You know, what I think this might look like is forging organizational commitments to women in cybersecurity initiatives and then investing consistently in this area. For instance, Workday, here at Workday, we're sponsoring WICS, which is Women in Cybersecurity. Which not only means we just send women and leaders to an annual conference, but we foster engagement throughout the year, with an additional investment in upscaling and leadership visibility for this community. But beyond that organizational investment, I really feel that at the team leadership level, it is important for me to be constantly thinking about creative solutions for resourcing. You know, when we have a unique or an unplanned need on a project, is that the right opportunity to get creative and maybe think about someone to step up into a stretch role? This change, I fundamentally believe, can happen one experience at a time if we're able to slow down to think creatively about who we can lift up, especially women and underrepresented minorities and, frankly, commit to making them successful in these stretch roles.

Ann Johnson: Yeah, I think one of the things that we're actually pretty good at, by the way, is I actually think we're pretty good about bringing women and underrepresented minorities into the industry, but we don't necessarily engage them and keep them in the industry. You know, I like to say we go where we're invited, we stay where we are welcome. And I think one of the things -- and you said it -- is how we not just lift people up but how we create an environment where they can be successful. And then they'll want to stay because the morale is really high, correct?

Robyn Frye: 100%, 100%. And we each need to own that responsibility to amplify these voices and to make sure that, you know, the people that we invite into the room are welcomed and are continued to be supported and that their voices and their unique ideas are shared and heard.

Ann Johnson: Exactly. So I'm a big believer also that welcoming the room, you get these diverse perspectives, and diverse perspectives enhance problem-solving, they enhance creativity, they enhance resilience in your organization. In your perspective, what are the blind spots that diverse teams can address more effectively?

Robyn Frye: The biggest blind spot that I've seen, and honestly, I am constantly concerned about as a leader, is whether the necessary levels of trust, connection, and empathy are in place to ensure that diverse perspectives can really be shared, can be genuinely heard and honestly considered. If people do not feel safe to be vulnerable and share their ideas without fear of judgment, then it is significantly less likely that those diverse perspectives will even be surfaced. I think that this all starts with the leaders on the team. Without continually exhibiting genuine vulnerability and authentic empathy, there is no bedrock to build deep trust and connection across a team, which is really critical for fostering that innovation, creativity, and resilience that you're talking about, Ann. Side note, can you tell that I've been reading a ton of Brené Brown recently?

Ann Johnson: Yes, and we're doing a lot of Brené Brown there to lead internally in my group at Microsoft. And I think it's really good, especially, you know, being clear is kind and all of the different things we talk about.

Robyn Frye: Absolutely. I am such a big fan.

Ann Johnson: So, you know, following that theme, right, about representation, and the fact that the representation actually leads to these broader talent challenges we have in the industry -- one of which is just building a pipeline and getting folks into the industry -- we know that fewer women and underrepresented groups actually even pursue careers in STEM topics. As a matter of fact, we also know that women tend to leave STEM education much earlier. What can we do as business leaders to attract and recruit folks into the pipeline? What strategies have you used or have you seen that are effective throughout your career?

Robyn Frye: Yeah, you know, I really think that to truly change representation, business leaders must be willing to disrupt the traditional modes of attracting and recruiting talent. I've seen success first-hand through programs like Europe veterans placement and returnship programs. Workday has a long-term partnership with Europe and our dedicated recruiting programs for veterans and for people who have temporarily stepped out of the workforce have yielded exceptional talent results. But these results don't come overnight or through a short-term commitment. Organizational leadership must be committed for the long term to foster and nurture these programs with the long game in mind. And I also think that the work goes beyond the attracting and recruiting side. And once you land that talent, how are you supporting that development, the retention, the sense of belonging for those underrepresented groups? You know, I really feel that it's a multidisciplinary approach for holistic success.

Ann Johnson: I absolutely agree. And I think that we all -- it's daily work. People ask me, you know, how are you successful in diversity and inclusion and bringing folks into the industry? I said, it's daily work, right, it's daily work reaching out and making connections, getting to know people, and helping people with their career and manage their career and guiding them along.

