Welcome to episode 252 of the Nerd Journey Podcast [@NerdJourney]! We’re John White (@vJourneyman) and Nick Korte (@NetworkNerd_) – two technology professionals with backgrounds in IT Operations and Sales Engineering on a mission to help others accelerate career progression and increase job satisfaction by bringing listeners the advice we wish we’d been given earlier in our careers. In today’s episode we share part 1 of an interview with Russell Swinney, detailing Russell’s journey into the technology field after starting as a mechanical engineer, his progression into leadership, the genesis of his business, the interim and virtual roles for technology leaders, and some thoughts on both the CIO and CISO roles and the lenses people in each of these roles use to view the business and the world.

Original Recording Date: 10-24-2023

Topics – Meet Russell Swinney, Learning and Onboarding, The Role of Mentors, Staying Technical and Organizational Constraints, Path into IT, Finding Inspiration and Hugging the Cactus, A Business Idea, Advice for the Potential Business Owner, The CIO and the CISO

2:50 – Meet Russell Swinney

• Russell Swinney provides interim CIO, CISO, and CTO services for companies in times of transition or trouble.
  • Russell tells us he works well in a crisis, and it is a good opportunity to apply his experience.
• In the 1980s Russell started supporting personal computers (PCs) for the forestry department’s computer lab while he was in college.
  • He was not a fan of mainframes, punch cards, or Fortran.
  • Russell was asked to connect all the computers and make them work, starting with the TRS-80 models with 8.5" disk drives.
  • Russell wrote a book on how people could utilize these computers, and as a result of that work he was offered a graduate teaching position within the college of agriculture at Texas A & M.
  • Russell would later help supporting building newer computer labs as personal computing took off around this time.
  • “I became a technologist and have been learning ever since.” – Russell Swinney
• Russell started out in mechanical engineering, worked with Fortran, and did graphical drawing with pencils. He thought this would be a good choice and feels he is pretty mechanically inclined.
• Russell was in Boy Scouts and spent a lot of time hiking. Due to this interest he thought maybe he should get into forestry since he “knew that stuff” (or thought he did).
  • “It was a good ride because I did very little actual forestry and a great deal of technology.” – Russell Swinney, on getting into forestry
  • Russell focused on applying technology to the business of forestry, gaining experience with the wood and paper products industries.

6:05 – Learning and Onboarding

• Russell had learned what he knew about computers on his own even leading up the graduate teaching assignment.
  • Russell remembered the struggles he had gone through learning the material he needed to teach, and that made him better as an instructor. He cites doing lab practical type activities with studies to take computers apart and see what they looked like inside.
  • When we’ve recently acquired knowledge we might have more patience for someone just learning compared to someone who is working with that knowledge constantly.
• Being in leadership has taught Russell that everyone is on some kind of learning journey. This also was the driving force behind his desire to mentor others.
  • “It helps me stay current with what they are learning but also how they are learning. People learn differently today than I did, and it helps me to understand how that works.” – Russell Swinney, on how mentoring has helped him understand people
  • Nick thinks if it’s been a while since we learned something we might easily forget what the challenges in learning the material were. This is similar to someone who has been in a role for a while realizing an employee just onboarding wasn’t told something the longer tenured employee had internalized as part of the job (i.e. they forgot it needed to be communicated). Usually this happens when someone asks a question we might think on the surface the person should know the answer to.
  • In Russell’s role as a consultant, he changes jobs / companies frequently, usually only staying in one place for 6-18 months. He has become sensitive to the new employee onboarding experience.
    • Russell has seen instances where a new employee starts with a company, and nothing is ready for them on their first day (no equipment, no people ready to support, etc.).
    • “If you’re going to hire someone, the day before you make sure everything is ready for them…a place to sit…all their technology they need. Their boss needs to take them to lunch.” – Russell Swinney, on what a good employee onboarding experience looks like
      • Ideally a boss would check in with their new employee over lunch and ask if they need anything, introduce them to teammates, etc.
      • Russell likes the idea of giving new employees company branded swag / merchandise to make them feel welcome.
      • If we compare this to job descriptions from HR, one would think for candidates who have met the requirements and been given the job, the company would care enough to show them where to sit.
    • Maybe onboarding experience is something we should be asking members of the team we could be working on during technical interviews / team member screenings?
      • Check out Episode 204 for more discussions of technical interviews and what we mean by that.
      • Russell says this alerts the interviewer (someone who could potentially become your team member) that you’re going to be looking for some help / give back as you onboard.
      • This also sets people up to understand the culture of the organization and the team is. John says even if there is a delay in a new team member getting all they need from a technology standpoint to do the job, just having teammates there to welcome and support a new team member can compensate for a lot of shortcomings in the onboarding process.

