#117: "ITAM is the first thing I do in a new company" - Renata Vincoletto, CISO at Civica

0:00What was your take on that, by the way, with co-op and Marks and Spencer's in quick succession was now getting hit. I really feel for them. I wouldn't like to be in their shoes. This is the worst nightmare for a cybersecurity expert, especially because that's the only moment that the board or the leadership will actually start to pay attention to the problems that you have.

0:28Every now and then, you have a conversation that really lands and where there's real connection, depth, and something genuinely memorable. And this was undoubtedly one of those moments. Renata Vincoleto is the Chief Information Security Officer of Civica, who are, amongst other things, a powerhouse in UK government and public sector technology. Hailing from Sao Paulo, Brazil, Renata discovered her passion for technology very early on in her life and followed it all the way to the UK after facing a deeply shocking setback, being dismissed from her position for effectively being pregnant. Renata chose resilience over resentment.

1:10Inspired by her mentor, she pushed forward, rising through the ranks to ultimately lead cybersecurity strategy for Civica, working on high stakes government and public sector IT programs. We discuss her empathy for the recent M &S security breach response team, why observability and IT asset management are fundamental to achieving a good security posture, the uncomfortable lack of female representation in security leadership. And we also talk about personal resilience and also how organizations should be thinking about AI and large language models from a security standpoint. I think you will absolutely love this lady.

1:52This is Renata Vincoletto.

2:02Renata, thank you so much for coming on the Tech Leaders podcast. I've actually been super excited about speaking to you. I've been aware of Civica for some time. There's so much going on in the cybersecurity space right now in light of all this innovation around AI and other things. Thanks so much for agreeing to come on. How are you today? I'm very, very happy to be here as well, Gareth. I'm very good today. As you know, we start off with a bang. The question we always start off with, what does good leadership mean to you, Renata? Good leadership for me. I think it's about creating clarity for the team and somehow fostering the trust and empowering people.

2:45I think that's the things that I think. Empowering my team to do their best, to be their best, the best version of themselves. Even when the path is not clear, you know, make sure that even in the decisive moments in a crisis, for instance, as a leader, I can be vulnerable enough to say, I don't have all the answers, you know, to show to them that we can figure out everything together. And I think that's the leadership. Absolutely. Humility and empathizing with your team is vital. Very good answer, Renata. I think that's, I completely agree. So look, can you give us a little bit of an introduction, certainly in terms of the early part of your career?

3:27Why did you pursue IT and technology as a career path? I've always been a geek. I think that that has, I've been proud, I would say, proud. Since I was very small, I was trying to open radios and videocassettes and things like that to see how they worked. Then growing up, I was fascinated by physics. That's my background. I went to university to read physics. While at university learning about physics, I was introduced to Cisco Net Academy. That was a partnership between my school and Cisco. and they were talking about, you know, providing CCNA and et cetera. And I thought that was very cool, you know.

4:12Oh, I want to learn more about this. And that was the end of physics for me because I loved it, you know, and I really wanted to do research and discover. I'm a very curious person and I wanted to study maybe cosmology, But with networking, internet and cyber after that, I discovered that I didn't need to study the space to be excited every day. That was something that led me to cybersecurity in less than six months that I was already on network engineering. I started to get more and more curious about, OK, so what's in the mind of the other people as well? Because although I am a geek, I am also, I would like to say I'm a people's person.

5:03I love interacting with people, understanding how they think, how they act. So you grew up in Brazil. Was it always the plan to leave Brazil and pursue work overseas? Or was that something that happened organically just through your career? My mother used to say that my ideas and my plans, they were too big for the country. in a way that she said that she always saw that she always knew that I wouldn't be living there next to her, living, you know, in the city. Even if Sao Paulo is a very big city, she always felt that I didn't belong there. And I agree, you know, I always see myself as a citizen of the world, you know, like that.

