April 2025 Summaries

In this episode of The Future of Security Operations podcast, Josh Lemos, the Chief Information Security Officer (CISO) at GitLab, discusses his extensive experience in security and leadership, focusing on AI-driven strategies, offensive security, and automation. With a background in companies like ServiceNow, Cylance, and Square, Josh shares insights on managing a transparent security function and aligning a remote, global team. He emphasizes the importance of building a culture of trust and connection, particularly in remote settings, and offers advice on networking, hiring, and mentoring future security leaders. The conversation also touches on the evolution of AI, particularly its impact on security, and the significance of intentional transparency at GitLab. Josh highlights GitLab's use of automation and orchestration to enhance security processes, and he expresses optimism about the future of security operations, advocating for risk management, governance, and the potential of self-funded security initiatives.

Muckwork, the repetitive and low-leverage tasks that slow down enterprises, has become a significant drain on time, money, and employee morale, leading to inefficiencies and burnout. While traditional solutions like hiring more staff, investing in software, or outsourcing have only added complexity without eliminating the problem, AI offers a promising alternative by handling tasks with speed and consistency. However, AI’s potential can only be realized through effective orchestration across systems, data, and workflows, a gap that companies like Tines aim to fill by creating a connective layer that enhances automation and AI adoption, especially within security and IT teams. By adopting a "Customer Zero" mindset akin to AWS, Tines internally tests and refines its AI tools, aiming to help organizations reduce muckwork to zero, streamline operations, and achieve what they term the "Autonomous Enterprise," where AI enables faster, safer, and more adaptable business environments.

In a recent episode of The Future of Security Operations podcast, Thomas Kinsella hosts Mark Hillick, the CISO at Brex, who shares insights from his extensive career in security, which began at Allied Irish Banks and included leadership roles at MongoDB and Riot Games. The discussion covers a range of topics, including maintaining excitement in the security field, transforming vendor relationships into meaningful partnerships, and learning from significant incidents to build team resilience. Hillick emphasizes the importance of fostering a culture where team members feel safe to voice their opinions and the need for security to serve business objectives. He also reflects on his leadership style, characterized by transparency and genuine care, and his approach to giving and receiving feedback. Additionally, Hillick discusses the challenges of securing gaming platforms, strategy and planning in the fintech space, and the inspiration behind his book, "The Security Path," which features interviews with over 70 security professionals.

In the modern security and IT landscape, workflows are crucial infrastructure rather than mere conveniences, and their failure can lead to serious security incidents and increased organizational risk. Tines Change Control addresses the need for balancing rapid workflow iteration with quality control by providing a controlled environment for safe experimentation and adjustments. It introduces features like multiple drafts, enabling parallel collaboration without bottlenecks, and intelligent merge conflict resolution to integrate changes seamlessly. Customizable settings allow organizations to optimize their use of Change Control, ensuring that all updates undergo proper review and align with company processes. This structured review process combines automation with human oversight, promoting innovation and skill development while maintaining workflow integrity. By enabling parallel development and providing smart conflict resolution, Change Control empowers teams to collaborate efficiently, fostering a safe environment for experimentation and learning.

A risk register is an essential tool used by Governance, Risk, and Compliance (GRC) teams to identify, assess, and manage organizational risks, helping maintain compliance with standards such as ISO 27001 and NIST SP800-30. Traditionally maintained in spreadsheets, risk registers can be cumbersome, prompting the need for automation tools like Tines Records, which offer structured data management through automated workflows called "stories." By using Tines, organizations can efficiently track, store, and visualize risk data, enabling security teams to prioritize tasks, reduce incidents, and ensure risks are managed according to company policies. The automation process involves calculating risk severity scores using a risk matrix or mathematical formulas, allowing for customization and adaptability in risk management strategies. Tines also facilitates the creation of dashboards and reports, enhancing visibility and communication of risk posture to upper management. Organizations considering automating their risk registers are encouraged to evaluate their current systems, identify inefficiencies, and leverage Tines for a streamlined GRC process, while contributing to the broader cybersecurity community through shared workflows.

In a recent episode of The Future of Security Operations podcast, Mollie Chard, a seasoned cybersecurity leader with over a decade of experience, discusses her journey from arts graduate to a prominent figure in the tech industry, emphasizing the importance of diversity and neurodiversity in cybersecurity. Chard highlights the unique challenges faced by the energy sector, such as managing legacy operational technology systems and tight budgets, while exploring the role of AI, acknowledging its benefits for automating low-level tasks but cautioning against its limitations due to lack of human context understanding. She advocates for inclusive hiring practices, stressing the need to value diverse skill sets and provide genuine support for neurodiverse team members, and she emphasizes the importance of adapting job descriptions to attract a wider range of talent. The conversation also covers the evolving landscape of cybersecurity, the ethical implications of AI, and the necessity of creating a supportive work environment that allows individuals to be authentic and valued.

The episode discusses Joe McCallister's journey from selling BMWs to leading a security team at The Trade Desk, and his insights on navigating salary conversations, balancing technical priorities with broader business goals, and the future of Security Operations (SecOps) in the era of Artificial Intelligence (AI). Joe shares his top three leadership principles: assuming positive intent, recognition, and candor, and emphasizes the importance of understanding where stakeholders want to go. He also talks about navigating imposter syndrome, winning over colleagues and stakeholders, and strategies for internal networking and stakeholder alignment.

The GenAI is moving beyond chat interfaces to orchestrate real action for SOC teams, reducing cognitive load and toil for security analysts. To achieve sustainable improvements, GenAI needs to combine learnings from a broader set of development, operations, and business stakeholders with automated workflows that include machine language-driven skillsets and AI-driven tasks. Specialized models can reduce the overhead of GenAI by focusing on specific domains like cybersecurity, achieving higher levels of relevance with lower cost and smaller system footprint. Orchestrating actions through composite AI is necessary to mitigate cyber risk, requiring multiple AIs working in conjunction and leveraging existing workflow automation assets. The SOC will not operate itself but instead specialized AIs trained on security and operations training data will handle repetitive work alongside policy-based automation, allowing human experts to focus on critical issues.

Tines has achieved a significant milestone with its library, now housing over 1,000 pre-built workflows designed to streamline the creation of security and IT automations. These workflows, called stories, are contributed by customers, users, partners, and the Tines team, and are free to access and easy to customize. They serve as valuable resources for both new and experienced users embarking on orchestration or automation projects. The 1,000th workflow, created by Haley Kidd from GE Vernova, focuses on disaster recovery by automating the backup of critical Tines components to an S3 bucket, offering a last line of defense against potential data loss. Tines encourages community involvement through submissions and competitions, further enriching the library and fostering innovation within the automation community.

On March 6th, a significant wave of updates and features was introduced following a "same-day-shipping" event by the Product team, resulting in 25 new features across various aspects of the platform. Key highlights include improvements to the Workbench, such as drag-and-drop file functionality, the ability to generate and run Python code, and marking conversations as favorites. The AI action received updates like credit usage reporting and new Amazon Nova models, while the case description editor now supports a WYSIWYG interface with rich text formatting and organizational features. Additionally, the Pages feature gained customizable layout options, and the Events console saw enhancements for easier event filtering and action execution. The updates were aimed at enhancing usability and efficiency, with further improvements like user impersonation for troubleshooting, Python execution via a Tines Tunnel, and several API enhancements.