Simply Solving Cyber - Beth St.Clair

Beth StClair joins us to talk about the important topic of burnout in cybersecurity.  While not a cybersecurity expert herself, Teddy and Aaron had so many requests about bringing this important topic for the industry more into the light.

Beth is the Owner and Principal Consultant at Act Up Consulting. 

You will learn a bit more of Beth's background in the show, but she was working as a consultant for a top firm. She had worked her way up and was seemingly doing well by most standards. At this time, she had the need to control everything. She thought being the hero meant solving every problem that came her way, alone. Yep, you needed something done? Beth was your gal.The result was not great. She felt disconnected, tired and burnt out. She felt like she was carrying the weight of the world on her shoulders. So when a friend of hers mentioned improvisational comedy class as a way to help Beth laugh and relax, she (hesitantly) agreed. With no previous theatre of performance experience and in her mid-thirties, Beth jumped into this new world. The decision ended up being one of the best ones of her life.

Take a listen and find out how Beth applied these new skills to managing through and beyond burnout.

You can visit Beth's company at https://actupconsulting.com/

If interested in checking out Improv Comedy, you can visit these resources to get involved!
Indy/Local:

https://www.indyprov.com

https://cszindianapolis.com

Non-Local (online courses):

https://www.secondcity.com/chicago/find-a-class/lets-get-started/

https://groundlings.com/school/online-classes

Transcript

Aaron: 0:00

Alright thanks for tunhing in to simply solving cyber I'm Aaron Pritz. And we are here with today with Beth St. Claire. She is the owner and principal of act up consulting. She does leadership development. Coaching is an improv improv. Uh,

Beth: 0:24

Improviser we'll improvise that word.

Aaron: 0:28

I was going to say, let's start over, but let's just leave that in because that's just, that's good. Awesome. And you might say this is a little bit unique for a guest and Beth. What am I going to add to this show? And I think with cyber, burnout and leadership and, finding your way in cyber is so important,, we get so many requests and some of the topics we do to talk about burnout, just because it's such a endemic in the industry. So I am happy to introduce Beth St. Claire. We're going to get into a conversation and talk about burnout. We're going to talk about how she's used improv and other skills and leadership to work through that. And, uh, we'll go.

Beth: 1:04

Sounds great. Thank you so much for having me, Aaron Teddy. It's it's a thrill. And when I, um, sat down, I just wanted to clarify with them that I don't know much about cyber security. But my area is around leadership development, coaching. I'm an improviser and have, um, I'd say a key theme with my one-on-one coaching clients. The last year really has been burnout. So I think it's a topic that every industry. Is facing. And I know for me, I have had the experience of burnout. Aaron. I know you have as well. So would love to just share that experience and perhaps some of the little tricks and tips that I've worked for me over time. Yeah. Let's

Aaron: 1:48

start there. And then Teddy, and I can tell you a little bit more about burnout in cyber and maybe you can help us in our listeners, uh, learn a little bit more about how to apply some of your learnings and skills to that, to their experience wherever they are.

Beth: 1:59

I would love that we'd love to brainstorm with you too. So, yeah. I had a career in a top consulting firm and I absolutely loved it. I graduated from an MBA program at IEU and I was like, put me in coach, whatever you need started at at this company. And really felt like I was willing to put in whatever it took work on the weekends work late because a couple of things, I loved the work. I felt like my talents were being utilized probably every day that I showed up. And I had a really strong community. So I had people that I trusted that were looking out for me. They had my back and vice versa. So that went on for a number of years, sort of if you think of employee engagement, I was probably the poster girl for that, like the highest level of engagement you could have. But fast forward some years later that company merged with a larger company and my worlds completely shifted. I found myself on this large scale of technology project, which if you know me at all, and I know this is funny for your listeners, you would say that is not a good fit for Beth. My talents were no longer being utilized. I kind of became a bit of a number because I was on a project that had multiple contractors and I no longer felt connected to a community. So some of those elements that were there for me initially sort of just stopped. And I went from this top performer to someone who is feeling pretty disengaged. And so for any of your listeners who have felt that way, I just want to tell you. I get it. Like, it can be a very difficult spot emotionally, especially if you're used to performing really well. You kind of asking yourself what went wrong? What did I do well, or