5:45Yeah, absolutely. And when we started, I started my career, I worked for cybersecurity at Siemens. I was information security manager for Siemens in Brazil. And then I was the information security officer for Telefónica, also in Brazil. And I was delivering training for Cisco Academy and for Checkpoint Firewalls as well. My husband was at that time working for Yahoo as a software engineer. we met at physics university and he's just like me a geek uh computer science biology and all that stuff he loved those things that's when he received a job offer from welcome trust institute in connection with cambridge university i thought okay i'm always excited about doing things different and we decided to move i got to ask you when you first moved to the uk what did you like and dislike about the UK when you first moved?

6:44It must have been things you missed about Brazil. I would say that things that I really like, it's that I can be myself. Brazilians are very much worried about appearance. You know, they love to look very beautiful and very well maintained and etc. And if you are not wearing the same clothes or if you are not wearing the style that is happening right now, people kind of judge you. So geeks are much more, I would say, well accepted here in UK than I would say in Brazil. Things that I dislike about UK, I have to say, I'm really sorry about that, Garrett, but it's the food. Well, yeah, I can imagine.

7:31Brazilians love barbecuing. I think it becomes, they're kind of famous for it, I think. That's usually what we do over the weekends. So you've had a fascinating journey from Brazil to obviously to work in the UK for Microsoft and so on and so forth. I just wanted to ask you, you obviously joined Microsoft in 2022 and then obviously you went on from there, ending up at Civica. Can you talk us through your time at Microsoft? What did you learn working for a global player in the technology space like Microsoft? What did you take from that experience? I would say that I was working for big companies back in Brazil, as I mentioned, Siemens, Telefónica, Hewlett-Packard.

8:13Those are the companies that I was working at Brazil. When I moved to UK, in Cambridge, there wasn't a big cybersecurity scene here yet. All the big players were in London. So I had to do a change in my career. And what I did was I saw the startup scene in Cambridge and I decided that one thing that I could do is to help those startups to build their IT and cybersecurity department. So that's what I was doing for probably 15 years. And it was amazing. I helped so many startups to build their departments from scratch. But then I was missing the big, big scene, global things happening to have access to cool tools that sometimes a startup doesn't have.

8:57So when I was offered a position at Microsoft, I thought it was a very good move. So I joined. I was working for them as a, it was so many things. We had a managed security services for companies that we provide for companies. But it was with a plus because we would offer a cyber architects, a cyber advisor that was in this case me, to provide services together with our managed services in our SOC. What I learned is that everything is so big. You have access to much more stuff that I, in a company, a startup or a smaller company, don't have the budget to do it. Right. But I also miss the I miss the less budget stuff because I think that allows you to be more creative.

9:54I know what you mean. Yeah. Your budget to be more creative. You've got to do more with less. Yeah. Exactly. Exactly. It was amazing to work at Microsoft. It opened so many doors. Probably I wouldn't be at Civica if it wasn't because of Microsoft. because one of the things that Civica wanted, they wanted to move to a Microsoft stack. And I was there already inside Microsoft. I had the knowledge how the tools work. I had the experience as a CIO in CISO before. Yeah, I think that was the good match. Yeah, absolutely. So I know whilst you were at Microsoft, you were doing a lot of CISO advisory stuff and obviously at IMD too.

10:38You've done a lot of working with executives to help them understand their security threat, improve their security posture and all of the related endeavors around that. So can you just tell us what executives, what leadership teams within large companies, what do they normally get wrong, Renata? What problems do you normally encounter? I would say that they are probably blind to the reality of the cybersecurity problems. Most of the time, I don't think that cybersecurity has enough voice in the boardroom. And because of that, the leaders don't get to see what's actually happening. There are so many threats happening down there.

