Random Access Memories

My Failure Made Me a Better CISO | Assaf Keren, former CISO, PayPal

Most leaders spend their careers trying to prove they're good at their jobs. But Assaf Keren does something different, he teaches his managers how he's failed. The current CSO of Qualtrics and former CISO of PayPal has spent more than two decades in security, but some of his strongest beliefs about leadership didn't come from the things he got right. They came from burnout, bad decisions, difficult feedback, and learning to let go of the need to be the smartest person in the room. In this episode of RAM, Assaf joins Jake Bernardes to talk about the stories behind his book and the leadership philosophy they created. That includes asking employees to tell him when he's wrong, telling leadership what he intends to do instead of constantly asking permission, and an annual ritual his team has learned to dread: Assaf publicly grading his own performance. One year, he even went to his boss and asked to be rated lower. But some failures cost more than a performance review. Early in his PayPal career, Assaf was working across Israel and the United States, essentially working two shifts every day. Good nights ended around 1 a.m. Bad ones at 3 or 4. Then he'd wake up and do it again. He did that for a year. Eventually he was physically ill, emotionally reactive, unable to think clearly, taking 15-minute power naps between meetings—and closer than he realized to leaving cybersecurity altogether. Compounding that experience was something else he'd carried quietly for years: PTSD. During COVID, Assaf learned that an employee with PTSD was afraid to disclose what they were experiencing. So Assaf wrote a message to a PayPal Slack channel with roughly 40,000 people explaining his own experience. Then he stared at it, for three days. His extended family didn't know. His colleagues didn't know. He worried his leaders might see him differently. Eventually, he pressed Enter, shut his laptop and walked away. Looking back, he says: “That was the moment I started healing.” Memory 006 is a conversation about failure, burnout, vulnerability, mental health, ego and what it actually means to lead people through a profession built on uncertainty. In this episode: Why Assaf calls English a low bandwidth language, and what it taught him about giving feedback The year he worked two full shifts a day, Tel Aviv mornings and US nights, until his body forced him to stop Why he asked his own boss to rate his performance lower than expected The Slack message to 40,000 people that he sat on for three days What a submarine commander's book taught him about intent based leadership Why he believes the entry level security career is disappearing, and what that means for the next generation of leaders

• Transcript

I Almost Left Cybersecurity | Rinki Sethi, CISO of Upwind, Founder of Lockstep

Rinki Sethi has spent nearly 25 years in cybersecurity, with stops at Walmart, eBay, Intuit, Palo Alto Networks, IBM, Rubrik, Twitter, Bill.com, and now Upwind. But one of the most important moments in that career came when she almost walked away from cybersecurity entirely. In this episode of Random Access Memories, Rinki joins Jake Bernardes to talk about the mentor who changed the trajectory of her career, why the people around you can matter more than the logo on your résumé, and what great leadership actually looks like when the goal isn't just building better programs, but building better people. They also dig into a question cybersecurity is going to have to answer sooner rather than later: What happens to the next generation of security leaders when AI automates the jobs where so many of today's CISOs learned the fundamentals? From the rise of the “builder” CISO to technical fluency in an AI-first world, Rinki and Jake explore how the role is changing, and why knowing how to ask the right questions may matter just as much as knowing how to write the code. Then, they look beyond the CISO seat. Rinki shares why she co-founded Lockstep, what she's learned from investing and working with founders, and why she believes security practitioners should sit at the center of the cybersecurity ecosystem instead of simply being sold to buy it. Her biggest lesson after decades in the industry is also one of the simplest: Don't just chase the company. Chase the people. Because the jobs change, the titles change, and the technology definitely changes but the relationships you build along the way can change everything. In this episode The Walmart mentor who kept Rinki from leaving cybersecurity Why great careers aren't necessarily built by chasing prestigious company names What separates a true leader and mentor from someone who's simply managing people Why tomorrow's CISOs may need a builder mindset Whether AI actually makes everyone technical — or just makes it easier to build the wrong thing What happens when SOC, GRC, AppSec, and pentesting entry-level work gets automated How the CISO role is shifting from technical architect to business leader, communicator, and influencer Rinki's move from traditional enterprise security into hypergrowth security at Upwind Why she co-founded Lockstep and what investing taught her about the cybersecurity ecosystem Why practitioners should have a bigger stake in the value they help create The importance of understanding equity, cap tables, vesting, and startup economics Why networking and community aren't side quests — they're often where the next opportunity begins