Aaron: 3:49

the trigger points when you started to see it maybe early on, or maybe if you didn't see it, but in hindsight you were able to see

Beth: 3:56

it. Yeah. It's so much better looking back. I think you have the perspective and clarity. For me, I started to have Erin these like physical manifestations. And I don't think for your listeners, there's one sort of checklist, I think, depending on who you are and what you're experiencing, there could be many different triggers for me. I started to have back issues, which at, as a young person was a little bit of a clue of what's going on to the point where I had a back spasm at work in my office, which was not ideal. It kind of forced me to slow down a little bit, which I think was good. Um, another thing is I had these, like, you know, the Sunday blues that people talk about, oh, it's Sunday

Teddy: 4:39

scaries.

Beth: 4:42

I have that times 10 and I had not experienced that before. If anything, I was excited to go back on Monday. And so that was new, this feeling of dread that I didn't want to go in. And then lack of self-care. I think even the busiest times than I had in the beginning at that company, I was still finding times to see time to see friends to work out all of that started to go away. And there's this feeling of where's the joy. Like isn't that, where's the love, where's the joy. So, um, yeah, that was, those were some of mine. Um, and so, yeah, so, so kind of found myself in a little bit of a funk. Um, and so I was telling Aaron and Teddy for your listeners, that there's lots of different ways to tackle when you're in that situation, but just by luck at that time, a friend of mine. Beth. Why don't you take improv comedy? You're not doing much in the way of fun or something. Interesting outside of work. And that's really counter to me. I'm much more of a planner, so it was scary and I was a little hesitant, but I did take that class. Fell in love, took all of the classes and even started an improv Tru and started.

Aaron: 5:57

Were you into comedy prior or was this just like a leap to get out of the

Beth: 6:00

funk to get out of the funk? Aaron? So yeah, some people ask me like, oh, you probably did theater in high school. No, no, no. None of it not until my early thirties. Try this thing. But what I found is, um, I found the joy. I found the love, um, what was happening in those improv classes was something that was so, um, delightful and in some cases felt magical. And so I started thinking about, well, what's so good about this. Like, why is it so good? And what I realized is there's these kind of principles or skills that I was being taught. That then I started showing up in that way at work, which made work all the more inspiring. So things like make your partner look good, give control, and share control freely. Um, yes, the end accepting offers and building on them. So I would say at least temporary lead that that became a bit. Of my saving grace at the time, because it started to trickle, trickle into my day-to-day at work. Right. Awesome.

Aaron: 7:06

Yeah. So then it helped you. And then I think as your story evolved, you got the idea to maybe compress some things together. Tell me about how that unfolded.

Beth: 7:17

Yeah. And so I think for our listeners, there is none. I don't want to say there's one path. My path ended up being a shift out of the company and to start my own thing, if you will. Right. Um, I think any time you're in a place of burnout, it's an opportunity. Number one, to rest, to find a way to pull back and rest, but also secondly, to reflect. What's not working. What is it that I really want? And it's a little bit of like some soul searching there.

Aaron: 7:50

Um, did you find before you made that leap, it was tough to find rest if your mind was worried or concerned or in burnout mode? Sometimes it's like, I just can't get any rest, even if I

