Big Results from Small Security Teams

Jacob Combs episode === Kevin: Hey everyone, and welcome to another episode of Cybersecurity Business. Today we're tackling a topic that many cybersecurity leaders face how to optimize a small security team. Running a lean security team comes with its fair share of challenges, but it also presents unique opportunities when resources are tight. Adaptability, creativity.

In cross-functional skills can become an organization's biggest strength, but how do you ensure efficiency without burnout? And how can security leaders maximize impact with limited personnel? Well, to help us break it all down, we're joined by Jacob Combs, VP of Cyber Security, and CISO at Tandem Diabetes Care. Jacob brings a wealth of firsthand experience in leading and optimizing small security teams.

Proving that size doesn't always limit effectiveness. Jacob, welcome to the show. Jacob: Yeah, thank you for having me, Kevin. Kevin: Our pleasure.

So, I know we know each other from your 2023 participation in our FES of Strength magazine, and I know it was a great read to dive deep into sort of your world at the time. You know, it looks like you've. Sort of taken your career over to Tandem as their security leader and have really matured their program, brought that program to the next level and and have found yourself on the advisory board of another organization. So suffice to say you've been busy since we've last spoke.

Jacob: Yeah, that's right. We never sleep in security. Kevin: Well, the topic today is sort of optimizing that small security team. So maybe you can frame it a little bit Jacob by talking about.

Right, like what a small security team means to you, like how small, how many people, and, and just talk about that a little bit. Jacob: You know, that's a really good question and the way I think about it is not necessarily just about size. It's about the constraints you're under that's what really drives what I would call the size, or I make a team smaller. And it does include things like headcount, but it also could conclude your budget.

If you have a small budget, your team will be naturally small or even the specialized skills that you have on the team, right? You may not have the depth, you have the need across the board to deliver and defend the company the way that's necessary in today's age. And so I really look. At a small team as a group where everyone has to be versatile, they wear multiple hats, and they focus only on what really matters to the business.

I wouldn't say that it's necessarily anything that a small team can't do as much as a large team, right? It just really requires that clarity, focus, and ability to innovate. Kevin: Now, is this from experience, meaning if you look at your security leadership roles over the years, by and large, were you operating and optimizing smaller teams? Jacob: Yeah, I am constantly, and the, challenge I have in my industry, which is medical device, is that I not only have to secure enterprise, um, but I also have to secure our products.

And that's a pretty large effort as well. If you look at the manufacturing time of a network development time of the medical devices, five years at least, that's a lot of security attention that needs to be on that, through that whole development lifecycle and then onto the time when it's in the field. So I've naturally had much smaller teams 'cause of that. And we have to be creative.

We really have to think about how can we make this happen over the long term and do we have to do, and, and frankly, I've led larger teams. I'm always looking for ways to shrink the team so I can force that innovation and creativity into the group as well. Kevin: What, so is that typically to different teams when you have to tackle product security as well? Jacob: Uh, it, it's different teams in certain areas.

So I would say on the engineering front it's certainly different teams 'cause it's really different skill sets and a different focus with different groups in the organization. Um, at the operational stage when it's running and in the field, we then bring them back together under our operations group. So watch for monitoring, detection, and incident response. Kevin: So with some of these teams, some of these smaller security teams talk about how you can turn.

Sort of that size into an advantage rather than a limitation, sort of like the, a age old interview question. Well, our, our biggest a weakness is also our biggest strength. Jacob: Yeah. I look at from three perspectives.

So the, the first one, and this is what I miss when I have large teams, is agility. I wanna be able to make really quick decisions and have really quick communications without any bureaucratic delays or having to get approvals from multiple teams. That's a big one that is really an advantage. The second is what I was getting at before, is this ability to focus.

You have to have laser-like attention on the highest risk priorities. You can't boil the ocean, as it were across all of the different threats or risks. You have to prioritize them, them, and attack the ones. And the last thing I would say is the.

Constraint really drives innovative solutions like automation or strategic outsourcing or however you need to do to solve the problem. Having that constraint force that where having a large budget or a large team allows you to be a little, I wouldn't say lazy, but allows you have to think as critically. Kevin: I think that's a really good point, and I like your contrast to larger companies because it's true Red tape politics. Loss of accountability.

