Speaker 0 | 00:06.414
All right, welcome everybody listening to Telecom Radio 1 and welcome to this new series, Dissecting Popular IT Nerds. Today, I am pleased to introduce to you Don Cox. Don has helped, Don has held numerous positions as both CIO and currently CISO, but really… Don has a long history of experience in all areas of business along with all of the certifications and schooling that go with that. So really, Don, I mean, you come with the whole package. Something that is really not easy takes years of blood, sweat, and tears. So in short, I’d say you’re kind of a big deal. Now, you’ve got over 40 recommendations on LinkedIn, which, jeez, man, that puts me to shame. So, you know, without… Any further ado, you’ve got a great backstory. Tell me, why don’t you just tell me a little bit about your journey, you know, from hacker to CIO to CISO. It’s a great story, man. Why don’t we just start there?
Speaker 1 | 01:10.971
Sure. Thanks for the introduction and the compliment. Yeah, I kind of happened to cross the technology world. My childhood dream was to be a police officer. I spent a number of years in the military growing up and learning. what a police officer could be and serving my country. And then about nine years after I started the military, I jumped out into local law enforcement in the Washington DC area. And while I was there, I was injured. And because some of my college credits were computer related, they asked me if I wanted to go over and try this computer crimes unit that they were. starting up this is 1999 and I said yes and the rest of history from there got really intrigued and and learned a lot about investigating intrusions and hacking and and then wanted to be able to testify in court as a expert witness so I went back to get my college degree and the time they didn’t have any classes in computer forensics so I just took management of IT which actually turned into be a CIO course which led to the MBA and some other things and then from there just kind of listened to people and said well for me to be successful as a CIO and the federal government and I’m sorry in general you know how do I do that and they said we’ll go in the government because you can go in the government you can fail all day long and they’ll never get fired you can you can learn how to manage projects manage people deal with money negotiate contracts keep IT up and running. The government does use some cutting-edge technologies. And then from there, each one of my roles was an attempt to get that experience that a CIO needs in order to sit at the table and effectively lead an organization. Some have been successful journeys and some have been startup failures, but in the end, I think I’m very well-rounded. The last role I jumped into, because I started seeing that the CISOs were getting a seat at the table and Honestly, their salaries were starting to go up. And I said, well, you know, since I have that background and I really enjoyed chasing the bad people, let me try that side of the house. And so I started to go back and work on my CISM. And that’s when somebody came across me and said, I have an opportunity. Would you be interested? And that’s how I got to the current role.
Speaker 0 | 03:48.640
Really cool. Now, we are going to jump into that. But before we get into that, it’s just. I mean, I graduated high school in 1995. So what was it like being part of any type of computer crime investigation back in, what was it, 99? I mean, what we had, we had the pen team. I mean, just what was, in a quick picture, what was your daily job like then? Who did you catch doing what back then? Because that’s interesting.
Speaker 1 | 04:15.944
Yeah, so, yes, that was 1999. I mean, we were, to get the certification. that I obtained, International Association of Computer Investigative Specialists. It was law enforcement officers that developed the training force for law enforcement officers, and it was federal, state, and local, international. So we were using products that weren’t designed for forensic analysis and doing the research to show why they could be used. We were doing analysis on floppy disks and ZIP-100 drives. and computers that were five on hard drives that were 512 megabytes in size. And literally to do my certification, I just sat with a computer and went down to the zeros and ones, you know, the hexadecimals. and just look for everything I could find inside of a hard drive. Can’t do that today with terabyte drives and all the other technologies that are going on. But a lot of it was, you know, like walking through the dark with your hands out in very minimal light, so to say. We were inventing technologies as we were going down this path. So most notable companies, Guidance Software and Encase, FTK, some other ones, we helped grow those technologies to what they are today. So very exciting. and also a lot of lessons learned.