Beth: 8:02

try. Yeah. It's kind of that notion of it takes a week on vacation to just get into vacation mode. And so people say take two weeks, if you can. Yeah, we're, we're in a vicious cycle, um, in some ways. And so how do you get off of that? Um, I think it's a, it's a challenge. Uh, I know at my company, I was looking into a sabbatical. If your listeners have that opportunity, that's a great way to really step away and get that soul searching in or have that reflection because I don't think a few days does it, if you're really in the depths or the grips. So I wanted to just give a couple practical things to think about because not everyone has that opportunity to step away for a period of time. So, um, in my work I have discovered what I think is a cheat sheet and I don't know. Sometimes why more people aren't talking about this, but gala is an organization that does a ton of research around employee engagement. And when we talk about burnout, it's connected to our level of engagement. So they have 12 factors that they've identified. If you Google it, you can find it. But if you do a little assessment on these 12 factors, I think that's going to give you some aha. So let me give you an example of that. Um, one of them is I have a best friend at work. There's a reason why they call it a best friend based on their research. It might sound a little, a little crazy, but the idea there is that you have someone you really trust at work. And if you're in a situation where you're like, well, I really, I don't have that. Well, that might be contributing. So how do you cultivate something like that? Another big one is my talents and my strengths are being utilized every day on the job. So if you take a step back and say, okay, I'm feeling burnout. And I noticed that what I'm really good at, which is big picture thinking, I'm not doing that every day. I'm not thinking strategically. I'm just in the weeds. Great, great opportunity to talk to your leader about, I'm noticing about my level of engagement. Are there other opportunities that I can get that really connect to my talents? So I'm going to give you one, one last example of the factor here. Um, Doesn't occur. Unfortunately, in a lot of the, um, companies that I see, which is I received positive feedback on a weekly basis from my leader. Whoa, how many of us get that? But that's an aspect of recognition and acknowledgement of our work. And if we're not getting it, it leads to disengagement and potential burnout. Right. If you're a leader listening, you might think, oh, how can I step that up? Like point out your team and what's going well, if you're an employee, you might think about having that conversation with your lead, or can we give each other feedback on a more regular basis? So that's a place for your listeners to look at least yup.

Aaron: 11:04

As leaders, sometimes we're in problem solving mode. So often it's, you got to take a step back and say, Okay. I've corrected some things. I fixed some things. Okay. If we've done a great job there, but how do you give that acknowledgement or the atta boy, atta girl, to really help keep them going and say, what am I doing? Right. What do I want to replicate next week that I did well this week?

Beth: 11:24

Well, Erin, and if your listeners are anything like me, it's like MBA risk analysis, trying to find what's wrong with this situation. So the muscle that we have around. Looking at what's right. Sometimes it's a bit at your feet. It's not natural to go there. How do you

Aaron: 11:40

have you gotten into the book now? Discover your strengths. I think that the theory of that is, um, you can focus on weaknesses, but make marginal improvements for people's. True weaknesses. You can always mitigate them, but the strengths is like, how can you prop up the things that they do really well versus kind of continuously focusing on what's wrong or not.

Beth: 12:01

I'm such a big fan of that because if more people are doing strength-based kind of leadership, then, then your team is going to be doing all the things that fill them up. Right. Make them feel happy, make them feel engaged. Yep. I'm with you on

Aaron: 12:15

that. Awesome. So how do you help companies? So how have you applied. Leadership skills and, and improv skills and kind of your own experience. How, how do you help companies through, you know, what, what types of challenges do you typically walk into that is like your bread and butter? The ones you want the projects you want to keep doing?

Beth: 12:34

Yeah. Yeah. Great question. Do you want to talk about the burnout component or more? Um, maybe a little bit of both. Yeah. Yeah. I think, yeah. Burnout comes out with one-on-one coaching clients that I have. So it would look like, um, a coaching arrangement, potentially a couple of coaching sessions a month where we set goals and then. In each session, talk through real life experience what's happening. What can we learn from it and move towards kind of meeting those goals? Um, definitely burnout has been a key theme and one of the things that has come up around how to deal with that in these coaching sessions is. Clear expectations and boundaries. I feel like boundaries are being thrown around. Like that word is being thrown around and talked about quite a bit. It might be overused, but what does it really mean? I mean, it means I know how to work with you Tenney. Cause you've clearly explained to me that you need to stop at five because of X, Y, and Z reason, but you're going to be back on for an hour, checking your email eight to 9:00 PM. Right. So if I know that. Oh, my gosh. Don't you think that makes my life a lot easier, a lot easier. So I'm not expecting you to respond to something when you've already told me you're not going to be available. And I think if anything, COVID world has opened up more of that discussion, cause we're all balancing so much more in our lives or sort of our personal or professional lives have mixed and smushed into this soup. And so it's a real deal that sometimes people in the middle of the day have to go take care of something that they wouldn't. Had to have before. Um, so I think that's healthy. Um, I think it can be scary guys to set boundaries and, and it, it comes down to do we trust the people we work with that they're going to be open to that. And if they're not, I think it's worth asking, am I in the right? Am I in the right culture? Assuming those requests are reasonable and you are doing a great job.