I mean something I call process paralysis sometimes when the team gets too big. So I can see what you're saying. Talk about some of the key roles and key skills that a small team should prioritize. Jacob: Yeah, this is a good question too, 'cause that's what I struggle with when I come onto new companies or do my advisory role.

I look what's the most important. In terms of skills, certainly the most important is making sure you have an incident response and detection capability that does that. No matter what kind of security protections you have in place, if you don't have a a detection incident response, they're always gonna find a gap in your defenses and you be able to protect the ability to respond quickly and mitigate the issue is key. And then this, the next skill I would say, in line there, depending on your industry, is likely either the engineering side or compliance, depending on what kind of regulations you're under, as.

A company from a, uh, roles perspective, it's hard to say precisely what roles, although they would revolve around those skills I just described. But when I look for people to come in to work in a smaller team, I look for what are called T-shaped professionals. People that have some depth in one area, but they have some breadth across all of security because they will have to wear many hats and take many roles and, you know, be agile when it comes to some new project or some new initiative coming up for the company.

So that's really how I frame. Kevin: And so some of those core areas, you mentioned incident response, you mentioned compliance. Are those core areas typically areas you handle in-house versus outsource? I, I'm assuming with a small team, there are components that you would look to outsource or use consultants to.

Jacob: When the small team, I mean, nowadays you have to have 24 by seven operations, right? Mm-hmm. To monitor at all times in holidays of the most attacks happen. So I typically outsource the SOC functionality, right.

At least the detection and monitoring piece. But when it comes to incident response, you can typically get a retainer to bring in a, a large professional company if you have a real incident. But you wanna make sure you have some handling of an internal to the company. 'cause you have to communicate with the business, you communicate with the executives, making sure you're following your policies and everything is donely.

And with working with legal mm-hmm. Make sure it's done correctly. So that is really. Where I draw the lock at least, is ensure that these integral pieces that could result in ri more risk to the company, if not handle correctly, are done internally.

And I, I do strategic outsourcing based on the skillset of the folks wherever, wherever I have gaps. Kevin: So, speaking of 24 7 and wearing multiple hats, the I, I could see the downside being. Stress, the downside being burnout. I mean, there's probably not a week that goes by that I don't hear from somebody in our industry about stress and about burnout.

I, that could be a podcast in and of itself. I assume that's something that as a leader, you must always be, be looking out for to make sure you don't burn your team out because there's so many opportunities for them to go elsewhere. Jacob: Yeah, absolutely. And.

And, and that with a small team, that's what I, I kind of getting at with the critical thinking requirement is that you absolutely have to focus or have to stay on what's the most important for the business. And you, you will be pulled away all the time. There's so many things that can happen. There's so many risks out there, so many vulnerabilities that pop up every day, but you have to focus on what's the most important, and that's what I, even in my larger teams.

I drive in that way. We, we take a risk approach to any kind of project, any kind of initiative, any kind of strategy we roll out is always how are we attacking the most risk to the business now? And it does require that backend. Analysis of deciding what is the most risk to our business, is this agreed upon by the rest of the company, by the executives, by the board, and then we take the initiative in that direction and that we have other things we have to take care of.

But putting those on the back burner until we can take care of these, that's the only way I found one, not only complete projects effectively and with high quality on time, but also keep my team from burning out. Kevin: In in, in that skillset you're talking about whether they come to you with that skillset or it's a learned skillset. If you take somebody perhaps who's a middle manager with a small security team, with that sort of motivated, accountable skillset, um, a lot of them want to be sitting in your shoes.

Their goal and their career trajectory would to become a security leader, to become a ciso. It seems to me that wearing multiple hats, having that skill at. A company with a smaller team, they're closer aligned to the business. They potentially might even have some visibility into leadership, into the board.

It, it seems like that skillset lends itself to an eventual path to become a CISO a bit more cleaner than being a cog in the wheel at a very larger organization. Is that true? Jacob: I would say yes it does, because you get to see the whole picture. It's that cog in the wheel you, you become, if you don't have the desire to learn and grow and change on your own, or even driving in these innovations like analysis, risk analysis and this kind of piece into your specific role, you will stagnate.