11:27I think the internet is a wild west. Sure. And there's so many things that I could stay ages talking about. For instance, digital safety. This is something that's very close to my heart. How is the situation in the world for the kids as well, for the kids that are growing up with the phone in their hands? How is their safety? And people don't see that. They don't have an idea of what's actually so easy and so dangerous for either the citizen, for your kids, or for the company. And I think that's the biggest problem. It's the lack of probably voice in the boardroom. Right. So because of that, they don't have the cyber risk.

12:16At the top of the priority, yeah. Yeah. Yes. So you're saying security should be not just the CTO's concern, it should be everyone's concern. Oh, yeah, definitely. So the CISO should be on every board, representing or reminding everyone about the very real threat. Because, I mean, if you get your security wrong, it could wipe out your business, couldn't it? You know what I mean? You could lose all your customers. Yes, yes. So if you get it really badly wrong. And we have so many examples of that. Especially recently with the retail organizations in the UK getting hit. What was your take on that, by the way, with Marks & Spencers?

12:50I think it was co-op and Marks & Spencers in quick succession, wasn't it? What was your sort of perspective on what happened there and your view on what happened? I would say that I really feel for them because I wouldn't like to be in their shoes. I have to say that this is the worst nightmare for a cybersecurity expert. when you go through this situation, especially because that's the only moment that the board or the leadership will actually start to pay attention to the problems that you have. So my feeling is that maybe this is an alert and we even use the joke around the cybersecurity world that we can't waste a good crisis because things like this is the one that will give us the ammunition to talk to the board, to the leadership, to tell them, look, this is what could happen if you don't pay attention.

13:54So my feeling is that it could have been better. They probably could have been better supported by their leadership. I don't know, but I really, really feel for them. It's not an easy thing to do, and it's really stressful, really, really stressful. Yes. There's lots of cybersecurity people now talking about their mental health as well. Oh, really? Okay. Yes. There's even a few groups starting to discuss this more and more because some people that I heard talking to them, they're talking about, like, I can't live like this anymore. Yeah, it's a lot of pressure. To consume it. Yeah. A lot of pressure and little recognition.

14:39Yeah, absolutely. I mean, people only sort of know about what you're doing for negative reasons normally, don't they? Because if there's no problems... That's exactly it. Nobody knows. If there's no problems, there's nothing to praise you about, even though you're the reason there's no problems with security a lot of the time. So it is enough for giving you work. And that's why I feel about the Marks and Spencer people or the cybersecurity team there. because sometimes they are doing the best they can, but they don't have the right tools. They don't have enough money. They don't have the support from the leadership.

15:19And then when you get in this situation, situation like this one from them, that's when people start to talk, oh, cybersecurity. That's what cybersecurity is. And again, we can't waste a good crisis. So I'm using this in my favor as well, inside the company, trying to show and try to show in other areas as well. Look, look how important this is. Yeah, look what could happen. For serious disease. Absolutely. Especially for an organization like Civica, who are, you know, responsible for the security posture of many companies. Do you know what I mean? So if one of your clients gets hit, I suppose, you know.

15:53And we are talking about citizen data here. We are looking after NHS data. We are looking after education, schools, local government, local councils. So it is very, very sensitive and important. What do you think about the importance of IT asset management and software asset management? How important is that for having a good security posture? Understanding the risk. Fundamental. Yeah. It's fundamental. My opinion, and I keep telling that to my team, and I think my team is already tired of hearing me saying that I can't protect what I don't know. Yeah, absolutely. I can't. And a good item or a good software bill of materials or any information that tells me what is it that I have in my technology stack will help me protect you better.

16:50If I don't know which data I have, how can I protect? How can I measure the right levels of protections, you know? So this is, for me, is fundamental. It's usually the first thing that I do when I enter a company. And that's what I did when I was in the startup scene as well. The first thing that you do is category, categorize everything. Where is everything? How can I have real-time information from the assets that I have, from the IT assets, from the software assets, APIs? What are the APIs that I'm using? What are the technologies that I'm using to build my software and so on? Yeah, absolutely.

