Protecting Critical Infrastructure in Engineering - Ep 117

Speaker A: Do your AEC leaders have the people and project management skills to truly lead at AH emi? Our leadership training and AEC Project management certification combine real world tools on um demand lessons and live PDH webinars so your team actually applies what they learn from confident communication to stronger delegation. Our programs are built for AEC professionals. Visit aecpm.com or call 800-920-4007 to learn more. That's aecpm.com or call us at 800-920-4007 because strong leaders build successful organizations

Speaker B: did you know the average engineering firm experiences a cybersecurity incident attempt every 39 seconds? Behind that number is a question the industry is just starting to grapple with. Why has protecting critical infrastructure become just as much an engineering challenge as a technical one? Today we're going to dig into this and what it means for the firms that are building tomorrow's infrastructure. Joining us today is Nick Engulfson, Chief Information and Corporate Services Officer at Ulteg where he leads the technology functions driving both protection and the transformation of the business. More than 20 years spent at the intersection of technology and engineering leadership. Nick has built a reputation for turning innovation into real lasting impact for clients and teams alike. In this episode, we'll dig into why cybersecurity is can no longer be treated as someone else's job, what it takes to build a technology roadmap that holds up under pressure, and how leaders can build organizations ready for what's next instead of scrambling to catch up. If you're an engineering or firm leader trying to figure out where technology fits into your future and how to protect what you've already built when you get there. This conversation is for you. Before we jump in, I want to tell you about AECPM Connect, a series of in person events we've created at AMI M for AEC project managers and the leaders who develop them. You want to stay on top of PM Trends, elevate your team and deliver stronger project results. These full day events are built for you. I'm coming to Kansas City this October. Learn more and register@aecpmconnect.com and I hope to see you there. It's now time for our conversation of the week with Nick Engulfs Land. Nick, thank you so much for taking the time to join the show today. Welcome.

Speaker C: Thank you. Glad to be here.

Speaker B: Yeah, and I know we just had a, had uh, a really nice chat. I think your background spans a couple of different areas. It's very interesting. I know you've been with Altag, uh, your company for, for quite some time here. So let's just jump in. So Nick, how did you find your way into engineering and technology and then what led you to where you are today as Chief Information and Corporate Services Officer at Altec?

Speaker C: Sure, that's uh, a fun question. So child of the, child of the 90s. So grew up with, uh, with, with tech and kind of. I um, think I was trying to, through curiosity and kind of troubleshooting, I was trying to take it apart before I knew how to work it. And uh, that pretty quickly led me into a, into a career in software engineering. So the, the basic idea that you could kind of create something and get near instantaneous response through development and then solve problems that people actually care about, um, just fascinated me and drew me into it. So my early career was almost exclusively doing integrations between systems. So software engineering to do integrations between systems, mostly in the ERP space. I joined um, the engineering firm, so Altag here. It's been about 18 years, a little over 18 years ago. And uh, what drew me, I would say I was less drawn to engineering and more drawn to professional services broadly. I wanted to be at a company that cared deeply about people. And uh, you know, I come from, come from large publicly traded traded firm that, you know, they had a view about stakeholder stakeholders and what mattered. And um, I was really attracted to what I saw from folks that I knew who worked in this space and actually folks I knew that worked at Altag and that care for people and their careers and getting to do things for folks that cared about employees, cared about their customers, really resonated for me. And then of course, once you get under the covers and you get to work with a bunch of great engineers who it turns out are also naturally curious folks that like to solve problems, it's really, really a great space to spend, spend your time in. Everybody wants to solve all the problems every day. It's fun.

Speaker B: Yeah, engineer, I mean, you know, you've, you know, have, you know, haven't seen the sitting in the seat that you've sat in. Engineering, great industry, um, sounds like your people are really, you know, a testament to that. But, um, like as the engineering space becomes more digital, how do you guys rethink your responsibility for protecting critical infrastructure across your different service lines?

