Ep 113: Trucker to Senior Cyber Leader with Travis Nichols

Good afternoon, and welcome to this week's episode, A Level of Cyber. My name is Tony Bryan, your host and the executive director over at Cyber up Man. I've met Travis today's guest about I want to say, a year year and a half ago out of to watch you event, and I've had an opportunity to interact and get to know him a little bit over the last twelve dayighteen months, and it continued to be impressed with just Tim as a human, as a security leader, and I'm very excited to share the conversation.

With you today because I think it's you have a really. Fun background and a career trajectory that I think a lot of people are going to resonate with, and I think we're also going to cover it just a little different. Most of our kind. Of break into cyber roles have been really towards entry level folks, but we're going to get a little different perspective of a senior leader in this today of where the things that, how he broke in, how he got to where he's at, and really what the future goes in.

So Travis Nichols, welcome to the show. Glad to have you as. A guest thanks to I've really been looking forward to being here and getting to have this conversation. So I know you, I just kind of, you know, I got to know you quite a bit over the last you know a little bit.

But I'd love for you to take a chance to introduce everybody to yourself a little bit about yourself, and we'll keep going. Yeah. So I started out about twenty years ago. I had was going to school and needed some money, so I started working at nights at a trucking company.

And when I finished my college degree, I ended up not wanting to go into that field, and so I stuck with trucking. It was it was good money at the time. And transferred down here to Columbia, Missouri, which is kind of like my hometown, and got into that and then discovered there really was a lot of opportunity for me in trucking, and so I wanted to do something else, wanted to take my life somewhere else, and so I started going to night school in the evenings in both a business degrees and in computers and started working with that and.

Really enjoyed the schooling. But when I graduated, it was right after the end of the dot com bust, and there just weren't a lot of cybersecurity jobs to be had, or sorry, not only cybersecurity jobs, but even IT jobs to be had. When you say things like it in the dot com boom, and I remember that it's this crazy time to think of how how far along we've come in the space and sector from that point to today. You know, making that first transition and exploring how you wanted that, you identified you wanted to do this, What were some of the things or classes or how did you start to dive in and learn the skills you felt like you needed to make that transition into from trucking over into an IT slash cyber role.

Yes, so my dad, my dad had some rule sorry, had some roles as a business analyst, and he got into those. And as he was talking to me about that, I was, well, that's really interesting that that juncture between it and business and and you know, not just doing cool things with technology, but actually helping a company be successful with those and automate things. And of course, you know the late late nineties, early two thousands, you know, the Internet was just coming on. You know, just having a website was was a big deal.

I remember the first job, you know, we were actually had to measure the size of our images so that they weren't too big because it could take too load, too long to load if you had images. What now you have software to click a button and it compresses the imageery in three seconds. For I'm sure back then it wasn't quite as easy to h to retrofit and make those things better. So how did you get your formal education?

Right? So you went from you you went from the trucking company to having the conversation with your data by business analysts? What was that? What was that first role that you felt was kind of true?

I t that you took and what what was that? And how did you how did you approach that that role? Yeah, so I mentioned is right at the end of the dot com bust and have a hard time finding any kind of it work. In fact, it was two years after I graduated before I got my first job at Carfax.

And in the meantime, you know, what do you do? How do you how do you build that resume? How do you grow from there? What do you do?

And so the best advice that I was given was, hey, volunteer, figure out you know, thing organizations that you want to help and go volunteer. So one of the things I did, uh, my dad was working at the University of Missouri and they had a new system and he said, hey, we need somebody to document it. I can't you know, can't get you any money to be paid for it, but you could add as a line to your resume. And so somewhere at the University of Missouri, on some shelf I'm sure very high up, there's a three re sorry, a three ring binder and it's probably all dusty.

But I had to document a system and it's you know, six inches worth of paper of clip clipping on a button in the menu and then documenting where that goes the pictures and then if you click on this button, you go from there all the way through that system. So that's one thing that I did to add aligned to my resume. Another thing was I found out local not for profits that needed some help with building kind of internal applications to keep track of their records. And so I did a couple of applications where I separated the front interface from the database behind it.