From CISO to Field CISO: Trust, Burnout & the Cost of the Role | Tim Chase, Field CISO, Orca

What happens after you finally get the CISO job you've spent your career working toward, and realize you want something different? Tim Chase made the move from operational CISO to Field CISO because he loved something specific about the job: talking to other security leaders, understanding their problems, sharing what he'd learned, and helping them find better answers. But becoming a Field CISO introduced a different kind of pressure. In this episode of RAM, Tim joins Jake Bernardes to talk about what the role actually looks like when you strip away the conference stages and LinkedIn posts: defending whether you're still a "real" CISO, pushing back when companies treat Field CISOs like salespeople with impressive Rolodexes, and trying to remain credible when your paycheck ultimately comes from a vendor. They also get into the part of the job that's harder to see: the cost to your family. It's a theme that came up with last week's guest, Avani Desai, too. Avani talked about one year when her career meant she saw her infant son only 50 days. For Tim, it's the conferences that overlap with the first week of school, the travel squeezed between kids' sports and date nights, and the guilt of knowing that being present somewhere often means being absent somewhere else. Different careers. Same uncomfortable question: How much of your life are you willing to give your job? Tim is a father of four with a working spouse. Being useful in the field means customers, conferences and teams constantly compete for his time. But every yes somewhere is a no somewhere else. Sometimes that means squeezing family life between trips. Sometimes it means sitting at a hockey game feeling guilty because his wife is home putting four kids to bed. And every year, Black Hat somehow lands during his children's first week of school. For Tim, being a great Field CISO isn't about being everywhere. It's about knowing where you're actually valuable, and having the discipline to say no everywhere else. This is a conversation about trust, credibility, career identity, burnout, family, and why sometimes the best thing a Field CISO can tell a customer is: Don't buy our product. In this episode Why Tim left an operational CISO role after spending years getting there Whether becoming a Field CISO is a progression, a lateral move—or a step backward Why some security leaders don't consider Field CISOs "real" CISOs Whether Tim would ever return to an operational CISO seat The misconception that Field CISOs are salespeople with CISO networks Why lived experience gives a Field CISO credibility with customers Why solving the customer's problem has to matter more than selling your product Times Tim has told prospects that his own company wasn't the right solution Why trust matters more than the product pitch The travel and visibility expectations that come with being a Field CISO Balancing conferences and customer commitments with four kids and a working spouse Why Tim refuses to become a "road warrior" The guilt that can come with being present professionally and absent personally Why saying no is part of staying effective What burnout looks like in a Field CISO role versus an operational security role

• Transcript

Career, Motherhood & Becoming CEO | Avani Desai, CEO of Schellman

Avani Desai once believed she had to make an impossible choice: be a good mother or become an exceptional executive. Today, she's CEO of Schellman, and she's building the kind of workplace she wishes she'd been able to see earlier in her career. In this episode of RAM, Avani joins Jake Bernardes to talk about growing up as the daughter of immigrants, beginning her career as one of the only women in penetration testing, and eventually becoming one of fewer than ten women leading a top-100 CPA firm. But this isn't really a story about becoming CEO. It's about what happened along the way. Avani opens up about being afraid to disclose her first pregnancy because she worried it could affect her next promotion, seeing her newborn son fewer than 50 days during his first year, and ultimately leaving a job she loved because she refused to sacrifice the kind of mother she wanted to be. Then an opportunity at Schellman changed the equation. Now, as CEO and mother of three, Avani is trying to make sure the people coming behind her never feel forced to make the same choice. It's a conversation about ambition, representation, parenthood, leadership—and redefining what having it all actually means. In this episode Why Avani's father moved his family to America specifically to create more opportunities for his daughters Going from penetration tester to privacy, marketing, president, and ultimately CEO What it feels like to be the only woman—or woman of color—in the room Why Avani was afraid to tell colleagues she was pregnant The impossible choice she felt forced to make between motherhood and her career Seeing her son fewer than 50 days during his first year Why she ultimately left a job she genuinely loved Finding a company where parenthood and ambition didn't have to compete Why 70% of Schellman's executive leadership team is female Why Avani believes representation isn't about celebrating being “the only”—it's about making sure you're not the last Her approach to being fully present at work and fully present at home Why Schellman shuts down for three weeks every year Why “rest is not a reward after burnout. It is part of performance.” Building a leadership team strong enough that the CEO can make herself “irrelevant” Chapters 00:00 – Meet Avani Desai 01:54 – Her hero: the father who sacrificed everything for his daughters 02:42 – Growing up as the daughter of immigrants 04:34 – Reinventing yourself without changing companies 06:35 – Being a female penetration tester in 2002 06:52 – Becoming one of the few women leading a top-100 CPA firm 07:34 – Why being “the only” isn't something to celebrate 08:04 – Being afraid to disclose her pregnancy 09:00 – The impossible choice: executive or mother? 09:47 – Seeing her son fewer than 50 days in his first year 10:18 – The opportunity that meant she didn't have to choose 10:55 – Building a leadership team that's 70% women 12:35 – Why Avani talks publicly about the good and the bad 13:12 – Can you actually “have it all”? 14:00 – Protecting the hours that belong to her family 21:38 – Why Schellman completely shuts down 22:26 – Why she rejects unlimited PTO 24:12 – “My job is to make me irrelevant” 24:30 – Why exhaustion shouldn't be a badge of honor 24:50 – Rest is part of performance