Speaker C: Yeah, so maybe I would start by saying that the infrastructure space is having their moment and kind of their realization what some other spaces have had a while ago, which is to say that in digital, whether you're talking about automation or Applications or SCADA systems. It can't be an afterthought. It needs to be part of the upfront design and procurement of the process. And if it's not, you end up in this really reactive space where you're exposing things to risk or risk additional cost and maybe support or commissioning issues when your infrastructure ultimately goes into service increasingly. And I think it's happening in different parts of the infrastructure, space, engineering space, at different times in different ways right now. But it seems to me that most infrastructure will have the opportunity to be better for the end customer, the population that uses it through digital systems in some way. Whether it's a power plant that's got smart aspects and sensors, et cetera, or it's uh, smart devices and roads and bridges to help make them safer. There are digital components and uh, for a while it was kind of an afterthought. And I think folks are realizing that it needs to be part of the upfront stream when the thing is designed to actually think about, you know, what, uh, who are all the players in the process, what are the cybersecurity implications and even some of the kind of, the less cyber, the less digital implications about supply chain as well. Who's responsible for this piece? Who can support it long term? Is this entity going to be enduring? What are my alternatives? Your traditional supply chain management kind of things that you need to think about. And um, you know, infrastructure's got a lot of smart parts in it now and it's just going to continue. And that supply chain risk has got to kind of be part of the upfront design.

Speaker B: And speaking of risk and cybersecurity, you, you'll often hear that as like a, hey, that's like an IT issue, not my department. Why do you see it as a business and engineering issue? Like why is it so important?

Speaker C: Well, uh, I think folks, folks by nature, and this is a good thing and good thing generally, and it reflects on how people like to lead. And folks like to put things in a box. You can put that box up on a shelf and you know, when it comes to tech issues and especially cyber, I think there's uh, a lot folks want to try to understand before they can dig in and if they can compartmentalize it and set it on a box and say, oh, so and so's got that, or, or we can handle that later, or that's being handled by a consultant or a contractor or partner. It's nice, it feels good to put it in a box and uh, set it aside. But the reality is Most cyber issues are not actually technical. I've been leading cyber in some ways for the last 15 or so years and my take is that maybe if you're lucky, 40% of that cyber stack gets to be technical stuff you can actually solve with systems and process processes and kind of what you see on tv. Most, most of it is management systems. It's process, it's governance, it's training. It's like the human, the human factors, the human performance factors behind it. And if you don't integrate that stuff into your business strategy, into your human capital strategy, into your day to day work, uh, it just doesn't work because either your cyber folks don't understand what your people are actually doing. They think they do but they don't because they're not hawking or your folks don't understand the cyber risks. So they go about their job every day and they don't realize they're taking on risk, risk to the company. You don't integrate those two things and really think about it as a human challenge or people, a ah, people thing. You leave a lot of risk out there, a lot of risk on the table.

Speaker A: Strong project outcomes need skilled managers and competent leaders. EMI's corporate training delivers expert led courses in project management and people leadership plus industry recognized certification and exclusive premium content. To take your team even further, elevate your team's leadership capabilities today. Visit engineeringmanagementinstitute.org and click on corporate training.

Speaker B: Yeah, and as we know people are not uh, let's say they're not deterministic systems. Right? So there's always, yeah there's, there's always going to be variability and that's, that's the fun part of dealing with people. Everybody's a little bit different and every situation's a little bit different. So, so not to say that even the technical portions of cybersecurity are that

Speaker C: way but you know they are to a certain extent. You know the technical aspects are m more deterministic. We, I think it folks in general have a reputation, you know, like for being pretty heads down and kind of focused on the tech. It's, it's easier to solve when we know how it's going to behave. You don't always know how a human's going to behave when you pick them up, pick up the phone in here, you call them and it's like hey, why'd you do that? You don't know what you're going to get. Folks don't like to do that. But that's really where the Magic happens. That's how you, how you actually have an impact on, on risk is when you engage with it with the other humans.

Speaker B: And I think part of that is like, you know, it's part of an overall strategy. So if we zoom out, like next day you're, you're sitting down to build a technology roadmap which is going to include, right, some of the qualitative pieces and some of the quantitative pieces. But when you, when you zoom out and look at that roadmap like what are the, your top three priorities that you're going to weigh against everything el you have to deal with?