11:38 – The Role of Mentors

• How did mentors impact what Russell did after getting out of school?
  • “I would says the reason I want to be a good mentor is I really wanted one and I never could find one.” – Russell Swinney, on mentoring
  • Russell takes the approach of having made many mistakes in his career and wants to help others avoid those if he can.
    • John says this was one of our principles for starting the podcast (to help people learn from mistakes and learn from others).
• How does someone become a good mentor when they don’t themselves have one?
  • Russell says it may be like the people who grow up without a dad but become good dads. It’s the case where you do not have a good or bad example to learn from.
  • Russell also learns from his mentees – the challenges they face, how they learn, etc. He understands the technology and business worlds enough to provide some guidance.
  • Russell sees leaders as synonymous with being mentors. A manager might be someone who merely enforces HR policy, but that isn’t enough to be a good manager.
    • “The objective of a manager is to have somebody who can step into your role. At every step you take in life your goal is to train up someone who can take your place. Even if you’re an entry level person, you’re going to want to have somebody trained up to take your place. My role as an interim CIO / CISO is to find the person that can step into this role…and let me leave.” – Russell Swinney
    • Russell gives the example of working with a mid-career mentee who was thinking about changing jobs. The person had a great job, was getting globally recognized experience, had great pay, and a had a boss who protected them.
      • Russell encouraged the person to stay put and not make a change right now, especially in the current economic climate. It was only because Russell had made the wrong choice that he was able to recognize the danger and provide some guidance.

14:34 – Staying Technical and Organizational Constraints

• What would Russell recommend people think about before taking on the role of people leader or people manager?
  • Russell has worked in organizations where the only way to advance was to move into management. In fact, a move into management was the only way for him to advance at a specific point in his career.
  • “Just remember…you can always feed your family with current technical skills….Management becomes dime a dozen.” – Russell Swinney, on advice for the individual contributor being pressured to go into management
  • Russell tells us that he has to keep learning because the unique, hands on skills can fade when you pursue management.
  • “Forget the management track. If you’re a technical person and you want to stay that way…the organization you work with needs to support that. They need to have a track that lets you advance…. If somebody’s working for me and they’re a technical person and they’ve reach the top, let’s just break the top.” – Russell Swinney
  • Technical people need to be able to advance financially and in recognition, even if they make more than managers or directors. Good managers want highly skilled technical people who keep systems running and working well.
  • Often times companies will have boundaries set by HR that they aren’t able to break out of. Russell believes this isn’t the right thing to do (i.e. placing these limits on people). We should be looking to maximize the talent of our people.
  • Both Nick and John have worked at companies which had really strong tracks for individual contributors to advance. Another way might be moving to a different team within the same company / greater internal organization.
• Maybe the existence of the type of track above is about designing organizations. How did Russell learn to do that (building / designing organizations)?
  • Much of Russell’s graduate studies were in operations research (very heavily focused in statistics related to biometric data, manufacturing process data / how to shave time off a mechanical process to save a company money, etc.).
  • The above got Russell interested in more analytics, which eventually became a business focus.
  • “If you’re not doing just what you need to do to meet the needs of the business so it’s successful, you’re building it all for naught.” – Russell Swinney, on the purpose of building technology systems and programs
  • Russell contrasts two different clients in similar industries
    • One that invested heavily in technology and spent a lot to get it right but failed as a company a year later
    • Another that did technology things on a shoestring budget and constantly needed help but succeeded / are still around
  • Often times technology professionals or cybersecurity professionals strive for things to be right, but Russell tells us in certain circumstances it’s ok not to be right.
    • Russell gives the example of the conflict between a need to update systems and a critical business function which cannot be interrupted. We need to (or the company needs to, rather) weigh the business need and the technology need and look at the risk involved. The decision as to which takes precedence is really an upper management decision (Russell mentions the CEO as owner of the decision).