Speaker 0 | 05:35.687
Really cool. Yeah. So you ended up with the level of experience that you got. One of the things that’s a theme that I like to touch on a lot for just IT directors in general or anyone growing in the space looking to get into a CIO role or even a C-level space, obviously there’s an education piece, there’s a certification piece, but just… when you did make it into that CIO role after getting out of college or getting your MBA and all that, just paint a picture of what your daily job was like as a CIO. Because I think that that gives a good, I guess, and chucked a position or whatever you want to call it, you know, kind of a side-by-side comparison that a general IT director can make comparative to what he does on a daily basis. So, you know, what was your…
Speaker 1 | 06:28.517
your daily job like as a cio so as a cio it was working side by side with the ceo cfo chief operating officer to say how do we align technology with the things that are revenue generating for the business anything else we got to ask why are we doing it what purpose does it serve um so a lot of it was working with teams to actually crunch the numbers list out technologies and then talk about what the business use case is for the technologies and and and it was aligning those with the business owners and and demonstrating where within the business this generated revenue and then what did we need to support it in order to either enhance revenue or to or to save money because we might be spending too much money example we’re in the cloud and we should be on-prem because it would be cheaper so I was doing a lot of the cost-benefit analysis for the organization. A lot of it was what I call gripping and grinning, meeting each one of the business owners and, hi, how you doing? Is IT doing good for you today? How can we do better? What do you need to be successful? I was meeting with vendors outside the organization. One thing I was always told and prided myself in is taking phone calls from vendors and meeting with them and then just, you know, honestly feedback saying it’s not in the roadmap for this year or I’d like to learn more, but I’m not buying it. just to keep up the speed with the new technology because it’s the CIOs and the CISOs job to kind of create the strategy for which direction they want to go and then they have to walk away from the implementation and then trust the people that they hire below to implement and then create the mechanisms to spot check to make sure that it is moving forward in a positive direction.
Speaker 0 | 08:17.873
Do you have any, I guess, tricks or anything out of your playbook in general? Obviously the gripping and grinning, I like that.
Speaker 1 | 08:25.381
Um,
Speaker 0 | 08:26.781
anything else out of your playbook that might help with finding or uncovering or managing that IT sprawl and, you know, the numerous licenses that everyone’s managing? Uh, I mean, any, any best practices there or anything that someone can walk away with?
Speaker 1 | 08:44.391
Uh, so in today’s day and age, yeah, IT licenses are getting a lot of companies in trouble and causing a lot of, uh, in that quote unquote, um, uh, what is the, the word that is used sometimes true up can get in a lot of trouble so it’s putting processes in place this is something that I learned inside the government with a legislation that was enacted a few years back is if somebody has to be responsible for all IT in the organization and and you have to have one location that understands the depth and breadth of technology you can’t let each business go out and buy its own technologies to be coordinated it should be understood so creating some mechanism with your vendor management group with your with your contract group and with your legal team to say look you’ve got a Contract or a purchase order with technology baked into it. It doesn’t even matter if it’s a printer or a Smart board it needs to have The office of the CIO signature on it before you can actually purchase it so that we can say hey Maybe there’s two boards over here, or there’s some spare technology over here, so getting your hands around the purchasing of IT is huge for CIOs to be successful. And then to be able to look at…
Speaker 0 | 10:00.574
So basically no rogue, no rogue spenders. So XYZ Susie buys a weird smart board that doesn’t interconnect with, I don’t know, zoom or something like that. I gotcha. No rogue spenders.
Speaker 1 | 10:17.298
Yeah, exactly. Yeah. Yeah. You have to try to control those things and then work with the businesses. So, I mean, one of the, one of the things that I was taught years ago is I’ll never say no to you. I’ll just tell you how much the yes I can get. You know, scale from one to a hundred because nobody wants to be here. No. And if you tell them, no, I mean, any experienced CIO or sister will tell you, the business is going to find out a way to find a way to get around you. So would you rather want them as a partner or as an adversary?
Speaker 0 | 10:45.075
Okay. So digging a little bit deeper on that partner piece. So in other words, by saying yes to them, partially they’re not going around your back and you’re not dealing with a problem later on. And so how, how would you say bring that? Just digging deeper about going around and making them a partner, is that sharing goals with them? Is that sharing what your vision is with them and trying to understand what their vision is? What is that?