And of course this is twenty years ago, so a lot of this is access can do pretty quickly in today, pretty easily, but back in the day, you really had to work at building these pieces. And so it allowed for multiple users to input data into a single database and did that for free. Just gave them to the not for profits. I wanted to see them succeed, and it gave me experience and practice and something to talk about in interviews that was interesting to the interviewers.

So I think what's kind of interesting to point out in that like this pre dates GitHub. This predates a lot of those things that I know Tips and Tricks were telling people in twenty twenty four of right, this is what you do to show your effort and work. You know this you predate that stuff, which is great. So you know, how did you go and articulators show your work to others through interview process and you know, as you're trying to break into those jobs, how did you highlight those skills that you learned through those volunteer projects.

Yeah, so I think it's part of it is finding organizations that you're excited about to volunteer at doing things that you're excited about, even if it's as simple as technical writing, and sometimes that can be complicated but bringing in what you're doing and when you come into that interview and you start saying, hey, I did this and I feel like it made a difference. And that passion, that that that that drive what interests you, that you're willing to do that even off hours, you know, not just eight to five, I did my job.

I'm going to go home, not going to go to do something else, but that you're so interested in that that you want to take your free time and learn and grow and become good at I think that that's really what makes the difference in an interview. That's really great advice. So now at this point we've broke we've got our first job. You know what did that look like is you started to navigate your career right, so you finally figured out that you got into it.

But there's as you know, that's evolved quite a bit and there's many layers, especially in cyber and beyond. So how did you start to really look at what you wanted to do, where you wanted to go, and what were some of the you know, where the people you reached out to, where the groups you did. How did you start to really pinpoint where you wanted a head for your career. So I think keda career is being flexible and willing to consider new things and see if you want to pivot.

In two thousand and six, when I started at Carfax as my first full time IT job, I came on as a software tester and they had this thing called agile, and it was fairly new, It's only coming in the late late nineties, and they were hardcore about it, like, very very disciplined. They did XP which was probably arguably one of the most defined and regimented types of that out there. The whole concept of Today, you know, people are a lot more flexible and figured out lots of ways to tailor Agile to their situations.

But back in two thousand and six, you know, there was a there was trying to establish itself. So you either were agile or you weren't. And so for me, going from where I'd learned sequential programming and those kind of things to going into this agile world and learning about all of that, And then as I got into it, I actually found that I really enjoyed a lot of the agile coaching aspects, so helping the team on the retrospectives, helping the planning games, setting those up, helping drive a team with their mindset where they wanted to go, and asking those open ended questions and really learning the agile practices.

That provided me a lot of a lot of pleasure. And so the opportunity was there to grow and so along with that at the time, Now it seems a little bit normal because there's the pm I ACP and their things like that, but at the time it was, you know, you were either agile or your waterfall, and that was a great controversy going, you know, back and forth, and you know, I tried to start bridging that gap. And I went ahead and not only not only got the Agile Certified Practitioner from PMI, but also got the full PMP as a project manager.

And then the opportunity came to move to being a project manager on the infrastructure side of the house at Carfax. And so rather than stay where I was comfortable and where it might be it was easy, I chose a hard road, move over to a different area, get a different perspective, try some of that out and did that and that was a great opportunity. I got to be part of their first migration to the cloud and again and this was twenty thirteen or so. It was really new and really exciting, and so throughout my career, you know, from there, I went to Veterans United and had several experiences, and then finally here to Shelter Insurance and being able to look at the opportunities and say, hey, am I willing to take a chance.

I'm good at what I do already, but I am willing to take a chance at being maybe even bad for a short period of time in order to be even the greater good and broaden those skills. Well, there's one thing that I think has been from our pre getting on here and now is that the continued commitment to education, learning and grow It has been kind of fundamental to you as a person as you've grown your career. Right, You've mentioned a master's degree in a certification. You're currently in a master's program.

So that's awesome, and I think a testament I'm assuming it's the culture of not just yourself. But your organizations and support those things. You know, But I also think you've you've taken some non traditional approaches to your education, right, like the program you mentioned now as you're studying marketing, you know, which is you know, you're sitting in the lead security information or information security role. But you chose marketing.