19:56 – Path into IT

• Russell’s master’s thesis was based upon a manufacturing plant study where he was applying statistics.
  • In 1986 he built an AI (artificial intelligence) module for an Allen Bradley PLC controller. It was really just a database and lookup tables which based on conditions referred to one another, and these databases would be considered tiny by today’s standards.
• If Russell had stuck with AI, things may have turned out far different than they did. He did not have a mentor and ended up moving to Dallas to teach computer programming with things like Paradox (database).
  • The book Russell had written for college covered spreadsheets, databases, and word processors. He brought that same concept to his work at Nations Bank.
• Russell then worked for a company called CyberTech, traveling the country and building Novell networks for many of the world’s largest life insurance companies.
  • He was a young single guy at the time and really enjoyed the work. Russell calls out this role as one that led him down a path of focusing on building datacenters for financial services companies.
  • After this experience, Russell thought he could do the same kind of thing for himself and led to the start of his business. That was 26 years ago, and his business is still running today.
• Did Russell just work with small language models back in the 1980s as opposed to the large language models of today?
  • John mentions these systems of lookup tables mentioned were called expert systems which had the purpose of emulating human decision making ability. But the company brochures said AI.
  • John says they were only missing the generative qualifier to AI at the time.

22:47 – Finding Inspiration and Hugging the Cactus

• Was Russell a people manager at any point before starting his own business?
  • When he was building datacenters, Russell had a team of 28 engineers he hired from across the country to help build and operate those datacenters.
  • Before that when Russell was designing networks for the life insurance companies, he would ensure these companies had properly hired and trained help desk support teams and systems administrators.
    • Russell would get involved when there was a problem these teams could not solve.
    • Russell refers to these times as being at the top of his technical career while also doing “some people work.”
  • Russell says he preferred the technical work at first but found he liked the people side of things also. He also noticed management missed some important ideas that could have had a big impact because they didn’t look or listen.
• I found I could bring technical, data and fact based information to management and impact the course of decisions. I could bring these to the conversation and have an impact. Technical information that’s factually correct with data points could sway management to change their mind." – Russell Swinney
  • This kind of thing might be displayed in a PowerPoint presentation today.
  • Russell found the above in inspiring to do (changing the course of decisions in a company) and kept pursuing this kind of work.
  • “I still say gain technical skills and experience in your career because you can always feed your family with technical skills when you keep them up. So that’s important. But at the same time, you can see how you deal with people. The people that you strongly disagree with…they honestly may become your greatest allies if you work it right. And management is war, so you need allies.” – Russell Swinney
  • John says we might disagree with people over decisions, strategy, or something else.
    • Russell says people could agree with him and still do it in a way that irks him. He saw the disagreements with others as a challenge to work through that would help both him and the other person grow. It also allowed Russell to (most of the time) impact others in a positive way.
    • Some people Russell could never reach.
    • When landing somewhere new in an interim role Russell seeks out those he thinks will hate him and takes them to lunch. Generating an ally from an enemy helps encourage positive changes.
    • It’s easier when Russell goes into a company to take the place of someone who made a lot of enemies and work to be an ally of the people there. He’s tasked with making progress before leaving the company but asks people what kind of person they would want in the role.
• Did Russell know about the people challenges before stepping into the role of people manager (and that it was going to be war)?
  • Nope! Russell says he basically got hit by the train with these types of challenges in the beginning.
  • “I’ve learned to be prepared for it, but I have also learned to just go seek it out and embrace it at first. I call it hugging the cactus. You find out what’s going to be painful. Let’s just go get it over with right now.” – Russell Swinney, on embracing the hard things of management
    • John likes the idea of seeking the things which will be painful (hard conversations, difficult decisions, etc.). We have a natural tendency to seek the comfortable as humans.
    • Russell has also learned not to overlook the talent in a role, believing that talent (i.e. the people) was put there for a reason, even if it needs to be developed. It’s very rewarding to “polish up the rough stone” as Russell says.
• Is it fair to say Russell went into people leadership to make a larger impact and that others seeking to make a greater impact will need to do a lot of hugging the cactus?
  • There are some protections found in continuing to pursue technical excellence instead of leading people. Expert technical people are hard to find.
  • If Russell can help someone in their career (provide advice or guidance on training, etc.) they will remember him later.