17:31So what advice do you have for CTOs then, maybe if they don't have a CISO, and in relation to IT asset management and getting there, understanding the risk profile of their software estate, what could you put in place to ensure, would you put an asset management tool in place to monitor this stuff on an ongoing basis? what advice would you give to a CTO, Renata, generally? I'm very agnostic from, you know, tool-wise. I don't care about the vendor. I care about what they are providing and how they can be helpful for me in the moment that I am. So any item, if you have money, go for the ones that are more expensive.

18:12But if you don't, try to do your best, but also always automating. Do not rely on Excel or static things. That's a nightmare. That's not scalable. You need to have something that will give you information. You give visibility constantly. There's a new area, not so new, but it's getting more and more famous, especially in the CTO area. Yeah. It is the observability. Of course. Observability is fundamental for that area because we need to have eyes on that. We need to know what's in there. And that area, for me, it's one of the most important areas that my team works with, with the engineering team.

18:56It's the observability engineers. We need to see what's happening. We need to know what's happening. So a asset management tool integrated with a CM, a very good CM with automation and a very good DevSecOps as well. and tools that can check what you have in your software, like SaaS, DAST, and things like that, that can give you the information of vulnerabilities that you have. They are fundamental for you to work, for you to have the proper view of what's happening. And probably a DLP, you know, all those tools, they work together to give you this visibility, right? Yeah, no, very well said. Fantastic.

19:39Just in terms of startups then, because it's a bit of a different situation, isn't it? But how do you, well, what advice would you give to entrepreneurs, especially entrepreneurs of companies who hold sensitive data, starting a digital first business, obviously in light of all this AI, I think AI is a huge security risk, isn't it? You know, chucking all your data into an LLM. You know, what sort of guardrails would you suggest for a startup to keep an eye on where their data is going and just making sure they maintain a decent security profile until they get a proper security person in to oversee it?

20:14I would say that if they are looking for someone that will help them with technology, make sure that this person that's helping with technology also has a cybersecurity hat, you know, because I don't think that they should wait for the possibility to have a cybersecurity person. I think that IT should start to wear the cybersecurity hat more and more. Right. Everybody, and developers as well. They shouldn't just go, I need to build a software that will do this, this and that. But they have to have ingrained in their heads, is it safe? Of course. Will be the data secure? So it has to be a cultural change.

20:59And if the new startups that are starting out there, I think that what they need is that they should put in the start of their plan. I want to have a software and the software needs to have this quality. It needs to do this, this and that and needs to be safe. It needs to be there at the beginning. They need to start to think about security by design. Yeah, of course. Everything needs to be a cultural change because a security won't work if you bring it later. you will have so much more work and it will be much more money to fix later. Of course. Instead of starting secure from the beginning. And that's why for me, I think it was so good for me when I was doing the startup scene because I was joining as the CIO, but a CIO with a CISO hat as well.

21:56Yeah, sure. So they were buying two for the price of one, in a way, you think. Because that's my passion. And so I was doing that. That was part of me. And for me, a CIO should think about cybersecurity all the time. A CTO should think about cybersecurity all the time. Absolutely. Yeah, 100%. I think, so look, I wanted to ask you, obviously, Civica do a lot of work within public sector. Now, public sector organizations are often, not always, but they're often quite, you know, maybe haven't even gone through full digital transformation yet in some cases. Obviously, have quite old working practices and didn't sort of evolve as digital first or security first.

22:41How do you impose a security structure on these organizations? What kind of problems do you encounter? I think most of the challenges are that, what you already said, they didn't go through a digital transformation. Sometimes their infrastructure is still in the last century. They didn't move to the 21st century yet. They are still, the process are still there as well. And the people's mentality, they are still using things like I want to connect using RDP or to, I want to use a connect directory to a computer instead of using the facility of connecting to a web page or an app itself. They are still using very old stuff, very old stuff.