Speaker C: Yeah, it's interesting. So right now in today's landscape, maybe I should caveat that. And I actually think it's really important that a business has a digital strategy and a technical strategy and uh, a tech strategy. And there's separate things. Your digital strategy really needs to be focused on how you're going to change the business, what you're delivering for your customers and how you're going to compete. Tech strategy is a little bit of difference face. And interestingly right now I would, I would say two thirds of those three points. So two of them are really in the governance space. So I think that one of them, you need to have a handle on what I would call SaaS and AI governance. The pace that new applications are kind of infiltrating, both in terms of the value they can provide. So you can't ignore them, you can't just put your blinders on and say nothing new, can't ignore them. But you can't just let it be a free for all. And uh, it is harder today to govern AI applications, AI use and just plain old SaaS application usage than it has ever been. So I would, I would put that at the top of my list. Second one on my list would be data strategy. If data is the new new oil, as some folks like to say, need to understand where your data is, where the value is and, and what the potential long term is to monetize it. What the roadmap is to make sure that you're setting the company up to do that long term to get the value from whatever data it is you, you have or you think you have. And then finally, and this is an interesting one, when I was thinking about this question, Nick, my third pillar right now would actually be human capital and the reason why, and this is kind of an interesting time in tech, I think that if you view what's going on with AI, there's probably some bubble aspects of it under the covers and a little bit going on. But there is a rethink of how humans work going on right now that maybe is akin to an industrial revolution. And I think as tech leaders, as business leaders right now, uh, we have an obligation to all of our people to make sure that we are making the investments in them to bring everybody along. So some folks might be scared, hey, this AI tool is going to take part of my job or I'm going to get this placed. I think the real question is how do we bring everybody along together so they know how to think about and know how to engage, gauge with and use these different, different tools at a time when work is changing maybe more rapidly than it ever, ever has been. And we, we don't want to leave anybody behind. So I think the, the human capital intersection, intersection with tech and AI right now would be my, my third, third

Speaker B: pillar which is ah, right. If you've, if you only paid attention to mainstream news media you would think if we, I thought all of our jobs were going to be taken away and replaced by this all powerful technology, but we both know that's not true.

Speaker C: It's a very kind of interesting space right now kind of um, the threading initially it was this world of possibility

Speaker B: when

Speaker C: your chat based LLNs started coming out and then this revelation with uh, with agents, agents as you know they've been able to progress into doing, doing actual work in some cases. I think right now the, the threading is this idea around the human as the orchestrator or the orchestrator of the orchestrator. And almost, you know we're, we're the manager of the, of the agents of the tools that are, that are doing some of the, some of this work that used to be done by people. The, I think the challenge is that the, somewhere along the line there does need to be a human in the loop for most of these things. They need to understand the tech, at least understand it enough to know how it's working or kind of what's under the, what's under the covers. And then also uh, not all humans are kind of natively built or trained to be able to manage and orchestrate large swaths of things. So I think there's some reskilling and some rethinking there. And I, you know I'm, I'm an optimist and I tend to have a growth mindset about things. So I don't, I don't know that I, I see the, the doomsday, all the jobs are getting taken by tech kind of angle. But I do see a need. Like, I do think there's real risk if we, uh, don't help people feel comfortable and feel good about what's changing that. That folks could get left behind. And I think that's a leadership imperial right now.

Speaker B: Absolutely. And uh, as you know. Right. Different people have different levels of that ability to like, manage or orchestrate. And also at the same time, how do they deal with and interact with technology? Like, I know people who. Right. Just turning on the computer can be a little bit challenging. And then others, it's just you give them the tools and equip them and they're off to the races.

Speaker C: Yep. And you can have issues in both ends of those spectrums. Right.

Speaker B: Yeah. Well, because if somebody can't turn on a computer, there's only so much damage they can do in the digital world at least. But, uh, you give somebody the keys to the castle without the proper guardrails. Oops.

Speaker C: It's uh, amazing what some folks can accomplish. Like the ultra curious when there aren't any fences. You know. Hey. And I vibe coded this and it does this, this and this. It's like, that's wonderful. And let's talk about how we can govern that.

Speaker B: Yes. And, uh, some. And sometimes.

Speaker A: Right.

Speaker B: The best thing is like, uh, hey, we're just going to give you a machine. It's isolated from the network and you can blow it up. It's cool. Just don't do that when, uh, it is connected. So, Nick, what's uh, one piece of advice you'd leave with utility and engineering leaders that are kind of being, I don't want to say dragged in. Right. But we all kind of are like, this future is coming, um, whether we want it to or not. And like you said earlier, there's a lot of change. Yeah.