It doesn't, you know, security is one industry, especially that does not sit still. And so being able to have that wider picture and the agility to flex and move to different areas to learn and grow and see what should you take care of first to lower the risk the most. How do I now analyze this? How should I change that?

How is this other company analyzing it so I can learn from them and grow and do things in the same way? It's having these constraints again forces you to learn and grow, and that is what at least helped me drop myself into this leadership position Kevin: and certainly do more with less. So when, you know, you mentioned one of the qualities in a small team could be less budget. So when you work for an organization with Lets budget, when budget does become available, how do you prioritize that?

And is there sort of a formula on prioritizing that when looking at putting that money toward people, putting that money toward technology? Jacob: Yeah, I wouldn't say there's a formula. I think that comes more from management experience. Mm-hmm.

And if, if you did do a good job of analyzing your risk and understanding where your gaps are, and that is, you know, maybe aligning to a framework like NIST or depending on your industry, something else. But when you align to a framework that will actually help you see where these gaps are. Mm-hmm. And then as you exercise and you drive towards the risk down in your different areas, you start to see where your team is capable and where it's not.

And so that can help you decide, okay, maybe we can take some of that budget and outsource this work and automate it, or we can bring on some contractors to help us automate. Or maybe this area is where we're not gonna take budget. We're gonna actually say, Hey, engineering team, you take this budget and we want you to do these additional security tasks. As part of your work, that you still have that creativity and that flexibility, if you have that in your mind, to be able to put it where it makes the most sense for your particular business and the skill sets you have across the organization.

That's the way I look the least. Kevin: You just mentioned automation, so can we talk about that a little bit more and sort of the role that plays in helping the team stay efficient and even more so, um, I think about ai, well, everybody does, or gen AI and sort of. Like what impact does this have now? And if very little do I have to think this is gonna have a bigger impact in the future?

Jacob: I think it is and it's, you know, everyone in the world is pontificating on where AI is gonna take us. And it's hard to say exactly, but what, where I can see the most value immediately is in the analysis side. So we do a lot of threat modeling in my company and we do a lot of third party. Risk analysis on third parties and even fourth parties, and having the capability to take all that information, aggregate it all together, do the analysis, and point out where we may or may have weaknesses.

And then this is some, one of the things I'm seeing that's coming through new security tools is that they really drive this context. And I think having that context, um, put right in front of you, gives you the ability to make a decision much more quickly. That's what I'm looking for when I'm thinking about these different areas and how AI is going to help improve it, is I want AI to drive that context for me, like an example is we use a cloud configuration management tool that helps us un analyze where we have the highest risk.

There's a vulnerability in the system. Give me the context to show me if this is risky or not. Basically, is it accessible by the internet? And it can tell you immediately, here's the top five that you need to take care of right away.

And so being able to drive use AI to drive context, not just in cloud, but in third party risk management and threat modeling or risk assessment of your products or however you wanna look at it, driving that context is where I think the most value will come immediately. Kevin: Are there other innovations or trends that we haven't spoke about that looking out over the next five years a small team should prepare for? Jacob: The, the thing I'm looking at, one is you have to be able to figure out a way to get towards a zero trust model.

I know it's been used as a marketing term and kind of, I would say slandered a bit by a lot of the companies out there, but you want to get to a place where you have that zero trust model in place across your company where you're only giving just in time access and only really need, and you're closely monitoring and managing all your assets and data across the whole company. That that is really, I think what we all should be. Putting as our north in terms of how we manage our enterprise assets.

The, the second thing I'll say is that, and, and this is also a trope that's used often, but really thinking about security by design. So how do you integrate security into the business processes? How do you integrate it into IT processes? How do you integrate it into your product development?

However it is, you start putting the onus on the other teams and sharing that responsibility across all of them. So security is built into everything you do. Even when you look at going into a new market or finding a new set of customers, you're thinking about security and you have that as one of the thoughts or one of, at least the threads that are there as you drive in that direction. And to me, that is.

It's a little bit theoretical, but that I think is what is draw a lot of the improvements, especially from a small team's perspective, to be able to have that scalability. Kevin: Yeah, love that. So if you take a step back for a moment, what general advice would you give to somebody who's either building or let's say they're doing exactly what you've probably done multiple times? You've inherited a small team and your goal is to optimize that small team and increase the maturity of an organization's security posture.