Aaron: 14:33

All right. So Teddy let's let's dive in and get Beth's help on the cyber burnout situation. So we were talking before we started the recording of kind of what is the systemic problem. Um, so maybe you and I can kind of share, but some of our thoughts and get thoughts on how to help our audience navigate or whether it's them that are in burnout or their peers or anybody that they may be interfacing within the industry. So from my perspective, I would say cyber security is a. High paced, high volume job companies are catching up. A lot of companies are investing. A lot of boards have woken up to the fact that it's not an it only thing that, you know, their CIO can go solve and they don't have to worry about it. Executive committee involvement. So the companies that are going all in that adds a lot of pressure and stress and that, you know, timelines are now 10 times the importance. Teddy, what are your thoughts on some of the root causes?

Teddy: 15:25

Yeah. So I think one of the main things has to do with it kind of being a thankless task. Right. So what we're doing, uh, right. So working in industry, right. If you're trying to protect a company, um, you. If you don't, if you don't get breached that day or that week, right. It's just kind of expected part of your job. It's not, um, you know, it's, it's not like you're enabling some business process or something along those lines to improve. It's really just, well, yeah, you didn't get hacked today. Good. That's it? Um, so I think from an industry perspective, that's definitely a lot going on, um, from a consulting perspective. It's I think it has a lot to do with, uh, Bill more hours, make more money type of thing. Um, and that's kind of where your performance metrics lie is in order to stand out in these organizations where you're like you've mentioned before, you're kind of a number you've really got to stand out because there's a lot of achievers working in those types of fields. So you're, you're working a lot of hours trying to impress people. And I think that has a lot to do with it as well. I don't have a pat on the pat on the back and that kind of stuff. So.

Aaron: 16:35

Beth thoughts. Is this consistent with other industries? Is there any uniqueness that you feel, or is this just maybe an exacerbated, focal point of the cyber journey? That is a lot of the same things that everyone is facing in all careers?

Beth: 16:51

Yeah. I think that the unique aspect that stands out to me is this idea that if you don't get hacked, good, good job. And then if you do. Bad jobs. So it's like you want, you're aiming for, um, status quo essentially a little bit. And, and so the question that comes up to me then is how do you set up structures where you're still able to give positive feedback, Agnew and acknowledgement of milestones, even if they're somewhat manufactured. And I mean, not in a very genuine. Real way, um, can leaners think about, well, how do I set up some metric that when we reach that metric, we have kind of a celebration of sorts. So that there's a sense that. We are doing a good job based on the last six months we haven't been breached and maybe even taking it back further, like set it, set some of those up so that you can on a more regular basis. And you guys tell me if this is crazy and what that could look like if, if leaders thought that through. But so it's not one metric which is breached or breached or not, or breached, I guess.

Aaron: 18:08

Yeah. I think a little bit of perspective from my, from my side, I think companies that are early maturity that don't have. Goals. And they're not, they've not measured their maturity and their figuring out, Hey, we need to go from point a to B, to C I think a lot of times the, it programs that it just owns it and they're very operational focused and it's like, Hey, we got to keep doing more stuff to avoid breaches to Teddy's point. That's typically when it's the thankless, it let's not get breached. And if we do we're in trouble, if we don't, maybe we get recognized. Maybe we don't. I think I like your comment of manufacturing milestones, because at the end of the day, You know, while cybersecurity is a protective function, we can also enable the business and help build things that make, you know, the company secure and also help them, um, you know, get things done productively. So it's almost like how do you not be in a defensive only posture and convert that to what are we trying to accomplish here and what is winning and losing look like. Um, but, but I think the points that you're right raised Teddy is there's probably a lot of companies that don't have that struggle. They don't know where they're at and where they're going. And it's just a few people that are doing cyber and trying to prevent bad things from happening. Is that yeah. For

Teddy: 19:23

you? Yeah. You're just basically expected to, you know, I think it's also like a lack of transparency, right? Like people not understanding how cyber risk really works. And I think it's just a ones and zeros type of thing. Um, and there's a lot more to it than that. The awareness is coming and it's gotten better over the years. At least I've noticed that, but it's still definitely not even close to being there where we needed to be.