23:32So I think that's one of the biggest problems that we have. They don't have enough hands. I think that's the other problem. They don't have enough hands. The hands that they have, they are putting on the things that they feel it's the most important. And as I said, cybersecurity, it's not on the top list of most people, most organizations. So they don't see it as important. So it's not there. So what I try is to kind of raise the bar, raise what cybersecurity actually means and how it's important. So that's kind of my personal goal, I would say. It's amazing how it isn't top of the priority list when it comes to all technology within the organization, isn't it?

24:17I mean, security threat should be top, especially for public sector, you'd think, or for any organization. But so can we use this as a segue into skills then? So obviously, prioritization is one thing, but also some people would argue, and I'd love to get your thoughts on this, that there is actually a skills shortage within the cybersecurity space right now, within the sort of compliance side of it, but also within the technical side of it as well. What are you seeing in the marketplace when you've tried to hire Renata? Do we need to do more? Is there enough training coming into this vocational direction?

24:51What's your thoughts on the whole picture in the UK right now? I think that's not a problem just in the UK. It's a global problem, right? I see this everywhere. That was one of the things that I researched during my master's. My thesis was about human aspect, the human side of cybersecurity and cybersecurity awareness. My research was kind of Brazil, as you can imagine, UK and other countries in Europe as well. And I could see that the results are almost the same. And for me, the problem is not the shortage of skills. Maybe it's more help from older people or for experienced professionals to mentor those people, to help them to where they need to go.

25:42Because it's a world that evolves very, very quickly. and it is crazy even for us that are in the field for 20 something years. Imagine for someone that's just started. And also I think it's lack of understanding of what cybersecurity roles and skills actually mean because you don't need to be a tech person to work with cybersecurity anymore. There are so many other areas that you can contribute, processes, compliance, risk, and et cetera, all those things, data compliance, everything. So you don't need to be an engineer anymore. And there is still this vision or this idea that, oh, if I want to work with cyber, I need to understand how a computer works and all the very single detail.

26:37And that's not exactly the truth. And I think that that's the biggest problem. You know, I've seen every time that I put a position, a job advertisement, I see so many people applying. Yeah. And sometimes it's even harder to find the right person because sometimes they are not really focused on one specific thing and they try to be too broad. But yeah, and I think you should find your niche inside cybersecurity and stick to it and go after it. Find what you are very good. Yes, I agree. And go for it. Absolutely. I completely agree. Specialize in something. But what I would say to that, Renato, and I think a lot of people kind of overlook this, is that it's quite different in each organization, isn't it?

27:29So for instance, if you had a security role in a smaller business, you would probably be responsible for quite a broad array of responsibilities. You'd be responsible for, I don't know, the ISO 27001 audit. You'd be responsible for the technology element and what's product, whether you get CrowdStrike or not, or potentially writing some code. Whereas in a company which is a larger company, absolutely, you're a small cog in a big wheel and you need to specialize. Otherwise, you're not really of any use to them. I mean, do you know what I mean? There's different scales, isn't there? organizational scale.

28:04Yes. And I think it's also down to your personality. You have to find what you are best. For instance, I've always been a generalist in a way. I love certain specific technologies. I love doing certain areas of cybersecurity. For instance, I love threat hunting, threat intelligence. But I've always been a generalist because I'm curious about all the other subjects. Yes. So I think it depends on your personality. I know people that they are amazing doing that specific thing. And if you give them other stuff to do, they will be okay, but they are very good at that thing. Of course. So I think in this case, obviously different companies, different size of companies, et cetera, will affect.

28:54But I think, again, you have to focus. So focus on what you are. Are you a generalist? So if you are a generalist, look for generalist positions. If you are a specialist, go make sure that you want, if you want to work only with AI security, go for it. And specialize, make yourself one of the best of them. Yeah, of course. There's so many tools out there that can help you for free to learn how to do it. So specialize on that, focus on that. You want to learn about everything, go for it as well. You can learn about everything, but then you can focus on the generalist positions that are open.