You know, I'd love elaborating on that and really the the you know, what made you choose that and how you plan to apply that to your current role in future roles. Yeah. So, as you mentioned, I finished a master's degree in cybersecurity from Missouri State University and a great program. Really loved it.

A couple of years ago, though, I was looking at Rafaike Rayvend's mind map that he does for CISOs and trying to look over the areas of what are we missing, what do we need to add here at shelter to even be closer to what is our best And I was looking at that he recently added in his most recent mind map a whole section on marketing the information security department within your company, And I really captured my imagination because as an undergrad, I never really thought about myself being a great, you know anything in marketing.

I took a couple of marketing classes for a degree in business administration as an undergrad, but you know I thought of. That as well. You've got to have be an extrovert, You've got to have a lot of personality. You've got to be brimming with ideas, all these things going on, and by this point.

I knew myself well enough that you know, I struggled with ideas. Like I was really good about reading others ideas and putting them together there maybe in new ways or things like that, but just coming up with ideas, you. Know, that was exhausting. If you get into.

Patrick Leccioni's studies about you know, working genius, that was not my working genius, and I was aware of that and not trying to make Travis be somebody besides Travis, but to be myself. And so you know, working through that, it really captured my imagination with this marketing aspect that that refee brought up. And so when the opportunity came, you know, thank you to Shelter for helping to fund my education, the opportunity to take a marketing degree and actually learn, you know, in today's world with the you know, the data, the data lakes and all the information that we didn't have twenty years ago when I first went to it degrees, you know, you can really drive to your product just by following what the data tells you, by using you know, AI and the different tools that we have available to us.

And it's a lot less about being, you know, having lots of ideas or having an outgoing personality, and even more about really following the data finding, knowing your market and knowing what will meet the needs of the market. Yeah, I keep you know. They clan't wash you. We I did the Executive Leadership Certificate program how to Wash You, and I was blown away right to your point of the importance of just the business acumen, understanding business needs and honestly, storytelling is such a huge part of a security leader as you're trying to get buy in right, whether it be from executives for your budget or buying from your peers for hiring and try to determine their needs or even for your you know, junior staff of how you're coaching them up.

But having the ability to really understand and embed the best business practices and project management and scrum type. Of activities that aren't going to be part of your lessons. That you're going to get in a traditional security class is really important because it makes you a well routed leader. I recently just learned of the idea of a BISO right the business information security officer, which blew my mind.

It seems like a great way given you know the size and scale of many organizations and the specific community needs that happen. And you know we're in Saint Louis, so Saint Louis is very different than Chicago or New York. So understanding what those local needs would be and advocating for those as you look ahead, right, and I don't want to get too far ahead of us, but as you look ahead, you know, what do you hope you know? Through a master's and cyber a scrum certification, the list goes on, adding a marketing degree, right, like what do you what does long term kind of look for you?

Look like for you where you want to where you want to land? So I hope you continue what I've been doing, which is, you know, finding out what I enjoy where I'm at, being willing to take a risk about changing to move to a different position where I don't have the experience, but I have the opportunity and I have the skills growing out in that way, particularly in the cybersecurity, we know we can't ever get too comfortable, right, there's there's a is at risk of having that bad day a lot of the decisions that are involved in our success in cybersecurity aren't even our decision.

We have to take kind of the handwheorre delt and we have to have the skill about bringing that together in a way to be successful. And I see the career that same way from here, maybe you know, maybe a SISO somewhere or maybe some other role either at Shelter or another company where I can continue to bring together the marketing, the statistics, the cybersecurity, the it the all of these skill sets together that where you have to make decisions that need not just a singular focus, but need a multifaceted focus in order to understand the problem and come up with a solution that solves business problems.

I do really like the marketing aspect because I think it plays to so many different things that happen through a daily or an annual kind of life or a SEESO whether it be a breach, and how do you handle that internally and externally, Like, there's so many applications I think comes along with it. So kudos to you if are thinking outside the box for a degree that you know, especially for a good school, right you go into a good school there where you know, you're getting that education.