Beth: 19:45

I mean, I think another area that comes to mind is sometimes, you know, we're promoted to a manager or leadership role because we do really great technical work and then we're expected all of a sudden to be responsible for this team and manage culture and manage individual performance. And we may or may not have the tool kit for that. It's like a real retooling moment actually. And I think it's okay for leaders to say. Oh, I don't, I don't think I have, like at a moment where I, where I was managing a team at the consulting firm thinking, I don't think I have the skills for this, which is why I went through my coaching program. Like I thought if I could get the coaching skills, I think I would be a better leader, a better manager, which I think ended up being true, but really as leaders thinking about what do I need that I don't have and being okay. Going to get that. Particular skill cause leadership is a whole separate animal with lots of responsibilities. So that's one thought. My other thought is just, I've seen a lot of leaders in the last year, put burnout on the top of their list, put mental health and wellbeing at the top of their list. So when they're having their one-on-ones, they're checking on that and offering support, asking how they can help, um, and really keeping a pulse. Whereas I think before the pandemic. That wasn't as much on the top of the priority list for leaders. Um, but I heard a leader recently say the individual wellbeing is greater than organizational wellbeing, which might seem very radical, but if your people are burning out and eventually leaving or, um, exiting the organization, that's going to be a real problem. Bottom line, right.

Aaron: 21:31

Worse, they don't leave the organization and they create collateral

Beth: 21:34

damage, toxic environment that they're creating. Yeah. So I think if your listeners are managing a team and they're not yet having that, that wellbeing conversation top of the list, I would encourage them, them to do that because the closer that they are to that, the more they're going to be able to prevent a really bad situation from occurring. You just gave an example and, and also just prevent so.

Aaron: 22:00

Yup. So talk to me a little bit more about improv specifically, cause that is, you know, well on a very cool, but a unique, um, tool to help people. And I know you have a passion for it. It helped you, but T tell, tell me how that works in the business world.

Beth: 22:19

Yeah. So, um, maybe the best way to do it is to give you an example. Um, so. Uh, we've all been kind of guilty of this. Someone throws it and I add an out an idea in a meeting and we say, yeah, but, and we kind of take the guard each in a different direction. And what happens to that original ideas? It kind of disappears. So that's called blocking and it's something that an improv we can't do, because if we do that, the scene literally dies and we can't go anywhere with the scene itself. So improvisers do, what's called yes. And so that's kind of the mentality, the yes, and mentality. And it's not enough to say yes, because Aaron, if you say, oh, we're going on a cruise together in a scene. And I simply say, yes, it puts the pressure on you to come up with the next thing. So the premise is we're, co-creating. The premise is what we create together is going to be so much better than what I create by myself. And if we believe that, then we have to let control a little bit on the outcome because I can't control what you're going to say. Aaron, are you Teddy? I gotta, yeah, Sandy. So yes. And is accepting that offer the cruise and building on it. Yeah. And, um, we can try water skiing. We've been talking about that for a long time. Yes. And I'm not sure I want to go. Okay. I think I want a divorce, we can take it many different ways. So, yes. And in thinking about a business setting, um, and also about burnout, right? It, it gives me affirmation, but I think most importantly, we're going to have a better result if we can. Yes. And, and it's not to say that. Can't block. I just think we've overused that muscle and we do it by default. So we say no a lot, just because we're used to saying it, but really to stop and be conscious about is this the time I really want to block because yes, and-ing is going to get you further, faster. Um, generally speaking. Yes.