• Transcript

The Uber Incident Through a CISO Family's Eyes | Joe & Prathiba Sullivan

Everyone remembers the headlines, but very few know what happened after the cameras left. Former Uber Chief Security Officer Joe Sullivan and his wife, Prathiba, join Jake for an honest conversation about what it was like to navigate one of cybersecurity's most public legal battles—not as a security leader, but as a family. From media scrutiny and online speculation to preparing their children for the possibility of prison, Joe and Prathiba share the conversations that happened behind closed doors and the resilience that carried them through. This isn't another breach retrospective. It's a story about marriage, community, parenthood, and what happens when your hardest professional moment becomes your family's burden too. If you've ever wondered what leadership really costs, this episode is for you. In this episode What life looked like behind the headlines of the Uber incident How public scrutiny affects spouses and children—not just executives Navigating fear, uncertainty, and the possibility of prison as a family Why community became their greatest source of strength Teaching resilience, honesty, and courage through adversity How hardship ultimately strengthened their marriage and reshaped their purpose

• Transcript

Living Through the SolarWinds Breach with Tim Brown, CISO

The Emotional and Strategic Resilience of a CISO: Insights from Tim Brown In this episode, Tim Brown reflects on his extraordinary journey through one of the most high-profile cybersecurity breaches in history, his health scare, and how these experiences reshaped his outlook on leadership, community, and the future of cybersecurity. Main Topics: The human side of cybersecurity leadership and managing personal health amid high-pressure incidents The importance of community support, compartmentalization, and resilience in crisis situations Lessons learned from a major breach and regulatory challenges, including navigating SEC cases The evolving role of the CISO in strategy, AI, and business impact awareness The benefits of pivoting careers and fostering innovation within the cybersecurity community Timestamps: 00:00 - Introduction to Tim Brown and episode overview 01:09 - Tim’s background, heroes, and personal interests 02:25 - Handling a major breach and personal health during crisis 04:00 - Managing work-life separation during high-stress legal and public scrutiny 06:00 - Lessons from a prolonged SEC case and their impact on mindset 07:24 - Decision to fight SEC charges and the importance of integrity 09:00 - Recognizing physical health signals amid stress 10:37 - The role of recovery versus stress and mental well-being 12:36 - How the incident changed life priorities and outlook 14:36 - Reflecting on advice for cybersecurity professionals before a crisis 17:02 - Factors motivating the decision to fight legal battles 19:20 - Post-crisis career pivot and current roles with Team8 22:24 - Trends and challenges in the cybersecurity community, including AI and future skills 28:18 - Resilience, design, and strategic thinking in the evolving security landscape 36:44 - The importance of visionary thinking beyond immediate technical solutions 37:22 - Final reflections: whether to avoid hardship or embrace growth 38:46 - Closing remarks on community, leadership, and future directions Resources & Links: Team8 CISO Village Tim Brown on LinkedIn Book (The CISO Journey) Connect with Tim Brown: LinkedIn Twitter Tim emphasizes the importance of community, strategic thinking, resilience, and integrity in cybersecurity leadership. His journey highlights how personal experiences can reinforce professional purpose and community contribution.

• Transcript