So as we look back to your you know, to your career where there were there kind of key players or moments that had resonated with you that kind of helped push you or nut you into that direction. Know, before we have to, I alluded towards kind of some mentorship and coaching of where you went from Veterangy United. To shelter right. You know, was there some kind of key moments in your career that really helped set it, that stood out to your mind to get you to where you're at today.

Yeah, So, so several key key moments. A couple of that most come to mind are, you know, big shout out to gentleman by the name of Jim Nole, who's the director there at Carfax. He took a risk bring me on. I was, you know, green and new, and.

He pushed me to to figure out who I am, to figure out what I could do and not be content with where I was at. And it felt sometimes a little uncomfortable, but it's really what I needed as an introvert, as someone who hadn't pushed himself before. He really taught me the value and the joy of discovering new things about yourself, and so that served me well. And then I can't.

Tell my story without including the name of Randy raw He's a CISO at Veterans un at Home Loans. He's the person that brought me into cybersecurity. Had always told myself if I got the opportunity, that I would definitely do that. I was an agile coach having a great time there at Veterans United doing that and Randy said, well, hey, would you consider being an IT auditor within information security?

And although I promised myself i'd get into information security if I got that chance, the thought of taking spreadsheets and comparing them all day long, that just didn't sound like a lot of fun to me. But he reminded me that not only would there be project management involved, but by being an IT auditor and the only IT auditor starting up that program, I would also get the opportunity to learn about any system at vetter J Home Loans that I wanted to And so that did as a learn that sounded really exciting.

So I was working on that and that's when I also started my first degree, my Cybersecurity Masters, and we were working through a class that was all about risk. And you know, by the time we finished that class and put all of our papers together into one paper and telling that story, it was over one hundred pages long. And as I was looking at that, I was thinking, you know, risk, we category categorize them into green, yellow, and red, and everything else is built off of that early decision.

And so if you happen to have a bad day and called a yellow a red or a green a yellow, then that affects that all the way through, and you could really make some poor decisions later based on the data that you created early on. And as I brought that to Randy and. Started talking that through, Randy kind of got a little smile on his face and he said. Hey, have you ever heard a quantified bread?

I said, no, what's that? And he said, well, here's some links, here's some articles about that. And so I went took that away, read upon that, figured out how that incorporated and answered the questions that I had about the whole risk setup and how that could take it from being kind of a feeling or a gut check, which if you don't have a lot of experience, it's really hard just to go with your gut but really make it more empirical with data, and I built. That up and I came back to him.

I said, Randy, this is great, and. I explained exactly how quantify risks address the concerns that I had with previous risk measurements, and he got that little smile on his face again, and they said great. Now go build me a team. And so I got promoted to manager and.

I ha had one other established person there, and we started bringing in folks and started with risk and third party risk management and auditing and brought all those together and got to build a whole team there and see how all that happens. And then after a couple of years of that, Randy came to me one day said, you know, Travis, you finished your master's degree and you've been doing a great job here. He said, I was talking to one of the executive vice presidents across town at Shelter Insurance and they have an opening for someone to lead their information security program.

And he said, you know, you've done a great job for us, but you're ready, you should go take that position. Here's the link. And he gave me his blessing to go apply for that job. And so that's that's how I ended up here at Shelter Insurance.

And you know, I owe so much to Randy for all of his encouragement. Sometimes the information he gave me was hard. At one point, I was, you know, starting to think about that I might want to go beyond being a manager. And he came to me and he said, you know, Travis, if you don't learn what executive presence is, you will never You'll never move beyond manager.

And that sounds a little bit harsh. And I said, Randy, what is executive presence? And he said, I can't tell you what executive presence is for you, but you're going to have to figure that out. You know, we'll come up with the resources if you want, some professional coaching or whatever you need, but you're gonna have to figure this out this out or you management, you know, as a role as a manager will be the end of the end of the end of the road for you.