Speaker C: I would. I was thinking about this one, Nick, and to me, the piece of advice is the same. And, and the iron. The interesting thing here is I've seen folks lose sight of this thinking it. It's still all about the customer, you know, so we're, you know, whether you're in the engineering space or you're. You're, you know, or you're running a utility. It's not about. It's still not about the tech. And we occasionally get blinded by the shiny penny. And we think it's about the tech, but it really is about the customer. And if you can't. If you can't look at the. Look at real problems that your customers have and ways to create real value for your customers and kind of map that through end to end with the tech size, the prize and what's in it for. What's in it for your customer. Um, you're probably looking at it a little, a little wrong. And uh, I think that's been right now kind of with the fervor fever pitch with AI right now. I can't count how many times I've heard peers who are doing what I do at other engineering firms who have this imperative from their leader. It's like, oh, uh, go tell us what we're doing with AI. It's like, maybe let's think about AI as the tool or think about digitization as the tool. And then let's look at what the real problems are that we can solve solve and figure out how they can create value for the customer. And the irony like, like where I started here Nick, is I think that's always been the, the way to look at it. We just occasionally get sidelined by the shiny pity of a, of the, the next thing or new tech. Especially when tech gets consumerized and you know, the, that thing shows up in your, in your phone and everybody, everybody knows, knows about it and they're kind of aware of the potential for business value. Still gotta go back and figure out how it, how you can create value for your customer as a thing.

Speaker B: Yeah. And I think the, sometimes the first, especially like you get to a certain point in your career or a certain position in the company where maybe you're not as connected to the customer as much as you'd like, facing their day to day problems. And it does become easy to get sidetracked, distracted by the shiny object. So I'm in agreement. Right. Because uh, without customers, well, none of this is possible.

Speaker C: Dan. That's right, Nick.

Speaker B: This has been an awesome discussion and like I said earlier, it's also great when we can get more Nicks on the show. I love that. So the final question I have for you today is if you're a firm looking to adopt AI, any new technology, be innovative, what are you telling them to focus on from a leadership and team development standpoint, to make the transition from where they are today to where they want to be successful people.

Speaker C: So in a word, focus, focus on people. And it goes back to some of what I, some of what I said before, which is really just, I, I really do see it as a, is kind of the leadership imperative of the day to bring people along and not leave folks behind, leave folks, you know, out in the cold for tomorrow's work workforce so to speak. My, my colleague, which you previously interviewed, Brian, Brian Gass, has a thing he likes to, he likes to say. And I'm going to butcher his analogy a little. It's really good. So, you know, Brian would, would say that, you know, traditional techno technologists have a habit of maybe they'll hand you a bike and say, go do something with it. And in this case the bike is akin to a tool. Like I hand you a piece of software and say, I'll go figure it out, go use it. Um, and with, with AI and digitization in particular, folks don't necessarily know what to do with the thing. So Brian's saying is, it's not like, here's your bike. Brian's, Brian's saying is, let's go ride bikes together. Let's figure out that, figure this out together. Let's go on this journey, let's learn together. And I think that's really, really apt when we're thinking about, thinking about tech and digitization and AI right now. And when we're trying to bring people along, I think we need to give specific examples and kind of show them along, along the way. It's not about, here's the tool, go do something with, with the tool. It's like, hey, here's how I use the tool to help me do this, here's some training to help you. And let's sit down and talk about some of the ways that you use the tool to kind of bring them along, bring them along together. And whether that's, you know, using Copilot to help you draft a PowerPoint or work on meeting notes or, you know, there's examples in everybody's day to day life. But for, for a lot of, a lot of folks, it's not enough to give them the tool and the training. I think we've got to give them the use case and circle back and kind of, you know, ride the, ride the AI bike together. To use Brian's analogy, I love it.

Speaker B: And you know, and that's, that really is like the classic it answer, which is like, hey, we procured it, we've got it set up, we've got it secure. All right. Our line is like, ah, the use case is squarely on like the business, but we need leaders.

Speaker C: Here's your tool. We've checked our box. We have this project is a success. We give ourselves an A. And then where you're never going to hear from us again. That's kind of the traditional technologist way.

Speaker B: Yeah. And as you know. Right. Like where does all the business value come from? It's the use case. Yep. The use case and the people and sitting down and shouting them. So, you know, great response. I'm in complete agreement and I love it. But, uh, Nick, you know, again, thank you so much for taking the time to join us today. If the audience wants to connect with you, maybe ask you some more questions or chat, what's the best way for them to reach you?

Speaker C: I've reached out to me on LinkedIn.

Speaker B: Beautiful. Thank you so much for taking the time today. This was awesome.

Speaker C: Yep. Thank you.

Speaker B: It's wonderful to meet you. Yeah. Likewise. Till next time, Please remember, you can find the show notes for this episode@aectechpodcast.com there you'll find a summary of the key points discussed in today's episode, as well as links to any of the resources, websites or books mentioned during this episode. Until next time, I wish you the best in all your engineering and technology endeavors.

Speaker C: Sam.