Speaker 1 | 11:06.660
Yeah, so, I mean, nine times out of ten is trying to understand what their vision is. So I’ve made this statement in the past, and it has made me some enemies with other CIOs, but I said CIOs have become our own worst enemies, right? We’ve gone from an age where we think we know everything about technology. and we’ll implement what you want to where the businesses are just as smart now in technology and they’re implementing what they need to be successful. So I really have to put my ego aside and I have to say, my job is to run IT for the entire organization, strategize on it. What do the business units need to be successful? And make sure that the VP or the executive over that business unit is heard and I understand them and we’re delivering to them. the product technology that they need in order for them to be successful and continue to generate revenue. And I keep telling my team, you know, we’re here to serve them. They’re, they’re our customers. So make sure that they have what they need to have. There’s going to be acceptance to rules. It’s going to be all of that, but it’s really what does the business need to make money?
Speaker 0 | 12:15.319
Awesome. In other words, it’s not your network that you architected. It’s our network that supports everybody.
Speaker 1 | 12:21.804
Absolutely. And I continually refer to You know, whenever a problem develops, you have an outage. Today, it’s network operations that has the outage. Tomorrow, it could be platform services. The next day, security could cause the problem. We can’t point fingers at each other. What we have to do is say, what’s in the best interest of Mednex? And that’s the company I work for now. But what’s in the best interest of the company we’re working for in order for the company to continue to be successful, profitable, and keep it moving forward? Today, it’s my issue and security. But I need help from other units, you know, band with me. And tomorrow I’ll do the same thing for you. So it’s that kind of a mentality in the organization.
Speaker 0 | 13:03.836
Awesome. Now, so my next question is, do you think, because I have seen this happen, do you think that the right person can come in with the right level of business acumen and ability to communicate with end users and has the technology background but may not have an MBA? may not have all the certifications, but they’re able to come in and communicate very, very effectively with the end users and the vendors and really, I guess you could say, do more with less, manage the IT sprawl. Is it possible for someone to come in? Is there a cutoff in an organization size? I guess my question is, how does one go from IT director to CIO? And I’m assuming it’s they… they first of all need to have the business acumen. They need to have all those things we just talked about. They need to be able to step out of the really kind of the maybe tunnel vision engineering mindset where we’re just fixing a problem. Those are hard enough issues to begin with, even if you do have the MBA. But is it possible to go from IT director to CIO, or do you really have to have the certifications and the education? Or if you had to pick one, which would it be?
Speaker 1 | 14:14.806
So I’ll answer this question in this manner. To get to an IT director, you have to be technical in some ways, shape, or form in today’s day and age. It used to be IT director was just the smartest guy in the room or low man on a totem pole or a guy with a good financial background. They stuck him in the role and just hoped that the people underneath him could manage the technology piece to it. But it’s become so verbose today that you do need an individual that’s technically… is knowledgeable, right? Technically knowledgeable. Could you go from director to VP to CIO? Yes, absolutely. A lot of those will be, you’ve been in an organization for five years or more and people have seen your ability to get things done and really that’s what you’re kind of graded on as a CIO. Can you get things done? So that’s possible. Now when you start going outside your organization and you start trying to go for larger organizations, definitely the Fortune 1000 companies or very profitable companies, then they’re going to start looking at what have you done to generate revenue for other businesses. And then what education and training do you have? So from a technical perspective, I would hire somebody that has certifications over somebody that has a four-year degree every day of the week. And they could even be expired certifications. It doesn’t matter. As you start getting up into the VP roles, you’re going to want to start asking the questions of what have you done about knowledge and program management or project management or portfolio management or contracts and negotiations. contracts and what have you done in budgeting so that’s where all that education and experience needs to come in but but you can get that without having a college degree it really depends on the organization and its size and their leadership and what their leadership thinks about education so you’d have to do your research and say is the CEO of this company do they have an MBA do they have a bachelor’s degree and a master’s degree And then kind of gauge it from there. If everybody at the exec level is, you know, just a bachelor’s degree or a master’s degree, then there’s a possibility you could be interviewed and get the job if you can show that you have done strategy and project management and budgets and contracts. So it’s possible.