Robyn Frye: It is the daily work of all of us, right? It's not just the recruiting team or the human resources team, it is every one of us. Whether you're a hiring manager or you're a peer on a team, all of us need to work together for that success.

Ann Johnson: Completely agree. Another challenge I hear a lot from folks is how do they land that first cyber job? Companies and hiring managers often have this long list of professional acronyms or certificates or areas of experience for certain roles. What is your perspective on this issue? How should leaders be thinking about recruiting and supporting folks who are trying to make that pivot into cybersecurity?

Robyn Frye: As leaders and again as hiring managers, we must be willing to adjust our ways of evaluating talent, and frankly, I'll say, be humble enough to evaluate our own unconscious bias. And this means challenging the basic requirements of university level degrees, or challenging our assumptions about lapses in candidate employee history. I personally would much rather invest in a super highly motivated individual that exhibits determination, willingness to be coached, over someone that merely checks the stereotypical experience boxes. You know, over the last few years, my team has had great success with hiring internal candidates that have transferred from functions such as our Workday support functions over into our cybersecurity domain. And, you know, while those individuals might not have all of the depth of cybersecurity knowledge that we would traditionally look for in hiring a candidate, what they bring to the role is a great foundation to build upon. And, you know, this has added even more incremental benefits, you know, because it fuels those diverse perspectives into the team, right, a different way of looking at or solving the problem, which then in turn, you know, fuels further innovation across the team.

Ann Johnson: I think that's right, in that innovation across the team is something that we talk about a lot but we don't necessarily talk about how we skill people to drive innovation or to even drive cyber skills. And skilling is a big topic in the industry right now. Because there's this huge change of pace, right, rapid adoption of things like generative AI. And when we think about innovation, generative AI is certainly one of the first things that come to mind. But how do we actually skill people? How do we get people into a rhythm where we're skilling them on the innovative new technologies, but we're also driving them to think about innovation?

Robyn Frye: You know, one innovative approach to skills development which has been pretty successful at Workday is to deploy an easy to access method for what we're calling gig experiences. We've created this marketplace to match time-bound part-time needs with workmates who have the capacity and have the desire to expand their skills. The reality is, you know, workers today don't have the capacity to step out of their role for a week or weeks at a time to learn a new skill, but could often find a way to fit in maybe two, four, six hours per week for a few months. So, for instance, I currently have an early talent security risk professional on my team. And he is participating in a gig in the management team in our cybersecurity organization. And, you know, this is a win on all fronts, from an upskilling perspective, from a capacity management perspective, and also frankly from an employee satisfaction and retention perspective. This person doesn't need to leave Workday or look for a new full-time job in order to gain new skills. You know, beyond that idea of gig experiences, you know, we've also been investing across our global cybersecurity team for multiple years now in a more formal role rotation program, where we have employees transition the first six months into a different cybersecurity function. And so by immersing these employees in new roles for just even six months, we see not only that upskilling but we're also finding it fosters deeper cross-functional understanding, but also connectivity. So that in the longer term across our cybersecurity organization, we're breaking down silos and we're ultimately allowing the whole organization to execute with more speed and more agility.

Ann Johnson: I love that concept of gig engagements. We do what we call a rotation program within my broader organization. It's funny, Robyn. We find that people are reticent to sign up for it because it takes them away from their day job that they're actually measured on. And they're concerned that if they dedicate cycles to another job, that'll somehow negatively impact, you know, maybe their annual rewards or their annual promotion path. But we try to encourage people and tell them, in order for you, A, it's not going to take away from your annual rewards measurement; and in order for you to be considered for a promotion, you do need all these different experiences. But longer term, it's going to help you in your career because it's going to give you all types of skills. So I love the fact that you advocate for that and encourage it.