And so I appreciate that tough love that he gave me because that's really what I needed to be my best, just like the tough love that Jim Nole gave me previously. So with that, what what did you use to improve your executive presence? What was you know, what was that? And I'm genuinely curious as a as an individual and an executive myself, but what what tools or things or classes.

That you lean into to grow your executive presence? Sure, well, you'd mentioned Washington University Roundtable, and I've been going to that for several years now. That involved, you know, taking a day, driving two hours from Columbia to Saint Louis, spending all day at the roundtable, and then driving two hours home usually meant like a twelve hour day, so you know, it was it was it was some sacrifice, it was some effort. It was something that I had to be passionate enough that I wanted to put time that I could be sitting at home on the couch or whatever.

And that's part of it, you know, as we're talking about what does it take to level up, that's what it takes. It takes finding out what you're passionate about, what you're willing to put that extra time into. And so that's what I've been doing for this cybersecurity roundtable. And there was a gentleman by the name of Gary Latham there that helped MC those roundtables.

And Gary had talked about the exposure that he had had to a lot of different CISOs and a lot of different experiences. And so when Randy said, you've got to figure this out, I said, you know what, in my head, I'm thinking. I knew exactly the person that can help me figure this out. For me.

There were probably other groups where, you know, you could go google executive presence and get a coach, and that probably would have been the more standard way. I think if you asked Randy today. He probably was maybe even a little surprised when I came back to him and said, Randy, I talked to Gary Latham, and I think he ought to be my executive coach. And it laid out the experiences that Gary had had, you know, he had worked in the State Department and different things like that.

And so for about six or eight month Gary and I met and just talked about what does executive presidence look like? And he really started out of what is your story? Because no one can tell your story like you can. And if you're lacking the confidence when you get in front of a group, a lot of times that's you know, you're thinking about, well, what if somebody can find a fact that I got wrong or you know, can poke holes or criticize, but if you're telling your story, nobody knows your story like you do.

And so that was just a place to ground myself. He reminded me that he even he had moments where he felt nervous before he spoke. And then believe it or not. Part of my homework from our meetings was to watch Ted Lasso and you know, if you watch those, especially that first season, he's got so many great, great leadership skills that he does in order to go from coaching American football to coaching the real football in the UK and being able to to bring together a group of people who have very different background from him in many ways, have different interests that he does, and yet bring them together and lead them.

And so that was a couple of the pieces of the executive coaching that Gary did with me and just really helped me. First and Great Show. I'm one of my favorites of all time, which you can't see is my coach Beard Funk go pop here and one of the best character He's one of my favorite characters I think of all. Time that NA show.

Coach Beard is fantastic and I mean and there's a consistent there. I think that I want to make sure we kind of stop our foot on here. Right. You had help and people coached you along the way, but the consistent there was that you took the initiative to go find opportunities, make binders, offer your services to nonprofits.

So there was a lot of self ownership in there, where I think a lot of times people want others to do things for them, where you just kind of took it on your own. So that's a big footstop for me. For for folks that are tuning into this is that there are yes, finding people. Finding your mentors is a great way to maybe get some help in that sometimes some good old fashioned elbow grease and just throwing yourself out there for folks, it's going to go a long way, and you might be surprised what somebody would really want to take from you if you give them an opportunity and you offer your support and services.

Right, Like, there's a lot of I think lessons learned in there for people to tap into. Yeah, I think a lot of it is get comfortable with being uncomfortable, and particularly for introverts, we like things normal, predictable around us. If you can learn to embrace that uncomfortable, that uncertain as normal and make that enough of a pattern in your life that you can really really get your arms around it. You know, your opportunities just really really expand yeah, I mean the job market is softened up quite a bit right this year.

It seems that there's you know, there's a. Lot of layoffs that seem to be coming up, and there's a lot of kind of uncertainty within the workforce. You know, hopefully it's temporary. Right by the end of the year, everything kind of opens back up after something that happens in November that we won't talk about today in this but you know, I think hopefully things will change, you know, beyond that and things start to open back up.