Aaron: 24:20

And what else might you use to, to use improv and the business? Um, see what I did there. I

Beth: 24:28

not, well, I tried it. Yes. And in me, do you want to hear about another principle or another idea? Yeah. So one is, and I'm, I'm kind of thinking through right now how this relates to the cyber world. Cause I understand. You know, Teddy's thing, zeros and ones. It's a little black and white, um, but view mistakes as offers. So still in many cultures, in many companies today, we're really scared of mistakes. And, uh, we don't want to make them, especially if you're struggling a little bit with perfectionism, that's like the worst thing you could do is make a mistake and improv. We don't even have the word mistake. It's just offer Teddy makes an offer. And maybe he called me the wrong. Character name. I get to do something with it. It's simply another word for offer. What if we have that view in businesses? Like I took a calculated risk. I made a mistake. How can we stay on that while we can talk about what do we learn from that? You know, what did we gain? How can we iterate on that? And so turning it, not like turning it into a positive per se, but seeing where we can take it. What's the next one? So let's another, another

Aaron: 25:36

idea. Okay. How do you, I'm really interested in that one? How do you draw that out of people to kind of take that C mean mistake, which there are no mistakes, but, and then vamp on that or iterate on how do you, yeah, maybe give me an

Beth: 25:48

example. I mean, some companies do. Like mistakes showcases like a product that really flopped, but turned into something amazing. So I don't have one specific that's coming into mind, but the sticky notes.

Teddy: 26:02

Oh, that is one.

Beth: 26:03

Yeah. That was a mistake that the posted, they were after a different product,

Teddy: 26:08

trying to make the strongest adhesive right. Or something along those lines. And then they got this reusable adhesive. Yeah, no, I've heard that one.

Beth: 26:16

That's great. So what, what can this be? If it didn't end up being what we thought, what purpose could it serve? Is there, is there some value or utility? So asking that type of question, that's a good example. Um, and yeah, the lessons learned, so a simple one is just someone makes a mistake. They apologize. We're kind of annoyed and we just kind of move on. No. That's like a huge opportunity. Take a moment and stop from the fast paced life. Let's meet for an hour and talk about the post-mortem. Right, right. We made a mistake. What contributed to that? Okay. Let's make sure we fix that next time. What did we learn? Can we still do something with this? So asking, getting curious, asking.

Aaron: 26:59

Great. Awesome. Um, so I guess lastly, how do people get in touch with you? Or how do you. How do you engage with companies, whether it be individual coaching or to do workshops, how do people

Beth: 27:10

read? You know, it's just those, the webs, the interwebs. Um, I am active Beth on Instagram and active consulting.com is my website. And there's a place on there. People want to get in touch with me. I love just talking with people, seeing if there's something that we can build together. So feel free to reach out. Awesome. Great. This is

Aaron: 27:31

helpful. This is very helpful. I guess, last question. Um, what advice do you have for the cyber security community? Whether they're in burnout, whether they fear getting to burnout, what is the, what is the key takeaway that you want them to kind of reflect on?

Beth: 27:47

Yeah. Um, what can you, yes. And about the situation, um, yes. And your burnout and there's something there that you can learn from and likely take action to move.

Aaron: 27:59

Yep. No, that's good. It's almost a little bit, how do you make lemons or lemonade from lemons and stuck in your moments? Yep.

Teddy: 28:07

Awesome. And one more thing I want to add to. Is I've heard of this, uh, notion of improv being a beneficial thing for business. Do you have any, so I'd say, let's say for the Indianapolis area specifically, is there any good courses that you would recommend or any online courses or anything like that that people could take if they're interested in getting into this type of thing?

Beth: 28:28

Yeah. That's a great question. And I've had people ask that. So, um, yeah, there's a couple avenues here in Indianapolis. I also want to mention since COVID. The world has opened up with online courses, even with improv comedy, standup comedy, things like that. So, um, second city has a whole catalog now, which you used to just have to go, right? If you're in a different place, you have to travel up there from indie to Chicago. Now you can access them and be a part. And I have taken one of those courses recently. And I was, I was wondering how it was going to play out in that virtual world. And I got a lot of value out of it. So even places like the Groundlings in LA, that's also a place online. You can, you can check it out. How about

Aaron: 29:15

locally for those in

Beth: 29:16

India? Um, there, can we put it in your show notes? I have a couple ideas. Yeah. And I'll send it to you. Awesome. There are a couple resources for, for this area too.

Aaron: 29:27

So, so much, Beth. I, I liked that this was unique. I liked that this was different and I liked that you're helping people. Um, but now in cyber, but even beyond that, it's such an important thing and we really appreciate you coming to share

Beth: 29:38

your learnings. Oh my gosh. Thank you. Pleasure guys.