Robyn Frye: Well, I couldn't agree with you more. It is looking at the long term, right? Six months in the grand scheme of things, if you're getting a different skill set that's only building your resume, frankly, it's giving you the confidence to say, I can actually try something different, I can actually learn something new, I can push myself in a different way. And besides that fear from the candidate side, what I've also been seeing is fear on the what I would call the host or the home manager, right, the person that's having to give the individual up, or the person that maybe is receiving someone. There's a lot of fear on, am I still going to be able to get all my work done? Am I still going to be able to hold up all our accountabilities? And I think that is a fair initial concern, but what we've seen over multiple years -- I'm curious if you've seen the same -- is it actually is more of a myth, a myth that we have to bust. Because honestly with infusing these people into new teams and really ensuring equity around how people are rotated, it is not impacting our ability to deliver.

Ann Johnson: That's a great way to think about it. So I said this earlier, but I like to say, people go where they're invited, they stay where they are welcomed. And I should credit that phrase actually to Microsoft's long-time chief security officer Bret Arsenault, is where I first heard it, by the way. That is a topic that, you know, is really top of mind for me when it comes to inclusion. And we've talked a little bit about inclusivity, but I'd like to go deeper and just, you know, what practical advice would you give to our listeners on how they can create a more inclusive environment in their organization?

Robyn Frye: Regardless of level, we each need to own responsibility to amplify underrepresented voices and perspectives. You know, this is something that each of us, regardless of level or role, must commit to. And I'll be honest, Ann, I think I actually have to credit you with this. I swear I heard you talk about this at our International Women's Day conversation, so I'm going to give you the credit, you know. And so just to build on that a little bit more, but I'd love to hear your perspective as well, you know, tactically this could look like asking for someone's perspective who's been really quiet in a meeting, or asking follow-up questions for a unique idea that's shared, or maybe even taking that space to ensure that the right people get credit for their ideas. You know, all too often we rely on the meeting organizer or the highest ranking person in the room to take on this responsibility, but it doesn't have to be that way. And it's equally if not more powerful when it comes from a peer. I also believe that displays of this courage spark others to have the confidence and the courage to do the same in other situations, which then triggers a broader change across the team and over time.

Ann Johnson: Exactly. I think that's really a good way as we continue thinking about it that you can't just lean on the most senior person in the room, it's everyone's responsibility every day. Well, let's talk before we end about mentorship and sponsorship. Both are incredibly important to career growth and retention. But from women I've spoke with in the industry, some say it's really hard to find good mentors and sponsors. And there's an old expression that women are over-mentored and under-sponsored. So what advice do you give to women looking for both mentors and sponsors, and what would you say, what would you tell them to look for, and how do they approach it?

Robyn Frye: Specifically on mentorship, I continue to see that women are wanting the relationship but they don't truly know what they're looking for or what they need to ask for in that relationship. So my first question when someone brings up mentorship always is, what are you looking to accomplish in this relationship? You know, if that's not super clear, then I often ask people to go back and do a little bit more soul-searching on what they're feeling they need in this moment at this point in their career. You know, just looking for general career inspiration honestly is not a valid reason to ask someone for a mentoring relationship. You can easily get that in spades through TED Talks or books or conferences, or as you know for me, reading everything Brene Brown has to issue. You know, but know what you want to accomplish in that mentoring relationship and think about it truly like a project, you know, that has a start and an end day, it has preparation, it has meetings with structure. Everybody's time is super precious, so if someone's willing to take the time to invest in mentoring you, you've got to collectively design what that definition of done is, invest the time like you would any other accountability that you have in your career. But, Ann, I would say beyond that mentorship side, in general, I get way less questions about sponsorship. And I think that's because it still feels really taboo for many women and frankly, Ann, you know, for just people in general to talk about sponsorship. It feels awkward. And if I'm very transparent and vulnerable with you, I'd put myself in that bucket too. Are you seeing the same?