Speaker 0 | 16:49.506
Gotcha. Project management, always the juggernaut. Now, I’m big into the partnership approach. What about IT directors partnering with other C-level executives? What about having good mentors and being able to say, well, maybe I don’t have an MBA, but I have the certifications and I’ve got mentorship underneath XYZ C-level leadership?
Speaker 1 | 17:20.690
Yes, there’s always opportunities. I mean, the first thing is to get the title of CIO, whether it’s in a… $50 million a year company or a $2 million a year company. It’s to get the title and then start looking at items that you can put on your resume that say that you’re capable and competent in this role. So maybe it’s do that. Yeah, mentoring is great. I’ve had a number of Fortune 100 CIOs that had mentored me when I was in the government. We paid for them to come in and consult. And my title was just director in the federal government. It took me years of experience in working with them to get my first job as a CIO. And that was a small company that the CEO was looking for a CTO. But as I talked to him, I convinced him that he was really looking more for a CIO and that I was that fit. And actually was able to change his mind.
Speaker 0 | 18:18.915
I have another interview on just the difference between CIO and CTO. I think a lot of times there’s a very cloudy, that can be a cloudy area there. can you leave us with maybe one one quick win or a tactic that anyone listening to the show right now they can go back to work you know maybe they can implement this one thing right away maybe it’s a mindset piece whatever it is what’s the easiest and
Speaker 1 | 18:44.311
fastest way that you know to make a difference communication um having one-on-one meetings with you your peers. So in years past I always thought that walking the hallway was a great way to manage and a great way to stay in tuned with what’s going on and in some sense it is because you’re there, you’re visible, people can ask you questions, the team appreciates that they have that kind of access to you even though you’re C-level or or a VP and it helps them. in their mind frame, right? And asking questions about what they’re doing and showing interest in, are they, they have tools they need, all that’s great. But I really found that I needed to have that 30 minutes of, and that’s all you need is with my peers and with some other people in the organization to say, what do you need? Or how are you doing today? And it really opens up a positive work experience and you become. I guess tighter as a group in an organization when you start having those one-on-one meetings and you get to talk to people and learn about them, their family, their likes or dislikes. So I would say as a CIO, the one thing I’ve learned is that that one-on-one time is totally necessary. And again, it’s just 30 minutes is all you need to talk to somebody.
Speaker 0 | 20:17.200
Yeah, it takes kind of like the bureaucracy feeling of the corporate world out of, you know, the gripping and grinning and walking down the hallways is great, yes. But the 30 minutes of one-on-one actually makes it personal and not so, you know, hierarchical bureaucracy. that we all experience so much. Did you have any outline for those meetings or anything like that? Any particular questions that you would that you would ask? Do you remember having like a piece of paper or anything like that? Or you know obviously not coming to a piece of paper but did you have anything in mind that you should start off with?
Speaker 1 | 20:52.215
It was typically for me, hey I have these particular items this week that that or seem to be roadblocks or here was some positive things that your team did so it was always it was always positive and negative, right? Thanks to your team for doing this and really appreciate them doing that. Or sharing some information about some other projects that I know are ongoing that they may be interested in, right, for sharing that knowledge, because maybe my peer in the other group hasn’t had a chance to come talk to that person or that they don’t have one-on-ones. And then it was really, I opened it up by saying, you know, and I would get out of my office and I would go meet them in their office, which is kind of. a big thing in most places, not having somebody come to you. Or meeting for coffee someplace, right, kind of change the environment, getting out of the office and meeting for coffee. But, no, it was really just close the door and kind of Chatham House rules, right, no retribution or no names to anything, and just say how do we make things better in the organization.
Speaker 0 | 22:00.420
Yeah, awesome, man. Well, Don. Thank you so much for being on the show today. It has been a pleasure, man. I would love to be able to jump into your mind and go back to 1999 and see us breaking down code on a hard drive. I certainly remember the copy disks. That would just be fun. So really appreciate your time today, man. Have a great day.
Speaker 1 | 22:21.497
All right. Thanks. You too.
