J.M. Porup has more than twenty years of experience in cybersecurity and currently serves as CISO of Ava Labs. He’s based in Berlin. Today he shares some thoughts on Web3 with Anna
• Is there a difference between working in Blockchain vs. other industries from your personal experience?
There is a huge difference between blockchain security and security in most other verticals. Outside of crypto, security is primarily compliance driven in order to satisfy regulatory requirements regarding the security of citizens’ data. Think GDPR. But personal data has no intrinsic value, so companies routinely skimp on security. If North Korea hacks a random company and steals 100 million user records, what is the immediate financial harm? Negligible. But if North Korea hacks a crypto company and steals 100 million dollars worth of crypto, then you just lost 100 million dollars. That means in crypto security we have to execute to a much higher standard.
• What is your leadership style?
I have the privilege to work with some amazing world-class security engineers. Micromanaging such people would be insulting and counterproductive. So I aim to set clear strategic goals and invite my direct reports to use their experience and creativity to come up with tactical solutions. Obviously I supervise the resulting execution, but if you want to get the best work out of great people, you have to trust them and give them space and time to do great work.
• How do you perceive recruitment, onboarding and talent development in the Blockchain industry?
Hiring and keeping great security engineers in the blockchain space is incredibly difficult because of this little thing called supply and demand. There is a ginormous demand for great security people and a huge talent shortage. That means you are either competing to pay top dollar for security engineers with blockchain experience, recruiting security engineers from outside blockchain to work for you, and cultivating juniors or career changers.
• What are your tips to recognize talent in the hiring process?
To be successful as a security engineer–in blockchain or another vertical–you need to show me you possess a strong “security mindset” and you know the system. Security mindset means you think adversarially. Your job as a blue teamer is to anticipate attacks. That means you need to creativity think like an attacker. You also need to deeply understand the systems you are protecting. You can’t hack a system (technical or social) if you don’t deeply understand how it works, and likewise you can’t defend a system if you don’t deeply understand how it works. That could mean application security of a blockchain itself, but it could equally mean DevSecOps/cloud security, IT security, cold storage/key management security, etc.
• What are the biggest challenges for Blockchain companies in terms of people management?
To get and keep the best talent, you have to offer 100% remote. That’s a fairly new challenge in the history of people management! It boils down to “trust but verify”. I trust you to do great work but I am going to check in on you to make sure you are doing the work.