Ann Johnson: I am. It's hard, right, it's hard to actually ask someone, hey, are you willing to sponsor me for this job or this opportunity or whatever it is. And I do think that women because of just some things that are inherent to our society, it's harder for women, right, to make that explicit ask for themselves. And they have to get more comfortable with it. Because at the end of the day, you need the people in the room when you're not in the room talking about you and saying, hey, Robyn would be great for this role, let's talk to Robyn about it. And then the other thing is if you're interviewing for a job, reaching out to your network and saying, would you be willing to sponsor me for this job, it's just something people need to get more comfortable doing. And by the way, people could always tell you no, or they could tell you they're not comfortable or whatever it is. Then you want to get that feedback, right, you want to understand why and what it is you need to improve on. Even if you get told no, it's a valuable thing for you, because it will give you insight into where you need to work on your skills potentially.

Robyn Frye: But if you don't try, you'll never know.

Ann Johnson: Correct. So we are going to wrap, but I have a couple of fun questions that I want to ask first. What is the best piece of career advice you've ever received?

Robyn Frye: You know, one of the best pieces of advice I received probably in the first decade of my career was from an EY partner I worked for. His name's Chuck. We were going into a really important client meeting where the room had at a big center table with chairs around it, and then kind of outside of that first round of chairs, it was a second line of chairs or second row or back row. And, you know, as we entered that room, I naturally gravitated towards that second line or back row, despite there being ample space for me at the table. So in that moment as everyone was kind of getting prepared to start the meeting, Chuck quietly came over to me and he said, "Don't give up your seat at the table." And I've taken that concept with me as I've progressed in my career. When I feel unworthy or I'm lacking confidence in a professional setting, I'm pushing myself now. I push myself to take the seat at the table and work through my fears, my uncertainties and my doubt. So while I don't think Chuck really meant that to be maybe a monument piece of career advice, maybe it actually was just very tactical in directing me to take literally a seat at the front row, it has served me in countless ways throughout my career.

Ann Johnson: You know, I think that's fabulous advice. And I also think that some of the best advice we get may be unintentional, someone saying something to us in the moment. I have a few of those that I've carried with me throughout my career. I think one of the best that I've received is someone said to me, "You don't understand the impact of what you say." And it took me a while to even understand what that meant, by the way. And once I understood what it meant, I became much more cautious and careful in the actual words that I use. Because I can be really blunt and really direct. And unfortunately, what I didn't realize at least that point in my career is you can't always be super blunt and direct with somebody that's maybe incredibly new in career, and you're saying things from a level of -- that's perceived as a level of power, right, and you're being too direct. It doesn't land well. It was a long time before I understood it. And someone said it to me in a specific moment, but it's something I've carried with me and I try to be really careful about. So those are great things. What advice do you have for aspiring cyber leaders out there?

Robyn Frye: I would encourage people to be dot connectors. You know, cyber security is so broad, and there are tons of aspects to what a comprehensive cybersecurity program entails. So while you might focus in one specific aspect of a cybersecurity program, what I think makes you especially valuable is your understanding of who is doing what across the whole security landscape in your organization. Solving a security problem for a business stakeholder isn't usually one-dimensional. And if you can connect the dots quickly and efficiently, we can mitigate risks more efficiently and enable the business to move at speed and achieve their goals. And I think being a dot connector is frankly a superpower that you can grow and grow and grow as you increase your leadership capabilities and opportunities within that organization.

Ann Johnson: That's fabulous. And it is important to understand how broad cyber is, right, and to put that in perspective every day when you go to work. Robyn, thank you again for taking the time. For our listeners, Robyn's actually joining us on her weekend, so I really appreciate you taking the time to join us today.

Robyn Frye: Ann, it has been an absolute pleasure to speak with you today.

Ann Johnson: And many thanks to the audience for listening. Join us next time on Afternoon Cyber Tea. [ Music ] So I invited Robyn Frye on the podcast because I met her -- I did an event with her at Workday, and she is such a dynamic leader in cybersecurity who has this incredibly pragmatic and amazing point of view about how we think about the industry, how we bring talent to the industry, and how we develop talent. This was a great episode, and I know the audience will get a lot of valuable content from it. [ Music ]