But in the. Interroum, this is a great time to do all the things that you just described, right, to go out volunteer, build skills, find more classes, find capture the flags, find all these things to really highlight, to put yourself out there and make friends along the way. And it's going to make that conversation and your applications go a lot further when things do open back up or you find an opportunity is available now that you could jump into because of some of the outreach and effort that you've done.

What are some other groups that you've tapped into along the way in your career? Right to wash you around table being one, are there are other things that you've kind of you've taken an active role in to learn and grow. Sure, so as you go along, most of the certification groups they have they have local organizations. So for me, the Project Managed Institute, the Mid Missouri chapter was influential.

I actually got to be part of their board, so you know, I have been a VP for before they're there on the board and just getting to learn those skills and how they approach there and learning from some folks with a lot of experience. You know that's great. And you know, you just whatever organization you're in, just looking to see, you know, what are their challenges, trying to really understand what the problems of the organization are and then if you can help be a problem solver.

There's no organization that has enough people solved to solve problems right there. Every every group has its its challenges and if you're one of those people that that solves those challenges, it helps figure out solutions you've you've made yourself invaluable. Really solid advice. I think you know, uh, the on adage to be a solution, not the problem.

It's always a good rule of if you find you're the problem, there's probably some deeper issues you need to look into. We're towards the tail end, so everybody gets the same. Last question for this one, what advice would you give for somebody to look looking. To level up their cybersecurity career.

Yeah, so I would say, think about what you're passionate about, because no matter what you do, if if you're not passionate about it, you're going to to burn out. You're gonna get tired of it. It doesn't matter how cool it may seem, or you know, a title that only is only gonna matter. To you just a few minutes each each month.

Sometimes you're gonna step back and say, Wow, I can't believe I'm a manager, I'm a director, I've got this this really cool job at Carfax what whatever your your role is. But most of the. Time, it's just hard work. And so if you're not passionate about what you do, it's it's gonna get old.

It's gonna it's gonna it's gonna wear on you. So I think that's the you know, the first thing, faure out what what you're passionate about, and then don't you know, be willing to break your own mold, like create your mold, get get solid, get your skills, and then break that mold and read redefine yourself as something new, because that'll keep it fresh and that keeps that passion alive. And I think those would be by two points of recommendation on that question. I like the idea of breaking the mold.

I think it's it's too easy to kind of jump in and do the sect plus to the CYSTP to the this to the that right which is that and there's again there's nothing wrong with that trajectory. But if that's not really what you think you want to do, or you want to have a specialty in one of the you know, forty to fifty different roles within cybersecurity, there's different pathways in which you can. Pursue different certifications. Right, Project management is a great certification that p m P you know, alluded to scrumb and agile a little bit earlier.

Another great you know certification that's going to that Those are not going away, and it gives you. A great opportunities to lead things for your organization. So really great advice that I think you've shared with everybody today. Travis.

One, thank you so much for being an incredible person. And then and this says, as I've gotten to know you, you stick out at the top of my mind. It's just, you know, a good person who has always been a smile on your face, a great perspective, and a really good attitude in every room I've ever been with you before. So I just you know, kudos to you if you carrying that, especially in a job distressful right.

A lot of times it's hard to have that that face when you're having a bad day, but I've never seen. You not be that way. So one, thanks for that too, Just you. Know, being a great leader within the security space and giving paying forward and having an interest or even with our work at cyber up to help the future generations get into it.

And then three, just really appreciate you sharing your story today with with our listeners. So thanks for tuning in for the show. Any alibis you want to add to kind of take away with that, you know, for to close on. I think that that covers it.

I just appreciate for the opportunation to share my story and talk to others. And you know, I often ask my team what can I do to help you be your best? And I think that's a great question for us to ask each other, just to help grow it, continue to grow. Yeah, striving to be your best is always good.

So thank you so much for joining us. Thank you to everybody who's tuned in and listened today. Always oppression. I appreciate our guests as we wind down the end of the year, look into next year to start finding more shows.

So if you want to come and join us, you have a topic or something you're passionate about, if you've seen us cover a lot of areas, reach out to me on LinkedIn. I would love to have you as a guest. Until then, thank you all so much for tuning in to level up Cyber and we'll see you next time.