28:33 – A Business Idea

• Where did the idea for Russell’s management consultancy company come from?
  • Russell was doing a lot of infrastructure work and developed the name InterStructure as his business name.
  • Russell would often be sent to help with financial services company acquisitions and would get involved as soon as the announcement was made to help assimilate the new company. This usually involved heavy travel.
  • Russell wished he would have been involved earlier in the acquisition process and encouraged leaders to involve him (knowing he could have pointed out issues along the way).
  • While his wife was pregnant with their first child, and Russell came home saying he had just engineered his own exit from his employer (including a severance package).
  • Small business has its challenges, but Russell’s decision to work for himself has worked out well (despite being a little tense when he broke the news to his wife).
    • Russell has hired and trained many people over time and feels this sets him up to be a good mentor to others.
    • Russell gives the example of having trained a printer repair technician to be a top tier networking expert and others who have pursued CCIE certifications (some of this for his business to become a Cisco partner).
    • Many of the people Russell trained would be hired away, and he has to find others to fill those roles.
  • “Always talk to somebody else before you make a life impacting career change just to bounce the idea off somebody who’s maybe been at that level or been at that role or been at that company or just might have some input that’s not what you would expect. It really helps.” – Russell Swinney, on making big career decisions
• Where did the idea for the interim CIO / CISO originate?
  • It made sense for Russell because it was something he was already doing. He was working with a lot of customers who needed help with technology decisions, strategic and even tactical decisions (any of which could be time sensitive). This is where the idea of virtual leader came to mind.
  • There’s a difference between interim and virtual leaders.
    • Interim leaders dig deep for 6-18 months with the goal being to help enable a lasting impact / change (some sort of transformation). Messing this up can hurt one’s reputation, and someone should be very focused on making sure this kind of experience goes well.
    • Virtual leaders are dedicated for a slice of time to one company but will have many identical engagements with different companies at once. The goal is to provide “better and best choices” advice for ongoing technology operations. Failing at this means customers maybe didn’t listen or perhaps the recommendations didn’t fit the company (which can be because your depth at a company was limited).
    • The virtual CISO (or vCISO) is a challenging role because it’s hard in the limited amount of time you have as a virtual leader to determine what is best for a company.
    • Russell calls out the Office of the CISO construct (a group of virtual CISOs) as a silver lining for the virtual leader. This is a group of CISOs who have different experience in different industries. If you end up on an engagement for an industry in which you do not have experience, you can “phone a friend” by asking another virtual leader from the Office of the CISO to help.
    • “No one of us knows enough, but together we can solve anything….You bring a team when you’re a virtual [leader]. When you’re an interim [leader], it’s you leading the whole show.” – Russell Swinney, on the differences between virtual and interim leaders
    • John delineates the two this way – the interim leader steps in when someone has left or has been asked to leave and there are outstanding decisions or projects to be done but the search process for a permanent person will be lengthy. The virtual leader steps in when a leader needs guidance but maybe hasn’t had exposure to a certain area.
    • Russell compliments the tight knit community group of CISOs in the Dallas / Fort Worth area and speaks to its helpfulness. The people who make up this group provide advice, guidance, and support for one another.