Jacob: Yeah, I've done this a couple times now. So the, the, the first thing, which is the most important is you need to hire smart. And what I, I, I learned this from a leader I worked with many years ago, but he said, all you wanna do is hire smart and nice people, people that you can easily work with and people that can think critically and, and be innovative. Um, and so really again, that T-shaped person, right, who has that depth in one area particularly, but also can work across the board.

Then the the other side, I would say there's probably two more pieces I would do. One is leveraging technology. There is, like you said, AI is coming in and providing a lot of capability, but there's a lot of capability out there already that you can really leverage to automate or outsource particularly. And then the last thing I would say is really embedding security into the business.

So making sure that you are ensuring that the partners you work with, the different departments you have to deal with, they also. Take on some of the responsibility of security and you have a way to manage and monitor that. So things like security champions or building out, putting particular security focused people into different, um, organizations or building and process what it looks like. But those three things are the best way to manage the scale and the breadth, frankly, of, um, security in the modern world.

Kevin: I like that you threw in the adjective of nice people because it is true. You're working with these people day in and day out, and I. People leave out that adjective when they talk about qualities of hiring people. And I completely agree, right?

I've been doing this too long to wanna work with people who aren't nice. I love that you threw that in there. Jacob: It's really important. And, and it's actually funny, we do this, um, survey where we, it's kind of like a Gallup survey in my company.

We look across how everyone's personality kind of fits in to the bigger company. A lot of the security people actually had these relationship skills, which were the most, and I kind of realized that that's one of the most important things as a security professional these days, especially in a small team, is that if you don't have the relationships with the different groups that you need to either audits or you know, hold accountable, then you're not gonna be able to be effective.

And so having those, those nicest skills are very important to being able to drive as a small team. Kevin: I like that. I think I might steal that from you too. Sure, Jacob: go for it.

Kevin: Um, well, we've covered a lot so far today, but before we close things out, we've got a few rapid fire questions that I'm gonna send your away, and some of them are cybersecurity adjacent and others are just, uh, just a couple quick questions to get to know who Jacob really is. Are you ready? Jacob: Yeah, let's do it. Kevin: Okay.

So if your CEO gave you unlimited budget for one thing, what would you spend it on? Jacob: I would, like I said earlier, zero Trust. I would, how would we get to Zero? Trust.

Okay. Okay. Zero, trust. Second.

What was the last book you've read? Uh, what was it called? I can't recall the name of it at the top of my head sitting here. Was it a, was it a business book or a It was a communications Kevin: book.

Communications book, okay. Yeah. Um, third, if you could instantly master any new skill, it could be professionally or it just could be personally, what would it be? Jacob: It would probably be like as communications, like more speaking and interpersonal communications.

Kevin: I mean, I think you're a great communicator Jacob: as it is, so I think I need Kevin: to work and become a master. Um, if you weren't working in cybersecurity, what would you be doing? Jacob: I would probably be an entrepreneur of some kind in technology. Okay.

So you, you, you'd still stick adjacent to our business? Yeah. I, I like technology more than me. I find myself drifting towards it all the time.

Kevin: Okay. So what's one piece of advice you wish you had when you first started your career? Young Jacob? Jacob: It's, it's really the, the bit about maturity is that no one's really paying attention to you and Yep, everyone's kind of faking it, so just go for it.

Kevin: Go for it. I like that. All right, last question. Did you see the new Robert De Niro series Zero Day?

It's about that massive cyber attack, and if you did, what did you think? I have not, but it's on my list. Oh, me too. I've heard really good things from some other CISOs I know, and they claim that it's sort of relevant and somewhat accurate to the, the tech in, in security, so Jacob: Oh, very good's Kevin: on my list too.

Jacob: I am sure my, my board will actually ask me about it next time we meet. I should probably watch, I should probably watch it ahead of time. Kevin: That's your homework. Well, that's a wrap on the rapid fire round and a wrap on the podcast.

So Jacob, um, awesome having you on. It's been great to hear your perspective and to have you in our world to, to participate and hear your expertise. So, so thank you so much and to everyone who's listening. Thanks for tuning in, uh, ten four and and we'll see you in the next episode.

Thank you.