34:26 – Advice for the Potential Business Owner

• What advice would Russell give the person who wants to start their own business?
  • Have cash available and at least one good customer lined up.
  • Consider getting a business address that is not your home address and a business phone number.
  • Take the time to create good legal documents for proposals so you are protected.
  • Do not issue credit even to your best customers. Russell says to the business owner, “you’re not a bank.”
  • Have a clean, current, and helpful website with reference information people can use.
  • Partnering well is key to success and what Russell highlights as the most important thing, which includes vendors who support products and services you sell and other companies in the same line of work as you for sharing overload / times when you cannot take on more customers.
    • Russell gets calls at times from peer companies who do not have the bandwidth to service a good customer, and Russell also asks those same companies for help when he is oversubscribed.
    • “Having partners you can share the load with is great.” – Russell Swinney, on managing workload as a business owner
    • Nick likes the idea of knowing the limits of what your business can take on from a workload standpoint (requires some self-knowledge and awareness).
  • Remember to consider the Office of the CISO if you want to do cybersecurity.
• Did Russell jump into his business full time immediately or begin to do it part time while still working a different full-time job like many of our guests have done?
  • Russell may have pursued starting his business on a part-time basis before leaving his full-time job if he had benefited from the advice of a mentor. But he didn’t have one at the time and went into it full-time.
  • Russell recommends choosing the type of company you will start carefully (like a LLC, S Corp, etc.), how you start it, whether you will have stock, and seek out guidance from lawyers who can help. There is also the possibility of gaining investors.

37:44 – The CIO and the CISO

• Nick posits many of us do not understand what a CIO (Chief Information officer) and CISO (Chief Information Security Officer) really entail.

• Russell tells us the CIO role (Chief Information Officer) is very much business focused with broad responsibility for all the technology, people, processes, and the organization. The CIO has a fiduciary responsibility to the board of directors to ensure all spending (and staffing) is setup to sustain operations.

  • While the CIO is thinking years ahead they have an immediate focus on the upcoming quarter or annual report. The annual report is for the board of directors.
  • A CIO would be tasked, for example, with selecting a new ERP system at a company. They would work to ensure conversion of systems does not impede business operations and negatively impact revenue.
  • “The specific lens…in a CIO role it doesn’t really matter what technology we use or who we need to run it. It just needs to work to meet the operational needs of the business….In my mind it’s the technology direction of the company….If we are going to acquire a company do we even want their technology or not? Would we even decide not to buy them if their technology’s bad….So a CIO would be very involved in those choices and decisions.” – Russell Swinney, on the CIO’s lens
    • Russell says the CISO should also be involved in decisions relating to company acquisitions. You don’t want to find out too late that a company you are about to buy has horrible security. Russell has seen cases where the CIO reports to a CEO as well as those in which the CIO reports in to another executive leader. Who the CIO reports to is a “personality trait of companies.”
    • “As leaders change in those upper roles the reporting structure should change accordingly too because a lot of it’s driven by personality.” – Russell Swinney, on reporting structure for executives

• The CISO might not be able to report to CIO due to compliance reasons.

  • Likely you would not want to CISO to report to the CFO (too much of a financial focus and might leave the impression that a CISO is a cost center).
  • One option for the CISO to report into is the CEO. No matter what a CISO would likely have a dotted line to the compliance / audit committee of the board of directors.
  • The best choice in Russell’s mind is for a CISO to report to COO (Chief Operating Officer) because cybersecurity is part of operations and is working to keep things running. The COO can be a champion for this.

• Much like a CIO, a CISO shouldn’t really care what the technology is. Russell says there are two types of CISOs – a business CISO and a cyber CISO

  • A business-focused CISO has a broader view and tends to be more facing the board of directors. This person would lead programs based on the purpose the organization has to be in business (such as financial services, healthcare, energy, etc.).
    • A business-focused CISO would mitigate threats through risk acceptance, insurance, or program changes based on impact to the bottom line.
    • “The best CISOs are going to come up with an idea to impact top line revenue….But they are also quick to outsource something that needs to happen quickly to meet business needs.” – Russell Swinney, on the role of the CISO
  • A cyber-focused CISO is focused on running operational aspects of the security organization. This role is very important in highly regulated and highly sensitive environments.
    • You need someone who can understand what is going on from a technical and compliance perspective.
    • As opposed to the business-focused CISO, the cyber-focused CISO already has some solutions in mind (a small change, a new program, a “fix everything script,” etc.) for when problems arise.
    • A company could peer someone with the cyber focus with someone having the business focus.
  • “The truth is we all need a little bit of both of types of personalities and understand to work at our best, but we have to figure out which one we’re best at, which one we’re uniquely gifted for…or else we’ll lose our sanity trying to be the other one.” – Russell Swinney, on the two types of CISO
  • “It’s a management skill, but it’s a management skill with technical depth.” – Russell Swinney, on being the top cybersecurity person at a company (i.e. the cyber-focused CISO)
  • John summarizes and points out these types of CISOs may have skills that lend themselves to being more vertical (cyber-focused CISO) or horizontal (business-focused CISO) in nature.
    • Russell says someone with the vertical depth would make a great addition to an Office of the CISO team.
    • John can see that any regulated industry needs experts in the regulations and compliance that are industry specific. This requires massive ongoing education also because regulations change.

• Mentioned in the outro

  • Russell tells us it’s ok to pursue technical excellence and not be forced into management as the only way to progress.
    • Perhaps we should at least consider the management track if someone else encourages us to do so, but only you can determine if that pursuit is interesting.
    • If your company has no way for you to continue on a technical career path / to progress as an individual contributor (in salary, impact, and responsibility), it might be time to look for employers who have staff or principal level roles like we discussed in Episode 242 with Ken Collins.
  • We spoke about different modalities of staff and principal engineers (4 of them) in the discussion with Ken Collins mentioned above. This is similar to the two types of CISOs Russell mentioned in our discussion (i.e. 2 modalities – business or cyber focus).
    • For those interested in pursuing a CISO with either focus, we recommend reading the job description carefully to determine which one is being described. Consider asking people you meet for professional networking purposes where their focus is within these two areas.
  • Russell wanted to move into management / leadership to influence decisions, and Nick feels this is another iteration of remembering and learning from struggle.
    • Russell remembered the struggle learning computers in his younger days and leveraged that to help him write a book and then to teach a class as a graduate teaching assistant. This same idea makes him a great mentor (since he never had one).
    • It seems like Russell’s purpose has become remembering the struggle and using it to help others.
    • Our experiences and struggles uniquely position us to solve problems, and many times it is the experience of struggle. This discussion with Russell in that light parallels the one we had with Al Elliott in Episode 235. In Al’s case it was his struggle with bankruptcy that gave him his next business idea.
  • Russell has been a successful business owner for 26 years as of the recording of this episode. Here’s to many more years of successful business! Unlike many other guests, Russell pursued starting a business full-time immediately once he made the decision.
  • Does hugging the cactus work better as an interim leader or a virtual leader?
    • We didn’t talk about it in the episode specifically, but likely it could help one grow in either scenario.
    • Are we intentionally making ourselves do the difficult things?
  • The Office of the CISO construct is a great way to poll expertise and draw from it. It should be ok to seek out help you need through a short term avenue like this to learn. Hopefully the people with expertise remember the struggles when they were just learning.

Contact us if you need help on the journey.